--- /dev/null
+From 59baf844a581452d1a79ee934dbfc7ecef5ab2de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Nov 2018 23:07:14 +0300
+Subject: ACPI: fix acpi_find_child_device() invocation in
+ acpi_preset_companion()
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+[ Upstream commit f8c6d1402b89f22a3647705d63cbd171aa19a77e ]
+
+acpi_find_child_device() accepts boolean not pointer as last argument.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+[ rjw: Subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/acpi.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 6a30f1e03aa9e..0bd0a9ad54556 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -75,7 +75,7 @@ static inline bool has_acpi_companion(struct device *dev)
+ static inline void acpi_preset_companion(struct device *dev,
+ struct acpi_device *parent, u64 addr)
+ {
+- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL));
++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false));
+ }
+
+ static inline const char *acpi_dev_name(struct acpi_device *adev)
+--
+2.20.1
+
--- /dev/null
+From ab8a2c1bddc32aa4704dd95302a4c4c70f8f31ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 01:17:14 +0800
+Subject: ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
+
+From: paulhsia <paulhsia@chromium.org>
+
+[ Upstream commit f5cdc9d4003a2f66ea57b3edd3e04acc2b1a4439 ]
+
+If the nullity check for `substream->runtime` is outside of the lock
+region, it is possible to have a null runtime in the critical section
+if snd_pcm_detach_substream is called right before the lock.
+
+Signed-off-by: paulhsia <paulhsia@chromium.org>
+Link: https://lore.kernel.org/r/20191112171715.128727-2-paulhsia@chromium.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 3ce2b87717623..950730709d28a 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1877,11 +1877,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ struct snd_pcm_runtime *runtime;
+ unsigned long flags;
+
+- if (PCM_RUNTIME_CHECK(substream))
++ if (snd_BUG_ON(!substream))
+ return;
+- runtime = substream->runtime;
+
+ snd_pcm_stream_lock_irqsave(substream, flags);
++ if (PCM_RUNTIME_CHECK(substream))
++ goto _unlock;
++ runtime = substream->runtime;
++
+ if (!snd_pcm_running(substream) ||
+ snd_pcm_update_hw_ptr0(substream, 1) < 0)
+ goto _end;
+@@ -1892,6 +1895,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ #endif
+ _end:
+ kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
++ _unlock:
+ snd_pcm_stream_unlock_irqrestore(substream, flags);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 6ef93a38db6dcbc84df0ad6691c26a7eacecf812 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Nov 2018 12:34:10 +0000
+Subject: altera-stapl: check for a null key before strcasecmp'ing it
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9ccb645683ef46e3c52c12c088a368baa58447d4 ]
+
+Currently the null check on key is occurring after the strcasecmp on
+the key, hence there is a potential null pointer dereference on key.
+Fix this by checking if key is null first. Also replace the == 0
+check on strcasecmp with just the ! operator.
+
+Detected by CoverityScan, CID#1248787 ("Dereference before null check")
+
+Fixes: fa766c9be58b ("[media] Altera FPGA firmware download module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/altera-stapl/altera.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
+index f53e217e963f5..494e263daa748 100644
+--- a/drivers/misc/altera-stapl/altera.c
++++ b/drivers/misc/altera-stapl/altera.c
+@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size,
+ key_ptr = &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i)])];
+- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) &&
+- (key != NULL)) {
++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) {
+ status = 0;
+
+ value_ptr = &p[note_strings +
+--
+2.20.1
+
--- /dev/null
+From 1a521fca07be6b445d263d3a96d356a209d36271 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 10:12:30 +0100
+Subject: ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
+
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+
+[ Upstream commit 344eb5539abf3e0b6ce22568c03e86450073e097 ]
+
+getuser() and putuser() (and there underscored variants) use two
+strb[t]/ldrb[t] instructions when they are asked to get/put 16-bits.
+This means that the read/write is not atomic even when performed to a
+16-bit-aligned address.
+
+This leads to problems with vhost: vhost uses __getuser() to read the
+vring's 16-bit avail.index field, and if it happens to observe a partial
+update of the index, wrong descriptors will be used which will lead to a
+breakdown of the virtio communication. A similar problem exists for
+__putuser() which is used to write to the vring's used.index field.
+
+The reason these functions use strb[t]/ldrb[t] is because strht/ldrht
+instructions did not exist until ARMv6T2/ARMv7. So we should be easily
+able to fix this on ARMv7. Also, since all ARMv6 processors also don't
+actually use the unprivileged instructions anymore for uaccess (since
+CONFIG_CPU_USE_DOMAINS is not used) we can easily fix them too.
+
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess.h | 18 ++++++++++++++++++
+ arch/arm/lib/getuser.S | 11 +++++++++++
+ arch/arm/lib/putuser.S | 20 ++++++++++----------
+ 3 files changed, 39 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index 9ae610bf52348..61479ebb98693 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -387,6 +387,13 @@ do { \
+ #define __get_user_asm_byte(x, addr, err) \
+ __get_user_asm(x, addr, err, ldrb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __get_user_asm_half(x, addr, err) \
++ __get_user_asm(x, addr, err, ldrh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __get_user_asm_half(x, __gu_addr, err) \
+ ({ \
+@@ -405,6 +412,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __get_user_asm_word(x, addr, err) \
+ __get_user_asm(x, addr, err, ldr)
+ #endif
+@@ -480,6 +489,13 @@ do { \
+ #define __put_user_asm_byte(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, strb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __put_user_asm_half(x, __pu_addr, err) \
++ __put_user_asm(x, __pu_addr, err, strh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __put_user_asm_half(x, __pu_addr, err) \
+ ({ \
+@@ -496,6 +512,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __put_user_asm_word(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, str)
+
+diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
+index 746e7801dcdf7..b2e4bc3a635e2 100644
+--- a/arch/arm/lib/getuser.S
++++ b/arch/arm/lib/getuser.S
+@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1)
+
+ ENTRY(__get_user_2)
+ check_uaccess r0, 2, r1, r2, __get_user_bad
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(ldrh) r2, [r0]
++
++#else
++
+ #ifdef CONFIG_CPU_USE_DOMAINS
+ rb .req ip
+ 2: ldrbt r2, [r0], #1
+@@ -56,6 +62,9 @@ rb .req r0
+ #else
+ orr r2, rb, r2, lsl #8
+ #endif
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ mov r0, #0
+ ret lr
+ ENDPROC(__get_user_2)
+@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8)
+ .pushsection __ex_table, "a"
+ .long 1b, __get_user_bad
+ .long 2b, __get_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __get_user_bad
++#endif
+ .long 4b, __get_user_bad
+ .long 5b, __get_user_bad8
+ .long 6b, __get_user_bad8
+diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
+index 38d660d3705f4..515eeaa9975c6 100644
+--- a/arch/arm/lib/putuser.S
++++ b/arch/arm/lib/putuser.S
+@@ -41,16 +41,13 @@ ENDPROC(__put_user_1)
+
+ ENTRY(__put_user_2)
+ check_uaccess r0, 2, r1, ip, __put_user_bad
+- mov ip, r2, lsr #8
+-#ifdef CONFIG_THUMB2_KERNEL
+-#ifndef __ARMEB__
+-2: TUSER(strb) r2, [r0]
+-3: TUSER(strb) ip, [r0, #1]
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(strh) r2, [r0]
++
+ #else
+-2: TUSER(strb) ip, [r0]
+-3: TUSER(strb) r2, [r0, #1]
+-#endif
+-#else /* !CONFIG_THUMB2_KERNEL */
++
++ mov ip, r2, lsr #8
+ #ifndef __ARMEB__
+ 2: TUSER(strb) r2, [r0], #1
+ 3: TUSER(strb) ip, [r0]
+@@ -58,7 +55,8 @@ ENTRY(__put_user_2)
+ 2: TUSER(strb) ip, [r0], #1
+ 3: TUSER(strb) r2, [r0]
+ #endif
+-#endif /* CONFIG_THUMB2_KERNEL */
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
+ mov r0, #0
+ ret lr
+ ENDPROC(__put_user_2)
+@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad)
+ .pushsection __ex_table, "a"
+ .long 1b, __put_user_bad
+ .long 2b, __put_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __put_user_bad
++#endif
+ .long 4b, __put_user_bad
+ .long 5b, __put_user_bad
+ .long 6b, __put_user_bad
+--
+2.20.1
+
--- /dev/null
+From 343a572d8ce96753bb43a43d88cc76d175cc5471 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 16:54:28 +0100
+Subject: ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 6035cbcceb069f87296b3cd0bc4736ad5618bf47 ]
+
+DWC2 hardware module integrated in Samsung SoCs requires some quirks to
+operate properly, so use Samsung SoC specific compatible to notify driver
+to apply respective fixes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
+index e81a27214188c..cbe3507e6e249 100644
+--- a/arch/arm/boot/dts/exynos3250.dtsi
++++ b/arch/arm/boot/dts/exynos3250.dtsi
+@@ -325,7 +325,7 @@
+ };
+
+ hsotg: hsotg@12480000 {
+- compatible = "snps,dwc2";
++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2";
+ reg = <0x12480000 0x20000>;
+ interrupts = <0 141 0>;
+ clocks = <&cmu CLK_USBOTG>;
+--
+2.20.1
+
--- /dev/null
+From 6838366b8e1c40b14fd53914c083f82eed48cac9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 18:53:06 +0100
+Subject: ARM: dts: mmp2: fix the gpio interrupt cell number
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 400583983f8a8e95ec02c9c9e2b50188753a87fb ]
+
+gpio-pxa uses two cell to encode the interrupt source: the pin number
+and the trigger type. Adjust the device node accordingly.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/mmp2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi
+index 47e5b63339d18..e95deed6a7973 100644
+--- a/arch/arm/boot/dts/mmp2.dtsi
++++ b/arch/arm/boot/dts/mmp2.dtsi
+@@ -180,7 +180,7 @@
+ clocks = <&soc_clocks MMP2_CLK_GPIO>;
+ resets = <&soc_clocks MMP2_CLK_GPIO>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ ranges;
+
+ gcb0: gpio@d4019000 {
+--
+2.20.1
+
--- /dev/null
+From 61929f82f136af72a88249372111a95e09b9ef9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 14:54:51 +0100
+Subject: ARM: dts: pxa: clean up USB controller nodes
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit c40ad24254f1dbd54f2df5f5f524130dc1862122 ]
+
+PXA25xx SoCs don't have a USB controller, so drop the node from the
+common pxa2xx.dtsi base file. Both pxa27x and pxa3xx have a dedicated
+node already anyway.
+
+While at it, unify the names for the nodes across all pxa platforms.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Reported-by: Sergey Yanovich <ynvich@gmail.com>
+Link: https://patchwork.kernel.org/patch/8375421/
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa27x.dtsi | 2 +-
+ arch/arm/boot/dts/pxa2xx.dtsi | 7 -------
+ arch/arm/boot/dts/pxa3xx.dtsi | 2 +-
+ 3 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 4448505e34d3b..e1a8466b77a4c 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -27,7 +27,7 @@
+ clocks = <&clks CLK_NONE>;
+ };
+
+- pxa27x_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi
+index 5e5af078b9b54..7343115c6d55b 100644
+--- a/arch/arm/boot/dts/pxa2xx.dtsi
++++ b/arch/arm/boot/dts/pxa2xx.dtsi
+@@ -117,13 +117,6 @@
+ status = "disabled";
+ };
+
+- usb0: ohci@4c000000 {
+- compatible = "marvell,pxa-ohci";
+- reg = <0x4c000000 0x10000>;
+- interrupts = <3>;
+- status = "disabled";
+- };
+-
+ mmc0: mmc@41100000 {
+ compatible = "marvell,pxa-mmc";
+ reg = <0x41100000 0x1000>;
+diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi
+index fec47bcd8292f..c714e583e5c75 100644
+--- a/arch/arm/boot/dts/pxa3xx.dtsi
++++ b/arch/arm/boot/dts/pxa3xx.dtsi
+@@ -88,7 +88,7 @@
+ status = "disabled";
+ };
+
+- pxa3xx_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+--
+2.20.1
+
--- /dev/null
+From 2139d67e1b9c2e094e6d1e3228ca241cc568b3ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 13:11:42 -0600
+Subject: ARM: dts: sunxi: Fix PMU compatible strings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 5719ac19fc32d892434939c1756c2f9a8322e6ef ]
+
+"arm,cortex-a15-pmu" is not a valid fallback compatible string for an
+Cortex-A7 PMU, so drop it.
+
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun6i-a31.dtsi | 2 +-
+ arch/arm/boot/dts/sun7i-a20.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
+index b6ad7850fac69..698970d0281f3 100644
+--- a/arch/arm/boot/dts/sun6i-a31.dtsi
++++ b/arch/arm/boot/dts/sun6i-a31.dtsi
+@@ -167,7 +167,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
+index e02eb720c4fc1..a7b4dbda1a878 100644
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -167,7 +167,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 838fb4d34650fb4d0939d32e2d7872050a01c043 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 21:46:41 +0200
+Subject: ARM: OMAP1/2: fix SoC name printing
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 04a92358b3964988c78dfe370a559ae550383886 ]
+
+Currently we get extra newlines on OMAP1/2 when the SoC name is printed:
+
+[ 0.000000] OMAP1510
+[ 0.000000] revision 2 handled as 15xx id: bc058c9b93111a16
+
+[ 0.000000] OMAP2420
+[ 0.000000]
+
+Fix by using pr_cont.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/id.c | 6 +++---
+ arch/arm/mach-omap2/id.c | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c
+index 52de382fc8047..7e49dfda3d2f4 100644
+--- a/arch/arm/mach-omap1/id.c
++++ b/arch/arm/mach-omap1/id.c
+@@ -200,10 +200,10 @@ void __init omap_check_revision(void)
+ printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type);
+ }
+
+- printk(KERN_INFO "OMAP%04x", omap_revision >> 16);
++ pr_info("OMAP%04x", omap_revision >> 16);
+ if ((omap_revision >> 8) & 0xff)
+- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff);
+- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n",
++ pr_cont("%x", (omap_revision >> 8) & 0xff);
++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n",
+ die_rev, omap_revision & 0xff, system_serial_low,
+ system_serial_high);
+ }
+diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
+index 8a2ae82cb2271..9651872a9e091 100644
+--- a/arch/arm/mach-omap2/id.c
++++ b/arch/arm/mach-omap2/id.c
+@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void)
+
+ pr_info("%s", soc_name);
+ if ((omap_rev() >> 8) & 0x0f)
+- pr_info("%s", soc_rev);
+- pr_info("\n");
++ pr_cont("%s", soc_rev);
++ pr_cont("\n");
+ }
+
+ #define OMAP3_SHOW_FEATURE(feat) \
+--
+2.20.1
+
--- /dev/null
+From 73eda8143ace6d3da61e852fe6ccc7073ad26411 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 00:03:11 -0400
+Subject: autofs: fix a leak in autofs_expire_indirect()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 03ad0d703df75c43f78bd72e16124b5b94a95188 ]
+
+if the second call of should_expire() in there ends up
+grabbing and returning a new reference to dentry, we need
+to drop it before continuing.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/autofs4/expire.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index 0d8b9c4f27f21..5124f06c32bcc 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -467,9 +467,10 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
+ */
+ flags &= ~AUTOFS_EXP_LEAVES;
+ found = should_expire(expired, mnt, timeout, how);
+- if (!found || found != expired)
+- /* Something has changed, continue */
++ if (found != expired) { // something has changed, continue
++ dput(found);
+ goto next;
++ }
+
+ if (expired != dentry)
+ dput(dentry);
+--
+2.20.1
+
--- /dev/null
+From acc3c9521b2b6fc1e9fc8aaed56168e6e5927d4b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 12:17:30 +0100
+Subject: clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit ac8cb53829a6ba119082e067f5bc8fab3611ce6a ]
+
+Similar to commit a9f0c0e56371 ("clk: rockchip: fix rk3188 sclk_smc
+gate data") there is one other gate clock in the rk3188 clock driver
+with a similar wrong ordering, the sclk_mac_lbtest. So fix it as well.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3188.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 986a558c361d6..4051782b6f844 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -329,8 +329,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ RK2928_CLKGATE_CON(2), 5, GFLAGS),
+ MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT,
+ RK2928_CLKSEL_CON(21), 4, 1, MFLAGS),
+- GATE(0, "sclk_mac_lbtest", "sclk_macref",
+- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS),
++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0,
++ RK2928_CLKGATE_CON(2), 12, GFLAGS),
+
+ COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0,
+ RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS,
+--
+2.20.1
+
--- /dev/null
+From 44cdc759d2b559b5363654ff11b96c537b4de276 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 15:45:49 +0000
+Subject: clk: rockchip: fix rk3188 sclk_smc gate data
+
+From: Finley Xiao <finley.xiao@rock-chips.com>
+
+[ Upstream commit a9f0c0e563717b9f63b3bb1c4a7c2df436a206d9 ]
+
+Fix sclk_smc gate data.
+Change variable order, flags come before the register address.
+
+Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
+Signed-off-by: Johan Jonker <jbx9999@hotmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3188.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index fe728f8dcbe43..986a558c361d6 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -360,8 +360,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ * Clock-Architecture Diagram 4
+ */
+
+- GATE(SCLK_SMC, "sclk_smc", "hclk_peri",
+- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS),
++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0,
++ RK2928_CLKGATE_CON(2), 4, GFLAGS),
+
+ COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0,
+ RK2928_CLKSEL_CON(25), 0, 7, DFLAGS,
+--
+2.20.1
+
--- /dev/null
+From c3bc0784b2ae348858d1672c871c58987a0df3d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 15:27:37 -0600
+Subject: dlm: fix invalid cluster name warning
+
+From: David Teigland <teigland@redhat.com>
+
+[ Upstream commit 3595c559326d0b660bb088a88e22e0ca630a0e35 ]
+
+The warning added in commit 3b0e761ba83
+ "dlm: print log message when cluster name is not set"
+
+did not account for the fact that lockspaces created
+from userland do not supply a cluster name, so bogus
+warnings are printed every time a userland lockspace
+is created.
+
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/user.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/dlm/user.c b/fs/dlm/user.c
+index dd2b7416e40ae..761d74a84f92f 100644
+--- a/fs/dlm/user.c
++++ b/fs/dlm/user.c
+@@ -25,6 +25,7 @@
+ #include "lvb_table.h"
+ #include "user.h"
+ #include "ast.h"
++#include "config.h"
+
+ static const char name_prefix[] = "dlm";
+ static const struct file_operations device_fops;
+@@ -402,7 +403,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- error = dlm_new_lockspace(params->name, NULL, params->flags,
++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags,
+ DLM_USER_LVB_LEN, NULL, NULL, NULL,
+ &lockspace);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From 51c22aa43705e9800f72ba70909ea2816a63d479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 11:17:40 -0600
+Subject: dlm: fix missing idr_destroy for recover_idr
+
+From: David Teigland <teigland@redhat.com>
+
+[ Upstream commit 8fc6ed9a3508a0435b9270c313600799d210d319 ]
+
+Which would leak memory for the idr internals.
+
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lockspace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index 30e4e01db35a3..b14bb2c460426 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -800,6 +800,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)
+
+ dlm_delete_debug_file(ls);
+
++ idr_destroy(&ls->ls_recover_idr);
+ kfree(ls->ls_recover_buf);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 33782df2e27659e83e23b6e493edcc691b724625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 15:25:00 +0800
+Subject: dlm: NULL check before kmem_cache_destroy is not needed
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit f31a89692830061bceba8469607e4e4b0f900159 ]
+
+kmem_cache_destroy(NULL) is safe, so removes NULL check before
+freeing the mem. This patch also fix ifnullfree.cocci warnings.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/memory.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c
+index 7cd24bccd4fe5..37be29f21d04d 100644
+--- a/fs/dlm/memory.c
++++ b/fs/dlm/memory.c
+@@ -38,10 +38,8 @@ int __init dlm_memory_init(void)
+
+ void dlm_memory_exit(void)
+ {
+- if (lkb_cache)
+- kmem_cache_destroy(lkb_cache);
+- if (rsb_cache)
+- kmem_cache_destroy(rsb_cache);
++ kmem_cache_destroy(lkb_cache);
++ kmem_cache_destroy(rsb_cache);
+ }
+
+ char *dlm_allocate_lvb(struct dlm_ls *ls)
+@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb)
+ struct dlm_user_args *ua;
+ ua = lkb->lkb_ua;
+ if (ua) {
+- if (ua->lksb.sb_lvbptr)
+- kfree(ua->lksb.sb_lvbptr);
++ kfree(ua->lksb.sb_lvbptr);
+ kfree(ua);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 81a423a304756b7aa86daa27df2922a223b55a23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:29:21 +0200
+Subject: dma-mapping: fix return type of dma_set_max_seg_size()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit c9d76d0655c06b8c1f944e46c4fd9e9cf4b331c0 ]
+
+The function dma_set_max_seg_size() can return either 0 on success or
+-EIO on error. Change its return type from unsigned int to int to
+capture this.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 2e551e2d2d03a..62dd6676b7cc6 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -151,8 +151,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev)
+ return SZ_64K;
+ }
+
+-static inline unsigned int dma_set_max_seg_size(struct device *dev,
+- unsigned int size)
++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size)
+ {
+ if (dev->dma_parms) {
+ dev->dma_parms->max_segment_size = size;
+--
+2.20.1
+
--- /dev/null
+From 513308d6b111d8d8e04b20c6a360fd46cfe8f482 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 11:33:48 +0800
+Subject: dmaengine: coh901318: Fix a double-lock bug
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 627469e4445b9b12e0229b3bdf8564d5ce384dd7 ]
+
+The function coh901318_alloc_chan_resources() calls spin_lock_irqsave()
+before calling coh901318_config().
+But coh901318_config() calls spin_lock_irqsave() again in its
+definition, which may cause a double-lock bug.
+
+Because coh901318_config() is only called by
+coh901318_alloc_chan_resources(), the bug fix is to remove the
+calls to spin-lock and -unlock functions in coh901318_config().
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/coh901318.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
+index c340ca9bd2b5d..69852a99fc243 100644
+--- a/drivers/dma/coh901318.c
++++ b/drivers/dma/coh901318.c
+@@ -1815,8 +1815,6 @@ static int coh901318_config(struct coh901318_chan *cohc,
+ int channel = cohc->id;
+ void __iomem *virtbase = cohc->base->virtbase;
+
+- spin_lock_irqsave(&cohc->lock, flags);
+-
+ if (param)
+ p = param;
+ else
+@@ -1836,8 +1834,6 @@ static int coh901318_config(struct coh901318_chan *cohc,
+ coh901318_set_conf(cohc, p->config);
+ coh901318_set_ctrl(cohc, p->ctrl_lli_last);
+
+- spin_unlock_irqrestore(&cohc->lock, flags);
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From dc1d012b4744634fc42e39c92e6bfb279531bc0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 16:38:47 +0100
+Subject: extcon: max8997: Fix lack of path setting in USB device mode
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit a2dc50914744eea9f83a70a5db0486be625e5dc0 ]
+
+MAX8997 driver disables automatic path selection from MicroUSB connector
+and manually sets path to either UART or USB lines. However the code for
+setting USB path worked only for USB host mode (when ID pin is set
+to ground). When standard USB cable (USB device mode) is connected, path
+registers are not touched. This means that once the non-USB accessory is
+connected to MAX8997-operated micro USB port, the path is no longer set
+to USB and USB device mode doesn't work. This patch fixes it by setting
+USB path both for USB and USB host modes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-max8997.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
+index b2b13b3dce147..3d6b42f61f56e 100644
+--- a/drivers/extcon/extcon-max8997.c
++++ b/drivers/extcon/extcon-max8997.c
+@@ -320,12 +320,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info,
+ {
+ int ret = 0;
+
+- if (usb_type == MAX8997_USB_HOST) {
+- ret = max8997_muic_set_path(info, info->path_usb, attached);
+- if (ret < 0) {
+- dev_err(info->dev, "failed to update muic register\n");
+- return ret;
+- }
++ ret = max8997_muic_set_path(info, info->path_usb, attached);
++ if (ret < 0) {
++ dev_err(info->dev, "failed to update muic register\n");
++ return ret;
+ }
+
+ switch (usb_type) {
+--
+2.20.1
+
--- /dev/null
+From 15bbf9e66b34d30c59ddf83574bc12808eb39f8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:29:13 +0100
+Subject: i2c: imx: don't print error message on probe defer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit fece4978510e43f09c8cd386fee15210e8c68493 ]
+
+Probe deferral is a normal operating condition in the probe function,
+so don't spam the log with an error in this case.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-imx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index cf1b57a054d09..d121c5732d7db 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1076,7 +1076,8 @@ static int i2c_imx_probe(struct platform_device *pdev)
+ /* Get I2C clock */
+ i2c_imx->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(i2c_imx->clk)) {
+- dev_err(&pdev->dev, "can't get I2C clock\n");
++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "can't get I2C clock\n");
+ return PTR_ERR(i2c_imx->clk);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From bcaa106d4e5533709e3ede58824b4e92482dac92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 17:04:54 -0800
+Subject: Input: cyttsp4_core - fix use after free bug
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 79aae6acbef16f720a7949f8fc6ac69816c79d62 ]
+
+The device md->input is used after it is released. Setting the device
+data to NULL is unnecessary as the device is never used again. Instead,
+md->input should be assigned NULL to avoid accessing the freed memory
+accidently. Besides, checking md->si against NULL is superfluous as it
+points to a variable address, which cannot be NULL.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/1572936379-6423-1-git-send-email-bianpan2016@163.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/cyttsp4_core.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
+index 5ed31057430c6..6e904048d1cb7 100644
+--- a/drivers/input/touchscreen/cyttsp4_core.c
++++ b/drivers/input/touchscreen/cyttsp4_core.c
+@@ -1972,11 +1972,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ /* get sysinfo */
+ md->si = &cd->sysinfo;
+- if (!md->si) {
+- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n",
+- __func__, md->si);
+- goto error_get_sysinfo;
+- }
+
+ rc = cyttsp4_setup_input_device(cd);
+ if (rc)
+@@ -1986,8 +1981,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ error_init_input:
+ input_free_device(md->input);
+-error_get_sysinfo:
+- input_set_drvdata(md->input, NULL);
+ error_alloc_failed:
+ dev_err(dev, "%s failed.\n", __func__);
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 0259a468e2383fc41f8bf84b9a7548727874c03c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Nov 2018 05:27:39 -0800
+Subject: iw_cxgb4: only reconnect with MPAv1 if the peer aborts
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit 9828ca654b52848e7eb7dcc9b0994ff130dd4546 ]
+
+Only retry connection setup with MPAv1 if the peer actually aborted the
+connection upon receiving the MPAv2 start message. This avoids retrying
+with MPAv1 in the case where the connection was aborted due to retransmit
+timeouts.
+
+Fixes: d2fe99e86bb2 ("RDMA/cxgb4: Add support for MPAv2 Enhanced RDMA Negotiation")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 54fd4d81a3f1f..0d13d369fea91 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2691,7 +2691,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
+ break;
+ case MPA_REQ_SENT:
+ (void)stop_ep_timer(ep);
+- if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1))
++ if (status != CPL_ERR_CONN_RESET || mpa_rev == 1 ||
++ (mpa_rev == 2 && ep->tried_with_mpa_v1))
+ connect_reply_upcall(ep, -ECONNRESET);
+ else {
+ /*
+--
+2.20.1
+
--- /dev/null
+From ea5a7ad4e2e941e3b22b7d9d9fb82a48b7d0b28e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jul 2018 21:57:50 +0300
+Subject: iwlwifi: mvm: Send non offchannel traffic via AP sta
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit dc1aca22f8f38b7e2ad7b118db87404d11e68771 ]
+
+TDLS discovery response frame is a unicast direct frame to the peer.
+Since we don't have a STA for this peer, this frame goes through
+iwl_tx_skb_non_sta(). As the result aux_sta and some completely
+arbitrary queue would be selected for this frame, resulting in a queue
+hang. Fix that by sending such frames through AP sta instead.
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/iwlwifi/mvm/mac80211.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index 7b2a7d848a56f..ca498b1f1f568 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -741,6 +741,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
+ !ieee80211_is_action(hdr->frame_control)))
+ sta = NULL;
+
++ /* If there is no sta, and it's not offchannel - send through AP */
++ if (info->control.vif->type == NL80211_IFTYPE_STATION &&
++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) {
++ struct iwl_mvm_vif *mvmvif =
++ iwl_mvm_vif_from_mac80211(info->control.vif);
++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
++
++ if (ap_sta_id < IWL_MVM_STATION_COUNT) {
++ /* mac80211 holds rcu read lock */
++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
++ if (IS_ERR_OR_NULL(sta))
++ goto drop;
++ }
++ }
++
+ if (sta) {
+ if (iwl_mvm_defer_tx(mvm, sta, skb))
+ return;
+--
+2.20.1
+
--- /dev/null
+From 06a6ab37cb1371dd8c128507793a0f7ffdada088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 08:11:54 +0900
+Subject: kbuild: fix single target build for external module
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit e07db28eea38ed4e332b3a89f3995c86b713cb5b ]
+
+Building a single target in an external module fails due to missing
+.tmp_versions directory.
+
+For example,
+
+ $ make -C /lib/modules/$(uname -r)/build M=$PWD foo.o
+
+will fail in the following way:
+
+ CC [M] /home/masahiro/foo/foo.o
+/bin/sh: 1: cannot create /home/masahiro/foo/.tmp_versions/foo.mod: Directory nonexistent
+
+This is because $(cmd_crmodverdir) is executed only before building
+/, %/, %.ko single targets of external modules. Create .tmp_versions
+in the 'prepare' target.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index eb4f5b889a1cc..42102ffb9eff8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1424,9 +1424,6 @@ else # KBUILD_EXTMOD
+
+ # We are always building modules
+ KBUILD_MODULES := 1
+-PHONY += crmodverdir
+-crmodverdir:
+- $(cmd_crmodverdir)
+
+ PHONY += $(objtree)/Module.symvers
+ $(objtree)/Module.symvers:
+@@ -1438,7 +1435,7 @@ $(objtree)/Module.symvers:
+
+ module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD))
+ PHONY += $(module-dirs) modules
+-$(module-dirs): crmodverdir $(objtree)/Module.symvers
++$(module-dirs): prepare $(objtree)/Module.symvers
+ $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
+
+ modules: $(module-dirs)
+@@ -1478,7 +1475,8 @@ help:
+
+ # Dummies...
+ PHONY += prepare scripts
+-prepare: ;
++prepare:
++ $(cmd_crmodverdir)
+ scripts: ;
+ endif # KBUILD_EXTMOD
+
+@@ -1602,17 +1600,14 @@ endif
+
+ # Modules
+ /: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ # Make sure the latest headers are built for Documentation
+ Documentation/: headers_install
+ %/: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ %.ko: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir) $(@:.ko=.o)
+ $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
+--
+2.20.1
+
--- /dev/null
+From 66c45912a1133ed5483e1559bad8a5d6bd2f4275 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 11:36:52 -0500
+Subject: lockd: fix decoding of TEST results
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit b8db159239b3f51e2b909859935cc25cb3ff3eed ]
+
+We fail to advance the read pointer when reading the stat.oh field that
+identifies the lock-holder in a TEST result.
+
+This turns out not to matter if the server is knfsd, which always
+returns a zero-length field. But other servers (Ganesha is an example)
+may not do this. The result is bad values in fcntl F_GETLK results.
+
+Fix this.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/clnt4xdr.c | 22 ++++++----------------
+ fs/lockd/clntxdr.c | 22 ++++++----------------
+ 2 files changed, 12 insertions(+), 32 deletions(-)
+
+diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
+index d3e40db289302..4fdf8dae0db28 100644
+--- a/fs/lockd/clnt4xdr.c
++++ b/fs/lockd/clnt4xdr.c
+@@ -127,24 +127,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
+index 3e9f7874b9755..29392d66473c8 100644
+--- a/fs/lockd/clntxdr.c
++++ b/fs/lockd/clntxdr.c
+@@ -124,24 +124,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 7eac89f405edd645c05d92936985a180e1631c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 11:14:38 +0800
+Subject: math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
+
+From: Vincent Chen <vincentc@andestech.com>
+
+[ Upstream commit 83312f1b7ae205dca647bf52bbe2d51303cdedfb ]
+
+_FP_ROUND_ZERO is defined as 0 and used as a statemente in macro
+_FP_ROUND. This generates "error: statement with no effect
+[-Werror=unused-value]" from gcc. Defining _FP_ROUND_ZERO as (void)0 to
+fix it.
+
+This modification is quoted from glibc 'commit <In libc/:>
+(8ed1e7d5894000c155acbd06f)'
+
+Signed-off-by: Vincent Chen <vincentc@andestech.com>
+Acked-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/math-emu/soft-fp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
+index 3f284bc031809..5650c16283830 100644
+--- a/include/math-emu/soft-fp.h
++++ b/include/math-emu/soft-fp.h
+@@ -138,7 +138,7 @@ do { \
+ _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \
+ } while (0)
+
+-#define _FP_ROUND_ZERO(wc, X) 0
++#define _FP_ROUND_ZERO(wc, X) (void)0
+
+ #define _FP_ROUND_PINF(wc, X) \
+ do { \
+--
+2.20.1
+
--- /dev/null
+From 0aecc2dd80345b10cd6ab210a77b3ecc83ca4bdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 05:40:54 -0500
+Subject: media: coda: fix memory corruption in case more than 32 instances are
+ opened
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f ]
+
+The ffz() return value is undefined if the instance mask does not
+contain any zeros. If it returned 32, the following set_bit would
+corrupt the debugfs_root pointer.
+Switch to IDA for context index allocation. This also removes the
+artificial 32 instance limit for all except CodaDx6.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/coda/coda-common.c | 26 +++++++++--------------
+ drivers/media/platform/coda/coda.h | 3 ++-
+ 2 files changed, 12 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 323aad3c89de6..154aa7d73a8d2 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -17,6 +17,7 @@
+ #include <linux/firmware.h>
+ #include <linux/gcd.h>
+ #include <linux/genalloc.h>
++#include <linux/idr.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/irq.h>
+@@ -1644,17 +1645,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq,
+ return coda_queue_init(priv, dst_vq);
+ }
+
+-static int coda_next_free_instance(struct coda_dev *dev)
+-{
+- int idx = ffz(dev->instance_mask);
+-
+- if ((idx < 0) ||
+- (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES))
+- return -EBUSY;
+-
+- return idx;
+-}
+-
+ /*
+ * File operations
+ */
+@@ -1663,7 +1653,8 @@ static int coda_open(struct file *file)
+ {
+ struct video_device *vdev = video_devdata(file);
+ struct coda_dev *dev = video_get_drvdata(vdev);
+- struct coda_ctx *ctx = NULL;
++ struct coda_ctx *ctx;
++ unsigned int max = ~0;
+ char *name;
+ int ret;
+ int idx;
+@@ -1672,12 +1663,13 @@ static int coda_open(struct file *file)
+ if (!ctx)
+ return -ENOMEM;
+
+- idx = coda_next_free_instance(dev);
++ if (dev->devtype->product == CODA_DX6)
++ max = CODADX6_MAX_INSTANCES - 1;
++ idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL);
+ if (idx < 0) {
+ ret = idx;
+ goto err_coda_max;
+ }
+- set_bit(idx, &dev->instance_mask);
+
+ name = kasprintf(GFP_KERNEL, "context%d", idx);
+ if (!name) {
+@@ -1771,8 +1763,8 @@ err_clk_per:
+ err_pm_get:
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
+ err_coda_name_init:
++ ida_free(&dev->ida, ctx->idx);
+ err_coda_max:
+ kfree(ctx);
+ return ret;
+@@ -1811,7 +1803,7 @@ static int coda_release(struct file *file)
+ pm_runtime_put_sync(&dev->plat_dev->dev);
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
++ ida_free(&dev->ida, ctx->idx);
+ if (ctx->ops->release)
+ ctx->ops->release(ctx);
+ debugfs_remove_recursive(ctx->debugfs_entry);
+@@ -2192,6 +2184,7 @@ static int coda_probe(struct platform_device *pdev)
+
+ mutex_init(&dev->dev_mutex);
+ mutex_init(&dev->coda_mutex);
++ ida_init(&dev->ida);
+
+ dev->debugfs_root = debugfs_create_dir("coda", NULL);
+ if (!dev->debugfs_root)
+@@ -2276,6 +2269,7 @@ static int coda_remove(struct platform_device *pdev)
+ coda_free_aux_buf(dev, &dev->tempbuf);
+ coda_free_aux_buf(dev, &dev->workbuf);
+ debugfs_remove_recursive(dev->debugfs_root);
++ ida_destroy(&dev->ida);
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
+index 96532b06bd9e1..239f6bb2fca42 100644
+--- a/drivers/media/platform/coda/coda.h
++++ b/drivers/media/platform/coda/coda.h
+@@ -16,6 +16,7 @@
+ #define __CODA_H__
+
+ #include <linux/debugfs.h>
++#include <linux/idr.h>
+ #include <linux/irqreturn.h>
+ #include <linux/mutex.h>
+ #include <linux/kfifo.h>
+@@ -93,7 +94,7 @@ struct coda_dev {
+ struct v4l2_m2m_dev *m2m_dev;
+ struct vb2_alloc_ctx *alloc_ctx;
+ struct list_head instances;
+- unsigned long instance_mask;
++ struct ida ida;
+ struct dentry *debugfs_root;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 43293bca7ca48cc5e1ed3675fd60d1f662b716d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 22:12:17 +0200
+Subject: MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible
+ definition
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 1c6121c39677175bd372076020948e184bad4b6b ]
+
+cn58xx is compatible with cn50xx, so use the latter.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+[paul.burton@mips.com: s/cn52xx/cn50xx/ in commit message.]
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c | 2 +-
+ arch/mips/include/asm/octeon/cvmx-pko.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+index 8241fc6aa17d8..3839feba68f20 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id)
+ } else {
+ union cvmx_pko_mem_debug8 debug8;
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- return debug8.cn58xx.doorbell;
++ return debug8.cn50xx.doorbell;
+ }
+ case CVMX_CMD_QUEUE_ZIP:
+ case CVMX_CMD_QUEUE_DFA:
+diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h
+index 5f47f76ed510a..20eb9c46a75ab 100644
+--- a/arch/mips/include/asm/octeon/cvmx-pko.h
++++ b/arch/mips/include/asm/octeon/cvmx-pko.h
+@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear,
+ pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num);
+ cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64);
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- status->doorbell = debug8.cn58xx.doorbell;
++ status->doorbell = debug8.cn50xx.doorbell;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e8ae5e7d02743f28eaa2a23faeee0b8404be20e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 00:37:29 +0200
+Subject: MIPS: OCTEON: octeon-platform: fix typing
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 2cf1c8933dd93088cfb5f8f58b3bb9bbdf1781b9 ]
+
+Use correct type for fdt_property nameoff field.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/21204/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/octeon-platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index 6df3a4ea77fc5..a56620cb7cad2 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -485,7 +485,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr)
+ if (phy_addr >= 256 && alt_phy > 0) {
+ const struct fdt_property *phy_prop;
+ struct fdt_property *alt_prop;
+- u32 phy_handle_name;
++ fdt32_t phy_handle_name;
+
+ /* Use the alt phy node instead.*/
+ phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL);
+--
+2.20.1
+
--- /dev/null
+From ec16160b4f68799ffcfb1af761263d31fc16833b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 22:42:37 +0000
+Subject: MIPS: SiByte: Enable ZONE_DMA32 for LittleSur
+
+From: Maciej W. Rozycki <macro@linux-mips.org>
+
+[ Upstream commit 756d6d836dbfb04a5a486bc2ec89397aa4533737 ]
+
+The LittleSur board is marked for high memory support and therefore
+clearly must provide a way to have enough memory installed for some to
+be present outside the low 4GiB physical address range. With the memory
+map of the BCM1250 SOC it has been built around it means over 1GiB of
+actual DRAM, as only the first 1GiB is mapped in the low 4GiB physical
+address range[1].
+
+Complement commit cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need
+DMA32.") then and also enable ZONE_DMA32 for LittleSur.
+
+References:
+
+[1] "BCM1250/BCM1125/BCM1125H User Manual", Revision 1250_1125-UM100-R,
+ Broadcom Corporation, 21 Oct 2002, Section 3: "System Overview",
+ "Memory Map", pp. 34-38
+
+Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Patchwork: https://patchwork.linux-mips.org/patch/21107/
+Fixes: cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need DMA32.")
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 422624ca01329..596cbda9cb3d3 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -773,6 +773,7 @@ config SIBYTE_LITTLESUR
+ select SYS_SUPPORTS_BIG_ENDIAN
+ select SYS_SUPPORTS_HIGHMEM
+ select SYS_SUPPORTS_LITTLE_ENDIAN
++ select ZONE_DMA32 if 64BIT
+
+ config SIBYTE_SENTOSA
+ bool "Sibyte BCM91250E-Sentosa"
+--
+2.20.1
+
--- /dev/null
+From cf64e80b75823b7584645ab7c9a83b8f5adf8342 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 21:18:07 -0500
+Subject: mlx4: Use snprintf instead of complicated strcpy
+
+From: Qian Cai <cai@gmx.us>
+
+[ Upstream commit 0fbc9b8b4ea3f688a5da141a64f97aa33ad02ae9 ]
+
+This fixes a compilation warning in sysfs.c
+
+drivers/infiniband/hw/mlx4/sysfs.c:360:2: warning: 'strncpy' output may be
+truncated copying 8 bytes from a string of length 31
+[-Wstringop-truncation]
+
+By eliminating the temporary stack buffer.
+
+Signed-off-by: Qian Cai <cai@gmx.us>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/sysfs.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
+index 69fb5ba94d0f2..19caacd26f61a 100644
+--- a/drivers/infiniband/hw/mlx4/sysfs.c
++++ b/drivers/infiniband/hw/mlx4/sysfs.c
+@@ -352,16 +352,12 @@ err:
+
+ static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max)
+ {
+- char base_name[9];
+-
+- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */
+- strlcpy(name, pci_name(dev->dev->persist->pdev), max);
+- strncpy(base_name, name, 8); /*till xxxx:yy:*/
+- base_name[8] = '\0';
+- /* with no ARI only 3 last bits are used so when the fn is higher than 8
++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n
++ * with no ARI only 3 last bits are used so when the fn is higher than 8
+ * need to add it to the dev num, so count in the last number will be
+ * modulo 8 */
+- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8));
++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev),
++ i / 8, i % 8);
+ }
+
+ struct mlx4_port {
+--
+2.20.1
+
--- /dev/null
+From cc841ea1a593eb5be8f3e0052bc7975b15f40786 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 13:14:13 -0800
+Subject: modpost: skip ELF local symbols during section mismatch check
+
+From: Paul Walmsley <paul.walmsley@sifive.com>
+
+[ Upstream commit a4d26f1a0958bb1c2b60c6f1e67c6f5d43e2647b ]
+
+During development of a serial console driver with a gcc 8.2.0
+toolchain for RISC-V, the following modpost warning appeared:
+
+----
+WARNING: vmlinux.o(.data+0x19b10): Section mismatch in reference from the variable .LANCHOR1 to the function .init.text:sifive_serial_console_setup()
+The variable .LANCHOR1 references
+the function __init sifive_serial_console_setup()
+If the reference is valid then annotate the
+variable with __init* or __refdata (see linux/init.h) or name the variable:
+*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console
+----
+
+".LANCHOR1" is an ELF local symbol, automatically created by gcc's section
+anchor generation code:
+
+https://gcc.gnu.org/onlinedocs/gccint/Anchored-Addresses.html
+
+https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/varasm.c;h=cd9591a45617464946dcf9a126dde277d9de9804;hb=9fb89fa845c1b2e0a18d85ada0b077c84508ab78#l7473
+
+This was verified by compiling the kernel with -fno-section-anchors
+and observing that the ".LANCHOR1" ELF local symbol disappeared, and
+modpost no longer warned about the section mismatch. The serial
+driver code idiom triggering the warning is standard Linux serial
+driver practice that has a specific whitelist inclusion in modpost.c.
+
+I'm neither a modpost nor an ELF expert, but naively, it doesn't seem
+useful for modpost to report section mismatch warnings caused by ELF
+local symbols by default. Local symbols have compiler-generated
+names, and thus bypass modpost's whitelisting algorithm, which relies
+on the presence of a non-autogenerated symbol name. This increases
+the likelihood that false positive warnings will be generated (as in
+the above case).
+
+Thus, disable section mismatch reporting on ELF local symbols. The
+rationale here is similar to that of commit 2e3a10a1551d ("ARM: avoid
+ARM binutils leaking ELF local symbols") and of similar code already
+present in modpost.c:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/mod/modpost.c?h=v4.19-rc4&id=7876320f88802b22d4e2daf7eb027dd14175a0f8#n1256
+
+This third version of the patch implements a suggestion from Masahiro
+Yamada <yamada.masahiro@socionext.com> to restructure the code as an
+additional pattern matching step inside secref_whitelist(), and
+further improves the patch description.
+
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 81b1c02a76fad..f27df76059995 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1156,6 +1156,14 @@ static const struct sectioncheck *section_mismatch(
+ * fromsec = text section
+ * refsymname = *.constprop.*
+ *
++ * Pattern 6:
++ * Hide section mismatch warnings for ELF local symbols. The goal
++ * is to eliminate false positive modpost warnings caused by
++ * compiler-generated ELF local symbol names such as ".LANCHOR1".
++ * Autogenerated symbol names bypass modpost's "Pattern 2"
++ * whitelisting, which relies on pattern-matching against symbol
++ * names to work. (One situation where gcc can autogenerate ELF
++ * local symbols is when "-fsection-anchors" is used.)
+ **/
+ static int secref_whitelist(const struct sectioncheck *mismatch,
+ const char *fromsec, const char *fromsym,
+@@ -1194,6 +1202,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
+ match(fromsym, optim_symbols))
+ return 0;
+
++ /* Check for pattern 6 */
++ if (strstarts(fromsym, ".L"))
++ return 0;
++
+ return 1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 21f747ac8e223d93ca2628ecb3c69aab1939d843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 23:43:24 +0800
+Subject: net: ep93xx_eth: fix mismatch of request_mem_region in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 3df70afe8d33f4977d0e0891bdcfb639320b5257 ]
+
+The driver calls release_resource in remove to match request_mem_region
+in probe, which is incorrect.
+Fix it by using the right one, release_mem_region.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cirrus/ep93xx_eth.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+index de9f7c97d916d..796ee362ad70c 100644
+--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+@@ -776,6 +776,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ {
+ struct net_device *dev;
+ struct ep93xx_priv *ep;
++ struct resource *mem;
+
+ dev = platform_get_drvdata(pdev);
+ if (dev == NULL)
+@@ -791,8 +792,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ iounmap(ep->base_addr);
+
+ if (ep->res != NULL) {
+- release_resource(ep->res);
+- kfree(ep->res);
++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ release_mem_region(mem->start, resource_size(mem));
+ }
+
+ free_netdev(dev);
+--
+2.20.1
+
--- /dev/null
+From ea34062215f557b4b9ebb460a89db82f942c2adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 09:50:27 +0100
+Subject: net/x25: fix called/calling length calculation in
+ x25_parse_address_block
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit d449ba3d581ed29f751a59792fdc775572c66904 ]
+
+The length of the called and calling address was not calculated
+correctly (BCD encoding).
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 5dca42dbc7375..5a041ea25fe25 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb,
+ }
+
+ len = *skb->data;
+- needed = 1 + (len >> 4) + (len & 0x0f);
++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2;
+
+ if (!pskb_may_pull(skb, needed)) {
+ /* packet is too short to hold the addresses it claims
+--
+2.20.1
+
--- /dev/null
+From 985d96c30702f46d4eacc51873bbb5596d4cfbe3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 09:50:28 +0100
+Subject: net/x25: fix null_x25_address handling
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 06137619f061f498c2924f6543fa45b7d39f0501 ]
+
+o x25_find_listener(): the compare for the null_x25_address was wrong.
+ We have to check the x25_addr of the listener socket instead of the
+ x25_addr of the incomming call.
+
+ o x25_bind(): it was not possible to bind a socket to null_x25_address
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 5a041ea25fe25..f330475a87ffb 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr,
+ sk_for_each(s, &x25_list)
+ if ((!strcmp(addr->x25_addr,
+ x25_sk(s)->source_addr.x25_addr) ||
+- !strcmp(addr->x25_addr,
++ !strcmp(x25_sk(s)->source_addr.x25_addr,
+ null_x25_address.x25_addr)) &&
+ s->sk_state == TCP_LISTEN) {
+ /*
+@@ -684,11 +684,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out;
+ }
+
+- len = strlen(addr->sx25_addr.x25_addr);
+- for (i = 0; i < len; i++) {
+- if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+- rc = -EINVAL;
+- goto out;
++ /* check for the null_x25_address */
++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
++
++ len = strlen(addr->sx25_addr.x25_addr);
++ for (i = 0; i < len; i++) {
++ if (!isdigit(addr->sx25_addr.x25_addr[i])) {
++ rc = -EINVAL;
++ goto out;
++ }
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c2198c344ac251576eae7d32b445efabfdca2a34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2019 17:19:15 +0100
+Subject: NFC: nxp-nci: Fix NULL pointer dereference after I2C communication
+ error
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit a71a29f50de1ef97ab55c151a1598eb12dde379d ]
+
+I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci
+result in a NULL pointer dereference at the moment:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ Oops: 0002 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1
+ RIP: 0010:skb_queue_tail+0x25/0x50
+ Call Trace:
+ nci_recv_frame+0x36/0x90 [nci]
+ nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c]
+ ? preempt_count_add+0x68/0xa0
+ ? irq_forced_thread_fn+0x80/0x80
+ irq_thread_fn+0x20/0x60
+ irq_thread+0xee/0x180
+ ? wake_threads_waitq+0x30/0x30
+ kthread+0xfb/0x130
+ ? irq_thread_check_affinity+0xd0/0xd0
+ ? kthread_park+0x90/0x90
+ ret_from_fork+0x1f/0x40
+
+Afterward the kernel must be rebooted to work properly again.
+
+This happens because it attempts to call nci_recv_frame() with skb == NULL.
+However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any
+NULL checks for skb, causing the NULL pointer dereference.
+
+Change the code to call only nxp_nci_fw_recv_frame() in case of an error.
+Make sure to log it so it is obvious that a communication error occurred.
+The error above then becomes:
+
+ nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
+ nci: __nci_request: wait_for_completion_interruptible_timeout failed 0
+ nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
+
+Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 0b1122cb5d0c8..b505a6e135b75 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -239,8 +239,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id)
+
+ if (r == -EREMOTEIO) {
+ phy->hard_fault = r;
+- skb = NULL;
+- } else if (r < 0) {
++ if (info->mode == NXP_NCI_MODE_FW)
++ nxp_nci_fw_recv_frame(phy->ndev, NULL);
++ }
++ if (r < 0) {
+ nfc_err(&client->dev, "Read failed with error %d\n", r);
+ goto exit_irq_handled;
+ }
+--
+2.20.1
+
--- /dev/null
+From 4c2f9e5132737349635fd7e3eda4ea681616d58e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:35:08 -0500
+Subject: nfsd: fix a warning in __cld_pipe_upcall()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit b493fd31c0b89d9453917e977002de58bebc3802 ]
+
+__cld_pipe_upcall() emits a "do not call blocking ops when
+!TASK_RUNNING" warning due to the dput() call in rpc_queue_upcall().
+Fix it by using a completion instead of hand coding the wait.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4recover.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
+index e3d47091b191d..2cb2e61cdbf6c 100644
+--- a/fs/nfsd/nfs4recover.c
++++ b/fs/nfsd/nfs4recover.c
+@@ -655,7 +655,7 @@ struct cld_net {
+ struct cld_upcall {
+ struct list_head cu_list;
+ struct cld_net *cu_net;
+- struct task_struct *cu_task;
++ struct completion cu_done;
+ struct cld_msg cu_msg;
+ };
+
+@@ -664,23 +664,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg)
+ {
+ int ret;
+ struct rpc_pipe_msg msg;
++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg);
+
+ memset(&msg, 0, sizeof(msg));
+ msg.data = cmsg;
+ msg.len = sizeof(*cmsg);
+
+- /*
+- * Set task state before we queue the upcall. That prevents
+- * wake_up_process in the downcall from racing with schedule.
+- */
+- set_current_state(TASK_UNINTERRUPTIBLE);
+ ret = rpc_queue_upcall(pipe, &msg);
+ if (ret < 0) {
+- set_current_state(TASK_RUNNING);
+ goto out;
+ }
+
+- schedule();
++ wait_for_completion(&cup->cu_done);
+
+ if (msg.errno < 0)
+ ret = msg.errno;
+@@ -747,7 +742,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ if (copy_from_user(&cup->cu_msg, src, mlen) != 0)
+ return -EFAULT;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ return mlen;
+ }
+
+@@ -762,7 +757,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
+ if (msg->errno >= 0)
+ return;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ }
+
+ static const struct rpc_pipe_ops cld_upcall_ops = {
+@@ -893,7 +888,7 @@ restart_search:
+ goto restart_search;
+ }
+ }
+- new->cu_task = current;
++ init_completion(&new->cu_done);
+ new->cu_msg.cm_vers = CLD_UPCALL_VERSION;
+ put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid);
+ new->cu_net = cn;
+--
+2.20.1
+
--- /dev/null
+From c5859c473d60134c9aa2a3b9517dd1157b9765bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 16:04:25 +0800
+Subject: nfsd: Return EPERM, not EACCES, in some SETATTR cases
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 255fbca65137e25b12bced18ec9a014dc77ecda0 ]
+
+As the man(2) page for utime/utimes states, EPERM is returned when the
+second parameter of utime or utimes is not NULL, the caller's effective UID
+does not match the owner of the file, and the caller is not privileged.
+
+However, in a NFS directory mounted from knfsd, it will return EACCES
+(from nfsd_setattr-> fh_verify->nfsd_permission). This patch fixes
+that.
+
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/vfs.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 17138a97f306c..7745d0a9029c7 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -387,10 +387,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ bool get_write_count;
+ bool size_change = (iap->ia_valid & ATTR_SIZE);
+
+- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
++ if (iap->ia_valid & ATTR_SIZE) {
+ accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+- if (iap->ia_valid & ATTR_SIZE)
+ ftype = S_IFREG;
++ }
++
++ /*
++ * If utimes(2) and friends are called with times not NULL, we should
++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission
++ * will return EACCESS, when the caller's effective UID does not match
++ * the owner of the file, and the caller is not privileged. In this
++ * situation, we should return EPERM(notify_change will return this).
++ */
++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) {
++ accmode |= NFSD_MAY_OWNER_OVERRIDE;
++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET)))
++ accmode |= NFSD_MAY_WRITE;
++ }
+
+ /* Callers that do fh_verify should do the fh_want_write: */
+ get_write_count = !fhp->fh_dentry;
+--
+2.20.1
+
--- /dev/null
+From 529fc2a3c02c9881b900237366b8fb27619d7948 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Nov 2018 20:34:11 -0500
+Subject: pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit 7ed07855773814337b9814f1c3e866df52ebce68 ]
+
+When attempting to setup up a gpio hog, device probing will repeatedly
+fail with -EPROBE_DEFERED errors. It is caused by a circular dependency
+between the gpio and pinctrl frameworks. If the gpio-ranges property is
+present in device tree, then the gpio framework will handle the gpio pin
+registration and eliminate the circular dependency.
+
+See Christian Lamparter's commit a86caa9ba5d7 ("pinctrl: msm: fix
+gpio-hog related boot issues") for a detailed commit message that
+explains the issue in much more detail. The code comment in this commit
+came from Christian's commit.
+
+I did not test this change against any hardware supported by this
+particular driver, however I was able to validate this same fix works
+for pinctrl-spmi-gpio.c using a LG Nexus 5 (hammerhead) phone.
+
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+index b1e8a2d905ff1..a0904e426c734 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -755,12 +755,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev)
+ goto unregister_pinctrl;
+ }
+
+- ret = gpiochip_add_pin_range(&pctrl->chip,
+- dev_name(pctrl->dev),
+- 0, 0, pctrl->chip.ngpio);
+- if (ret) {
+- dev_err(pctrl->dev, "failed to add pin range\n");
+- goto unregister_gpiochip;
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev),
++ 0, 0, pctrl->chip.ngpio);
++ if (ret) {
++ dev_err(pctrl->dev, "failed to add pin range\n");
++ goto unregister_gpiochip;
++ }
+ }
+
+ platform_set_drvdata(pdev, pctrl);
+--
+2.20.1
+
--- /dev/null
+From dabdcc7c453639ab9f99bea0bf5e3a9859fb8667 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 09:37:46 +1030
+Subject: powerpc/math-emu: Update macros from GCC
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit b682c8692442711684befe413cf93cf01c5324ea ]
+
+The add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros originate
+from GCC's longlong.h which in turn was copied from GMP's longlong.h a
+few decades ago.
+
+This was found when compiling with clang:
+
+ arch/powerpc/math-emu/fnmsub.c:46:2: error: invalid use of a cast in a
+ inline asm context requiring an l-value: remove the cast or build with
+ -fheinous-gnu-extensions
+ FP_ADD_D(R, T, B);
+ ^~~~~~~~~~~~~~~~~
+ ...
+
+ ./arch/powerpc/include/asm/sfp-machine.h:283:27: note: expanded from
+ macro 'sub_ddmmss'
+ : "=r" ((USItype)(sh)), \
+ ~~~~~~~~~~^~~
+
+Segher points out: this was fixed in GCC over 16 years ago
+( https://gcc.gnu.org/r56600 ), and in GMP (where it comes from)
+presumably before that.
+
+Update the add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros to
+the latest GCC version in order to git rid of the invalid casts. These
+were taken as-is from GCC's longlong in order to make future syncs
+obvious. Other parts of sfp-machine.h were left as-is as the file
+contains more features than present in longlong.h.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/260
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/sfp-machine.h | 92 ++++++++------------------
+ 1 file changed, 29 insertions(+), 63 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h
+index d89beaba26ff9..8b957aabb826d 100644
+--- a/arch/powerpc/include/asm/sfp-machine.h
++++ b/arch/powerpc/include/asm/sfp-machine.h
+@@ -213,30 +213,18 @@
+ * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow
+ * (i.e. carry out) is not stored anywhere, and is lost.
+ */
+-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+ else \
+- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \
++ : "=r" (sh), "=&r" (sl) \
++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \
+ } while (0)
+
+ /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to
+@@ -248,44 +236,24 @@
+ * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere,
+ * and is lost.
+ */
+-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (ah) && (ah) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+ else if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+ else \
+- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \
++ : "=r" (sh), "=&r" (sl) \
++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \
+ } while (0)
+
+ /* asm fragments for mul and div */
+@@ -294,13 +262,10 @@
+ * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype
+ * word product in HIGH_PROD and LOW_PROD.
+ */
+-#define umul_ppmm(ph, pl, m0, m1) \
++#define umul_ppmm(ph, pl, m0, m1) \
+ do { \
+ USItype __m0 = (m0), __m1 = (m1); \
+- __asm__ ("mulhwu %0,%1,%2" \
+- : "=r" ((USItype)(ph)) \
+- : "%r" (__m0), \
+- "r" (__m1)); \
++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \
+ (pl) = __m0 * __m1; \
+ } while (0)
+
+@@ -312,9 +277,10 @@
+ * significant bit of DENOMINATOR must be 1, then the pre-processor symbol
+ * UDIV_NEEDS_NORMALIZATION is defined to 1.
+ */
+-#define udiv_qrnnd(q, r, n1, n0, d) \
++#define udiv_qrnnd(q, r, n1, n0, d) \
+ do { \
+- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \
++ UWtype __d1, __d0, __q1, __q0; \
++ UWtype __r1, __r0, __m; \
+ __d1 = __ll_highpart (d); \
+ __d0 = __ll_lowpart (d); \
+ \
+@@ -325,7 +291,7 @@
+ if (__r1 < __m) \
+ { \
+ __q1--, __r1 += (d); \
+- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \
++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\
+ if (__r1 < __m) \
+ __q1--, __r1 += (d); \
+ } \
+--
+2.20.1
+
--- /dev/null
+From 1c1e235f4e6245151154023e3bc6ddf495f106d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 19:19:30 -0800
+Subject: regulator: Fix return value of _set_load() stub
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit f1abf67217de91f5cd3c757ae857632ca565099a ]
+
+The stub implementation of _set_load() returns a mode value which is
+within the bounds of valid return codes for success (the documentation
+just says that failures are negative error codes) but not sensible or
+what the actual implementation does. Fix it to just return 0.
+
+Reported-by: Cheng-Yi Chiang <cychiang@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/regulator/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
+index 9e0e76992be08..bf62713af290e 100644
+--- a/include/linux/regulator/consumer.h
++++ b/include/linux/regulator/consumer.h
+@@ -485,7 +485,7 @@ static inline unsigned int regulator_get_mode(struct regulator *regulator)
+
+ static inline int regulator_set_load(struct regulator *regulator, int load_uA)
+ {
+- return REGULATOR_MODE_NORMAL;
++ return 0;
+ }
+
+ static inline int regulator_allow_bypass(struct regulator *regulator,
+--
+2.20.1
+
--- /dev/null
+From 43202c1f2b61d1fba7da978cf85d4c0f5e40786e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 14:38:47 +0800
+Subject: rsxx: add missed destroy_workqueue calls in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit dcb77e4b274b8f13ac6482dfb09160cd2fae9a40 ]
+
+The driver misses calling destroy_workqueue in remove like what is done
+when probe fails.
+Add the missed calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rsxx/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
+index d8b2488aaade1..620a3a67cdd52 100644
+--- a/drivers/block/rsxx/core.c
++++ b/drivers/block/rsxx/core.c
+@@ -1028,8 +1028,10 @@ static void rsxx_pci_remove(struct pci_dev *dev)
+
+ cancel_work_sync(&card->event_work);
+
++ destroy_workqueue(card->event_wq);
+ rsxx_destroy_dev(card);
+ rsxx_dma_destroy(card);
++ destroy_workqueue(card->creg_ctrl.creg_wq);
+
+ spin_lock_irqsave(&card->irq_lock, flags);
+ rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
+--
+2.20.1
+
--- /dev/null
+From 831e767903748298b746aa986a1d943c7e62cfb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 14:34:02 +0200
+Subject: rtc: dt-binding: abx80x: fix resistance scale
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 73852e56827f5cb5db9d6e8dd8191fc2f2e8f424 ]
+
+The abracon,tc-resistor property value is in kOhm.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/rtc/abracon,abx80x.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+index be789685a1c24..18b892d010d87 100644
+--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+@@ -27,4 +27,4 @@ and valid to enable charging:
+
+ - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V)
+ - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output
+- resistor, the other values are in ohm.
++ resistor, the other values are in kOhm.
+--
+2.20.1
+
--- /dev/null
+From dab3d820297a16c461fc7db024966aa4bf8254bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:19:51 +0100
+Subject: rtc: max8997: Fix the returned value in case of error in
+ 'max8997_rtc_read_alarm()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 41ef3878203cd9218d92eaa07df4b85a2cb128fb ]
+
+In case of error, we return 0.
+This is spurious and not consistent with the other functions of the driver.
+Propagate the error code instead.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-max8997.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c
+index db984d4bf9526..4cce5bd448f65 100644
+--- a/drivers/rtc/rtc-max8997.c
++++ b/drivers/rtc/rtc-max8997.c
+@@ -221,7 +221,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+
+ out:
+ mutex_unlock(&info->lock);
+- return 0;
++ return ret;
+ }
+
+ static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info)
+--
+2.20.1
+
--- /dev/null
+From 326fe0c6257a77c55f6e2adfc0e06df564ee841a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 15:44:57 +0100
+Subject: scsi: zfcp: drop default switch case which might paper over missing
+ case
+
+From: Steffen Maier <maier@linux.ibm.com>
+
+[ Upstream commit 0c902936e55cff9335b27ed632fc45e7115ced75 ]
+
+This was introduced with v4.18 commit 8c3d20aada70 ("scsi: zfcp: fix
+missing REC trigger trace for all objects in ERP_FAILED") but would now
+suppress helpful -Wswitch compiler warnings when building with W=1 such as
+the following forced example:
+
+drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_handle_failed':
+drivers/s390/scsi/zfcp_erp.c:126:2: warning: enumeration value 'ZFCP_ERP_ACTION_REOPEN_PORT_FORCED' not handled in switch [-Wswitch]
+ switch (want) {
+ ^~~~~~
+
+But then again, only with W=1 we would notice unhandled enum cases.
+Without the default cases and a missed unhandled enum case, the code might
+perform unforeseen things we might not want...
+
+As of today, we never run through the removed default case, so removing it
+is no functional change. In the future, we never should run through a
+default case but introduce the necessary specific case(s) to handle new
+functionality.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/scsi/zfcp_erp.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index cc62d8cc8cfdd..d5214c4eb9ddb 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -178,9 +178,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter,
+ adapter, ZFCP_STATUS_COMMON_ERP_FAILED);
+ }
+ break;
+- default:
+- need = 0;
+- break;
+ }
+
+ return need;
+--
+2.20.1
+
--- /dev/null
+From 9206a32280aca0d02b47970b353969a563dc9af1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:11:04 -0700
+Subject: serial: core: Allow processing sysrq at port unlock time
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit d6e1935819db0c91ce4a5af82466f3ab50d17346 ]
+
+Right now serial drivers process sysrq keys deep in their character
+receiving code. This means that they've already grabbed their
+port->lock spinlock. This can end up getting in the way if we've go
+to do serial stuff (especially kgdb) in response to the sysrq.
+
+Serial drivers have various hacks in them to handle this. Looking at
+'8250_port.c' you can see that the console_write() skips locking if
+we're in the sysrq handler. Looking at 'msm_serial.c' you can see
+that the port lock is dropped around uart_handle_sysrq_char().
+
+It turns out that these hacks aren't exactly perfect. If you have
+lockdep turned on and use something like the 8250_port hack you'll get
+a splat that looks like:
+
+ WARNING: possible circular locking dependency detected
+ [...] is trying to acquire lock:
+ ... (console_owner){-.-.}, at: console_unlock+0x2e0/0x5e4
+
+ but task is already holding lock:
+ ... (&port_lock_key){-.-.}, at: serial8250_handle_irq+0x30/0xe4
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #1 (&port_lock_key){-.-.}:
+ _raw_spin_lock_irqsave+0x58/0x70
+ serial8250_console_write+0xa8/0x250
+ univ8250_console_write+0x40/0x4c
+ console_unlock+0x528/0x5e4
+ register_console+0x2c4/0x3b0
+ uart_add_one_port+0x350/0x478
+ serial8250_register_8250_port+0x350/0x3a8
+ dw8250_probe+0x67c/0x754
+ platform_drv_probe+0x58/0xa4
+ really_probe+0x150/0x294
+ driver_probe_device+0xac/0xe8
+ __driver_attach+0x98/0xd0
+ bus_for_each_dev+0x84/0xc8
+ driver_attach+0x2c/0x34
+ bus_add_driver+0xf0/0x1ec
+ driver_register+0xb4/0x100
+ __platform_driver_register+0x60/0x6c
+ dw8250_platform_driver_init+0x20/0x28
+ ...
+
+ -> #0 (console_owner){-.-.}:
+ lock_acquire+0x1e8/0x214
+ console_unlock+0x35c/0x5e4
+ vprintk_emit+0x230/0x274
+ vprintk_default+0x7c/0x84
+ vprintk_func+0x190/0x1bc
+ printk+0x80/0xa0
+ __handle_sysrq+0x104/0x21c
+ handle_sysrq+0x30/0x3c
+ serial8250_read_char+0x15c/0x18c
+ serial8250_rx_chars+0x34/0x74
+ serial8250_handle_irq+0x9c/0xe4
+ dw8250_handle_irq+0x98/0xcc
+ serial8250_interrupt+0x50/0xe8
+ ...
+
+ other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&port_lock_key);
+ lock(console_owner);
+ lock(&port_lock_key);
+ lock(console_owner);
+
+ *** DEADLOCK ***
+
+The hack used in 'msm_serial.c' doesn't cause the above splats but it
+seems a bit ugly to unlock / lock our spinlock deep in our irq
+handler.
+
+It seems like we could defer processing the sysrq until the end of the
+interrupt handler right after we've unlocked the port. With this
+scheme if a whole batch of sysrq characters comes in one irq then we
+won't handle them all, but that seems like it should be a fine
+compromise.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/serial_core.h | 37 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
+index 297d4fa1cfe51..b5b527efeea08 100644
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -159,6 +159,7 @@ struct uart_port {
+ struct console *cons; /* struct console, if any */
+ #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ)
+ unsigned long sysrq; /* sysrq timeout */
++ unsigned int sysrq_ch; /* char for sysrq */
+ #endif
+
+ /* flags must be updated while holding port mutex */
+@@ -440,8 +441,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
+ }
+ return 0;
+ }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
++{
++ if (port->sysrq) {
++ if (ch && time_before(jiffies, port->sysrq)) {
++ port->sysrq_ch = ch;
++ port->sysrq = 0;
++ return 1;
++ }
++ port->sysrq = 0;
++ }
++ return 0;
++}
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ int sysrq_ch;
++
++ sysrq_ch = port->sysrq_ch;
++ port->sysrq_ch = 0;
++
++ spin_unlock_irqrestore(&port->lock, irqflags);
++
++ if (sysrq_ch)
++ handle_sysrq(sysrq_ch);
++}
+ #else
+-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; })
++static inline int
++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ spin_unlock_irqrestore(&port->lock, irqflags);
++}
+ #endif
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 7305708ac31de6b32e9bb0b62a38fe1dddbc986f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:49:38 +0100
+Subject: serial: imx: fix error handling in console_setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 63fd4b94b948c14eeb27a3bbf50ea0f7f0593bad ]
+
+The ipg clock only needs to be unprepared in case preparing
+per clock fails. The ipg clock has already disabled at the point.
+
+Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/imx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index f5f46c121ee39..d607cb2eb64eb 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1784,7 +1784,7 @@ imx_console_setup(struct console *co, char *options)
+
+ retval = clk_prepare(sport->clk_per);
+ if (retval)
+- clk_disable_unprepare(sport->clk_ipg);
++ clk_unprepare(sport->clk_ipg);
+
+ error_console:
+ return retval;
+--
+2.20.1
+
serial-pl011-fix-dma-flush_buffer.patch
serial-serial_core-perform-null-checks-for-break_ctl-ops.patch
serial-ifx6x60-add-missed-pm_runtime_disable.patch
+autofs-fix-a-leak-in-autofs_expire_indirect.patch
+nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch
+input-cyttsp4_core-fix-use-after-free-bug.patch
+alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch
+rsxx-add-missed-destroy_workqueue-calls-in-remove.patch
+net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch
+serial-core-allow-processing-sysrq-at-port-unlock-ti.patch
+iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch
+arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch
+extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch
+clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch
+clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch
+dlm-fix-missing-idr_destroy-for-recover_idr.patch
+mips-sibyte-enable-zone_dma32-for-littlesur.patch
+scsi-zfcp-drop-default-switch-case-which-might-paper.patch
+pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch
+staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch
+regulator-fix-return-value-of-_set_load-stub.patch
+iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch
+mips-octeon-octeon-platform-fix-typing.patch
+math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch
+rtc-max8997-fix-the-returned-value-in-case-of-error-.patch
+rtc-dt-binding-abx80x-fix-resistance-scale.patch
+arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch
+media-coda-fix-memory-corruption-in-case-more-than-3.patch
+dmaengine-coh901318-fix-a-double-lock-bug.patch
+acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch
+dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch
+altera-stapl-check-for-a-null-key-before-strcasecmp-.patch
+serial-imx-fix-error-handling-in-console_setup.patch
+i2c-imx-don-t-print-error-message-on-probe-defer.patch
+lockd-fix-decoding-of-test-results.patch
+dlm-null-check-before-kmem_cache_destroy-is-not-need.patch
+nfsd-fix-a-warning-in-__cld_pipe_upcall.patch
+arm-omap1-2-fix-soc-name-printing.patch
+net-x25-fix-called-calling-length-calculation-in-x25.patch
+net-x25-fix-null_x25_address-handling.patch
+arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch
+tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch
+modpost-skip-elf-local-symbols-during-section-mismat.patch
+kbuild-fix-single-target-build-for-external-module.patch
+arm-dts-pxa-clean-up-usb-controller-nodes.patch
+dlm-fix-invalid-cluster-name-warning.patch
+powerpc-math-emu-update-macros-from-gcc.patch
+mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch
+nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch
+mlx4-use-snprintf-instead-of-complicated-strcpy.patch
+arm-dts-sunxi-fix-pmu-compatible-strings.patch
--- /dev/null
+From d5fffb2156350cc1104511546bb306fb3a82f63a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Nov 2018 04:19:07 +0530
+Subject: Staging: iio: adt7316: Fix i2c data reading, set the data field
+
+From: Shreeya Patel <shreeya.patel23498@gmail.com>
+
+[ Upstream commit 688cd642ba0c393344c802647848da5f0d925d0e ]
+
+adt7316_i2c_read function nowhere sets the data field.
+It is necessary to have an appropriate value for it.
+Hence, assign the value stored in 'ret' variable to data field.
+
+This is an ancient bug, and as no one seems to have noticed,
+probably no sense in applying it to stable.
+
+Signed-off-by: Shreeya Patel <shreeya.patel23498@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/iio/addac/adt7316-i2c.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c
+index 78fe0b5572802..fa1ef25d7a9a3 100644
+--- a/drivers/staging/iio/addac/adt7316-i2c.c
++++ b/drivers/staging/iio/addac/adt7316-i2c.c
+@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data)
+ return ret;
+ }
+
++ *data = ret;
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 7f9e63065385ee729148efdf2372171ecb030be4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 16:06:43 -0800
+Subject: tcp: fix off-by-one bug on aborting window-probing socket
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit 3976535af0cb9fe34a55f2ffb8d7e6b39a2f8188 ]
+
+Previously there is an off-by-one bug on determining when to abort
+a stalled window-probing socket. This patch fixes that so it is
+consistent with tcp_write_timeout().
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_timer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 61359944acc71..710cde1a5a832 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -336,7 +336,7 @@ static void tcp_probe_timer(struct sock *sk)
+ return;
+ }
+
+- if (icsk->icsk_probes_out > max_probes) {
++ if (icsk->icsk_probes_out >= max_probes) {
+ abort: tcp_write_err(sk);
+ } else {
+ /* Only send another probe if we didn't close things up. */
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
