--- /dev/null
+From b711438ca762b07b59bb1f611dba3887ec5806ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 07:59:51 -0700
+Subject: arm64: dts: qcom: Add Asus NovaGo TP370QL
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 722eb2f65acc4cebeb710fc7cc98f51513e90f1f ]
+
+This adds the initial DT for the Asus NovaGo TP370QL laptop. Supported
+functionality includes USB (host), microSD-card, keyboard, and trackpad.
+
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/Makefile | 1 +
+ .../dts/qcom/msm8998-asus-novago-tp370ql.dts | 47 +++++++++++++++++++
+ 2 files changed, 48 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts
+
+diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile
+index 28695e7c0cc3d..954d75de617ba 100644
+--- a/arch/arm64/boot/dts/qcom/Makefile
++++ b/arch/arm64/boot/dts/qcom/Makefile
+@@ -6,6 +6,7 @@ dtb-$(CONFIG_ARCH_QCOM) += msm8916-mtp.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8992-bullhead-rev-101.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8994-angler-rev-101.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8996-mtp.dtb
++dtb-$(CONFIG_ARCH_QCOM) += msm8998-asus-novago-tp370ql.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8998-hp-envy-x2.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8998-lenovo-miix-630.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8998-mtp.dtb
+diff --git a/arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts b/arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts
+new file mode 100644
+index 0000000000000..db5821be1e2fe
+--- /dev/null
++++ b/arch/arm64/boot/dts/qcom/msm8998-asus-novago-tp370ql.dts
+@@ -0,0 +1,47 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */
++
++/dts-v1/;
++
++#include "msm8998-clamshell.dtsi"
++
++/ {
++ model = "Asus NovaGo TP370QL";
++ compatible = "asus,novago-tp370ql", "qcom,msm8998";
++};
++
++&blsp1_i2c6 {
++ status = "okay";
++
++ touchpad@15 {
++ compatible = "hid-over-i2c";
++ interrupt-parent = <&tlmm>;
++ interrupts = <0x7b IRQ_TYPE_LEVEL_LOW>;
++ reg = <0x15>;
++ hid-descr-addr = <0x0001>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&touchpad>;
++ };
++
++ keyboard@3a {
++ compatible = "hid-over-i2c";
++ interrupt-parent = <&tlmm>;
++ interrupts = <0x25 IRQ_TYPE_LEVEL_LOW>;
++ reg = <0x3a>;
++ hid-descr-addr = <0x0001>;
++ };
++};
++
++&sdhc2 {
++ cd-gpios = <&tlmm 95 GPIO_ACTIVE_HIGH>;
++};
++
++&tlmm {
++ touchpad: touchpad {
++ config {
++ pins = "gpio123";
++ bias-pull-up;
++ };
++ };
++};
+--
+2.20.1
+
--- /dev/null
+From d4b56ef90fe67e72cedebdf3ac44c764c1a5ffe2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 07:57:21 -0700
+Subject: arm64: dts: qcom: Add HP Envy x2
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 3f527d311932791fde67ffec32536d22d5dd3030 ]
+
+This adds the initial DT for the HP Envy x2 laptop. Supported
+functionality includes USB (host), microSD-card, keyboard, and trackpad.
+
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/Makefile | 1 +
+ .../boot/dts/qcom/msm8998-hp-envy-x2.dts | 30 +++++++++++++++++++
+ 2 files changed, 31 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts
+
+diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile
+index c38ca859f2e02..28695e7c0cc3d 100644
+--- a/arch/arm64/boot/dts/qcom/Makefile
++++ b/arch/arm64/boot/dts/qcom/Makefile
+@@ -6,6 +6,7 @@ dtb-$(CONFIG_ARCH_QCOM) += msm8916-mtp.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8992-bullhead-rev-101.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8994-angler-rev-101.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8996-mtp.dtb
++dtb-$(CONFIG_ARCH_QCOM) += msm8998-hp-envy-x2.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8998-lenovo-miix-630.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8998-mtp.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r1.dtb
+diff --git a/arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts b/arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts
+new file mode 100644
+index 0000000000000..24073127091f6
+--- /dev/null
++++ b/arch/arm64/boot/dts/qcom/msm8998-hp-envy-x2.dts
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */
++
++/dts-v1/;
++
++#include "msm8998-clamshell.dtsi"
++
++/ {
++ model = "HP Envy x2";
++ compatible = "hp,envy-x2", "qcom,msm8998";
++};
++
++&blsp1_i2c6 {
++ status = "okay";
++
++ keyboard@3a {
++ compatible = "hid-over-i2c";
++ interrupt-parent = <&tlmm>;
++ interrupts = <0x79 IRQ_TYPE_LEVEL_LOW>;
++ reg = <0x3a>;
++ hid-descr-addr = <0x0001>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&touchpad>;
++ };
++};
++
++&sdhc2 {
++ cd-gpios = <&tlmm 95 GPIO_ACTIVE_LOW>;
++};
+--
+2.20.1
+
--- /dev/null
+From 01422f61f5c90132d668568a1fbd7185732afec6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 07:54:50 -0700
+Subject: arm64: dts: qcom: Add Lenovo Miix 630
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 2c6d2d3a580a852fe0a694e13af502a862293e0e ]
+
+This adds the initial DT for the Lenovo Miix 630 laptop. Supported
+functionality includes USB (host), microSD-card, keyboard, and trackpad.
+
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/Makefile | 1 +
+ .../boot/dts/qcom/msm8998-clamshell.dtsi | 240 ++++++++++++++++++
+ .../boot/dts/qcom/msm8998-lenovo-miix-630.dts | 30 +++
+ 3 files changed, 271 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi
+ create mode 100644 arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts
+
+diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile
+index 0a7e5dfce6f79..c38ca859f2e02 100644
+--- a/arch/arm64/boot/dts/qcom/Makefile
++++ b/arch/arm64/boot/dts/qcom/Makefile
+@@ -6,6 +6,7 @@ dtb-$(CONFIG_ARCH_QCOM) += msm8916-mtp.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8992-bullhead-rev-101.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8994-angler-rev-101.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8996-mtp.dtb
++dtb-$(CONFIG_ARCH_QCOM) += msm8998-lenovo-miix-630.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += msm8998-mtp.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r1.dtb
+ dtb-$(CONFIG_ARCH_QCOM) += sdm845-cheza-r2.dtb
+diff --git a/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi
+new file mode 100644
+index 0000000000000..9682d4dd7496e
+--- /dev/null
++++ b/arch/arm64/boot/dts/qcom/msm8998-clamshell.dtsi
+@@ -0,0 +1,240 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */
++
++/*
++ * Common include for MSM8998 clamshell devices, ie the Lenovo Miix 630,
++ * Asus NovaGo TP370QL, and HP Envy x2. All three devices are basically the
++ * same, with differences in peripherals.
++ */
++
++#include "msm8998.dtsi"
++#include "pm8998.dtsi"
++#include "pm8005.dtsi"
++
++/ {
++ chosen {
++ };
++
++ vph_pwr: vph-pwr-regulator {
++ compatible = "regulator-fixed";
++ regulator-name = "vph_pwr";
++ regulator-always-on;
++ regulator-boot-on;
++ };
++};
++
++&qusb2phy {
++ status = "okay";
++
++ vdda-pll-supply = <&vreg_l12a_1p8>;
++ vdda-phy-dpdm-supply = <&vreg_l24a_3p075>;
++};
++
++&rpm_requests {
++ pm8998-regulators {
++ compatible = "qcom,rpm-pm8998-regulators";
++
++ vdd_s1-supply = <&vph_pwr>;
++ vdd_s2-supply = <&vph_pwr>;
++ vdd_s3-supply = <&vph_pwr>;
++ vdd_s4-supply = <&vph_pwr>;
++ vdd_s5-supply = <&vph_pwr>;
++ vdd_s6-supply = <&vph_pwr>;
++ vdd_s7-supply = <&vph_pwr>;
++ vdd_s8-supply = <&vph_pwr>;
++ vdd_s9-supply = <&vph_pwr>;
++ vdd_s10-supply = <&vph_pwr>;
++ vdd_s11-supply = <&vph_pwr>;
++ vdd_s12-supply = <&vph_pwr>;
++ vdd_s13-supply = <&vph_pwr>;
++ vdd_l1_l27-supply = <&vreg_s7a_1p025>;
++ vdd_l2_l8_l17-supply = <&vreg_s3a_1p35>;
++ vdd_l3_l11-supply = <&vreg_s7a_1p025>;
++ vdd_l4_l5-supply = <&vreg_s7a_1p025>;
++ vdd_l6-supply = <&vreg_s5a_2p04>;
++ vdd_l7_l12_l14_l15-supply = <&vreg_s5a_2p04>;
++ vdd_l9-supply = <&vph_pwr>;
++ vdd_l10_l23_l25-supply = <&vph_pwr>;
++ vdd_l13_l19_l21-supply = <&vph_pwr>;
++ vdd_l16_l28-supply = <&vph_pwr>;
++ vdd_l18_l22-supply = <&vph_pwr>;
++ vdd_l20_l24-supply = <&vph_pwr>;
++ vdd_l26-supply = <&vreg_s3a_1p35>;
++ vdd_lvs1_lvs2-supply = <&vreg_s4a_1p8>;
++
++ vreg_s3a_1p35: s3 {
++ regulator-min-microvolt = <1352000>;
++ regulator-max-microvolt = <1352000>;
++ };
++ vreg_s4a_1p8: s4 {
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ regulator-allow-set-load;
++ };
++ vreg_s5a_2p04: s5 {
++ regulator-min-microvolt = <1904000>;
++ regulator-max-microvolt = <2040000>;
++ };
++ vreg_s7a_1p025: s7 {
++ regulator-min-microvolt = <900000>;
++ regulator-max-microvolt = <1028000>;
++ };
++ vreg_l1a_0p875: l1 {
++ regulator-min-microvolt = <880000>;
++ regulator-max-microvolt = <880000>;
++ regulator-allow-set-load;
++ };
++ vreg_l2a_1p2: l2 {
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <1200000>;
++ regulator-allow-set-load;
++ };
++ vreg_l3a_1p0: l3 {
++ regulator-min-microvolt = <1000000>;
++ regulator-max-microvolt = <1000000>;
++ };
++ vreg_l5a_0p8: l5 {
++ regulator-min-microvolt = <800000>;
++ regulator-max-microvolt = <800000>;
++ };
++ vreg_l6a_1p8: l6 {
++ regulator-min-microvolt = <1808000>;
++ regulator-max-microvolt = <1808000>;
++ };
++ vreg_l7a_1p8: l7 {
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ };
++ vreg_l8a_1p2: l8 {
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <1200000>;
++ };
++ vreg_l9a_1p8: l9 {
++ regulator-min-microvolt = <1808000>;
++ regulator-max-microvolt = <2960000>;
++ };
++ vreg_l10a_1p8: l10 {
++ regulator-min-microvolt = <1808000>;
++ regulator-max-microvolt = <2960000>;
++ };
++ vreg_l11a_1p0: l11 {
++ regulator-min-microvolt = <1000000>;
++ regulator-max-microvolt = <1000000>;
++ };
++ vreg_l12a_1p8: l12 {
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ };
++ vreg_l13a_2p95: l13 {
++ regulator-min-microvolt = <1808000>;
++ regulator-max-microvolt = <2960000>;
++ };
++ vreg_l14a_1p88: l14 {
++ regulator-min-microvolt = <1880000>;
++ regulator-max-microvolt = <1880000>;
++ };
++ vreg_15a_1p8: l15 {
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ };
++ vreg_l16a_2p7: l16 {
++ regulator-min-microvolt = <2704000>;
++ regulator-max-microvolt = <2704000>;
++ };
++ vreg_l17a_1p3: l17 {
++ regulator-min-microvolt = <1304000>;
++ regulator-max-microvolt = <1304000>;
++ };
++ vreg_l18a_2p7: l18 {
++ regulator-min-microvolt = <2704000>;
++ regulator-max-microvolt = <2704000>;
++ };
++ vreg_l19a_3p0: l19 {
++ regulator-min-microvolt = <3008000>;
++ regulator-max-microvolt = <3008000>;
++ };
++ vreg_l20a_2p95: l20 {
++ regulator-min-microvolt = <2960000>;
++ regulator-max-microvolt = <2960000>;
++ regulator-allow-set-load;
++ };
++ vreg_l21a_2p95: l21 {
++ regulator-min-microvolt = <2960000>;
++ regulator-max-microvolt = <2960000>;
++ regulator-allow-set-load;
++ regulator-system-load = <800000>;
++ };
++ vreg_l22a_2p85: l22 {
++ regulator-min-microvolt = <2864000>;
++ regulator-max-microvolt = <2864000>;
++ };
++ vreg_l23a_3p3: l23 {
++ regulator-min-microvolt = <3312000>;
++ regulator-max-microvolt = <3312000>;
++ };
++ vreg_l24a_3p075: l24 {
++ regulator-min-microvolt = <3088000>;
++ regulator-max-microvolt = <3088000>;
++ };
++ vreg_l25a_3p3: l25 {
++ regulator-min-microvolt = <3104000>;
++ regulator-max-microvolt = <3312000>;
++ };
++ vreg_l26a_1p2: l26 {
++ regulator-min-microvolt = <1200000>;
++ regulator-max-microvolt = <1200000>;
++ };
++ vreg_l28_3p0: l28 {
++ regulator-min-microvolt = <3008000>;
++ regulator-max-microvolt = <3008000>;
++ };
++
++ vreg_lvs1a_1p8: lvs1 {
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ };
++
++ vreg_lvs2a_1p8: lvs2 {
++ regulator-min-microvolt = <1800000>;
++ regulator-max-microvolt = <1800000>;
++ };
++
++ };
++};
++
++&tlmm {
++ gpio-reserved-ranges = <0 4>, <81 4>;
++
++ touchpad: touchpad {
++ config {
++ pins = "gpio123";
++ bias-pull-up; /* pull up */
++ };
++ };
++};
++
++&sdhc2 {
++ status = "okay";
++
++ vmmc-supply = <&vreg_l21a_2p95>;
++ vqmmc-supply = <&vreg_l13a_2p95>;
++
++ pinctrl-names = "default", "sleep";
++ pinctrl-0 = <&sdc2_clk_on &sdc2_cmd_on &sdc2_data_on &sdc2_cd_on>;
++ pinctrl-1 = <&sdc2_clk_off &sdc2_cmd_off &sdc2_data_off &sdc2_cd_off>;
++};
++
++&usb3 {
++ status = "okay";
++};
++
++&usb3_dwc3 {
++ dr_mode = "host"; /* Force to host until we have Type-C hooked up */
++};
++
++&usb3phy {
++ status = "okay";
++
++ vdda-phy-supply = <&vreg_l1a_0p875>;
++ vdda-pll-supply = <&vreg_l2a_1p2>;
++};
+diff --git a/arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts b/arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts
+new file mode 100644
+index 0000000000000..407c6a32911cc
+--- /dev/null
++++ b/arch/arm64/boot/dts/qcom/msm8998-lenovo-miix-630.dts
+@@ -0,0 +1,30 @@
++// SPDX-License-Identifier: GPL-2.0
++/* Copyright (c) 2019, Jeffrey Hugo. All rights reserved. */
++
++/dts-v1/;
++
++#include "msm8998-clamshell.dtsi"
++
++/ {
++ model = "Lenovo Miix 630";
++ compatible = "lenovo,miix-630", "qcom,msm8998";
++};
++
++&blsp1_i2c6 {
++ status = "okay";
++
++ keyboard@3a {
++ compatible = "hid-over-i2c";
++ interrupt-parent = <&tlmm>;
++ interrupts = <0x79 IRQ_TYPE_LEVEL_LOW>;
++ reg = <0x3a>;
++ hid-descr-addr = <0x0001>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&touchpad>;
++ };
++};
++
++&sdhc2 {
++ cd-gpios = <&tlmm 95 GPIO_ACTIVE_HIGH>;
++};
+--
+2.20.1
+
--- /dev/null
+From 2a3d9cce7fae80a89d53aaa91a48e1877222a619 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 3 Aug 2019 20:29:04 -0400
+Subject: ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
+
+From: Hui Peng <benquike@gmail.com>
+
+[ Upstream commit 39d170b3cb62ba98567f5c4f40c27b5864b304e5 ]
+
+The `ar_usb` field of `ath6kl_usb_pipe_usb_pipe` objects
+are initialized to point to the containing `ath6kl_usb` object
+according to endpoint descriptors read from the device side, as shown
+below in `ath6kl_usb_setup_pipe_resources`:
+
+for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ endpoint = &iface_desc->endpoint[i].desc;
+
+ // get the address from endpoint descriptor
+ pipe_num = ath6kl_usb_get_logical_pipe_num(ar_usb,
+ endpoint->bEndpointAddress,
+ &urbcount);
+ ......
+ // select the pipe object
+ pipe = &ar_usb->pipes[pipe_num];
+
+ // initialize the ar_usb field
+ pipe->ar_usb = ar_usb;
+}
+
+The driver assumes that the addresses reported in endpoint
+descriptors from device side to be complete. If a device is
+malicious and does not report complete addresses, it may trigger
+NULL-ptr-deref `ath6kl_usb_alloc_urb_from_pipe` and
+`ath6kl_usb_free_urb_to_pipe`.
+
+This patch fixes the bug by preventing potential NULL-ptr-deref
+(CVE-2019-15098).
+
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/usb.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
+index 4defb7a0330f4..53b66e9434c99 100644
+--- a/drivers/net/wireless/ath/ath6kl/usb.c
++++ b/drivers/net/wireless/ath/ath6kl/usb.c
+@@ -132,6 +132,10 @@ ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe)
+ struct ath6kl_urb_context *urb_context = NULL;
+ unsigned long flags;
+
++ /* bail if this pipe is not initialized */
++ if (!pipe->ar_usb)
++ return NULL;
++
+ spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+ if (!list_empty(&pipe->urb_list_head)) {
+ urb_context =
+@@ -150,6 +154,10 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe,
+ {
+ unsigned long flags;
+
++ /* bail if this pipe is not initialized */
++ if (!pipe->ar_usb)
++ return;
++
+ spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags);
+ pipe->urb_cnt++;
+
+--
+2.20.1
+
--- /dev/null
+From ef6c8326c7e16a380ba3a3ed553f76865b01eb18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jul 2019 22:04:22 -0700
+Subject: rtw88: Fix misuse of GENMASK macro
+
+From: Joe Perches <joe@perches.com>
+
+[ Upstream commit 5ff29d836d1beb347080bd96e6321c811a8e3f62 ]
+
+Arguments are supposed to be ordered high then low.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Acked-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822b.c b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+index 1172f6c0605b3..d61d534396c73 100644
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -997,7 +997,7 @@ static void rtw8822b_do_iqk(struct rtw_dev *rtwdev)
+ rtw_write_rf(rtwdev, RF_PATH_A, RF_DTXLOK, RFREG_MASK, 0x0);
+
+ reload = !!rtw_read32_mask(rtwdev, REG_IQKFAILMSK, BIT(16));
+- iqk_fail_mask = rtw_read32_mask(rtwdev, REG_IQKFAILMSK, GENMASK(0, 7));
++ iqk_fail_mask = rtw_read32_mask(rtwdev, REG_IQKFAILMSK, GENMASK(7, 0));
+ rtw_dbg(rtwdev, RTW_DBG_PHY,
+ "iqk counter=%d reload=%d do_iqk_cnt=%d n_iqk_fail(mask)=0x%02x\n",
+ counter, reload, ++do_iqk_cnt, iqk_fail_mask);
+--
+2.20.1
+
--- /dev/null
+From 6f81da225f550a86937118dcf91468727f3d48b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 15:45:04 +0200
+Subject: s390/pci: fix MSI message data
+
+From: Sebastian Ott <sebott@linux.ibm.com>
+
+[ Upstream commit cf2c4a3f35b75d38cebb4afbd578f1594f068d1e ]
+
+After recent changes the MSI message data needs to specify the
+function-relative IRQ number.
+
+Reported-and-tested-by: Alexander Schmidt <alexs@linux.ibm.com>
+Signed-off-by: Sebastian Ott <sebott@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_irq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/pci/pci_irq.c b/arch/s390/pci/pci_irq.c
+index d80616ae8dd8a..fbe97ab2e2286 100644
+--- a/arch/s390/pci/pci_irq.c
++++ b/arch/s390/pci/pci_irq.c
+@@ -284,7 +284,7 @@ int arch_setup_msi_irqs(struct pci_dev *pdev, int nvec, int type)
+ return rc;
+ irq_set_chip_and_handler(irq, &zpci_irq_chip,
+ handle_percpu_irq);
+- msg.data = hwirq;
++ msg.data = hwirq - bit;
+ if (irq_delivery == DIRECTED) {
+ msg.address_lo = zdev->msi_addr & 0xff0000ff;
+ msg.address_lo |= msi->affinity ?
+--
+2.20.1
+
perf-aux-fix-tracking-of-auxiliary-trace-buffer-allo.patch
usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch
nbd-verify-socket-is-supported-during-setup.patch
+arm64-dts-qcom-add-lenovo-miix-630.patch
+arm64-dts-qcom-add-hp-envy-x2.patch
+arm64-dts-qcom-add-asus-novago-tp370ql.patch
+rtw88-fix-misuse-of-genmask-macro.patch
+s390-pci-fix-msi-message-data.patch
+thunderbolt-correct-path-indices-for-pcie-tunnel.patch
+thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch
+ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch
--- /dev/null
+From 593771bcdb10dcfe60d99bc3e440666d9d4c3823 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 19:31:26 +0300
+Subject: thunderbolt: Correct path indices for PCIe tunnel
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit ce19f91eae43e39d5a1da55344756ab5a3c7e8d1 ]
+
+PCIe tunnel path indices got mixed up when we added support for tunnels
+between switches that are not adjacent. This did not affect the
+functionality as it is just an index but fix it now nevertheless to make
+the code easier to understand.
+
+Reported-by: Rajmohan Mani <rajmohan.mani@intel.com>
+Fixes: 8c7acaaf020f ("thunderbolt: Extend tunnel creation to more than 2 adjacent switches")
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Yehezkel Bernat <YehezkelShB@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/tunnel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thunderbolt/tunnel.c b/drivers/thunderbolt/tunnel.c
+index 31d0234837e45..5a99234826e73 100644
+--- a/drivers/thunderbolt/tunnel.c
++++ b/drivers/thunderbolt/tunnel.c
+@@ -211,7 +211,7 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up,
+ return NULL;
+ }
+ tb_pci_init_path(path);
+- tunnel->paths[TB_PCI_PATH_UP] = path;
++ tunnel->paths[TB_PCI_PATH_DOWN] = path;
+
+ path = tb_path_alloc(tb, up, TB_PCI_HOPID, down, TB_PCI_HOPID, 0,
+ "PCIe Up");
+@@ -220,7 +220,7 @@ struct tb_tunnel *tb_tunnel_alloc_pci(struct tb *tb, struct tb_port *up,
+ return NULL;
+ }
+ tb_pci_init_path(path);
+- tunnel->paths[TB_PCI_PATH_DOWN] = path;
++ tunnel->paths[TB_PCI_PATH_UP] = path;
+
+ return tunnel;
+ }
+--
+2.20.1
+
--- /dev/null
+From e0dd6709b01e8fc405617023c251d2fd81b974e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 08:46:07 +0300
+Subject: thunderbolt: Use 32-bit writes when writing ring producer/consumer
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 943795219d3cb9f8ce6ce51cad3ffe1f61e95c6b ]
+
+The register access should be using 32-bit reads/writes according to the
+datasheet. With the previous generation hardware 16-bit writes have been
+working but starting with ICL this is not the case anymore so fix
+producer/consumer register update to use correct width register address.
+
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Yehezkel Bernat <YehezkelShB@gmail.com>
+Tested-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/nhi.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
+index 27fbe62c7ddd4..9c782706e652f 100644
+--- a/drivers/thunderbolt/nhi.c
++++ b/drivers/thunderbolt/nhi.c
+@@ -143,9 +143,20 @@ static void __iomem *ring_options_base(struct tb_ring *ring)
+ return io;
+ }
+
+-static void ring_iowrite16desc(struct tb_ring *ring, u32 value, u32 offset)
++static void ring_iowrite_cons(struct tb_ring *ring, u16 cons)
+ {
+- iowrite16(value, ring_desc_base(ring) + offset);
++ /*
++ * The other 16-bits in the register is read-only and writes to it
++ * are ignored by the hardware so we can save one ioread32() by
++ * filling the read-only bits with zeroes.
++ */
++ iowrite32(cons, ring_desc_base(ring) + 8);
++}
++
++static void ring_iowrite_prod(struct tb_ring *ring, u16 prod)
++{
++ /* See ring_iowrite_cons() above for explanation */
++ iowrite32(prod << 16, ring_desc_base(ring) + 8);
+ }
+
+ static void ring_iowrite32desc(struct tb_ring *ring, u32 value, u32 offset)
+@@ -197,7 +208,10 @@ static void ring_write_descriptors(struct tb_ring *ring)
+ descriptor->sof = frame->sof;
+ }
+ ring->head = (ring->head + 1) % ring->size;
+- ring_iowrite16desc(ring, ring->head, ring->is_tx ? 10 : 8);
++ if (ring->is_tx)
++ ring_iowrite_prod(ring, ring->head);
++ else
++ ring_iowrite_cons(ring, ring->head);
+ }
+ }
+
+@@ -662,7 +676,7 @@ void tb_ring_stop(struct tb_ring *ring)
+
+ ring_iowrite32options(ring, 0, 0);
+ ring_iowrite64desc(ring, 0, 0);
+- ring_iowrite16desc(ring, 0, ring->is_tx ? 10 : 8);
++ ring_iowrite32desc(ring, 0, 8);
+ ring_iowrite32desc(ring, 0, 12);
+ ring->head = 0;
+ ring->tail = 0;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
