--- /dev/null
+From 82126e60dbe7b109d58d8844c09740f64a82d3f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:37 +0000
+Subject: ACPI / APEI: Don't wait to serialise with oops messages when
+ panic()ing
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 78b0b690f6558ed788dccafa45965325dd11ba89 ]
+
+oops_begin() exists to group printk() messages with the oops message
+printed by die(). To reach this caller we know that platform firmware
+took this error first, then notified the OS via NMI with a 'panic'
+severity.
+
+Don't wait for another CPU to release the die-lock before panic()ing,
+our only goal is to print this fatal error and panic().
+
+This code is always called in_nmi(), and since commit 42a0bb3f7138
+("printk/nmi: generic solution for safe printk in NMI"), it has been
+safe to call printk() from this context. Messages are batched in a
+per-cpu buffer and printed via irq-work, or a call back from panic().
+
+Link: https://patchwork.kernel.org/patch/10313555/
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 5889f6407fea8..9c31c7cd5cb5e 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -33,7 +33,6 @@
+ #include <linux/interrupt.h>
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+-#include <linux/kdebug.h>
+ #include <linux/platform_device.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+@@ -936,7 +935,6 @@ static int ghes_notify_nmi(unsigned int cmd, struct pt_regs *regs)
+
+ sev = ghes_severity(ghes->estatus->error_severity);
+ if (sev >= GHES_SEV_PANIC) {
+- oops_begin();
+ ghes_print_queued_estatus();
+ __ghes_panic(ghes);
+ }
+--
+2.20.1
+
--- /dev/null
+From 805f7a4412b9fc757e9694b228159f8c01cc85e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:39 +0000
+Subject: ACPI / APEI: Switch estatus pool to use vmalloc memory
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 0ac234be1a9497498e57d958f4251f5257b116b4 ]
+
+The ghes code is careful to parse and round firmware's advertised
+memory requirements for CPER records, up to a maximum of 64K.
+However when ghes_estatus_pool_expand() does its work, it splits
+the requested size into PAGE_SIZE granules.
+
+This means if firmware generates 5K of CPER records, and correctly
+describes this in the table, __process_error() will silently fail as it
+is unable to allocate more than PAGE_SIZE.
+
+Switch the estatus pool to vmalloc() memory. On x86 vmalloc() memory
+may fault and be fixed up by vmalloc_fault(). To prevent this call
+vmalloc_sync_all() before an NMI handler could discover the memory.
+
+Signed-off-by: James Morse <james.morse@arm.com>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 9c31c7cd5cb5e..cd6fae6ad4c2a 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -170,40 +170,40 @@ static int ghes_estatus_pool_init(void)
+ return 0;
+ }
+
+-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool,
++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool,
+ struct gen_pool_chunk *chunk,
+ void *data)
+ {
+- free_page(chunk->start_addr);
++ vfree((void *)chunk->start_addr);
+ }
+
+ static void ghes_estatus_pool_exit(void)
+ {
+ gen_pool_for_each_chunk(ghes_estatus_pool,
+- ghes_estatus_pool_free_chunk_page, NULL);
++ ghes_estatus_pool_free_chunk, NULL);
+ gen_pool_destroy(ghes_estatus_pool);
+ }
+
+ static int ghes_estatus_pool_expand(unsigned long len)
+ {
+- unsigned long i, pages, size, addr;
+- int ret;
++ unsigned long size, addr;
+
+ ghes_estatus_pool_size_request += PAGE_ALIGN(len);
+ size = gen_pool_size(ghes_estatus_pool);
+ if (size >= ghes_estatus_pool_size_request)
+ return 0;
+- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE;
+- for (i = 0; i < pages; i++) {
+- addr = __get_free_page(GFP_KERNEL);
+- if (!addr)
+- return -ENOMEM;
+- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1);
+- if (ret)
+- return ret;
+- }
+
+- return 0;
++ addr = (unsigned long)vmalloc(PAGE_ALIGN(len));
++ if (!addr)
++ return -ENOMEM;
++
++ /*
++ * New allocation must be visible in all pgd before it can be found by
++ * an NMI allocating from the pool.
++ */
++ vmalloc_sync_all();
++
++ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ }
+
+ static int map_gen_v2(struct ghes *ghes)
+--
+2.20.1
+
--- /dev/null
+From fdefbc672139f51cf5e1793012940d0bd3f52cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Dec 2018 13:59:24 +0100
+Subject: ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1a2fa02f7489dc4d746f2a15fb77b3ce1affade8 ]
+
+Ignore acpi_device_fix_up_power() return value. If we return an error
+we end up with acpi_default_enumeration() still creating a platform-
+device for the device and we end up with the device still being used
+but without the special LPSS related handling which is not useful.
+
+Specicifically ignoring the error fixes the touchscreen no longer
+working after a suspend/resume on a Prowise PT301 tablet.
+
+This tablet has a broken _PS0 method on the touchscreen's I2C controller,
+causing acpi_device_fix_up_power() to fail, causing fallback to standard
+platform-dev handling and specifically causing acpi_lpss_save/restore_ctx
+to not run.
+
+The I2C controllers _PS0 method does actually turn on the device, but then
+does some more nonsense which fails when run during early boot trying to
+use I2C opregion handling on another not-yet registered I2C controller.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index 1ab8d7223b252..84b1d30f699cf 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -518,12 +518,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ * have _PS0 and _PS3 without _PSC (and no power resources), so
+ * acpi_bus_init_power() will assume that the BIOS has put them into D0.
+ */
+- ret = acpi_device_fix_up_power(adev);
+- if (ret) {
+- /* Skip the device, but continue the namespace scan. */
+- ret = 0;
+- goto err_out;
+- }
++ acpi_device_fix_up_power(adev);
+
+ adev->driver_data = pdata;
+ pdev = acpi_create_platform_device(adev, dev_desc->properties);
+--
+2.20.1
+
--- /dev/null
+From b93a297f8f8facb012d5483461c07a521fbaaeb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Feb 2019 10:21:23 +0000
+Subject: apparmor: delete the dentry in aafs_remove() to avoid a leak
+
+From: Chris Coulson <chris.coulson@canonical.com>
+
+[ Upstream commit 201218e4d3dfa1346e30997f48725acce3f26d01 ]
+
+Although the apparmorfs dentries are always dropped from the dentry cache
+when the usage count drops to zero, there is no guarantee that this will
+happen in aafs_remove(), as another thread might still be using it. In
+this scenario, this means that the dentry will temporarily continue to
+appear in the results of lookups, even after the call to aafs_remove().
+
+In the case of removal of a profile - it also causes simple_rmdir()
+on the profile directory to fail, as the directory won't be empty until
+the usage counts of all child dentries have decreased to zero. This
+results in the dentry for the profile directory leaking and appearing
+empty in the file system tree forever.
+
+Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/apparmorfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index dd746bd69a9b2..c106988c1b254 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -363,6 +363,7 @@ static void aafs_remove(struct dentry *dentry)
+ simple_rmdir(dir, dentry);
+ else
+ simple_unlink(dir, dentry);
++ d_delete(dentry);
+ dput(dentry);
+ }
+ inode_unlock(dir);
+--
+2.20.1
+
--- /dev/null
+From bf92ffc9e6ca7eeabd4e9305aa771f6f7c5dd5b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:04:16 +0100
+Subject: ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 7c41ea57beb2aee96fa63091a457b1a2826f3c42 ]
+
+If debugging on i.MX is enabled DEBUG_IMX_UART_PORT defines which UART
+is used for the debug output. If however debugging is off don't only
+hide the then unused config item but drop it completely by using a
+dependency instead of a conditional prompt.
+
+This fixes DEBUG_IMX_UART_PORT being present in the kernel config even
+if DEBUG_LL is disabled.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig.debug | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index 954ba8b810521..fd4b679945d3a 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1376,21 +1376,21 @@ config DEBUG_OMAP2PLUS_UART
+ depends on ARCH_OMAP2PLUS
+
+ config DEBUG_IMX_UART_PORT
+- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \
+- DEBUG_IMX25_UART || \
+- DEBUG_IMX21_IMX27_UART || \
+- DEBUG_IMX31_UART || \
+- DEBUG_IMX35_UART || \
+- DEBUG_IMX50_UART || \
+- DEBUG_IMX51_UART || \
+- DEBUG_IMX53_UART || \
+- DEBUG_IMX6Q_UART || \
+- DEBUG_IMX6SL_UART || \
+- DEBUG_IMX6SX_UART || \
+- DEBUG_IMX6UL_UART || \
+- DEBUG_IMX7D_UART
++ int "i.MX Debug UART Port Selection"
++ depends on DEBUG_IMX1_UART || \
++ DEBUG_IMX25_UART || \
++ DEBUG_IMX21_IMX27_UART || \
++ DEBUG_IMX31_UART || \
++ DEBUG_IMX35_UART || \
++ DEBUG_IMX50_UART || \
++ DEBUG_IMX51_UART || \
++ DEBUG_IMX53_UART || \
++ DEBUG_IMX6Q_UART || \
++ DEBUG_IMX6SL_UART || \
++ DEBUG_IMX6SX_UART || \
++ DEBUG_IMX6UL_UART || \
++ DEBUG_IMX7D_UART
+ default 1
+- depends on ARCH_MXC
+ help
+ Choose UART port on which kernel low-level debug messages
+ should be output.
+--
+2.20.1
+
--- /dev/null
+From 55f80080dc2729bba711aa64f34f282cee5b49bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 09:00:51 +0200
+Subject: ARM: dts: Fix up SQ201 flash access
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit d88b11ef91b15d0af9c0676cbf4f441a0dff0c56 ]
+
+This sets the partition information on the SQ201 to be read
+out from the RedBoot partition table, removes the static
+partition table and sets our boot options to mount root from
+/dev/mtdblock2 where the squashfs+JFFS2 resides.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/gemini-sq201.dts | 37 ++++--------------------------
+ 1 file changed, 5 insertions(+), 32 deletions(-)
+
+diff --git a/arch/arm/boot/dts/gemini-sq201.dts b/arch/arm/boot/dts/gemini-sq201.dts
+index 63c02ca9513c4..e9e2f6ff0c583 100644
+--- a/arch/arm/boot/dts/gemini-sq201.dts
++++ b/arch/arm/boot/dts/gemini-sq201.dts
+@@ -20,7 +20,7 @@
+ };
+
+ chosen {
+- bootargs = "console=ttyS0,115200n8";
++ bootargs = "console=ttyS0,115200n8 root=/dev/mtdblock2 rw rootfstype=squashfs,jffs2 rootwait";
+ stdout-path = &uart0;
+ };
+
+@@ -71,37 +71,10 @@
+ /* 16MB of flash */
+ reg = <0x30000000 0x01000000>;
+
+- partition@0 {
+- label = "RedBoot";
+- reg = <0x00000000 0x00120000>;
+- read-only;
+- };
+- partition@120000 {
+- label = "Kernel";
+- reg = <0x00120000 0x00200000>;
+- };
+- partition@320000 {
+- label = "Ramdisk";
+- reg = <0x00320000 0x00600000>;
+- };
+- partition@920000 {
+- label = "Application";
+- reg = <0x00920000 0x00600000>;
+- };
+- partition@f20000 {
+- label = "VCTL";
+- reg = <0x00f20000 0x00020000>;
+- read-only;
+- };
+- partition@f40000 {
+- label = "CurConf";
+- reg = <0x00f40000 0x000a0000>;
+- read-only;
+- };
+- partition@fe0000 {
+- label = "FIS directory";
+- reg = <0x00fe0000 0x00020000>;
+- read-only;
++ partitions {
++ compatible = "redboot-fis";
++ /* Eraseblock at 0xfe0000 */
++ fis-index-block = <0x1fc>;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 17eedb80dad717784060a51f66a037584dc12d11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 16:10:01 -0200
+Subject: ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 998a84c27a7f3f9133d32af64e19c05cec161a1a ]
+
+imx53-voipac-dmm-668 has two memory nodes, but the correct representation
+would be to use a single one with two reg entries - one for each RAM chip
+select, so fix it accordingly.
+
+Reported-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+index df8dafe2564dd..2297ed90ee895 100644
+--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+@@ -17,12 +17,8 @@
+
+ memory@70000000 {
+ device_type = "memory";
+- reg = <0x70000000 0x20000000>;
+- };
+-
+- memory@b0000000 {
+- device_type = "memory";
+- reg = <0xb0000000 0x20000000>;
++ reg = <0x70000000 0x20000000>,
++ <0xb0000000 0x20000000>;
+ };
+
+ regulators {
+--
+2.20.1
+
--- /dev/null
+From 6b159afcd5574310742a0ee6a259e3f18db5ba72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 22:58:38 +0100
+Subject: ARM: ks8695: fix section mismatch warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4aa64677330beeeed721b4b122884dabad845d66 ]
+
+WARNING: vmlinux.o(.text+0x13250): Section mismatch in reference from the function acs5k_i2c_init() to the (unknown reference) .init.data:(unknown)
+The function acs5k_i2c_init() references
+the (unknown reference) __initdata (unknown).
+This is often because acs5k_i2c_init lacks a __initdata
+annotation or the annotation of (unknown) is wrong.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ks8695/board-acs5k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c
+index e4d709c8ed32f..76d3083f1f634 100644
+--- a/arch/arm/mach-ks8695/board-acs5k.c
++++ b/arch/arm/mach-ks8695/board-acs5k.c
+@@ -92,7 +92,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = {
+ },
+ };
+
+-static void acs5k_i2c_init(void)
++static void __init acs5k_i2c_init(void)
+ {
+ /* The gpio interface */
+ platform_device_register(&acs5k_i2c_device);
+--
+2.20.1
+
--- /dev/null
+From 9d512d5064b9bac4d613a4383db7c4e6144d0a2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 19:57:42 +0200
+Subject: ARM: OMAP1: fix USB configuration for device-only setups
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit c7b7b5cbd0c859b1546a5a3455d457708bdadf4c ]
+
+Currently we do USB configuration only if the host mode (CONFIG_USB)
+is enabled. But it should be done also in the case of device-only setups,
+so change the condition to CONFIG_USB_SUPPORT. This allows to use
+omap_udc on Palm Tungsten E.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/Makefile | 2 +-
+ arch/arm/mach-omap1/include/mach/usb.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile
+index e8ccf51c6f292..ec0235899de20 100644
+--- a/arch/arm/mach-omap1/Makefile
++++ b/arch/arm/mach-omap1/Makefile
+@@ -25,7 +25,7 @@ obj-y += $(i2c-omap-m) $(i2c-omap-y)
+
+ led-y := leds.o
+
+-usb-fs-$(CONFIG_USB) := usb.o
++usb-fs-$(CONFIG_USB_SUPPORT) := usb.o
+ obj-y += $(usb-fs-m) $(usb-fs-y)
+
+ # Specific board support
+diff --git a/arch/arm/mach-omap1/include/mach/usb.h b/arch/arm/mach-omap1/include/mach/usb.h
+index 77867778d4ec7..5429d86c7190d 100644
+--- a/arch/arm/mach-omap1/include/mach/usb.h
++++ b/arch/arm/mach-omap1/include/mach/usb.h
+@@ -11,7 +11,7 @@
+
+ #include <linux/platform_data/usb-omap1.h>
+
+-#if IS_ENABLED(CONFIG_USB)
++#if IS_ENABLED(CONFIG_USB_SUPPORT)
+ void omap1_usb_init(struct omap_usb_config *pdata);
+ #else
+ static inline void omap1_usb_init(struct omap_usb_config *pdata)
+--
+2.20.1
+
--- /dev/null
+From 0fe8222bd59729d46bc3122266be0caa04fcdfc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 22:50:40 +0000
+Subject: arm64: mm: Prevent mismatched 52-bit VA support
+
+From: Steve Capper <steve.capper@arm.com>
+
+[ Upstream commit a96a33b1ca57dbea4285893dedf290aeb8eb090b ]
+
+For cases where there is a mismatch in ARMv8.2-LVA support between CPUs
+we have to be careful in allowing secondary CPUs to boot if 52-bit
+virtual addresses have already been enabled on the boot CPU.
+
+This patch adds code to the secondary startup path. If the boot CPU has
+enabled 52-bit VAs then ID_AA64MMFR2_EL1 is checked to see if the
+secondary can also enable 52-bit support. If not, the secondary is
+prevented from booting and an error message is displayed indicating why.
+
+Technically this patch could be implemented using the cpufeature code
+when considering 52-bit userspace support. However, we employ low level
+checks here as the cpufeature code won't be able to run if we have
+mismatched 52-bit kernel va support.
+
+Signed-off-by: Steve Capper <steve.capper@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/head.S | 26 ++++++++++++++++++++++++++
+ arch/arm64/kernel/smp.c | 5 +++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 92cc7b51f1002..9c00fd2acc2a4 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -594,6 +594,7 @@ secondary_startup:
+ /*
+ * Common entry point for secondary CPUs.
+ */
++ bl __cpu_secondary_check52bitva
+ bl __cpu_setup // initialise processor
+ bl __enable_mmu
+ ldr x8, =__secondary_switched
+@@ -668,6 +669,31 @@ ENTRY(__enable_mmu)
+ ret
+ ENDPROC(__enable_mmu)
+
++ENTRY(__cpu_secondary_check52bitva)
++#ifdef CONFIG_ARM64_52BIT_VA
++ ldr_l x0, vabits_user
++ cmp x0, #52
++ b.ne 2f
++
++ mrs_s x0, SYS_ID_AA64MMFR2_EL1
++ and x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT)
++ cbnz x0, 2f
++
++ adr_l x0, va52mismatch
++ mov w1, #1
++ strb w1, [x0]
++ dmb sy
++ dc ivac, x0 // Invalidate potentially stale cache line
++
++ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1
++1: wfe
++ wfi
++ b 1b
++
++#endif
++2: ret
++ENDPROC(__cpu_secondary_check52bitva)
++
+ __no_granule_support:
+ /* Indicate that this CPU can't boot and is stuck in the kernel */
+ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index a683cd4995157..0881dfab10f8f 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -106,6 +106,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle)
+ }
+
+ static DECLARE_COMPLETION(cpu_running);
++bool va52mismatch __ro_after_init;
+
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+@@ -135,6 +136,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+
+ if (!cpu_online(cpu)) {
+ pr_crit("CPU%u: failed to come online\n", cpu);
++
++ if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch)
++ pr_crit("CPU%u: does not support 52-bit VAs\n", cpu);
++
+ ret = -EIO;
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 9c749f7cf8eb255be0d259acc7c15c83e6404351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 18:07:33 +0000
+Subject: arm64: smp: Handle errors reported by the firmware
+
+From: Suzuki K Poulose <Suzuki.Poulose@arm.com>
+
+[ Upstream commit f357b3a7e17af7736d67d8267edc1ed3d1dd9391 ]
+
+The __cpu_up() routine ignores the errors reported by the firmware
+for a CPU bringup operation and looks for the error status set by the
+booting CPU. If the CPU never entered the kernel, we could end up
+in assuming stale error status, which otherwise would have been
+set/cleared appropriately by the booting CPU.
+
+Reported-by: Steve Capper <steve.capper@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/smp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 0881dfab10f8f..909bf3926fd23 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -144,6 +144,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ }
+ } else {
+ pr_err("CPU%u: failed to boot: %d\n", cpu, ret);
++ return ret;
+ }
+
+ secondary_data.task = NULL;
+--
+2.20.1
+
--- /dev/null
+From 38a07a11b977c8c5325c9faca4a0c5ced2678a42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 10:54:32 +0100
+Subject: ASoC: compress: fix unsigned integer overflow check
+
+From: Xiaojun Sang <xsang@codeaurora.org>
+
+[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ]
+
+Parameter fragments and fragment_size are type of u32. U32_MAX is
+the correct check.
+
+Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/compress_offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 2e2d184684911..7ae8e24dc1e61 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
+ params->buffer.fragments == 0)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 946112e2b3f9aabaf1016f4a0f7b8d34a6275cb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:44 +0100
+Subject: ASoC: kirkwood: fix external clock probe defer
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ]
+
+When our call to get the external clock fails, we forget to clean up
+the enabled internal clock correctly. Enable the clock after we have
+obtained all our resources.
+
+Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index 105a73cc51585..149b7cba10fb7 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -569,10 +569,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->clk);
+ }
+
+- err = clk_prepare_enable(priv->clk);
+- if (err < 0)
+- return err;
+-
+ priv->extclk = devm_clk_get(&pdev->dev, "extclk");
+ if (IS_ERR(priv->extclk)) {
+ if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
+@@ -588,6 +584,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ }
+ }
+
++ err = clk_prepare_enable(priv->clk);
++ if (err < 0)
++ return err;
++
+ /* Some sensible defaults - this reflects the powerup values */
+ priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
+ priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
+--
+2.20.1
+
--- /dev/null
+From f65f4bfe40d6c152f42ffebf8b9becf087821484 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Oct 2019 17:30:06 +0200
+Subject: ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 9110d1b0e229cebb1ffce0c04db2b22beffd513d ]
+
+According to the PM8916 Hardware Register Description,
+CDC_D_CDC_CONN_HPHR_DAC_CTL has only a single bit (RX_SEL)
+to switch between RX1 (0) and RX2 (1). It is not possible to
+disable it entirely to achieve the "ZERO" state.
+
+However, at the moment the "RDAC2 MUX" mixer defines three possible
+values ("ZERO", "RX2" and "RX1"). Setting the mixer to "ZERO"
+actually configures it to RX1. Setting the mixer to "RX1" has
+(seemingly) no effect.
+
+Remove "ZERO" and replace it with "RX1" to fix this.
+
+Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20191020153007.206070-1-stephan@gerhold.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index 0b9b014b4bb6c..969283737787f 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -303,7 +303,7 @@ struct pm8916_wcd_analog_priv {
+ };
+
+ static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
+-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" };
++static const char *const rdac2_mux_text[] = { "RX1", "RX2" };
+ static const char *const hph_text[] = { "ZERO", "Switch", };
+
+ static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT(
+@@ -318,7 +318,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT(
+
+ /* RDAC2 MUX */
+ static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE(
+- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text);
++ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text);
+
+ static const struct snd_kcontrol_new spkr_switch[] = {
+ SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0)
+--
+2.20.1
+
--- /dev/null
+From aa612ac7317ebec6e67374d9877fc3f45c67f824 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:13 +0200
+Subject: ath6kl: Fix off by one error in scan completion
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit 5803c12816c43bd09e5f4247dd9313c2d9a2c41b ]
+
+When ath6kl was reworked to share code between regular and scheduled scans
+in commit 3b8ffc6a22ba ("ath6kl: Configure probed SSID list consistently"),
+probed SSID entry changed from 1-index to 0-indexed. However,
+ath6kl_cfg80211_scan_complete_event() was missed in that change. Fix its
+indexing so that we correctly clear out the probed SSID list.
+
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index f790d8021fa17..37deb9bae3643 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -1093,7 +1093,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted)
+ if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) {
+ for (i = 0; i < vif->scan_req->n_ssids; i++) {
+ ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx,
+- i + 1, DISABLE_SSID_FLAG,
++ i, DISABLE_SSID_FLAG,
+ 0, NULL);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 12c07ce28bf9d5caeb68d6229249cf408c5eeea4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:11 +0200
+Subject: ath6kl: Only use match sets when firmware supports it
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit fb376a495fbdb886f38cfaf5a3805401b9e46f13 ]
+
+Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+merged the probed and matched SSID lists before sending them to the
+firmware. In the process, it assumed match set support is always available
+in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check
+that the firmware supports matching SSIDs in scheduled scans before setting
+MATCH_SSID_FLAG.
+
+Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index 414b5b596efcd..f790d8021fa17 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
+ else
+ ssid_list[i].flag = ANY_SSID_FLAG;
+
+- if (n_match_ssid == 0)
++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
+ ssid_list[i].flag |= MATCH_SSID_FLAG;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From dbe78740d7c4049723a9dcf67784f6f9bd2ce450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:23:19 -0600
+Subject: atl1e: checking the status of atl1e_write_phy_reg
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit ff07d48d7bc0974d4f96a85a4df14564fb09f1ef ]
+
+atl1e_write_phy_reg() could fail. The fix issues an error message when
+it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 4f7e195af0bc6..0d08039981b54 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -472,7 +472,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id,
+ {
+ struct atl1e_adapter *adapter = netdev_priv(netdev);
+
+- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val);
++ if (atl1e_write_phy_reg(&adapter->hw,
++ reg_num & MDIO_REG_ADDR_MASK, val))
++ netdev_err(netdev, "write phy register failed\n");
+ }
+
+ static int atl1e_mii_ioctl(struct net_device *netdev,
+--
+2.20.1
+
--- /dev/null
+From 223f696268e24c742343dc513f15a467bcfa9d17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 11:55:39 +0100
+Subject: blktrace: Show requests without sector
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 0803de78049fe1b0baf44bcddc727b036fb9139b ]
+
+Currently, blktrace will not show requests that don't have any data as
+rq->__sector is initialized to -1 which is out of device range and thus
+discarded by act_log_check(). This is most notably the case for cache
+flush requests sent to the device. Fix the problem by making
+blk_rq_trace_sector() return 0 for requests without initialized sector.
+
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/blktrace_api.h | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
+index 8804753805ac5..7bb2d8de9f308 100644
+--- a/include/linux/blktrace_api.h
++++ b/include/linux/blktrace_api.h
+@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes);
+
+ static inline sector_t blk_rq_trace_sector(struct request *rq)
+ {
+- return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq);
++ /*
++ * Tracing should ignore starting sector for passthrough requests and
++ * requests where starting sector didn't get set.
++ */
++ if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1)
++ return 0;
++ return blk_rq_pos(rq);
+ }
+
+ static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq)
+--
+2.20.1
+
--- /dev/null
+From dcd55fa9c98a58b35d1f5cddbc4c4108698d3528 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 10:48:47 +0300
+Subject: block: drbd: remove a stray unlock in __drbd_send_protocol()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ]
+
+There are two callers of this function and they both unlock the mutex so
+this ends up being a double unlock.
+
+Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 8cb3791898ae9..7ea13b5497fdc 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -795,7 +795,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
+
+ if (nc->tentative && connection->agreed_pro_version < 92) {
+ rcu_read_unlock();
+- mutex_unlock(&sock->mutex);
+ drbd_err(connection, "--dry-run is not supported by peer");
+ return -EOPNOTSUPP;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1ffd1d8ddca5fe17f268820aea971da0b4d5ab7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 12:22:28 +0100
+Subject: Bluetooth: hci_bcm: Handle specific unknown packets after firmware
+ loading
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Bakker <xc-racer2@live.ca>
+
+[ Upstream commit 22bba80500fdf624a7cfbb65fdfa97a038ae224d ]
+
+The Broadcom controller on aries S5PV210 boards sends out a couple of
+unknown packets after the firmware is loaded. This will cause
+logging of errors such as:
+ Bluetooth: hci0: Frame reassembly failed (-84)
+
+This is probably also the case with other boards, as there are related
+Android userspace patches for custom ROMs such as
+https://review.lineageos.org/#/c/LineageOS/android_system_bt/+/142721/
+Since this appears to be intended behaviour, treated them as diagnostic
+packets.
+
+Note that this is another variant of commit 01d5e44ace8a
+("Bluetooth: hci_bcm: Handle empty packet after firmware loading")
+
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcm.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index 6d41b2023f09d..61971ddbd2313 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -50,6 +50,12 @@
+ #define BCM_LM_DIAG_PKT 0x07
+ #define BCM_LM_DIAG_SIZE 63
+
++#define BCM_TYPE49_PKT 0x31
++#define BCM_TYPE49_SIZE 0
++
++#define BCM_TYPE52_PKT 0x34
++#define BCM_TYPE52_SIZE 0
++
+ #define BCM_AUTOSUSPEND_DELAY 5000 /* default autosleep delay */
+
+ /* platform device driver resources */
+@@ -483,12 +489,28 @@ finalize:
+ .lsize = 0, \
+ .maxlen = BCM_NULL_SIZE
+
++#define BCM_RECV_TYPE49 \
++ .type = BCM_TYPE49_PKT, \
++ .hlen = BCM_TYPE49_SIZE, \
++ .loff = 0, \
++ .lsize = 0, \
++ .maxlen = BCM_TYPE49_SIZE
++
++#define BCM_RECV_TYPE52 \
++ .type = BCM_TYPE52_PKT, \
++ .hlen = BCM_TYPE52_SIZE, \
++ .loff = 0, \
++ .lsize = 0, \
++ .maxlen = BCM_TYPE52_SIZE
++
+ static const struct h4_recv_pkt bcm_recv_pkts[] = {
+ { H4_RECV_ACL, .recv = hci_recv_frame },
+ { H4_RECV_SCO, .recv = hci_recv_frame },
+ { H4_RECV_EVENT, .recv = hci_recv_frame },
+ { BCM_RECV_LM_DIAG, .recv = hci_recv_diag },
+ { BCM_RECV_NULL, .recv = hci_recv_diag },
++ { BCM_RECV_TYPE49, .recv = hci_recv_diag },
++ { BCM_RECV_TYPE52, .recv = hci_recv_diag },
+ };
+
+ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
+--
+2.20.1
+
--- /dev/null
+From f0791ad411ffa7637db6f8db728415d754a4ccc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:31 -0500
+Subject: bnxt_en: query force speeds before disabling autoneg mode.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 56d374624778652d2a999e18c87a25338b127b41 ]
+
+With autoneg enabled, PHY loopback test fails. To disable autoneg,
+driver needs to send a valid forced speed to FW. FW is not sending
+async event for invalid speeds. To fix this, query forced speeds
+and send the correct speed when disabling autoneg mode.
+
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 22 ++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 4879371ad0c75..fc8e185718a1d 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2258,17 +2258,37 @@ static int bnxt_hwrm_mac_loopback(struct bnxt *bp, bool enable)
+ return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ }
+
++static int bnxt_query_force_speeds(struct bnxt *bp, u16 *force_speeds)
++{
++ struct hwrm_port_phy_qcaps_output *resp = bp->hwrm_cmd_resp_addr;
++ struct hwrm_port_phy_qcaps_input req = {0};
++ int rc;
++
++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_PORT_PHY_QCAPS, -1, -1);
++ mutex_lock(&bp->hwrm_cmd_lock);
++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (!rc)
++ *force_speeds = le16_to_cpu(resp->supported_speeds_force_mode);
++
++ mutex_unlock(&bp->hwrm_cmd_lock);
++ return rc;
++}
++
+ static int bnxt_disable_an_for_lpbk(struct bnxt *bp,
+ struct hwrm_port_phy_cfg_input *req)
+ {
+ struct bnxt_link_info *link_info = &bp->link_info;
+- u16 fw_advertising = link_info->advertising;
++ u16 fw_advertising;
+ u16 fw_speed;
+ int rc;
+
+ if (!link_info->autoneg)
+ return 0;
+
++ rc = bnxt_query_force_speeds(bp, &fw_advertising);
++ if (rc)
++ return rc;
++
+ fw_speed = PORT_PHY_CFG_REQ_FORCE_LINK_SPEED_1GB;
+ if (netif_carrier_ok(bp->dev))
+ fw_speed = bp->link_info.link_speed;
+--
+2.20.1
+
--- /dev/null
+From 4abbc4bb4814dde76945a7984bdd18f28bc84493 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:28 -0500
+Subject: bnxt_en: Return linux standard errors in bnxt_ethtool.c
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 7c675421afef18253a86ffc383f57bc15ef32ea8 ]
+
+Currently firmware specific errors are returned directly in flash_device
+and reset ethtool hooks. Modify it to return linux standard errors
+to userspace when flashing operations fail.
+
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 56 +++++++++++++------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index a22336fef66b2..4879371ad0c75 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1339,14 +1339,22 @@ static int bnxt_flash_nvram(struct net_device *dev,
+ rc = hwrm_send_message(bp, &req, sizeof(req), FLASH_NVRAM_TIMEOUT);
+ dma_free_coherent(&bp->pdev->dev, data_len, kmem, dma_handle);
+
++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to flash the device\n");
++ rc = -EACCES;
++ } else if (rc) {
++ rc = -EIO;
++ }
+ return rc;
+ }
+
+ static int bnxt_firmware_reset(struct net_device *dev,
+ u16 dir_type)
+ {
+- struct bnxt *bp = netdev_priv(dev);
+ struct hwrm_fw_reset_input req = {0};
++ struct bnxt *bp = netdev_priv(dev);
++ int rc;
+
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FW_RESET, -1, -1);
+
+@@ -1380,7 +1388,15 @@ static int bnxt_firmware_reset(struct net_device *dev,
+ return -EINVAL;
+ }
+
+- return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to reset the device\n");
++ rc = -EACCES;
++ } else if (rc) {
++ rc = -EIO;
++ }
++ return rc;
+ }
+
+ static int bnxt_flash_firmware(struct net_device *dev,
+@@ -1587,9 +1603,9 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr;
+ struct hwrm_nvm_install_update_input install = {0};
+ const struct firmware *fw;
++ int rc, hwrm_err = 0;
+ u32 item_len;
+ u16 index;
+- int rc;
+
+ bnxt_hwrm_fw_set_time(bp);
+
+@@ -1632,15 +1648,16 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ memcpy(kmem, fw->data, fw->size);
+ modify.host_src_addr = cpu_to_le64(dma_handle);
+
+- rc = hwrm_send_message(bp, &modify, sizeof(modify),
+- FLASH_PACKAGE_TIMEOUT);
++ hwrm_err = hwrm_send_message(bp, &modify,
++ sizeof(modify),
++ FLASH_PACKAGE_TIMEOUT);
+ dma_free_coherent(&bp->pdev->dev, fw->size, kmem,
+ dma_handle);
+ }
+ }
+ release_firmware(fw);
+- if (rc)
+- return rc;
++ if (rc || hwrm_err)
++ goto err_exit;
+
+ if ((install_type & 0xffff) == 0)
+ install_type >>= 16;
+@@ -1648,12 +1665,10 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ install.install_type = cpu_to_le32(install_type);
+
+ mutex_lock(&bp->hwrm_cmd_lock);
+- rc = _hwrm_send_message(bp, &install, sizeof(install),
+- INSTALL_PACKAGE_TIMEOUT);
+- if (rc) {
+- rc = -EOPNOTSUPP;
++ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
++ INSTALL_PACKAGE_TIMEOUT);
++ if (hwrm_err)
+ goto flash_pkg_exit;
+- }
+
+ if (resp->error_code) {
+ u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+@@ -1661,12 +1676,11 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ install.flags |= cpu_to_le16(
+ NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+- rc = _hwrm_send_message(bp, &install, sizeof(install),
+- INSTALL_PACKAGE_TIMEOUT);
+- if (rc) {
+- rc = -EOPNOTSUPP;
++ hwrm_err = _hwrm_send_message(bp, &install,
++ sizeof(install),
++ INSTALL_PACKAGE_TIMEOUT);
++ if (hwrm_err)
+ goto flash_pkg_exit;
+- }
+ }
+ }
+
+@@ -1677,6 +1691,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ }
+ flash_pkg_exit:
+ mutex_unlock(&bp->hwrm_cmd_lock);
++err_exit:
++ if (hwrm_err == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to flash the device\n");
++ rc = -EACCES;
++ } else if (hwrm_err) {
++ rc = -EOPNOTSUPP;
++ }
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a104dc7bff5fd874e344baec01b7f2c42246f287 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 22:15:37 +0800
+Subject: bpf: decrease usercnt if bpf_map_new_fd() fails in
+ bpf_map_get_fd_by_id()
+
+From: Peng Sun <sironhide0null@gmail.com>
+
+[ Upstream commit 781e62823cb81b972dc8652c1827205cda2ac9ac ]
+
+In bpf/syscall.c, bpf_map_get_fd_by_id() use bpf_map_inc_not_zero()
+to increase the refcount, both map->refcnt and map->usercnt. Then, if
+bpf_map_new_fd() fails, should handle map->usercnt too.
+
+Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID")
+Signed-off-by: Peng Sun <sironhide0null@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 59d2e94ecb798..34110450a78f2 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1354,7 +1354,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
+
+ fd = bpf_map_new_fd(map);
+ if (fd < 0)
+- bpf_map_put(map);
++ bpf_map_put_with_uref(map);
+
+ return fd;
+ }
+--
+2.20.1
+
--- /dev/null
+From bc241c6f67f1681bd88c8ca219b1eee9751647e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 22:36:25 +0800
+Subject: bpf: drop refcount if bpf_map_new_fd() fails in map_create()
+
+From: Peng Sun <sironhide0null@gmail.com>
+
+[ Upstream commit 352d20d611414715353ee65fc206ee57ab1a6984 ]
+
+In bpf/syscall.c, map_create() first set map->usercnt to 1, a file
+descriptor is supposed to return to userspace. When bpf_map_new_fd()
+fails, drop the refcount.
+
+Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID")
+Signed-off-by: Peng Sun <sironhide0null@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 34110450a78f2..f5c1d5479ba3d 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -348,12 +348,12 @@ static int map_create(union bpf_attr *attr)
+ err = bpf_map_new_fd(map);
+ if (err < 0) {
+ /* failed to allocate fd.
+- * bpf_map_put() is needed because the above
++ * bpf_map_put_with_uref() is needed because the above
+ * bpf_map_alloc_id() has published the map
+ * to the userspace and the userspace may
+ * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID.
+ */
+- bpf_map_put(map);
++ bpf_map_put_with_uref(map);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9289021ff2982a31a50b6dfcb90744016f003a30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 20:54:28 +0100
+Subject: bridge: ebtables: don't crash when using dnat target in output chains
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ]
+
+xt_in() returns NULL in the output hook, skip the pkt_type change for
+that case, redirection only makes sense in broute/prerouting hooks.
+
+Reported-by: Tom Yan <tom.ty89@gmail.com>
+Cc: Linus Lüssing <linus.luessing@c0d3.blue>
+Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
+index dfc86a0199dab..1d8c834d90189 100644
+--- a/net/bridge/netfilter/ebt_dnat.c
++++ b/net/bridge/netfilter/ebt_dnat.c
+@@ -19,7 +19,6 @@ static unsigned int
+ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ const struct ebt_nat_info *info = par->targinfo;
+- struct net_device *dev;
+
+ if (!skb_make_writable(skb, 0))
+ return EBT_DROP;
+@@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ else
+ skb->pkt_type = PACKET_MULTICAST;
+ } else {
+- if (xt_hooknum(par) != NF_BR_BROUTING)
+- dev = br_port_get_rcu(xt_in(par))->br->dev;
+- else
++ const struct net_device *dev;
++
++ switch (xt_hooknum(par)) {
++ case NF_BR_BROUTING:
+ dev = xt_in(par);
++ break;
++ case NF_BR_PRE_ROUTING:
++ dev = br_port_get_rcu(xt_in(par))->br->dev;
++ break;
++ default:
++ dev = NULL;
++ break;
++ }
++
++ if (!dev) /* NF_BR_LOCAL_OUT */
++ return info->target;
+
+ if (ether_addr_equal(info->mac, dev->dev_addr))
+ skb->pkt_type = PACKET_HOST;
+--
+2.20.1
+
--- /dev/null
+From 1c842e3a835f418044547ca93dee77ac6fdbc428 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 10:20:32 -0500
+Subject: btrfs: only track ref_heads in delayed_ref_updates
+
+From: Josef Bacik <jbacik@fb.com>
+
+[ Upstream commit 158ffa364bf723fa1ef128060646d23dc3942994 ]
+
+We use this number to figure out how many delayed refs to run, but
+__btrfs_run_delayed_refs really only checks every time we need a new
+delayed ref head, so we always run at least one ref head completely no
+matter what the number of items on it. Fix the accounting to only be
+adjusted when we add/remove a ref head.
+
+In addition to using this number to limit the number of delayed refs
+run, a future patch is also going to use it to calculate the amount of
+space required for delayed refs space reservation.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-ref.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 93ffa898df6d8..d56bd36254681 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -195,8 +195,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ ref->in_tree = 0;
+ btrfs_put_delayed_ref(ref);
+ atomic_dec(&delayed_refs->num_entries);
+- if (trans->delayed_ref_updates)
+- trans->delayed_ref_updates--;
+ }
+
+ static bool merge_ref(struct btrfs_trans_handle *trans,
+@@ -458,7 +456,6 @@ add_tail:
+ if (ref->action == BTRFS_ADD_DELAYED_REF)
+ list_add_tail(&ref->add_list, &href->ref_add_list);
+ atomic_inc(&root->num_entries);
+- trans->delayed_ref_updates++;
+ spin_unlock(&href->lock);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 17996a0c9a42b575ae9acb16396c3a69ee6b047f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:01:20 +0000
+Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on
+ open
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ]
+
+When the CAN interface is closed it the hardwre is put in power down
+mode, but does not reset the error counters / state. Reset the D_CAN on
+open, so the reported state and the actual state match.
+
+According to [1], the C_CAN module doesn't have the software reset.
+
+[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 9b61bfbea6cd1..24c6015f6c92b 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -52,6 +52,7 @@
+ #define CONTROL_EX_PDR BIT(8)
+
+ /* control register */
++#define CONTROL_SWR BIT(15)
+ #define CONTROL_TEST BIT(7)
+ #define CONTROL_CCE BIT(6)
+ #define CONTROL_DISABLE_AR BIT(5)
+@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ IF_MCONT_RCV_EOB);
+ }
+
++static int c_can_software_reset(struct net_device *dev)
++{
++ struct c_can_priv *priv = netdev_priv(dev);
++ int retry = 0;
++
++ if (priv->type != BOSCH_D_CAN)
++ return 0;
++
++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
++ msleep(20);
++ if (retry++ > 100) {
++ netdev_err(dev, "CCTRL: software reset failed\n");
++ return -EIO;
++ }
++ }
++
++ return 0;
++}
++
+ /*
+ * Configure C_CAN chip:
+ * - enable/disable auto-retransmission
+@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ static int c_can_chip_config(struct net_device *dev)
+ {
+ struct c_can_priv *priv = netdev_priv(dev);
++ int err;
++
++ err = c_can_software_reset(dev);
++ if (err)
++ return err;
+
+ /* enable automatic retransmission */
+ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
+--
+2.20.1
+
--- /dev/null
+From 526b581809788aec69102532b23027317ec35130 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 08:58:45 +0000
+Subject: can: peak_usb: report bus recovery as well
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ]
+
+While the state changes are reported when the error counters increase
+and decrease, there is no event when the bus recovers and the error
+counters decrease again. So add those as well.
+
+Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING ->
+ERROR_ACTIVE instead of directly to ERROR_ACTIVE again.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Cc: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index e626c2afbbb11..0e1fc6c4360e7 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -441,8 +441,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+ if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
+ /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ new_state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ }
+ break;
+
+@@ -465,9 +465,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+
+ if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
+- /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ /* no error (back to warning state) */
++ new_state = CAN_STATE_ERROR_WARNING;
++ break;
+ }
+ break;
+
+@@ -506,6 +506,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ mc->pdev->dev.can.can_stats.error_warning++;
+ break;
+
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ break;
++
+ default:
+ /* CAN_STATE_MAX (trick to handle other errors) */
+ cf->can_id |= CAN_ERR_CRTL;
+--
+2.20.1
+
--- /dev/null
+From fd46a5f806fc17f4af3cbbbedf3ed338def11adc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 1f7f504dcd9d1262437bdcf4fa071e41dec1af03 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+If the hardware FIFO is empty can_rx_offload_offload_one() will return
+NULL.
+
+In case a CAN frame was read from the hardware,
+can_rx_offload_offload_one() returns the skb containing it.
+
+Without this patch can_rx_offload_irq_offload_fifo() bails out if no skb
+returned, regardless of the reason.
+
+Similar to can_rx_offload_irq_offload_timestamp() in case of a resource
+shortage the whole FIFO should be discarded, to avoid an IRQ storm and
+give the system some time to recover. However if the FIFO is empty the
+loop can be left.
+
+With this patch the loop is left in case of empty FIFO, but not on
+errors.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index fef6534f163b7..54ffd1e91a693 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -257,7 +257,9 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+
+ while (1) {
+ skb = can_rx_offload_offload_one(offload, 0);
+- if (IS_ERR_OR_NULL(skb))
++ if (IS_ERR(skb))
++ continue;
++ if (!skb)
+ break;
+
+ skb_queue_tail(&offload->skb_queue, skb);
+--
+2.20.1
+
--- /dev/null
+From f0b770f1423ae7b02ced86f09633a178d4b1d1df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on
+ error
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit c2a9f74c9d18acfdcabd3361adc7eac82c537a66 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+However can_rx_offload_irq_offload_timestamp() bails out in the error
+case. In case of a resource shortage all mailboxes should be discarded,
+to avoid an IRQ storm and give the system some time to recover.
+
+Since can_rx_offload_irq_offload_timestamp() is typically called from a
+while loop, all message will eventually be discarded. So let's continue
+on error instead to discard them directly.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 840aef094f208..fef6534f163b7 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -225,7 +225,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+
+ skb = can_rx_offload_offload_one(offload, i);
+ if (IS_ERR_OR_NULL(skb))
+- break;
++ continue;
+
+ __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+ }
+--
+2.20.1
+
--- /dev/null
+From be459038ef0ea2e93303d469522461cd0e6fa16a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 16:03:18 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): do not increase the
+ skb_queue beyond skb_queue_len_max
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 ]
+
+The skb_queue is a linked list, holding the skb to be processed in the
+next NAPI call.
+
+Without this patch, the queue length in can_rx_offload_offload_one() is
+limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no
+array or other resources are accessed out-of-bound, however this
+behaviour is counterintuitive.
+
+This patch limits the rx-offload skb_queue length to skb_queue_len_max.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index b26987a136203..c0e51a2f8e4fc 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -124,7 +124,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+ int ret;
+
+ /* If queue is full or skb not available, read to discard mailbox */
+- if (likely(skb_queue_len(&offload->skb_queue) <=
++ if (likely(skb_queue_len(&offload->skb_queue) <
+ offload->skb_queue_len_max))
+ skb = alloc_can_skb(offload->dev, &cf);
+
+--
+2.20.1
+
--- /dev/null
+From fbe3b8faceee3ac9358eec27f410bc71820e052b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:15:07 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): increment
+ rx_fifo_errors on queue overflow or OOM
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 4e9016bee3bf0c24963097edace034ff205b565c ]
+
+If the rx-offload skb_queue is full or the skb allocation fails (due to OOM),
+the mailbox contents is discarded.
+
+This patch adds the incrementing of the rx_fifo_errors statistics counter.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index c0e51a2f8e4fc..b068e2320c794 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -134,8 +134,10 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+
+ ret = offload->mailbox_read(offload, &cf_overflow,
+ ×tamp, n);
+- if (ret)
++ if (ret) {
+ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++ }
+
+ return NULL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3111b4c925df84197cbbbc72b0625fa74a4b2893 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 21:00:32 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to
+ propagate error value in case of errors
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit d763ab3044f0bf50bd0e6179f6b2cf1c125d1d94 ]
+
+Before this patch can_rx_offload_offload_one() returns a pointer to a
+skb containing the read CAN frame or a NULL pointer.
+
+However the meaning of the NULL pointer is ambiguous, it can either mean
+the requested mailbox is empty or there was an error.
+
+This patch fixes this situation by returning:
+- pointer to skb on success
+- NULL pointer if mailbox is empty
+- ERR_PTR() in case of an error
+
+All users of can_rx_offload_offload_one() have been adopted, no
+functional change intended.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 86 ++++++++++++++++++++++++++++++------
+ 1 file changed, 73 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index b068e2320c794..840aef094f208 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -116,39 +116,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b)
+ return cb_b->timestamp - cb_a->timestamp;
+ }
+
+-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
++/**
++ * can_rx_offload_offload_one() - Read one CAN frame from HW
++ * @offload: pointer to rx_offload context
++ * @n: number of mailbox to read
++ *
++ * The task of this function is to read a CAN frame from mailbox @n
++ * from the device and return the mailbox's content as a struct
++ * sk_buff.
++ *
++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue
++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be
++ * allocated, the mailbox contents is discarded by reading it into an
++ * overflow buffer. This way the mailbox is marked as free by the
++ * driver.
++ *
++ * Return: A pointer to skb containing the CAN frame on success.
++ *
++ * NULL if the mailbox @n is empty.
++ *
++ * ERR_PTR() in case of an error
++ */
++static struct sk_buff *
++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
+ {
+- struct sk_buff *skb = NULL;
++ struct sk_buff *skb = NULL, *skb_error = NULL;
+ struct can_rx_offload_cb *cb;
+ struct can_frame *cf;
+ int ret;
+
+- /* If queue is full or skb not available, read to discard mailbox */
+ if (likely(skb_queue_len(&offload->skb_queue) <
+- offload->skb_queue_len_max))
++ offload->skb_queue_len_max)) {
+ skb = alloc_can_skb(offload->dev, &cf);
++ if (unlikely(!skb))
++ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */
++ } else {
++ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */
++ }
+
+- if (!skb) {
++ /* If queue is full or skb not available, drop by reading into
++ * overflow buffer.
++ */
++ if (unlikely(skb_error)) {
+ struct can_frame cf_overflow;
+ u32 timestamp;
+
+ ret = offload->mailbox_read(offload, &cf_overflow,
+ ×tamp, n);
+- if (ret) {
+- offload->dev->stats.rx_dropped++;
+- offload->dev->stats.rx_fifo_errors++;
+- }
+
+- return NULL;
++ /* Mailbox was empty. */
++ if (unlikely(!ret))
++ return NULL;
++
++ /* Mailbox has been read and we're dropping it or
++ * there was a problem reading the mailbox.
++ *
++ * Increment error counters in any case.
++ */
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ /* There was a problem reading the mailbox, propagate
++ * error value.
++ */
++ if (unlikely(ret < 0))
++ return ERR_PTR(ret);
++
++ return skb_error;
+ }
+
+ cb = can_rx_offload_get_cb(skb);
+ ret = offload->mailbox_read(offload, cf, &cb->timestamp, n);
+- if (!ret) {
++
++ /* Mailbox was empty. */
++ if (unlikely(!ret)) {
+ kfree_skb(skb);
+ return NULL;
+ }
+
++ /* There was a problem reading the mailbox, propagate error value. */
++ if (unlikely(ret < 0)) {
++ kfree_skb(skb);
++
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ return ERR_PTR(ret);
++ }
++
++ /* Mailbox was read. */
+ return skb;
+ }
+
+@@ -168,7 +224,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+ continue;
+
+ skb = can_rx_offload_offload_one(offload, i);
+- if (!skb)
++ if (IS_ERR_OR_NULL(skb))
+ break;
+
+ __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+@@ -199,7 +255,11 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ struct sk_buff *skb;
+ int received = 0;
+
+- while ((skb = can_rx_offload_offload_one(offload, 0))) {
++ while (1) {
++ skb = can_rx_offload_offload_one(offload, 0);
++ if (IS_ERR_OR_NULL(skb))
++ break;
++
+ skb_queue_tail(&offload->skb_queue, skb);
+ received++;
+ }
+--
+2.20.1
+
--- /dev/null
+From f85cd602573e6b99d0b4bfc1effb03a8bec35763 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:48:48 +0200
+Subject: can: rx-offload: can_rx_offload_queue_tail(): fix error handling,
+ avoid skb mem leak
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 6caf8a6d6586d44fd72f4aa1021d14aa82affafb ]
+
+If the rx-offload skb_queue is full can_rx_offload_queue_tail() will not
+queue the skb and return with an error.
+
+This patch frees the skb in case of a full queue, which brings
+can_rx_offload_queue_tail() in line with the
+can_rx_offload_queue_sorted() function, which has been adjusted in the
+previous patch.
+
+The return value is adjusted to -ENOBUFS to better reflect the actual
+problem.
+
+The device stats handling is left to the caller.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Reported-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 1a7c183e66783..b26987a136203 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -261,8 +261,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+ struct sk_buff *skb)
+ {
+ if (skb_queue_len(&offload->skb_queue) >
+- offload->skb_queue_len_max)
+- return -ENOMEM;
++ offload->skb_queue_len_max) {
++ kfree_skb(skb);
++ return -ENOBUFS;
++ }
+
+ skb_queue_tail(&offload->skb_queue, skb);
+ can_rx_offload_schedule(offload);
+--
+2.20.1
+
--- /dev/null
+From 7e1011d1db1e7806bfd6f4b173e48b1a73066f4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 09:39:32 -0500
+Subject: ceph: return -EINVAL if given fsc mount option on kernel w/o support
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit ff29fde84d1fc82f233c7da0daa3574a3942bec7 ]
+
+If someone requests fscache on the mount, and the kernel doesn't
+support it, it should fail the mount.
+
+[ Drop ceph prefix -- it's provided by pr_err. ]
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/super.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index f0694293b31a2..088c4488b4492 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -232,6 +232,7 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ break;
+ case Opt_fscache_uniq:
++#ifdef CONFIG_CEPH_FSCACHE
+ kfree(fsopt->fscache_uniq);
+ fsopt->fscache_uniq = kstrndup(argstr[0].from,
+ argstr[0].to-argstr[0].from,
+@@ -240,7 +241,10 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ break;
+- /* misc */
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_wsize:
+ if (intval < PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)
+ return -EINVAL;
+@@ -312,8 +316,13 @@ static int parse_fsopt_token(char *c, void *private)
+ fsopt->flags &= ~CEPH_MOUNT_OPT_INO32;
+ break;
+ case Opt_fscache:
++#ifdef CONFIG_CEPH_FSCACHE
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ break;
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_nofscache:
+ fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
+ break;
+--
+2.20.1
+
--- /dev/null
+From 0d34b914337dfb852c8ee27ae16445dc4d5221ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 17:39:06 +0200
+Subject: clk: at91: avoid sleeping early
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ]
+
+It is not allowed to sleep to early in the boot process and this may lead
+to kernel issues if the bootloader didn't prepare the slow clock and main
+clock.
+
+This results in the following error and dump stack on the AriettaG25:
+ bad: scheduling from the idle thread!
+
+Ensure it is possible to sleep, else simply have a delay.
+
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com
+Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver")
+Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-main.c | 5 ++++-
+ drivers/clk/at91/sckc.c | 20 ++++++++++++++++----
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index 2f97a843d6d6b..fb5c14af8cc8d 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
+ regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
+ if (mcfr & AT91_PMC_MAINRDY)
+ return 0;
+- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(MAINF_LOOP_MIN_WAIT);
++ else
++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+ } while (time_before(prep_time, timeout));
+
+ return -ETIMEDOUT;
+diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
+index ab6ecefc49ad8..43ba2a8b03faf 100644
+--- a/drivers/clk/at91/sckc.c
++++ b/drivers/clk/at91/sckc.c
+@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
+
+ writel(tmp | AT91_SCKC_OSC32EN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
+
+ writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
+
+ writel(tmp, sckcr);
+
+- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(SLOWCK_SW_TIME_USEC);
++ else
++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+
+ return 0;
+ }
+@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
+ return 0;
+ }
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ osc->prepared = true;
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 67efb70324ed4361d98f1a54ae24195d3d447968 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Sep 2019 17:04:11 +0200
+Subject: clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 44b09b11b813b8550e6b976ea51593bc23bba8d1 ]
+
+The meson-saradc driver manually sets the input clock for
+sar_adc_clk_sel. Update the GXBB clock driver (which is used on GXBB,
+GXL and GXM) so the rate settings on sar_adc_clk_div are propagated up
+to sar_adc_clk_sel which will let the common clock framework select the
+best matching parent clock if we want that.
+
+This makes sar_adc_clk_div consistent with the axg-aoclk and g12a-aoclk
+drivers, which both also specify CLK_SET_RATE_PARENT.
+
+Fixes: 33d0fcdfe0e870 ("clk: gxbb: add the SAR ADC clocks and expose them")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 92168348ffa6e..f2d27addf485c 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -687,6 +687,7 @@ static struct clk_divider gxbb_sar_adc_clk_div = {
+ .ops = &clk_divider_ops,
+ .parent_names = (const char *[]){ "sar_adc_clk_sel" },
+ .num_parents = 1,
++ .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 0cd3e6bde6af109dedaf564de3b5ecdb9da86712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:02:01 +0200
+Subject: clk: samsung: exynos5420: Preserve PLL configuration during
+ suspend/resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ]
+
+Properly save and restore all top PLL related configuration registers
+during suspend/resume cycle. So far driver only handled EPLL and RPLL
+clocks, all other were reset to default values after suspend/resume cycle.
+This caused for example lower G3D (MALI Panfrost) performance after system
+resume, even if performance governor has been selected.
+
+Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index a882f7038bcec..47a14f93f8693 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -170,12 +170,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ GATE_BUS_CPU,
+ GATE_SCLK_CPU,
+ CLKOUT_CMU_CPU,
++ CPLL_CON0,
++ DPLL_CON0,
+ EPLL_CON0,
+ EPLL_CON1,
+ EPLL_CON2,
+ RPLL_CON0,
+ RPLL_CON1,
+ RPLL_CON2,
++ IPLL_CON0,
++ SPLL_CON0,
++ VPLL_CON0,
++ MPLL_CON0,
+ SRC_TOP0,
+ SRC_TOP1,
+ SRC_TOP2,
+--
+2.20.1
+
--- /dev/null
+From 06ca8c9a874516a5f54d313b2e3f383a624083a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 12:28:09 +0100
+Subject: clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cdfc2e2086bf9c465f44e2db25561373b084a113 ]
+
+The zero'ing of bits 16 and 18 is incorrect. Currently the code
+is masking with the bitwise-and of BIT(16) & BIT(18) which is
+0, so the updated value for val is always zero. Fix this by bitwise
+and-ing value with the correct mask that will zero bits 16 and 18.
+
+Addresses-Coverity: (" Suspicious &= or |= constant expression")
+Fixes: b8eb71dcdd08 ("clk: sunxi-ng: Add A80 CCU")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun9i-a80.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+index 8936ef87652c0..c14bf782b2b33 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+@@ -1231,7 +1231,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev)
+
+ /* Enforce d1 = 0, d2 = 0 for Audio PLL */
+ val = readl(reg + SUN9I_A80_PLL_AUDIO_REG);
+- val &= (BIT(16) & BIT(18));
++ val &= ~(BIT(16) | BIT(18));
+ writel(val, reg + SUN9I_A80_PLL_AUDIO_REG);
+
+ /* Enforce P = 1 for both CPU cluster PLLs */
+--
+2.20.1
+
--- /dev/null
+From 9a35dc430413e9da192e7d23498b6c5a650d25e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 11:34:36 +0300
+Subject: clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 9982b0f69b49931b652d35f86f519be2ccfc7027 ]
+
+ti_clk_register() calls it already so the driver should not create
+duplicated alias.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lkml.kernel.org/r/20191002083436.10194-1-peter.ujfalusi@ti.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-dra7-atl.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index 1488154704313..beb672a215b6c 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ struct clk_init_data init = { NULL };
+ const char **parent_names = NULL;
+ struct clk *clk;
+- int ret;
+
+ clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
+ if (!clk_hw) {
+@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
+
+ if (!IS_ERR(clk)) {
+- ret = ti_clk_add_alias(NULL, clk, node->name);
+- if (ret) {
+- clk_unregister(clk);
+- goto cleanup;
+- }
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ kfree(parent_names);
+ return;
+--
+2.20.1
+
--- /dev/null
+From c336bfbdd9dde0ebb66aa9c58b56d6514ed3271e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 14:53:50 -0700
+Subject: clocksource/drivers/fttmr010: Fix invalid interrupt register access
+
+From: Tao Ren <taoren@fb.com>
+
+[ Upstream commit 86fe57fc47b17b3528fa5497fc57e158d846c4ea ]
+
+TIMER_INTR_MASK register (Base Address of Timer + 0x38) is not designed
+for masking interrupts on ast2500 chips, and it's not even listed in
+ast2400 datasheet, so it's not safe to access TIMER_INTR_MASK on aspeed
+chips.
+
+Similarly, TIMER_INTR_STATE register (Base Address of Timer + 0x34) is
+not interrupt status register on ast2400 and ast2500 chips. Although
+there is no side effect to reset the register in fttmr010_common_init(),
+it's just misleading to do so.
+
+Besides, "count_down" is renamed to "is_aspeed" in "fttmr010" structure,
+and more comments are added so the code is more readble.
+
+Signed-off-by: Tao Ren <taoren@fb.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-fttmr010.c | 73 ++++++++++++++++------------
+ 1 file changed, 42 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
+index cdfe1c82f3f00..3928f3999015e 100644
+--- a/drivers/clocksource/timer-fttmr010.c
++++ b/drivers/clocksource/timer-fttmr010.c
+@@ -21,7 +21,7 @@
+ #include <linux/delay.h>
+
+ /*
+- * Register definitions for the timers
++ * Register definitions common for all the timer variants.
+ */
+ #define TIMER1_COUNT (0x00)
+ #define TIMER1_LOAD (0x04)
+@@ -36,9 +36,10 @@
+ #define TIMER3_MATCH1 (0x28)
+ #define TIMER3_MATCH2 (0x2c)
+ #define TIMER_CR (0x30)
+-#define TIMER_INTR_STATE (0x34)
+-#define TIMER_INTR_MASK (0x38)
+
++/*
++ * Control register (TMC30) bit fields for fttmr010/gemini/moxart timers.
++ */
+ #define TIMER_1_CR_ENABLE BIT(0)
+ #define TIMER_1_CR_CLOCK BIT(1)
+ #define TIMER_1_CR_INT BIT(2)
+@@ -53,8 +54,9 @@
+ #define TIMER_3_CR_UPDOWN BIT(11)
+
+ /*
+- * The Aspeed AST2400 moves bits around in the control register
+- * and lacks bits for setting the timer to count upwards.
++ * Control register (TMC30) bit fields for aspeed ast2400/ast2500 timers.
++ * The aspeed timers move bits around in the control register and lacks
++ * bits for setting the timer to count upwards.
+ */
+ #define TIMER_1_CR_ASPEED_ENABLE BIT(0)
+ #define TIMER_1_CR_ASPEED_CLOCK BIT(1)
+@@ -66,6 +68,18 @@
+ #define TIMER_3_CR_ASPEED_CLOCK BIT(9)
+ #define TIMER_3_CR_ASPEED_INT BIT(10)
+
++/*
++ * Interrupt status/mask register definitions for fttmr010/gemini/moxart
++ * timers.
++ * The registers don't exist and they are not needed on aspeed timers
++ * because:
++ * - aspeed timer overflow interrupt is controlled by bits in Control
++ * Register (TMC30).
++ * - aspeed timers always generate interrupt when either one of the
++ * Match registers equals to Status register.
++ */
++#define TIMER_INTR_STATE (0x34)
++#define TIMER_INTR_MASK (0x38)
+ #define TIMER_1_INT_MATCH1 BIT(0)
+ #define TIMER_1_INT_MATCH2 BIT(1)
+ #define TIMER_1_INT_OVERFLOW BIT(2)
+@@ -80,7 +94,7 @@
+ struct fttmr010 {
+ void __iomem *base;
+ unsigned int tick_rate;
+- bool count_down;
++ bool is_aspeed;
+ u32 t1_enable_val;
+ struct clock_event_device clkevt;
+ #ifdef CONFIG_ARM
+@@ -130,7 +144,7 @@ static int fttmr010_timer_set_next_event(unsigned long cycles,
+ cr &= ~fttmr010->t1_enable_val;
+ writel(cr, fttmr010->base + TIMER_CR);
+
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ /*
+ * ASPEED Timer Controller will load TIMER1_LOAD register
+ * into TIMER1_COUNT register when the timer is re-enabled.
+@@ -175,16 +189,17 @@ static int fttmr010_timer_set_oneshot(struct clock_event_device *evt)
+
+ /* Setup counter start from 0 or ~0 */
+ writel(0, fttmr010->base + TIMER1_COUNT);
+- if (fttmr010->count_down)
++ if (fttmr010->is_aspeed) {
+ writel(~0, fttmr010->base + TIMER1_LOAD);
+- else
++ } else {
+ writel(0, fttmr010->base + TIMER1_LOAD);
+
+- /* Enable interrupt */
+- cr = readl(fttmr010->base + TIMER_INTR_MASK);
+- cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
+- cr |= TIMER_1_INT_MATCH1;
+- writel(cr, fttmr010->base + TIMER_INTR_MASK);
++ /* Enable interrupt */
++ cr = readl(fttmr010->base + TIMER_INTR_MASK);
++ cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
++ cr |= TIMER_1_INT_MATCH1;
++ writel(cr, fttmr010->base + TIMER_INTR_MASK);
++ }
+
+ return 0;
+ }
+@@ -201,9 +216,8 @@ static int fttmr010_timer_set_periodic(struct clock_event_device *evt)
+ writel(cr, fttmr010->base + TIMER_CR);
+
+ /* Setup timer to fire at 1/HZ intervals. */
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ writel(period, fttmr010->base + TIMER1_LOAD);
+- writel(0, fttmr010->base + TIMER1_MATCH1);
+ } else {
+ cr = 0xffffffff - (period - 1);
+ writel(cr, fttmr010->base + TIMER1_COUNT);
+@@ -281,23 +295,21 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ }
+
+ /*
+- * The Aspeed AST2400 moves bits around in the control register,
+- * otherwise it works the same.
++ * The Aspeed timers move bits around in the control register.
+ */
+ if (is_aspeed) {
+ fttmr010->t1_enable_val = TIMER_1_CR_ASPEED_ENABLE |
+ TIMER_1_CR_ASPEED_INT;
+- /* Downward not available */
+- fttmr010->count_down = true;
++ fttmr010->is_aspeed = true;
+ } else {
+ fttmr010->t1_enable_val = TIMER_1_CR_ENABLE | TIMER_1_CR_INT;
+- }
+
+- /*
+- * Reset the interrupt mask and status
+- */
+- writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
+- writel(0, fttmr010->base + TIMER_INTR_STATE);
++ /*
++ * Reset the interrupt mask and status
++ */
++ writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
++ writel(0, fttmr010->base + TIMER_INTR_STATE);
++ }
+
+ /*
+ * Enable timer 1 count up, timer 2 count up, except on Aspeed,
+@@ -306,9 +318,8 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ if (is_aspeed)
+ val = TIMER_2_CR_ASPEED_ENABLE;
+ else {
+- val = TIMER_2_CR_ENABLE;
+- if (!fttmr010->count_down)
+- val |= TIMER_1_CR_UPDOWN | TIMER_2_CR_UPDOWN;
++ val = TIMER_2_CR_ENABLE | TIMER_1_CR_UPDOWN |
++ TIMER_2_CR_UPDOWN;
+ }
+ writel(val, fttmr010->base + TIMER_CR);
+
+@@ -321,7 +332,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ writel(0, fttmr010->base + TIMER2_MATCH1);
+ writel(0, fttmr010->base + TIMER2_MATCH2);
+
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ writel(~0, fttmr010->base + TIMER2_LOAD);
+ clocksource_mmio_init(fttmr010->base + TIMER2_COUNT,
+ "FTTMR010-TIMER2",
+@@ -371,7 +382,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+
+ #ifdef CONFIG_ARM
+ /* Also use this timer for delays */
+- if (fttmr010->count_down)
++ if (fttmr010->is_aspeed)
+ fttmr010->delay_timer.read_current_timer =
+ fttmr010_read_current_timer_down;
+ else
+--
+2.20.1
+
--- /dev/null
+From 50d6b6c05391df0496e7f273f3d6e48f84b0fbf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 07:52:32 -0200
+Subject: crypto: mxc-scc - fix build warnings on ARM64
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 2326828ee40357b3d2b1359b8ca7526af201495b ]
+
+The following build warnings are seen when building for ARM64 allmodconfig:
+
+drivers/crypto/mxc-scc.c:181:20: warning: format '%d' expects argument of type 'int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:186:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:277:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:339:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+drivers/crypto/mxc-scc.c:340:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+
+Fix them by using the %zu specifier to print a size_t variable and using
+a plain %x to print the result of a readl().
+
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxc-scc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c
+index e01c46387df8d..519086730791b 100644
+--- a/drivers/crypto/mxc-scc.c
++++ b/drivers/crypto/mxc-scc.c
+@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx,
+ else
+ from = scc->black_memory;
+
+- dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from,
++ dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from,
+ ctx->dst_nents * 8);
+ len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents,
+ from, ctx->size, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len);
++ dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len);
+ return -EINVAL;
+ }
+
+@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx,
+ len = sg_pcopy_to_buffer(req->src, ctx->src_nents,
+ to, len, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len);
++ dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len);
+ return -EINVAL;
+ }
+
+@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx,
+ return;
+ }
+
+- dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n",
+- (void *)readl(scc->base + SCC_SCM_RED_START),
+- (void *)readl(scc->base + SCC_SCM_BLACK_START));
++ dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n",
++ readl(scc->base + SCC_SCM_RED_START),
++ readl(scc->base + SCC_SCM_BLACK_START));
+
+ /* clear interrupt control registers */
+ writel(SCC_SCM_INTR_CTRL_CLR_INTR,
+--
+2.20.1
+
--- /dev/null
+From 8ac8734c3535fffb75f9d17a04d95ae0488f1ef2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 15:55:41 -0800
+Subject: crypto: user - support incremental algorithm dumps
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0ac6b8fb23c724b015d9ca70a89126e8d1563166 ]
+
+CRYPTO_MSG_GETALG in NLM_F_DUMP mode sometimes doesn't return all
+registered crypto algorithms, because it doesn't support incremental
+dumps. crypto_dump_report() only permits itself to be called once, yet
+the netlink subsystem allocates at most ~64 KiB for the skb being dumped
+to. Thus only the first recvmsg() returns data, and it may only include
+a subset of the crypto algorithms even if the user buffer passed to
+recvmsg() is large enough to hold all of them.
+
+Fix this by using one of the arguments in the netlink_callback structure
+to keep track of the current position in the algorithm list. Then
+userspace can do multiple recvmsg() on the socket after sending the dump
+request. This is the way netlink dumps work elsewhere in the kernel;
+it's unclear why this was different (probably just an oversight).
+
+Also fix an integer overflow when calculating the dump buffer size hint.
+
+Fixes: a38f7907b926 ("crypto: Add userspace configuration API")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/crypto_user.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 2b8fb8f1391e0..5e457a7dd1c92 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -296,30 +296,33 @@ drop_alg:
+
+ static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+- struct crypto_alg *alg;
++ const size_t start_pos = cb->args[0];
++ size_t pos = 0;
+ struct crypto_dump_info info;
+- int err;
+-
+- if (cb->args[0])
+- goto out;
+-
+- cb->args[0] = 1;
++ struct crypto_alg *alg;
++ int res;
+
+ info.in_skb = cb->skb;
+ info.out_skb = skb;
+ info.nlmsg_seq = cb->nlh->nlmsg_seq;
+ info.nlmsg_flags = NLM_F_MULTI;
+
++ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list) {
+- err = crypto_report_alg(alg, &info);
+- if (err)
+- goto out_err;
++ if (pos >= start_pos) {
++ res = crypto_report_alg(alg, &info);
++ if (res == -EMSGSIZE)
++ break;
++ if (res)
++ goto out;
++ }
++ pos++;
+ }
+-
++ cb->args[0] = pos;
++ res = skb->len;
+ out:
+- return skb->len;
+-out_err:
+- return err;
++ up_read(&crypto_alg_sem);
++ return res;
+ }
+
+ static int crypto_dump_report_done(struct netlink_callback *cb)
+@@ -503,7 +506,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
+ (nlh->nlmsg_flags & NLM_F_DUMP))) {
+ struct crypto_alg *alg;
+- u16 dump_alloc = 0;
++ unsigned long dump_alloc = 0;
+
+ if (link->dump == NULL)
+ return -EINVAL;
+@@ -511,16 +514,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list)
+ dump_alloc += CRYPTO_REPORT_MAXSIZE;
++ up_read(&crypto_alg_sem);
+
+ {
+ struct netlink_dump_control c = {
+ .dump = link->dump,
+ .done = link->done,
+- .min_dump_alloc = dump_alloc,
++ .min_dump_alloc = min(dump_alloc, 65535UL),
+ };
+ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ }
+- up_read(&crypto_alg_sem);
+
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From 9efc025a2898868edda05b9a37ef271d7d9cd230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 21:12:19 +0100
+Subject: decnet: fix DN_IFREQ_SIZE
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 50c2936634bcb1db78a8ca63249236810c11a80f ]
+
+Digging through the ioctls with Al because of the previous
+patches, we found that on 64-bit decnet's dn_dev_ioctl()
+is wrong, because struct ifreq::ifr_ifru is actually 24
+bytes (not 16 as expected from struct sockaddr) due to the
+ifru_map and ifru_settings members.
+
+Clearly, decnet expects the ioctl to be called with a struct
+like
+ struct ifreq_dn {
+ char ifr_name[IFNAMSIZ];
+ struct sockaddr_dn ifr_addr;
+ };
+
+since it does
+ struct ifreq *ifr = ...;
+ struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
+
+This means that DN_IFREQ_SIZE is too big for what it wants on
+64-bit, as it is
+ sizeof(struct ifreq) - sizeof(struct sockaddr) +
+ sizeof(struct sockaddr_dn)
+
+This assumes that sizeof(struct sockaddr) is the size of ifr_ifru
+but that isn't true.
+
+Fix this to use offsetof(struct ifreq, ifr_ifru).
+
+This indeed doesn't really matter much - the result is that we
+copy in/out 8 bytes more than we should on 64-bit platforms. In
+case the "struct ifreq_dn" lands just on the end of a page though
+it might lead to faults.
+
+As far as I can tell, it has been like this forever, so it seems
+very likely that nobody cares.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/decnet/dn_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index df042b6d80b83..22876a197ebec 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -56,7 +56,7 @@
+ #include <net/dn_neigh.h>
+ #include <net/dn_fib.h>
+
+-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
+
+ static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
+ static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00};
+--
+2.20.1
+
--- /dev/null
+From 69c2c59369e3caca7591011479dfa8da0253aecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 08:04:24 -0500
+Subject: dm flakey: Properly corrupt multi-page bios.
+
+From: Sweet Tea <sweettea@redhat.com>
+
+[ Upstream commit a00f5276e26636cbf72f24f79831026d2e2868e7 ]
+
+The flakey target is documented to be able to corrupt the Nth byte in
+a bio, but does not corrupt byte indices after the first biovec in the
+bio. Change the corrupting function to actually corrupt the Nth byte
+no matter in which biovec that index falls.
+
+A test device generating two-page bios, atop a flakey device configured
+to corrupt a byte index on the second page, verified both the failure
+to corrupt before this patch and the expected corruption after this
+change.
+
+Signed-off-by: John Dorminy <jdorminy@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-flakey.c | 33 ++++++++++++++++++++++-----------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index 0c1ef63c3461b..b1b68e01b889c 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -282,20 +282,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio)
+
+ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc)
+ {
+- unsigned bio_bytes = bio_cur_bytes(bio);
+- char *data = bio_data(bio);
++ unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1;
++
++ struct bvec_iter iter;
++ struct bio_vec bvec;
++
++ if (!bio_has_data(bio))
++ return;
+
+ /*
+- * Overwrite the Nth byte of the data returned.
++ * Overwrite the Nth byte of the bio's data, on whichever page
++ * it falls.
+ */
+- if (data && bio_bytes >= fc->corrupt_bio_byte) {
+- data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value;
+-
+- DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
+- "(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n",
+- bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
+- (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
+- (unsigned long long)bio->bi_iter.bi_sector, bio_bytes);
++ bio_for_each_segment(bvec, bio, iter) {
++ if (bio_iter_len(bio, iter) > corrupt_bio_byte) {
++ char *segment = (page_address(bio_iter_page(bio, iter))
++ + bio_iter_offset(bio, iter));
++ segment[corrupt_bio_byte] = fc->corrupt_bio_value;
++ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
++ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
++ bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
++ (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
++ (unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size);
++ break;
++ }
++ corrupt_bio_byte -= bio_iter_len(bio, iter);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 70cfea86061a62a748f59ad98730980dc0550296 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:37 +0100
+Subject: drbd: do not block when adjusting "disk-options" while IO is frozen
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit f708bd08ecbdc23d03aaedf5b3311ebe44cfdb50 ]
+
+"suspending" IO is overloaded.
+It can mean "do not allow new requests" (obviously),
+but it also may mean "must not complete pending IO",
+for example while the fencing handlers do their arbitration.
+
+When adjusting disk options, we suspend io (disallow new requests), then
+wait for the activity-log to become unused (drain all IO completions),
+and possibly replace it with a new activity log of different size.
+
+If the other "suspend IO" aspect is active, pending IO completions won't
+happen, and we would block forever (unkillable drbdsetup process).
+
+Fix this by skipping the activity log adjustment if the "al-extents"
+setting did not change. Also, in case it did change, fail early without
+blocking if it looks like we would block forever.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 37 ++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index a675a0f61f9c0..31d7fe4480afd 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1515,6 +1515,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis
+ }
+ }
+
++static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc)
++{
++ int err = -EBUSY;
++
++ if (device->act_log &&
++ device->act_log->nr_elements == dc->al_extents)
++ return 0;
++
++ drbd_suspend_io(device);
++ /* If IO completion is currently blocked, we would likely wait
++ * "forever" for the activity log to become unused. So we don't. */
++ if (atomic_read(&device->ap_bio_cnt))
++ goto out;
++
++ wait_event(device->al_wait, lc_try_lock(device->act_log));
++ drbd_al_shrink(device);
++ err = drbd_check_al_size(device, dc);
++ lc_unlock(device->act_log);
++ wake_up(&device->al_wait);
++out:
++ drbd_resume_io(device);
++ return err;
++}
++
+ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ {
+ struct drbd_config_context adm_ctx;
+@@ -1577,15 +1601,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- drbd_suspend_io(device);
+- wait_event(device->al_wait, lc_try_lock(device->act_log));
+- drbd_al_shrink(device);
+- err = drbd_check_al_size(device, new_disk_conf);
+- lc_unlock(device->act_log);
+- wake_up(&device->al_wait);
+- drbd_resume_io(device);
+-
++ err = disk_opts_check_al_size(device, new_disk_conf);
+ if (err) {
++ /* Could be just "busy". Ignore?
++ * Introduce dedicated error code? */
++ drbd_msg_put_info(adm_ctx.reply_skb,
++ "Try again without changing current al-extents setting");
+ retcode = ERR_NOMEM;
+ goto fail_unlock;
+ }
+--
+2.20.1
+
--- /dev/null
+From 50b1d0033d928e8552e83c866a59b8e6f1273d31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:39 +0100
+Subject: drbd: fix print_st_err()'s prototype to match the definition
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 2c38f035117331eb78d0504843c79ea7c7fabf37 ]
+
+print_st_err() is defined with its 4th argument taking an
+'enum drbd_state_rv' but its prototype use an int for it.
+
+Fix this by using 'enum drbd_state_rv' in the prototype too.
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Roland Kammerer <roland.kammerer@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_state.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index ea58301d0895c..b2a390ba73a05 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -131,7 +131,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state
+ enum chg_state_flags,
+ struct completion *done);
+ extern void print_st_err(struct drbd_device *, union drbd_state,
+- union drbd_state, int);
++ union drbd_state, enum drbd_state_rv);
+
+ enum drbd_state_rv
+ _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val,
+--
+2.20.1
+
--- /dev/null
+From 682a8bd94a5559b6288fa12f669ec0aefb24c16e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:31 +0100
+Subject: drbd: ignore "all zero" peer volume sizes in handshake
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit 94c43a13b8d6e3e0dd77b3536b5e04a84936b762 ]
+
+During handshake, if we are diskless ourselves, we used to accept any size
+presented by the peer.
+
+Which could be zero if that peer was just brought up and connected
+to us without having a disk attached first, in which case both
+peers would just "flip" their volume sizes.
+
+Now, even a diskless node will ignore "zero" sizes
+presented by a diskless peer.
+
+Also a currently Diskless Primary will refuse to shrink during handshake:
+it may be frozen, and waiting for a "suitable" local disk or peer to
+re-appear (on-no-data-accessible suspend-io). If the peer is smaller
+than what we used to be, it is not suitable.
+
+The logic for a diskless node during handshake is now supposed to be:
+believe the peer, if
+ - I don't have a current size myself
+ - we agree on the size anyways
+ - I do have a current size, am Secondary, and he has the only disk
+ - I do have a current size, am Primary, and he has the only disk,
+ which is larger than my current size
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_receiver.c | 33 +++++++++++++++++++++++++++---
+ 1 file changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 8fbdfaacc2226..08586bc5219bf 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -3977,6 +3977,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL;
+ enum determine_dev_size dd = DS_UNCHANGED;
+ sector_t p_size, p_usize, p_csize, my_usize;
++ sector_t new_size, cur_size;
+ int ldsc = 0; /* local disk size changed */
+ enum dds_flags ddsf;
+
+@@ -3984,6 +3985,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ if (!peer_device)
+ return config_unknown_volume(connection, pi);
+ device = peer_device->device;
++ cur_size = drbd_get_capacity(device->this_bdev);
+
+ p_size = be64_to_cpu(p->d_size);
+ p_usize = be64_to_cpu(p->u_size);
+@@ -3994,7 +3996,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ device->p_size = p_size;
+
+ if (get_ldev(device)) {
+- sector_t new_size, cur_size;
+ rcu_read_lock();
+ my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size;
+ rcu_read_unlock();
+@@ -4012,7 +4013,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ /* Never shrink a device with usable data during connect.
+ But allow online shrinking if we are connected. */
+ new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0);
+- cur_size = drbd_get_capacity(device->this_bdev);
+ if (new_size < cur_size &&
+ device->state.disk >= D_OUTDATED &&
+ device->state.conn < C_CONNECTED) {
+@@ -4077,9 +4077,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ *
+ * However, if he sends a zero current size,
+ * take his (user-capped or) backing disk size anyways.
++ *
++ * Unless of course he does not have a disk himself.
++ * In which case we ignore this completely.
+ */
++ sector_t new_size = p_csize ?: p_usize ?: p_size;
+ drbd_reconsider_queue_parameters(device, NULL, o);
+- drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size);
++ if (new_size == 0) {
++ /* Ignore, peer does not know nothing. */
++ } else if (new_size == cur_size) {
++ /* nothing to do */
++ } else if (cur_size != 0 && p_size == 0) {
++ drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ } else if (new_size < cur_size && device->state.role == R_PRIMARY) {
++ drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD);
++ return -EIO;
++ } else {
++ /* I believe the peer, if
++ * - I don't have a current size myself
++ * - we agree on the size anyways
++ * - I do have a current size, am Secondary,
++ * and he has the only disk
++ * - I do have a current size, am Primary,
++ * and he has the only disk,
++ * which is larger than my current size
++ */
++ drbd_set_my_capacity(device, new_size);
++ }
+ }
+
+ if (get_ldev(device)) {
+--
+2.20.1
+
--- /dev/null
+From 4eddb619b0080664cabe9e6b986c5b27cf82d8f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:35 +0100
+Subject: drbd: reject attach of unsuitable uuids even if connected
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit fe43ed97bba3b11521abd934b83ed93143470e4f ]
+
+Multiple failure scenario:
+a) all good
+ Connected Primary/Secondary UpToDate/UpToDate
+b) lose disk on Primary,
+ Connected Primary/Secondary Diskless/UpToDate
+c) continue to write to the device,
+ changes only make it to the Secondary storage.
+d) lose disk on Secondary,
+ Connected Primary/Secondary Diskless/Diskless
+e) now try to re-attach on Primary
+
+This would have succeeded before, even though that is clearly the
+wrong data set to attach to (missing the modifications from c).
+Because we only compared our "effective" and the "to-be-attached"
+data generation uuid tags if (device->state.conn < C_CONNECTED).
+
+Fix: change that constraint to (device->state.pdsk != D_UP_TO_DATE)
+compare the uuids, and reject the attach.
+
+This patch also tries to improve the reverse scenario:
+first lose Secondary, then Primary disk,
+then try to attach the disk on Secondary.
+
+Before this patch, the attach on the Secondary succeeds, but since commit
+drbd: disconnect, if the wrong UUIDs are attached on a connected peer
+the Primary will notice unsuitable data, and drop the connection hard.
+
+Though unfortunately at a point in time during the handshake where
+we cannot easily abort the attach on the peer without more
+refactoring of the handshake.
+
+We now reject any attach to "unsuitable" uuids,
+as long as we can see a Primary role,
+unless we already have access to "good" data.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 6 +++---
+ drivers/block/drbd/drbd_receiver.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index ad13ec66c8e4d..a675a0f61f9c0 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1935,9 +1935,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- if (device->state.conn < C_CONNECTED &&
+- device->state.role == R_PRIMARY && device->ed_uuid &&
+- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
++ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid &&
++ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) &&
++ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
+ drbd_err(device, "Can only attach to data with current UUID=%016llX\n",
+ (unsigned long long)device->ed_uuid);
+ retcode = ERR_DATA_NOT_CURRENT;
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 08586bc5219bf..a7c180426c601 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -4392,6 +4392,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info
+ if (peer_state.conn == C_AHEAD)
+ ns.conn = C_BEHIND;
+
++ /* TODO:
++ * if (primary and diskless and peer uuid != effective uuid)
++ * abort attach on peer;
++ *
++ * If this node does not have good data, was already connected, but
++ * the peer did a late attach only now, trying to "negotiate" with me,
++ * AND I am currently Primary, possibly frozen, with some specific
++ * "effective" uuid, this should never be reached, really, because
++ * we first send the uuids, then the current state.
++ *
++ * In this scenario, we already dropped the connection hard
++ * when we received the unsuitable uuids (receive_uuids().
++ *
++ * Should we want to change this, that is: not drop the connection in
++ * receive_uuids() already, then we would need to add a branch here
++ * that aborts the attach of "unsuitable uuids" on the peer in case
++ * this node is currently Diskless Primary.
++ */
++
+ if (device->p_uuid && peer_state.disk >= D_NEGOTIATING &&
+ get_ldev_if_state(device, D_NEGOTIATING)) {
+ int cr; /* consider resync */
+--
+2.20.1
+
--- /dev/null
+From 7201500e21232fdf6a283008590d1e46b7a9ec67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:29:05 -0800
+Subject: drivers/base/platform.c: kmemleak ignore a known leak
+
+From: Qian Cai <cai@gmx.us>
+
+[ Upstream commit 967d3010df8b6f6f9aa95c198edc5fe3646ebf36 ]
+
+unreferenced object 0xffff808ec6dc5a80 (size 128):
+ comm "swapper/0", pid 1, jiffies 4294938063 (age 2560.530s)
+ hex dump (first 32 bytes):
+ ff ff ff ff 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
+ 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
+ backtrace:
+ [<00000000476dcf8c>] kmem_cache_alloc_trace+0x430/0x500
+ [<000000004f708d37>] platform_device_register_full+0xbc/0x1e8
+ [<000000006c2a7ec7>] acpi_create_platform_device+0x370/0x450
+ [<00000000ef135642>] acpi_default_enumeration+0x34/0x78
+ [<000000003bd9a052>] acpi_bus_attach+0x2dc/0x3e0
+ [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+ [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+ [<000000002968643e>] acpi_bus_scan+0xb0/0x110
+ [<0000000010dd0bd7>] acpi_scan_init+0x1a8/0x410
+ [<00000000965b3c5a>] acpi_init+0x408/0x49c
+ [<00000000ed4b9fe2>] do_one_initcall+0x178/0x7f4
+ [<00000000a5ac5a74>] kernel_init_freeable+0x9d4/0xa9c
+ [<0000000070ea6c15>] kernel_init+0x18/0x138
+ [<00000000fb8fff06>] ret_from_fork+0x10/0x1c
+ [<0000000041273a0d>] 0xffffffffffffffff
+
+Then, faddr2line pointed out this line,
+
+/*
+ * This memory isn't freed when the device is put,
+ * I don't have a nice idea for that though. Conceptually
+ * dma_mask in struct device should not be a pointer.
+ * See http://thread.gmane.org/gmane.linux.kernel.pci/9081
+ */
+pdev->dev.dma_mask =
+ kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
+
+Since this leak has existed for more than 8 years and it does not
+reference other parts of the memory, let kmemleak ignore it, so users
+don't need to waste time reporting this in the future.
+
+Link: http://lkml.kernel.org/r/20181206160751.36211-1-cai@gmx.us
+Signed-off-by: Qian Cai <cai@gmx.us>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J . Wysocki" <rafael.j.wysocki@intel.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 9045c5f3734e8..f1105de0d9fed 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -27,6 +27,7 @@
+ #include <linux/clk/clk-conf.h>
+ #include <linux/limits.h>
+ #include <linux/property.h>
++#include <linux/kmemleak.h>
+
+ #include "base.h"
+ #include "power/power.h"
+@@ -526,6 +527,8 @@ struct platform_device *platform_device_register_full(
+ if (!pdev->dev.dma_mask)
+ goto err;
+
++ kmemleak_ignore(pdev->dev.dma_mask);
++
+ *pdev->dev.dma_mask = pdevinfo->dma_mask;
+ pdev->dev.coherent_dma_mask = pdevinfo->dma_mask;
+ }
+--
+2.20.1
+
--- /dev/null
+From fcd112c35fffdd1d6e13c3b5bbf05b0068530cc9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 23:04:13 -0600
+Subject: drivers/regulator: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 966e927bf8cc6a44f8b72582a1d6d3ffc73b12ad ]
+
+If palmas_smps_read() fails, we should not use the read data in "reg"
+which may contain random value. The fix inserts a check for the return
+value of palmas_smps_read(): If it fails, we return the error code
+upstream and stop using "reg".
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/palmas-regulator.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index bb5ab7d78895b..c2cc392a27d40 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -443,13 +443,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg,
+ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
+ {
+ int id = rdev_get_id(dev);
++ int ret;
+ struct palmas_pmic *pmic = rdev_get_drvdata(dev);
+ struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata;
+ struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id];
+ unsigned int reg;
+ bool rail_enable = true;
+
+- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ if (ret)
++ return ret;
+
+ reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+
+--
+2.20.1
+
--- /dev/null
+From fde257d2d3dcda8d1f8280fa83e8f123c8c9ae63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 22:26:42 -0500
+Subject: exofs_mount(): fix leaks on failure exits
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 26cb5a328c6b2bda9e859307ce4cfc60df3a2c28 ]
+
+... and don't abuse mount_nodev(), while we are at it.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exofs/super.c | 37 +++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index c9ec652e2fcd2..881d5798a1814 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -702,21 +702,18 @@ out:
+ /*
+ * Read the superblock from the OSD and fill in the fields
+ */
+-static int exofs_fill_super(struct super_block *sb, void *data, int silent)
++static int exofs_fill_super(struct super_block *sb,
++ struct exofs_mountopt *opts,
++ struct exofs_sb_info *sbi,
++ int silent)
+ {
+ struct inode *root;
+- struct exofs_mountopt *opts = data;
+- struct exofs_sb_info *sbi; /*extended info */
+ struct osd_dev *od; /* Master device */
+ struct exofs_fscb fscb; /*on-disk superblock info */
+ struct ore_comp comp;
+ unsigned table_count;
+ int ret;
+
+- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+- if (!sbi)
+- return -ENOMEM;
+-
+ /* use mount options to fill superblock */
+ if (opts->is_osdname) {
+ struct osd_dev_info odi = {.systemid_len = 0};
+@@ -860,7 +857,9 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ int flags, const char *dev_name,
+ void *data)
+ {
++ struct super_block *s;
+ struct exofs_mountopt opts;
++ struct exofs_sb_info *sbi;
+ int ret;
+
+ ret = parse_options(data, &opts);
+@@ -869,9 +868,31 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ return ERR_PTR(ret);
+ }
+
++ sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
++ if (!sbi) {
++ kfree(opts.dev_name);
++ return ERR_PTR(-ENOMEM);
++ }
++
++ s = sget(type, NULL, set_anon_super, flags, NULL);
++
++ if (IS_ERR(s)) {
++ kfree(opts.dev_name);
++ kfree(sbi);
++ return ERR_CAST(s);
++ }
++
+ if (!opts.dev_name)
+ opts.dev_name = dev_name;
+- return mount_nodev(type, flags, &opts, exofs_fill_super);
++
++
++ ret = exofs_fill_super(s, &opts, sbi, flags & SB_SILENT ? 1 : 0);
++ if (ret) {
++ deactivate_locked_super(s);
++ return ERR_PTR(ret);
++ }
++ s->s_flags |= SB_ACTIVE;
++ return dget(s->s_root);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 533b6950b413fd564fb6a3e1f64f53e959c9b999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 09:32:25 +0800
+Subject: f2fs: fix to data block override node segment by mistake
+
+From: zhengliang <zhengliang6@huawei.com>
+
+[ Upstream commit a0770e13c8da83bdb64738c0209ab02dd3cfff8b ]
+
+v4: Rearrange the previous three versions.
+
+The following scenario could lead to data block override by mistake.
+
+TASK A | TASK kworker | TASK B | TASK C
+ | | |
+open | | |
+write | | |
+close | | |
+ | f2fs_write_data_pages | |
+ | f2fs_write_cache_pages | |
+ | f2fs_outplace_write_data | |
+ | f2fs_allocate_data_block (get block in seg S, | |
+ | S is full, and only | |
+ | have this valid data | |
+ | block) | |
+ | allocate_segment | |
+ | locate_dirty_segment (mark S as PRE) | |
+ | f2fs_submit_page_write (submit but is not | |
+ | written on dev) | |
+unlink | | |
+ iput_final | | |
+ f2fs_drop_inode | | |
+ f2fs_truncate | | |
+ (not evict) | | |
+ | | write_checkpoint |
+ | | flush merged bio but not wait file data writeback |
+ | | set_prefree_as_free (mark S as FREE) |
+ | | | update NODE/DATA
+ | | | allocate_segment (select S)
+ | writeback done | |
+
+So we need to guarantee io complete before truncate inode in f2fs_drop_inode.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index e4aabfc21bd43..9554338f9c35d 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -668,6 +668,10 @@ static int f2fs_drop_inode(struct inode *inode)
+ sb_start_intwrite(inode->i_sb);
+ f2fs_i_size_write(inode, 0);
+
++ f2fs_submit_merged_write_cond(F2FS_I_SB(inode),
++ inode, NULL, 0, DATA);
++ truncate_inode_pages_final(inode->i_mapping);
++
+ if (F2FS_HAS_BLOCKS(inode))
+ f2fs_truncate(inode);
+
+--
+2.20.1
+
--- /dev/null
+From 3dce5e0aba6b8034d7e8f7fd062bb16c71f5a2b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 19:20:17 +0800
+Subject: f2fs: fix to dirty inode synchronously
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit b32e019049e959ee10ec359893c9dd5d057dad55 ]
+
+If user change inode's i_flags via ioctl, let's add it into global
+dirty list, so that checkpoint can guarantee its persistence before
+fsync, it can make checkpoint keeping strong consistency.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 1b17921994459..d68b0132718a6 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1593,7 +1593,7 @@ static int __f2fs_ioc_setflags(struct inode *inode, unsigned int flags)
+
+ inode->i_ctime = current_time(inode);
+ f2fs_set_inode_flags(inode);
+- f2fs_mark_inode_dirty_sync(inode, false);
++ f2fs_mark_inode_dirty_sync(inode, true);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0fba5b6aabc750749f6b2666db064ab6c2145169 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:28:03 -0800
+Subject: fork: fix some -Wmissing-prototypes warnings
+
+From: Yi Wang <wang.yi59@zte.com.cn>
+
+[ Upstream commit fb5bf31722d0805a3f394f7d59f2e8cd07acccb7 ]
+
+We get a warning when building kernel with W=1:
+
+ kernel/fork.c:167:13: warning: no previous prototype for `arch_release_thread_stack' [-Wmissing-prototypes]
+ kernel/fork.c:779:13: warning: no previous prototype for `fork_init' [-Wmissing-prototypes]
+
+Add the missing declaration in head file to fix this.
+
+Also, remove arch_release_thread_stack() completely because no arch
+seems to implement it since bb9d81264 (arch: remove tile port).
+
+Link: http://lkml.kernel.org/r/1542170087-23645-1-git-send-email-wang.yi59@zte.com.cn
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched/task.h | 2 ++
+ init/main.c | 1 -
+ kernel/fork.c | 5 -----
+ 3 files changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
+index a74ec619ac510..11b4fba82950f 100644
+--- a/include/linux/sched/task.h
++++ b/include/linux/sched/task.h
+@@ -39,6 +39,8 @@ void __noreturn do_task_dead(void);
+
+ extern void proc_caches_init(void);
+
++extern void fork_init(void);
++
+ extern void release_task(struct task_struct * p);
+
+ #ifdef CONFIG_HAVE_COPY_THREAD_TLS
+diff --git a/init/main.c b/init/main.c
+index 51067e2db509d..b1ab36fe1a55c 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -98,7 +98,6 @@
+ static int kernel_init(void *);
+
+ extern void init_IRQ(void);
+-extern void fork_init(void);
+ extern void radix_tree_init(void);
+
+ /*
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 3352fdbd5e20d..3d9d6a28e21d9 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -162,10 +162,6 @@ static inline void free_task_struct(struct task_struct *tsk)
+ }
+ #endif
+
+-void __weak arch_release_thread_stack(unsigned long *stack)
+-{
+-}
+-
+ #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR
+
+ /*
+@@ -348,7 +344,6 @@ static void release_task_stack(struct task_struct *tsk)
+ return; /* Better to leak the stack than to free prematurely */
+
+ account_kernel_stack(tsk, -1);
+- arch_release_thread_stack(tsk->stack);
+ free_thread_stack(tsk);
+ tsk->stack = NULL;
+ #ifdef CONFIG_VMAP_STACK
+--
+2.20.1
+
--- /dev/null
+From ea37350230f478b81f79f3ea7a7ca59e7d059c13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 08:29:32 -0600
+Subject: gfs2: take jdata unstuff into account in do_grow
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit bc0205612bbd4dd4026d4ba6287f5643c37366ec ]
+
+Before this patch, function do_grow would not reserve enough journal
+blocks in the transaction to unstuff jdata files while growing them.
+This patch adds the logic to add one more block if the file to grow
+is jdata.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Reviewed-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/bmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 09432b25fe9b8..b3a1b16d4e3e3 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -1445,6 +1445,8 @@ static int do_grow(struct inode *inode, u64 size)
+ }
+
+ error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT +
++ (unstuff &&
++ gfs2_is_jdata(ip) ? RES_JDATA : 0) +
+ (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ?
+ 0 : RES_QUOTA), 0);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From 2c6b3f891ddfe27b969bf004e199e35c3d2e273a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 10:45:49 +0100
+Subject: gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c5510b8dafce5f3f5a039c9b262ebcae0092c462 ]
+
+If CONFIG_GPOILIB is not set, the stub of gpio_to_desc() should return
+the same type of error as regular version: NULL. All the callers
+compare the return value of gpio_to_desc() against NULL, so returned
+ERR_PTR would be treated as non-error case leading to dereferencing of
+error value.
+
+Fixes: 79a9becda894 ("gpiolib: export descriptor-based GPIO interface")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index c4a350d835788..79ad4f8b889dc 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -404,7 +404,7 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc)
+
+ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+- return ERR_PTR(-EINVAL);
++ return NULL;
+ }
+
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+--
+2.20.1
+
--- /dev/null
+From 5aebd80f3d11a3cae6fca0eb2d04c1ce1269f850 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 16:46:29 +0100
+Subject: gpu: ipu-v3: pre: don't trigger update if buffer address doesn't
+ change
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit eb0200a4357da100064971689d3a0e9e3cf57f33 ]
+
+On a NOP double buffer update where current buffer address is the same
+as the next buffer address, the SDW_UPDATE bit clears too late. As we
+are now using this bit to determine when it is safe to signal flip
+completion to userspace this will delay completion of atomic commits
+where one plane doesn't change the buffer by a whole frame period.
+
+Fix this by remembering the last buffer address and just skip the
+double buffer update if it would not change the buffer address.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+[p.zabel@pengutronix.de: initialize last_bufaddr in ipu_pre_configure]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-pre.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
+index 1d1612e28854b..6fd4af647f599 100644
+--- a/drivers/gpu/ipu-v3/ipu-pre.c
++++ b/drivers/gpu/ipu-v3/ipu-pre.c
+@@ -102,6 +102,7 @@ struct ipu_pre {
+ void *buffer_virt;
+ bool in_use;
+ unsigned int safe_window_end;
++ unsigned int last_bufaddr;
+ };
+
+ static DEFINE_MUTEX(ipu_pre_list_mutex);
+@@ -177,6 +178,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
+
+ writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
+ writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++ pre->last_bufaddr = bufaddr;
+
+ val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) |
+ IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) |
+@@ -218,7 +220,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
+ unsigned short current_yblock;
+ u32 val;
+
++ if (bufaddr == pre->last_bufaddr)
++ return;
++
+ writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++ pre->last_bufaddr = bufaddr;
+
+ do {
+ if (time_after(jiffies, timeout)) {
+--
+2.20.1
+
--- /dev/null
+From 3ff5f52aed51118629bf80f53c39e42d071c7055 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 11:28:51 +1000
+Subject: HID: doc: fix wrong data structure reference for UHID_OUTPUT
+
+From: Peter Hutterer <peter.hutterer@who-t.net>
+
+[ Upstream commit 46b14eef59a8157138dc02f916a7f97c73b3ec53 ]
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hid/uhid.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt
+index c8656dd029a91..958fff9453044 100644
+--- a/Documentation/hid/uhid.txt
++++ b/Documentation/hid/uhid.txt
+@@ -160,7 +160,7 @@ them but you should handle them according to your needs.
+ UHID_OUTPUT:
+ This is sent if the HID device driver wants to send raw data to the I/O
+ device on the interrupt channel. You should read the payload and forward it to
+- the device. The payload is of type "struct uhid_data_req".
++ the device. The payload is of type "struct uhid_output_req".
+ This may be received even though you haven't received UHID_OPEN, yet.
+
+ UHID_GET_REPORT:
+--
+2.20.1
+
--- /dev/null
+From fd48023afc8e2bc22be510a6e585b7d2f04117c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 08:52:33 +0800
+Subject: HID: intel-ish-hid: fixes incorrect error handling
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 6e0856d317440a950b17c00a9283114f025e5699 ]
+
+The memory chunk allocated by hid_allocate_device() should be released
+by hid_destroy_device(), not kfree().
+
+Fixes: 0b28cb4bcb1("HID: intel-ish-hid: ISH HID client driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ishtp-hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c
+index cd23903ddcf19..e918d78e541c0 100644
+--- a/drivers/hid/intel-ish-hid/ishtp-hid.c
++++ b/drivers/hid/intel-ish-hid/ishtp-hid.c
+@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev,
+ err_hid_device:
+ kfree(hid_data);
+ err_hid_data:
+- kfree(hid);
++ hid_destroy_device(hid);
+ return rv;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9f57342da70f810e71ae1101bf292a2c17c198de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 10:05:36 +0300
+Subject: IB/qib: Fix an error code in qib_sdma_verbs_send()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5050ae5fa3d54c8e83e1e447cc7e3591110a7f57 ]
+
+We accidentally return success on this error path.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
+index 891873b38a1e6..5f3f197678b78 100644
+--- a/drivers/infiniband/hw/qib/qib_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_sdma.c
+@@ -600,8 +600,10 @@ retry:
+ dw = (len + 3) >> 2;
+ addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr,
+ dw << 2, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr))
++ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) {
++ ret = -ENOMEM;
+ goto unmap;
++ }
+ sdmadesc[0] = 0;
+ make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset);
+ /* SDmaUseLargeBuf has to be set in every descriptor */
+--
+2.20.1
+
--- /dev/null
+From c3e976f4e99644a79ee4ef2e01bdb40654ccf3f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 00:32:42 -0600
+Subject: IB/rxe: Make counters thread safe
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit d5108e69fe013ff47ab815b849caba9cc33ca1e5 ]
+
+Current rxe device counters are not thread safe.
+When multiple QPs are used, they can be racy.
+Make them thread safe by making it atomic64.
+
+Fixes: 0b1e5b99a48b ("IB/rxe: Add port protocol stats")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_hw_counters.c | 2 +-
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_hw_counters.c b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+index 6aeb7a165e469..ea4542a9d69e6 100644
+--- a/drivers/infiniband/sw/rxe/rxe_hw_counters.c
++++ b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+@@ -59,7 +59,7 @@ int rxe_ib_get_hw_stats(struct ib_device *ibdev,
+ return -EINVAL;
+
+ for (cnt = 0; cnt < ARRAY_SIZE(rxe_counter_name); cnt++)
+- stats->value[cnt] = dev->stats_counters[cnt];
++ stats->value[cnt] = atomic64_read(&dev->stats_counters[cnt]);
+
+ return ARRAY_SIZE(rxe_counter_name);
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index b2b76a316ebae..d1cc89f6f2e33 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -410,16 +410,16 @@ struct rxe_dev {
+ spinlock_t mmap_offset_lock; /* guard mmap_offset */
+ int mmap_offset;
+
+- u64 stats_counters[RXE_NUM_OF_COUNTERS];
++ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS];
+
+ struct rxe_port port;
+ struct list_head list;
+ struct crypto_shash *tfm;
+ };
+
+-static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters cnt)
++static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index)
+ {
+- rxe->stats_counters[cnt]++;
++ atomic64_inc(&rxe->stats_counters[index]);
+ }
+
+ static inline struct rxe_dev *to_rdev(struct ib_device *dev)
+--
+2.20.1
+
--- /dev/null
+From 5ca9aec84d88fce8b42f48e0979e1918f0aa1d5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 00:25:08 -0400
+Subject: idr: Fix idr_alloc_u32 on 32-bit systems
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit b7e9728f3d7fc5c5c8508d99f1675212af5cfd49 ]
+
+Attempting to allocate an entry at 0xffffffff when one is already
+present would succeed in allocating one at 2^32, which would confuse
+everything. Return -ENOSPC in this case, as expected.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/radix-tree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index d172f0341b807..ff00c816266b1 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -2184,7 +2184,7 @@ void __rcu **idr_get_free_cmn(struct radix_tree_root *root,
+ offset = radix_tree_find_next_bit(node, IDR_FREE,
+ offset + 1);
+ start = next_index(start, node, offset);
+- if (start > max)
++ if (start > max || start == 0)
+ return ERR_PTR(-ENOSPC);
+ while (offset == RADIX_TREE_MAP_SIZE) {
+ offset = node->offset + 1;
+--
+2.20.1
+
--- /dev/null
+From 5932a1347b2ae51ec61654bca50714c3f44eb3f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2019 21:53:24 +0800
+Subject: iommu/amd: Fix NULL dereference bug in match_hid_uid
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+[ Upstream commit bb6bccba390c7d743c1e4427de4ef284c8cc6869 ]
+
+Add a non-NULL check to fix potential NULL pointer dereference
+Cleanup code to call function once.
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Fixes: 2bf9a0a12749b ('iommu/amd: Add iommu support for ACPI HID devices')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 07b6cf58fd99b..d09c24825734e 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -139,10 +139,14 @@ static struct lock_class_key reserved_rbtree_key;
+ static inline int match_hid_uid(struct device *dev,
+ struct acpihid_map_entry *entry)
+ {
++ struct acpi_device *adev = ACPI_COMPANION(dev);
+ const char *hid, *uid;
+
+- hid = acpi_device_hid(ACPI_COMPANION(dev));
+- uid = acpi_device_uid(ACPI_COMPANION(dev));
++ if (!adev)
++ return -ENODEV;
++
++ hid = acpi_device_hid(adev);
++ uid = acpi_device_uid(adev);
+
+ if (!hid || !(*hid))
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From a9bf31f674f7d416faa0cac3356c696c8f10162a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 13:11:25 +0800
+Subject: ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
+
+From: wenxu <wenxu@ucloud.cn>
+
+[ Upstream commit d71b57532d70c03f4671dd04e84157ac6bf021b0 ]
+
+ip l add dev tun type gretap key 1000
+ip a a dev tun 10.0.0.1/24
+
+Packets with tun-id 1000 can be recived by tun dev. But packet can't
+be sent through dev tun for non-tunnel-dst
+
+With this patch: tunnel-dst can be get through lwtunnel like beflow:
+ip r a 10.0.0.7 encap ip dst 172.168.0.11 dev tun
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index fabc299cb875f..7a31287ff1232 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -661,13 +661,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ dst = tnl_params->daddr;
+ if (dst == 0) {
+ /* NBMA tunnel */
++ struct ip_tunnel_info *tun_info;
+
+ if (!skb_dst(skb)) {
+ dev->stats.tx_fifo_errors++;
+ goto tx_error;
+ }
+
+- if (skb->protocol == htons(ETH_P_IP)) {
++ tun_info = skb_tunnel_info(skb);
++ if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
++ ip_tunnel_info_af(tun_info) == AF_INET &&
++ tun_info->key.u.ipv4.dst)
++ dst = tun_info->key.u.ipv4.dst;
++ else if (skb->protocol == htons(ETH_P_IP)) {
+ rt = skb_rtable(skb);
+ dst = rt_nexthop(rt, inner_iph->daddr);
+ }
+--
+2.20.1
+
--- /dev/null
+From a15f22460764a17554e81e835175cd17bb0b8f8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 09:23:08 +0300
+Subject: iwlwifi: move iwl_nvm_check_version() into dvm
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 64866e5da1eabd0c52ff45029b245f5465920031 ]
+
+This function is only half-used by mvm (i.e. only the nvm_version part
+matters, since the calibration version is irrelevant), so it's
+pointless to export it from iwlwifi. If mvm uses this function, it
+has the additional complexity of setting the calib version to a bogus
+value on all cfg structs.
+
+To avoid this, move the function to dvm and make a simple comparison
+of the nvm_version in mvm instead.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/main.c | 17 +++++++++++++++++
+ .../wireless/intel/iwlwifi/iwl-eeprom-parse.c | 19 -------------------
+ .../wireless/intel/iwlwifi/iwl-eeprom-parse.h | 5 ++---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +++-
+ 4 files changed, 22 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+index 2acd94da9efeb..051a2fea95724 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+@@ -1229,6 +1229,23 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
+ return 0;
+ }
+
++static int iwl_nvm_check_version(struct iwl_nvm_data *data,
++ struct iwl_trans *trans)
++{
++ if (data->nvm_version >= trans->cfg->nvm_ver ||
++ data->calib_version >= trans->cfg->nvm_calib_ver) {
++ IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
++ data->nvm_version, data->calib_version);
++ return 0;
++ }
++
++ IWL_ERR(trans,
++ "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
++ data->nvm_version, trans->cfg->nvm_ver,
++ data->calib_version, trans->cfg->nvm_calib_ver);
++ return -EINVAL;
++}
++
+ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
+ const struct iwl_cfg *cfg,
+ const struct iwl_fw *fw,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+index 3199d345b4274..92727f7e42db7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+@@ -928,22 +928,3 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ return NULL;
+ }
+ IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data);
+-
+-/* helper functions */
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+- struct iwl_trans *trans)
+-{
+- if (data->nvm_version >= trans->cfg->nvm_ver ||
+- data->calib_version >= trans->cfg->nvm_calib_ver) {
+- IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
+- data->nvm_version, data->calib_version);
+- return 0;
+- }
+-
+- IWL_ERR(trans,
+- "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
+- data->nvm_version, trans->cfg->nvm_ver,
+- data->calib_version, trans->cfg->nvm_calib_ver);
+- return -EINVAL;
+-}
+-IWL_EXPORT_SYMBOL(iwl_nvm_check_version);
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+index b33888991b946..5545210151cd9 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+@@ -7,6 +7,7 @@
+ *
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -33,6 +34,7 @@
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -121,9 +123,6 @@ struct iwl_nvm_data *
+ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ const u8 *eeprom, size_t eeprom_size);
+
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+- struct iwl_trans *trans);
+-
+ int iwl_init_sband_channels(struct iwl_nvm_data *data,
+ struct ieee80211_supported_band *sband,
+ int n_channels, enum nl80211_band band);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 534c0ea7b232e..78228f870f8f5 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -501,7 +501,9 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
+ if (mvm->nvm_file_name)
+ iwl_mvm_load_nvm_to_nic(mvm);
+
+- WARN_ON(iwl_nvm_check_version(mvm->nvm_data, mvm->trans));
++ WARN_ONCE(mvm->nvm_data->nvm_version < mvm->trans->cfg->nvm_ver,
++ "Too old NVM version (0x%0x, required = 0x%0x)",
++ mvm->nvm_data->nvm_version, mvm->trans->cfg->nvm_ver);
+
+ /*
+ * abort after reading the nvm in case RF Kill is on, we will complete
+--
+2.20.1
+
--- /dev/null
+From c1b193c13b7aab4957cc1e6c83ce3374fccb0c2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 16:12:57 +0100
+Subject: kprobes/x86/xen: blacklist non-attachable xen interrupt functions
+
+From: Andrea Righi <righi.andrea@gmail.com>
+
+[ Upstream commit bf9445a33ae6ac2f0822d2f1ce1365408387d568 ]
+
+Blacklist symbols in Xen probe-prohibited areas, so that user can see
+these prohibited symbols in debugfs.
+
+See also: a50480cb6d61.
+
+Signed-off-by: Andrea Righi <righi.andrea@gmail.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/xen-asm_64.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
+index 3a6feed76dfc1..a93d8a7cef26c 100644
+--- a/arch/x86/xen/xen-asm_64.S
++++ b/arch/x86/xen/xen-asm_64.S
+@@ -12,6 +12,7 @@
+ #include <asm/segment.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
++#include <asm/asm.h>
+
+ #include <xen/interface/xen.h>
+
+@@ -24,6 +25,7 @@ ENTRY(xen_\name)
+ pop %r11
+ jmp \name
+ END(xen_\name)
++_ASM_NOKPROBE(xen_\name)
+ .endm
+
+ xen_pv_trap divide_error
+--
+2.20.1
+
--- /dev/null
+From ecdfc7aa3cd932ba557ec52d5bba24c037b91ca1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 16:34:37 +0100
+Subject: kvm: properly check debugfs dentry before using it
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 8ed0579c12b2fe56a1fac2f712f58fc26c1dc49b ]
+
+debugfs can now report an error code if something went wrong instead of
+just NULL. So if the return value is to be used as a "real" dentry, it
+needs to be checked if it is an error before dereferencing it.
+
+This is now happening because of ff9fb72bc077 ("debugfs: return error
+values, not NULL"). syzbot has found a way to trigger multiple debugfs
+files attempting to be created, which fails, and then the error code
+gets passed to dentry_path_raw() which obviously does not like it.
+
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Reported-and-tested-by: syzbot+7857962b4d45e602b8ad@syzkaller.appspotmail.com
+Cc: "Radim Krčmář" <rkrcmar@redhat.com>
+Cc: kvm@vger.kernel.org
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ virt/kvm/kvm_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index cdaacdf7bc877..deff4b3eb9722 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3989,7 +3989,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
+ }
+ add_uevent_var(env, "PID=%d", kvm->userspace_pid);
+
+- if (kvm->debugfs_dentry) {
++ if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) {
+ char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL);
+
+ if (p) {
+--
+2.20.1
+
--- /dev/null
+From b7d52adc0a23a645a397c740c1287408d6461980 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 15:32:06 +0100
+Subject: KVM: s390: unregister debug feature on failing arch init
+
+From: Michael Mueller <mimu@linux.ibm.com>
+
+[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]
+
+Make sure the debug feature and its allocated resources get
+released upon unsuccessful architecture initialization.
+
+A related indication of the issue will be reported as kernel
+message.
+
+Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index ff62a4fe2159a..91c24e87fe10a 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -361,19 +361,30 @@ static void kvm_s390_cpu_feat_init(void)
+
+ int kvm_arch_init(void *opaque)
+ {
++ int rc;
++
+ kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
+ if (!kvm_s390_dbf)
+ return -ENOMEM;
+
+ if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
+- debug_unregister(kvm_s390_dbf);
+- return -ENOMEM;
++ rc = -ENOMEM;
++ goto out_debug_unreg;
+ }
+
+ kvm_s390_cpu_feat_init();
+
+ /* Register floating interrupt controller interface. */
+- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ if (rc) {
++ pr_err("Failed to register FLIC rc=%d\n", rc);
++ goto out_debug_unreg;
++ }
++ return 0;
++
++out_debug_unreg:
++ debug_unregister(kvm_s390_dbf);
++ return rc;
+ }
+
+ void kvm_arch_exit(void)
+--
+2.20.1
+
--- /dev/null
+From 798d2efcc9ff90615e2942b5871ec2ae93fb6fc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 15:28:58 -0800
+Subject: kvm: vmx: Set IA32_TSC_AUX for legacy mode guests
+
+From: Jim Mattson <jmattson@google.com>
+
+[ Upstream commit 0023ef39dc35c773c436eaa46ca539a26b308b55 ]
+
+RDTSCP is supported in legacy mode as well as long mode. The
+IA32_TSC_AUX MSR should be set to the correct guest value before
+entering any guest that supports RDTSCP.
+
+Fixes: 4e47c7a6d714 ("KVM: VMX: Add instruction rdtscp support for guest")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Peter Shier <pshier@google.com>
+Reviewed-by: Marc Orr <marcorr@google.com>
+Reviewed-by: Liran Alon <liran.alon@oracle.com>
+Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index f67fc0f359ff3..76f353aef577f 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2818,9 +2818,6 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ index = __find_msr_index(vmx, MSR_CSTAR);
+ if (index >= 0)
+ move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_TSC_AUX);
+- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
+- move_msr_up(vmx, index, save_nmsrs++);
+ /*
+ * MSR_STAR is only needed on long mode guests, and only
+ * if efer.sce is enabled.
+@@ -2833,6 +2830,9 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ index = __find_msr_index(vmx, MSR_EFER);
+ if (index >= 0 && update_transition_efer(vmx, index))
+ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_TSC_AUX);
++ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
++ move_msr_up(vmx, index, save_nmsrs++);
+
+ vmx->save_nmsrs = save_nmsrs;
+
+--
+2.20.1
+
--- /dev/null
+From 8030afaf5e422aabf6d00ce2a2d10906ba78cb7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:44 -0800
+Subject: lib/genalloc.c: fix allocation of aligned buffer from non-aligned
+ chunk
+
+From: Alexey Skidanov <alexey.skidanov@intel.com>
+
+[ Upstream commit 52fbf1134d479234d7e64ba9dcbaea23405f229e ]
+
+gen_pool_alloc_algo() uses different allocation functions implementing
+different allocation algorithms. With gen_pool_first_fit_align()
+allocation function, the returned address should be aligned on the
+requested boundary.
+
+If chunk start address isn't aligned on the requested boundary, the
+returned address isn't aligned too. The only way to get properly
+aligned address is to initialize the pool with chunks aligned on the
+requested boundary. If want to have an ability to allocate buffers
+aligned on different boundaries (for example, 4K, 1MB, ...), the chunk
+start address should be aligned on the max possible alignment.
+
+This happens because gen_pool_first_fit_align() looks for properly
+aligned memory block without taking into account the chunk start address
+alignment.
+
+To fix this, we provide chunk start address to
+gen_pool_first_fit_align() and change its implementation such that it
+starts looking for properly aligned block with appropriate offset
+(exactly as is done in CMA).
+
+Link: https://lkml.kernel.org/lkml/a170cf65-6884-3592-1de9-4c235888cc8a@intel.com
+Link: http://lkml.kernel.org/r/1541690953-4623-1-git-send-email-alexey.skidanov@intel.com
+Signed-off-by: Alexey Skidanov <alexey.skidanov@intel.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Logan Gunthorpe <logang@deltatee.com>
+Cc: Daniel Mentz <danielmentz@google.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/genalloc.h | 13 +++++++------
+ lib/genalloc.c | 20 ++++++++++++--------
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
+index 872f930f1b06d..dd0a452373e71 100644
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -51,7 +51,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map,
+ unsigned long size,
+ unsigned long start,
+ unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool,
++ unsigned long start_addr);
+
+ /*
+ * General purpose special memory pool descriptor.
+@@ -131,24 +132,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo,
+
+ extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_fixed_alloc(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_first_fit_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern struct gen_pool *devm_gen_pool_create(struct device *dev,
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index ca06adc4f4451..5deb25c40a5a1 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -311,7 +311,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ end_bit = chunk_size(chunk) >> order;
+ retry:
+ start_bit = algo(chunk->bits, end_bit, start_bit,
+- nbits, data, pool);
++ nbits, data, pool, chunk->start_addr);
+ if (start_bit >= end_bit)
+ continue;
+ remain = bitmap_set_ll(chunk->bits, start_bit, nbits);
+@@ -525,7 +525,7 @@ EXPORT_SYMBOL(gen_pool_set_algo);
+ */
+ unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ return bitmap_find_next_zero_area(map, size, start, nr, 0);
+ }
+@@ -543,16 +543,19 @@ EXPORT_SYMBOL(gen_pool_first_fit);
+ */
+ unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_align *alignment;
+- unsigned long align_mask;
++ unsigned long align_mask, align_off;
+ int order;
+
+ alignment = data;
+ order = pool->min_alloc_order;
+ align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1;
+- return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
++ align_off = (start_addr & (alignment->align - 1)) >> order;
++
++ return bitmap_find_next_zero_area_off(map, size, start, nr,
++ align_mask, align_off);
+ }
+ EXPORT_SYMBOL(gen_pool_first_fit_align);
+
+@@ -567,7 +570,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align);
+ */
+ unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_fixed *fixed_data;
+ int order;
+@@ -601,7 +604,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc);
+ */
+ unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start,
+- unsigned int nr, void *data, struct gen_pool *pool)
++ unsigned int nr, void *data, struct gen_pool *pool,
++ unsigned long start_addr)
+ {
+ unsigned long align_mask = roundup_pow_of_two(nr) - 1;
+
+@@ -624,7 +628,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align);
+ */
+ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ unsigned long start_bit = size;
+ unsigned long len = size + 1;
+--
+2.20.1
+
--- /dev/null
+From 760a42a4a528814c9a1649a811b0222c39445502 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 13:21:18 -0800
+Subject: lib/genalloc.c: include vmalloc.h
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit 35004f2e55807a1a1491db24ab512dd2f770a130 ]
+
+Fixes build break on most ARM/ARM64 defconfigs:
+
+ lib/genalloc.c: In function 'gen_pool_add_virt':
+ lib/genalloc.c:190:10: error: implicit declaration of function 'vzalloc_node'; did you mean 'kzalloc_node'?
+ lib/genalloc.c:190:8: warning: assignment to 'struct gen_pool_chunk *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ lib/genalloc.c: In function 'gen_pool_destroy':
+ lib/genalloc.c:254:3: error: implicit declaration of function 'vfree'; did you mean 'kfree'?
+
+Fixes: 6862d2fc8185 ('lib/genalloc.c: use vzalloc_node() to allocate the bitmap')
+Cc: Huang Shijie <sjhuang@iluvatar.ai>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index f365d71cdc774..7e85d1e37a6ea 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -35,6 +35,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/genalloc.h>
+ #include <linux/of_device.h>
++#include <linux/vmalloc.h>
+
+ static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
+ {
+--
+2.20.1
+
--- /dev/null
+From 4a68eb8d9cc1953398d2864a199877ad48214d03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:51 -0800
+Subject: lib/genalloc.c: use vzalloc_node() to allocate the bitmap
+
+From: Huang Shijie <sjhuang@iluvatar.ai>
+
+[ Upstream commit 6862d2fc81859f88c1f3f660886427893f2b4f3f ]
+
+Some devices may have big memory on chip, such as over 1G. In some
+cases, the nbytes maybe bigger then 4M which is the bounday of the
+memory buddy system (4K default).
+
+So use vzalloc_node() to allocate the bitmap. Also use vfree to free
+it.
+
+Link: http://lkml.kernel.org/r/20181225015701.6289-1-sjhuang@iluvatar.ai
+Signed-off-by: Huang Shijie <sjhuang@iluvatar.ai>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index 5deb25c40a5a1..f365d71cdc774 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -187,7 +187,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ int nbytes = sizeof(struct gen_pool_chunk) +
+ BITS_TO_LONGS(nbits) * sizeof(long);
+
+- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid);
++ chunk = vzalloc_node(nbytes, nid);
+ if (unlikely(chunk == NULL))
+ return -ENOMEM;
+
+@@ -251,7 +251,7 @@ void gen_pool_destroy(struct gen_pool *pool)
+ bit = find_next_bit(chunk->bits, end_bit, 0);
+ BUG_ON(bit < end_bit);
+
+- kfree(chunk);
++ vfree(chunk);
+ }
+ kfree_const(pool->name);
+ kfree(pool);
+--
+2.20.1
+
--- /dev/null
+From 40546a35019a2c406eeed7d0c83700ffdc421e61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 06:12:43 -0600
+Subject: mac80211: fix station inactive_time shortly after boot
+
+From: Ahmed Zaki <anzaki@gmail.com>
+
+[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ]
+
+In the first 5 minutes after boot (time of INITIAL_JIFFIES),
+ieee80211_sta_last_active() returns zero if last_ack is zero. This
+leads to "inactive time" showing jiffies_to_msecs(jiffies).
+
+ # iw wlan0 station get fc:ec:da:64:a6:dd
+ Station fc:ec:da:64:a6:dd (on wlan0)
+ inactive time: 4294894049 ms
+ .
+ .
+ connected time: 70 seconds
+
+Fix by returning last_rx if last_ack == 0.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index f1b496222bda6..1a86974b02e39 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2313,7 +2313,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ {
+ struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
+
+- if (time_after(stats->last_rx, sta->status_stats.last_ack))
++ if (!sta->status_stats.last_ack ||
++ time_after(stats->last_rx, sta->status_stats.last_ack))
+ return stats->last_rx;
+ return sta->status_stats.last_ack;
+ }
+--
+2.20.1
+
--- /dev/null
+From d736f0da3c690441ad4599f48f66599147c2da5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:52 +0900
+Subject: microblaze: adjust the help to the real behavior
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit bafcc61d998c1ca18f556d92a0e95335ac68c7da ]
+
+"make ARCH=microblaze help" mentions simpleImage.<dt>.unstrip,
+but it is not a real Make target. It does not work because Makefile
+assumes "system.unstrip" is the name of DT.
+
+$ make ARCH=microblaze CROSS_COMPILE=microblaze-linux- simpleImage.system.unstrip
+ [ snip ]
+make[1]: *** No rule to make target 'arch/microblaze/boot/dts/system.unstrip.dtb', needed by 'arch/microblaze/boot/dts/system.dtb'. Stop.
+make: *** [Makefile;1060: arch/microblaze/boot/dts] Error 2
+make: *** Waiting for unfinished jobs....
+
+simpleImage.<dt> works like a phony target that generates multiple
+images. Reflect the real behavior. I removed the DT directory path
+information because it is already explained a few lines below.
+
+While I am here, I deleted the redundant *_defconfig explanation.
+
+The top-level Makefile caters to list available defconfig files:
+
+ mmu_defconfig - Build for mmu
+ nommu_defconfig - Build for nommu
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index d269dd4b82795..188f07bba0959 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -91,11 +91,11 @@ define archhelp
+ echo '* linux.bin - Create raw binary'
+ echo ' linux.bin.gz - Create compressed raw binary'
+ echo ' linux.bin.ub - Create U-Boot wrapped raw binary'
+- echo ' simpleImage.<dt> - ELF image with $(arch)/boot/dts/<dt>.dts linked in'
+- echo ' - stripped elf with fdt blob'
+- echo ' simpleImage.<dt>.unstrip - full ELF image with fdt blob'
+- echo ' *_defconfig - Select default config from arch/microblaze/configs'
+- echo ''
++ echo ' simpleImage.<dt> - Create the following images with <dt>.dtb linked in'
++ echo ' simpleImage.<dt> : raw image'
++ echo ' simpleImage.<dt>.ub : raw image with U-Boot header'
++ echo ' simpleImage.<dt>.unstrip: ELF (identical to vmlinux)'
++ echo ' simpleImage.<dt>.strip : stripped ELF'
+ echo ' Targets with <dt> embed a device tree blob inside the image'
+ echo ' These targets support board with firmware that does not'
+ echo ' support passing a device tree directly. Replace <dt> with the'
+--
+2.20.1
+
--- /dev/null
+From f5674e2161197bfc7f02b65ba33914a8c70c9ff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:53 +0900
+Subject: microblaze: move "... is ready" messages to arch/microblaze/Makefile
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 2e14f94cf4bc2f15ca5362e81ca3a987c79e3062 ]
+
+To prepare for more fixes, move this to arch/microblaze/Makefile.
+Otherwise, the same "... is ready" would be printed multiple times.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 2 ++
+ arch/microblaze/boot/Makefile | 4 ----
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 188f07bba0959..fe5e48184c3c2 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -83,9 +83,11 @@ archclean:
+
+ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ simpleImage.%: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ define archhelp
+ echo '* linux.bin - Create raw binary'
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 7c2f52d4a0e45..49dbd1063d717 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -9,15 +9,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+
+ $(obj)/linux.bin: vmlinux FORCE
+ $(call if_changed,objcopy)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ $(call if_changed,uimage)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ $(call if_changed,gzip)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ quiet_cmd_cp = CP $< $@$2
+ cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+@@ -35,6 +32,5 @@ $(obj)/simpleImage.%: vmlinux FORCE
+ $(call if_changed,objcopy)
+ $(call if_changed,uimage)
+ $(call if_changed,strip,.strip)
+- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+
+ clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb
+--
+2.20.1
+
--- /dev/null
+From 2fe6d3340c6c66b16de064110b959b46392f0d64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:18:25 +0100
+Subject: mmc: meson-gx: make sure the descriptor is stopped on errors
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 18f92bc02f1739b5c4d5b70009fbb7eada45bca3 ]
+
+On errors, if we don't stop the descriptor chain, it may continue to
+run and raise IRQ after we have called mmc_request_done(). This is bad
+because we won't be able to get cmd anymore and properly deal with the
+IRQ.
+
+This patch makes sure the descriptor chain is stopped before
+calling mmc_request_done()
+
+Fixes: 79ed05e329c3 ("mmc: meson-gx: add support for descriptor chain mode")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/meson-gx-mmc.c | 73 ++++++++++++++++++++++++++++-----
+ 1 file changed, 63 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index 08a55c2e96e1b..53ce1bb83d2c5 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -21,6 +21,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
++#include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+@@ -74,9 +75,11 @@
+ #define CFG_CLK_ALWAYS_ON BIT(18)
+ #define CFG_CHK_DS BIT(20)
+ #define CFG_AUTO_CLK BIT(23)
++#define CFG_ERR_ABORT BIT(27)
+
+ #define SD_EMMC_STATUS 0x48
+ #define STATUS_BUSY BIT(31)
++#define STATUS_DESC_BUSY BIT(30)
+ #define STATUS_DATI GENMASK(23, 16)
+
+ #define SD_EMMC_IRQ_EN 0x4c
+@@ -905,6 +908,7 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd)
+
+ cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode);
+ cmd_cfg |= CMD_CFG_OWNER; /* owned by CPU */
++ cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */
+
+ meson_mmc_set_response_bits(cmd, &cmd_cfg);
+
+@@ -999,6 +1003,17 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+ u32 irq_en, status, raw_status;
+ irqreturn_t ret = IRQ_NONE;
+
++ irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
++ raw_status = readl(host->regs + SD_EMMC_STATUS);
++ status = raw_status & irq_en;
++
++ if (!status) {
++ dev_dbg(host->dev,
++ "Unexpected IRQ! irq_en 0x%08x - status 0x%08x\n",
++ irq_en, raw_status);
++ return IRQ_NONE;
++ }
++
+ if (WARN_ON(!host) || WARN_ON(!host->cmd))
+ return IRQ_NONE;
+
+@@ -1006,22 +1021,18 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+
+ cmd = host->cmd;
+ data = cmd->data;
+- irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
+- raw_status = readl(host->regs + SD_EMMC_STATUS);
+- status = raw_status & irq_en;
+-
+ cmd->error = 0;
+ if (status & IRQ_CRC_ERR) {
+ dev_dbg(host->dev, "CRC Error - status 0x%08x\n", status);
+ cmd->error = -EILSEQ;
+- ret = IRQ_HANDLED;
++ ret = IRQ_WAKE_THREAD;
+ goto out;
+ }
+
+ if (status & IRQ_TIMEOUTS) {
+ dev_dbg(host->dev, "Timeout - status 0x%08x\n", status);
+ cmd->error = -ETIMEDOUT;
+- ret = IRQ_HANDLED;
++ ret = IRQ_WAKE_THREAD;
+ goto out;
+ }
+
+@@ -1046,17 +1057,49 @@ out:
+ /* ack all enabled interrupts */
+ writel(irq_en, host->regs + SD_EMMC_STATUS);
+
++ if (cmd->error) {
++ /* Stop desc in case of errors */
++ u32 start = readl(host->regs + SD_EMMC_START);
++
++ start &= ~START_DESC_BUSY;
++ writel(start, host->regs + SD_EMMC_START);
++ }
++
+ if (ret == IRQ_HANDLED)
+ meson_mmc_request_done(host->mmc, cmd->mrq);
+- else if (ret == IRQ_NONE)
+- dev_warn(host->dev,
+- "Unexpected IRQ! status=0x%08x, irq_en=0x%08x\n",
+- raw_status, irq_en);
+
+ spin_unlock(&host->lock);
+ return ret;
+ }
+
++static int meson_mmc_wait_desc_stop(struct meson_host *host)
++{
++ int loop;
++ u32 status;
++
++ /*
++ * It may sometimes take a while for it to actually halt. Here, we
++ * are giving it 5ms to comply
++ *
++ * If we don't confirm the descriptor is stopped, it might raise new
++ * IRQs after we have called mmc_request_done() which is bad.
++ */
++ for (loop = 50; loop; loop--) {
++ status = readl(host->regs + SD_EMMC_STATUS);
++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY))
++ udelay(100);
++ else
++ break;
++ }
++
++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) {
++ dev_err(host->dev, "Timed out waiting for host to stop\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
+ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ {
+ struct meson_host *host = dev_id;
+@@ -1067,6 +1110,13 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ if (WARN_ON(!cmd))
+ return IRQ_NONE;
+
++ if (cmd->error) {
++ meson_mmc_wait_desc_stop(host);
++ meson_mmc_request_done(host->mmc, cmd->mrq);
++
++ return IRQ_HANDLED;
++ }
++
+ data = cmd->data;
+ if (meson_mmc_bounce_buf_read(data)) {
+ xfer_bytes = data->blksz * data->blocks;
+@@ -1107,6 +1157,9 @@ static void meson_mmc_cfg_init(struct meson_host *host)
+ cfg |= FIELD_PREP(CFG_RC_CC_MASK, ilog2(SD_EMMC_CFG_CMD_GAP));
+ cfg |= FIELD_PREP(CFG_BLK_LEN_MASK, ilog2(SD_EMMC_CFG_BLK_SIZE));
+
++ /* abort chain on R/W errors */
++ cfg |= CFG_ERR_ABORT;
++
+ writel(cfg, host->regs + SD_EMMC_CFG);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From dd022c3a53d5de1e1a7e34b3457b20afa2564387 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jan 2019 15:36:54 +0100
+Subject: mtd: Check add_mtd_device() ret code
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit 2b6f0090a3335b7bdd03ca520c35591159463041 ]
+
+add_mtd_device() can fail. We should always check its return value
+and gracefully handle the failure case. Fix the call sites where this
+not done (in mtdpart.c) and add a __must_check attribute to the
+prototype to avoid this kind of mistakes.
+
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.h | 2 +-
+ drivers/mtd/mtdpart.c | 36 +++++++++++++++++++++++++++++++-----
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h
+index 37accfd0400e5..24480b75a88dd 100644
+--- a/drivers/mtd/mtdcore.h
++++ b/drivers/mtd/mtdcore.h
+@@ -7,7 +7,7 @@
+ extern struct mutex mtd_table_mutex;
+
+ struct mtd_info *__mtd_next_device(int i);
+-int add_mtd_device(struct mtd_info *mtd);
++int __must_check add_mtd_device(struct mtd_info *mtd);
+ int del_mtd_device(struct mtd_info *mtd);
+ int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
+ int del_mtd_partitions(struct mtd_info *);
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index a308e707392d5..27d9785487d69 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -684,10 +684,22 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,
+ list_add(&new->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&new->mtd);
++ ret = add_mtd_device(&new->mtd);
++ if (ret)
++ goto err_remove_part;
+
+ mtd_add_partition_attrs(new);
+
++ return 0;
++
++err_remove_part:
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&new->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(new);
++ pr_info("%s:%i\n", __func__, __LINE__);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(mtd_add_partition);
+@@ -778,22 +790,31 @@ int add_mtd_partitions(struct mtd_info *master,
+ {
+ struct mtd_part *slave;
+ uint64_t cur_offset = 0;
+- int i;
++ int i, ret;
+
+ printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+
+ for (i = 0; i < nbparts; i++) {
+ slave = allocate_partition(master, parts + i, i, cur_offset);
+ if (IS_ERR(slave)) {
+- del_mtd_partitions(master);
+- return PTR_ERR(slave);
++ ret = PTR_ERR(slave);
++ goto err_del_partitions;
+ }
+
+ mutex_lock(&mtd_partitions_mutex);
+ list_add(&slave->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&slave->mtd);
++ ret = add_mtd_device(&slave->mtd);
++ if (ret) {
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&slave->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(slave);
++ goto err_del_partitions;
++ }
++
+ mtd_add_partition_attrs(slave);
+ if (parts[i].types)
+ mtd_parse_part(slave, parts[i].types);
+@@ -802,6 +823,11 @@ int add_mtd_partitions(struct mtd_info *master,
+ }
+
+ return 0;
++
++err_del_partitions:
++ del_mtd_partitions(master);
++
++ return ret;
+ }
+
+ static DEFINE_SPINLOCK(part_parser_lock);
+--
+2.20.1
+
--- /dev/null
+From 3816fefeda6f45ceec4c3d5b5331eec8a9f6af7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 09:34:17 +0100
+Subject: mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET
+
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+
+[ Upstream commit 732774437ae01d9882e60314e303898e63c7f038 ]
+
+The opcodes used by the controller when doing batched page prog should
+be written in NFC_REG_WCMD_SET not FC_REG_RCMD_SET. Luckily, the
+default NFC_REG_WCMD_SET value matches the one we set in the driver
+which explains why we didn't notice the problem.
+
+Fixes: 614049a8d904 ("mtd: nand: sunxi: add support for DMA assisted operations")
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/sunxi_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
+index 9589748215821..8e52314823976 100644
+--- a/drivers/mtd/nand/sunxi_nand.c
++++ b/drivers/mtd/nand/sunxi_nand.c
+@@ -1435,7 +1435,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd,
+ sunxi_nfc_randomizer_enable(mtd);
+
+ writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG,
+- nfc->regs + NFC_REG_RCMD_SET);
++ nfc->regs + NFC_REG_WCMD_SET);
+
+ dma_async_issue_pending(nfc->dmac);
+
+--
+2.20.1
+
--- /dev/null
+From d8bb4ab519a3e8943d4224932a2b721e8161b2b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 09:47:00 +0100
+Subject: mtd: Remove a debug trace in mtdpart.c
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit bda2ab56356b9acdfab150f31c4bac9846253092 ]
+
+Commit 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") contained
+a leftover of the debug session that led to this bug fix. Remove this
+pr_info().
+
+Fixes: 2b6f0090a333 ("mtd: Check add_mtd_device() ret code")
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdpart.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 27d9785487d69..45626b0eed643 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -698,7 +698,6 @@ err_remove_part:
+ mutex_unlock(&mtd_partitions_mutex);
+
+ free_partition(new);
+- pr_info("%s:%i\n", __func__, __LINE__);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From ab421d8390ed481e627063431306008ab49d3f61 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 14:26:55 -0800
+Subject: mwifiex: debugfs: correct histogram spacing, formatting
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 4cb777c64e030778c569f605398d7604d8aabc0f ]
+
+Currently, snippets of this file look like:
+
+rx rates (in Mbps): 0=1M 1=2M2=5.5M 3=11M 4=6M 5=9M 6=12M
+7=18M 8=24M 9=36M 10=48M 11=54M12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)
+44-53=MCS0-9(VHT:BW20)54-63=MCS0-9(VHT:BW40)64-73=MCS0-9(VHT:BW80)
+...
+noise_flr[--96dBm] = 22
+noise_flr[--95dBm] = 149
+noise_flr[--94dBm] = 9
+noise_flr[--93dBm] = 2
+
+We're missing some spaces, and we're adding a minus sign ('-') on values
+that are already negative signed integers.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/debugfs.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index 6f4239be609d0..49ca84ef1a992 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -296,15 +296,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ "total samples = %d\n",
+ atomic_read(&phist_data->num_samples));
+
+- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M");
+- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n");
+- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M");
+- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
++ p += sprintf(p,
++ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n"
++ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+ if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
++ p += sprintf(p,
++ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n");
+ } else {
+ p += sprintf(p, "\n");
+ }
+@@ -333,7 +331,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+ value = atomic_read(&phist_data->noise_flr[i]);
+ if (value)
+- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
++ p += sprintf(p, "noise_flr[%02ddBm] = %d\n",
+ (int)(i-128), value);
+ }
+ for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+--
+2.20.1
+
--- /dev/null
+From 81c355cacdeadcb2969ace22d751436c97db597a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:25:19 +0800
+Subject: mwifiex: fix potential NULL dereference and use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ]
+
+There are two defects: (1) passing a NULL bss to
+mwifiex_save_hidden_ssid_channels will result in NULL dereference,
+(2) using bss after dropping the reference to it via cfg80211_put_bss.
+To fix them, the patch moves the buggy code to the branch that bss is
+not NULL and puts it before cfg80211_put_bss.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/scan.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index 67c3342210777..c013c94fbf15f 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1901,15 +1901,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
+ ETH_ALEN))
+ mwifiex_update_curr_bss_params(priv,
+ bss);
+- cfg80211_put_bss(priv->wdev.wiphy, bss);
+- }
+
+- if ((chan->flags & IEEE80211_CHAN_RADAR) ||
+- (chan->flags & IEEE80211_CHAN_NO_IR)) {
+- mwifiex_dbg(adapter, INFO,
+- "radar or passive channel %d\n",
+- channel);
+- mwifiex_save_hidden_ssid_channels(priv, bss);
++ if ((chan->flags & IEEE80211_CHAN_RADAR) ||
++ (chan->flags & IEEE80211_CHAN_NO_IR)) {
++ mwifiex_dbg(adapter, INFO,
++ "radar or passive channel %d\n",
++ channel);
++ mwifiex_save_hidden_ssid_channels(priv,
++ bss);
++ }
++
++ cfg80211_put_bss(priv->wdev.wiphy, bss);
+ }
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 8e91a2344c180d9283ceb16e81ad5310f685cf46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 11:07:26 -0800
+Subject: net: bcmgenet: reapply manual settings to the PHY
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 0686bd9d5e6863f60e4bb1e78e6fe7bb217a0890 ]
+
+The phy_init_hw() function may reset the PHY to a configuration
+that does not match manual network settings stored in the phydev
+structure. If the phy state machine is polled rather than event
+driven this can create a timing hazard where the phy state machine
+might alter the settings stored in the phydev structure from the
+value read from the BMCR.
+
+This commit follows invocations of phy_init_hw() by the bcmgenet
+driver with invocations of the genphy_config_aneg() function to
+ensure that the BMCR is written to match the settings held in the
+phydev structure. This prevents the risk of manual settings being
+accidentally altered.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index b6af286fa5c7e..3e3044fe32066 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2611,8 +2611,10 @@ static void bcmgenet_irq_task(struct work_struct *work)
+ }
+
+ if (status & UMAC_IRQ_PHY_DET_R &&
+- priv->dev->phydev->autoneg != AUTONEG_ENABLE)
++ priv->dev->phydev->autoneg != AUTONEG_ENABLE) {
+ phy_init_hw(priv->dev->phydev);
++ genphy_config_aneg(priv->dev->phydev);
++ }
+
+ /* Link UP/DOWN event */
+ if (status & UMAC_IRQ_LINK_EVENT)
+@@ -3688,6 +3690,7 @@ static int bcmgenet_resume(struct device *d)
+
+ phy_init_hw(priv->phydev);
+ /* Speed settings must be restored */
++ genphy_config_aneg(dev->phydev);
+ bcmgenet_mii_config(priv->dev, false);
+
+ /* disable ethernet MAC while updating its registers */
+--
+2.20.1
+
--- /dev/null
+From 366c2598dc4763d309f367aec16aa87d026ba11d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:38:43 +0300
+Subject: net/core/neighbour: fix kmemleak minimal reference count for hash
+ tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 01b833ab44c9e484060aad72267fc7e71beb559b ]
+
+This should be 1 for normal allocations, 0 disables leak reporting.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
+Fixes: 85704cb8dcfd ("net/core/neighbour: tell kmemleak about hash tables")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 9a28a21a51f05..2664ad58e5c01 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -368,7 +368,7 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
+- kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
+ }
+ if (!buckets) {
+ kfree(ret);
+--
+2.20.1
+
--- /dev/null
+From 5f322f736a7546da4d56582410d199c93288b9af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jan 2019 12:30:00 +0300
+Subject: net/core/neighbour: tell kmemleak about hash tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 85704cb8dcfd88d351bfc87faaeba1c8214f3177 ]
+
+This fixes false-positive kmemleak reports about leaked neighbour entries:
+
+unreferenced object 0xffff8885c6e4d0a8 (size 1024):
+ comm "softirq", pid 0, jiffies 4294922664 (age 167640.804s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 20 2c f3 83 ff ff ff ff ........ ,......
+ 08 c0 ef 5f 84 88 ff ff 01 8c 7d 02 01 00 00 00 ..._......}.....
+ backtrace:
+ [<00000000748509fe>] ip6_finish_output2+0x887/0x1e40
+ [<0000000036d7a0d8>] ip6_output+0x1ba/0x600
+ [<0000000027ea7dba>] ip6_send_skb+0x92/0x2f0
+ [<00000000d6e2111d>] udp_v6_send_skb.isra.24+0x680/0x15e0
+ [<000000000668a8be>] udpv6_sendmsg+0x18c9/0x27a0
+ [<000000004bd5fa90>] sock_sendmsg+0xb3/0xf0
+ [<000000008227b29f>] ___sys_sendmsg+0x745/0x8f0
+ [<000000008698009d>] __sys_sendmsg+0xde/0x170
+ [<00000000889dacf1>] do_syscall_64+0x9b/0x400
+ [<0000000081cdb353>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<000000005767ed39>] 0xffffffffffffffff
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index eb3efeabac91d..9a28a21a51f05 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -18,6 +18,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/slab.h>
++#include <linux/kmemleak.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -361,12 +362,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
+ if (!ret)
+ return NULL;
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ buckets = kzalloc(size, GFP_ATOMIC);
+- else
++ } else {
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
++ kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ }
+ if (!buckets) {
+ kfree(ret);
+ return NULL;
+@@ -386,10 +389,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
+ size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
+ struct neighbour __rcu **buckets = nht->hash_buckets;
+
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ kfree(buckets);
+- else
++ } else {
++ kmemleak_free(buckets);
+ free_pages((unsigned long)buckets, get_order(size));
++ }
+ kfree(nht);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 34239d346a293c1ab928c00b47410e0f42c018e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:55:37 -0600
+Subject: net: (cpts) fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 2d822f2dbab7f4c820f72eb8570aacf3f35855bd ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index e7b76f6b4f67e..7d1281d812480 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -567,7 +567,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
+ return ERR_PTR(PTR_ERR(cpts->refclk));
+ }
+
+- clk_prepare(cpts->refclk);
++ ret = clk_prepare(cpts->refclk);
++ if (ret)
++ return ERR_PTR(ret);
+
+ cpts->cc.read = cpts_systim_read;
+ cpts->cc.mask = CLOCKSOURCE_MASK(32);
+--
+2.20.1
+
--- /dev/null
+From fe42aabcee86701a300d6ea88e891eb61d6c2e81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 13:37:26 +0300
+Subject: net: dev: Use unsigned integer as an argument to left-shift
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit f4d7b3e23d259c44f1f1c39645450680fcd935d6 ]
+
+1 << 31 is Undefined Behaviour according to the C standard.
+Use U type modifier to avoid theoretical overflow.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 40b830d55fe50..4725a9d9597fc 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3522,7 +3522,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
+ if (debug_value == 0) /* no output */
+ return 0;
+ /* set low N bits */
+- return (1 << debug_value) - 1;
++ return (1U << debug_value) - 1;
+ }
+
+ static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
+--
+2.20.1
+
--- /dev/null
+From 5281e2f1da78a74999a133a48f43c4589d40b409 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:08:18 -0600
+Subject: net: dsa: bcm_sf2: Propagate error value from mdio_write
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit e49505f7255be8ced695919c08a29bf2c3d79616 ]
+
+Both bcm_sf2_sw_indir_rw and mdiobus_write_nested could fail, so let's
+return their error codes upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index af666951a9592..94ad2fdd6ef0d 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -432,11 +432,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum,
+ * send them to our master MDIO bus controller
+ */
+ if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr))
+- bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
++ return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
+ else
+- mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val);
+-
+- return 0;
++ return mdiobus_write_nested(priv->master_mii_bus, addr,
++ regnum, val);
+ }
+
+ static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id)
+--
+2.20.1
+
--- /dev/null
+From ac576fdd680f7c4673560f6cc9b04f2cb0e40973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 23:50:00 +0800
+Subject: net: fec: add missed clk_disable_unprepare in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ]
+
+This driver forgets to disable and unprepare clks when remove.
+Add calls to clk_disable_unprepare to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 0ae6532b02e09..0237221059bfd 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3574,6 +3574,8 @@ fec_drv_remove(struct platform_device *pdev)
+ regulator_disable(fep->reg_phy);
+ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ clk_disable_unprepare(fep->clk_ahb);
++ clk_disable_unprepare(fep->clk_ipg);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+--
+2.20.1
+
--- /dev/null
+From 816d97122080a3bbfeeff6f4b0b6a529c9f6ca0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 12:26:27 -0800
+Subject: net: fix possible overflow in __sk_mem_raise_allocated()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5bf325a53202b8728cf7013b72688c46071e212e ]
+
+With many active TCP sockets, fat TCP sockets could fool
+__sk_mem_raise_allocated() thanks to an overflow.
+
+They would increase their share of the memory, instead
+of decreasing it.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 2 +-
+ net/core/sock.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 780c6c0a86f04..0af46cbd3649c 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1232,7 +1232,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
+ percpu_counter_inc(sk->sk_prot->sockets_allocated);
+ }
+
+-static inline int
++static inline u64
+ sk_sockets_allocated_read_positive(struct sock *sk)
+ {
+ return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 7ccbcd853cbce..90ccbbf9e6b00 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2357,7 +2357,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ }
+
+ if (sk_has_memory_pressure(sk)) {
+- int alloc;
++ u64 alloc;
+
+ if (!sk_under_memory_pressure(sk))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From 7c42853ffba9e03765fbdc7ab52ed72641c4250a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 07:39:34 +0800
+Subject: net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 4a402f47cfce904051cd8b31bef4fe2910d9dce9 ]
+
+According to firmware error code definition, the error code of 2
+means NOT_SUPPORTED, this patch changes it to NOT_SUPPORTED.
+
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 2 ++
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index 8b511e6e0ce9d..396ea0db71023 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -251,6 +251,8 @@ int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num)
+ if ((enum hclge_cmd_return_status)desc_ret ==
+ HCLGE_CMD_EXEC_SUCCESS)
+ retval = 0;
++ else if (desc_ret == HCLGE_CMD_NOT_SUPPORTED)
++ retval = -EOPNOTSUPP;
+ else
+ retval = -EIO;
+ hw->cmq.last_status = (enum hclge_cmd_status)desc_ret;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 758cf39481312..3823ae6303ad6 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -52,7 +52,7 @@ struct hclge_cmq_ring {
+ enum hclge_cmd_return_status {
+ HCLGE_CMD_EXEC_SUCCESS = 0,
+ HCLGE_CMD_NO_AUTH = 1,
+- HCLGE_CMD_NOT_EXEC = 2,
++ HCLGE_CMD_NOT_SUPPORTED = 2,
+ HCLGE_CMD_QUEUE_FULL = 3,
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 4f99c9be8f07078d31a389aa1cb2af9e2b9223e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 13:15:11 +0200
+Subject: net/mlx5: Continue driver initialization despite debugfs failure
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 199fa087dc6b503baad06712716fac645a983e8a ]
+
+The failure to create debugfs entry is unpleasant event, but not enough
+to abort drier initialization. Align the mlx5_core code to debugfs design
+and continue execution whenever debugfs_create_dir() successes or not.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Reviewed-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 97874c2568fc9..1ac0e173da12c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -838,11 +838,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+
+ priv->numa_node = dev_to_node(&dev->pdev->dev);
+
+- priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
+- if (!priv->dbg_root) {
+- dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
+- return -ENOMEM;
+- }
++ if (mlx5_debugfs_root)
++ priv->dbg_root =
++ debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root);
+
+ err = mlx5_pci_enable_device(dev);
+ if (err) {
+--
+2.20.1
+
--- /dev/null
+From 0666a968fcae4c81ac3262c3f57b2aab476a0531 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 19:42:38 -0600
+Subject: net/net_namespace: Check the return value of register_pernet_subsys()
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 0eb987c874dc93f9c9d85a6465dbde20fdd3884c ]
+
+In net_ns_init(), register_pernet_subsys() could fail while registering
+network namespace subsystems. The fix checks the return value and
+sends a panic() on failure.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/net_namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 60b88718b1d48..1af25d53f63ca 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -854,7 +854,8 @@ static int __init net_ns_init(void)
+
+ mutex_unlock(&net_mutex);
+
+- register_pernet_subsys(&net_ns_ops);
++ if (register_pernet_subsys(&net_ns_ops))
++ panic("Could not register network namespace subsystems");
+
+ rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
+ RTNL_FLAG_DOIT_UNLOCKED);
+--
+2.20.1
+
--- /dev/null
+From f64d2971ae0684b2089ecbb1f68af4977b679214 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 18:54:53 -0600
+Subject: net/netlink_compat: Fix a missing check of nla_parse_nested
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 89dfd0083751d00d5d7ead36f6d8b045bf89c5e1 ]
+
+In tipc_nl_compat_sk_dump(), if nla_parse_nested() fails, it could return
+an error. To be consistent with other invocations of the function call,
+on error, the fix passes the return value upstream.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index ad4dcc663c6de..1c8ac0c11008c 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -1021,8 +1021,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg,
+ u32 node;
+ struct nlattr *con[TIPC_NLA_CON_MAX + 1];
+
+- nla_parse_nested(con, TIPC_NLA_CON_MAX,
+- sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++ err = nla_parse_nested(con, TIPC_NLA_CON_MAX,
++ sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++
++ if (err)
++ return err;
+
+ node = nla_get_u32(con[TIPC_NLA_CON_NODE]);
+ tipc_tlv_sprintf(msg->rep, " connected to <%u.%u.%u:%u>",
+--
+2.20.1
+
--- /dev/null
+From 1bccd168a0726f3ce21b4e64f5f3cdb82ffbcdf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:51:02 +0100
+Subject: net/smc: prevent races between smc_lgr_terminate() and
+ smc_conn_free()
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 77f838ace755d2f466536c44dac6c856f62cd901 ]
+
+To prevent races between smc_lgr_terminate() and smc_conn_free() add an
+extra check of the lgr field before accessing it, and cancel a delayed
+free_work when a new smc connection is created.
+This fixes the problem that free_work cleared the lgr variable but
+smc_lgr_terminate() or smc_conn_free() still access it in parallel.
+
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index f04a037dc9677..0de788fa43e95 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -103,6 +103,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn)
+ struct smc_link_group *lgr = conn->lgr;
+ int reduced = 0;
+
++ if (!lgr)
++ return;
+ write_lock_bh(&lgr->conns_lock);
+ if (conn->alert_token_local) {
+ reduced = 1;
+@@ -431,6 +433,8 @@ int smc_conn_create(struct smc_sock *smc, __be32 peer_in_addr,
+ local_contact = SMC_REUSE_CONTACT;
+ conn->lgr = lgr;
+ smc_lgr_register_conn(conn); /* add smc conn to lgr */
++ if (delayed_work_pending(&lgr->free_work))
++ cancel_delayed_work(&lgr->free_work);
+ write_unlock_bh(&lgr->conns_lock);
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 2fe6b6691d63f3325701622a67a98050e2e043c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:57:14 -0600
+Subject: net: stmicro: fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit f86a3b83833e7cfe558ca4d70b64ebc48903efec ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index d07520fb969e6..62ccbd47c1db2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ gmac->clk_enabled = 1;
+ } else {
+ clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+- clk_prepare(gmac->tx_clk);
++ ret = clk_prepare(gmac->tx_clk);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From e7182651ff11722963262b561d962487f5df7dd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 16:28:30 +0800
+Subject: net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit 40752b3eae29f8ca2378e978a02bd6dbeeb06d16 ]
+
+This patch fixes potential double frees if register_hdlc_device() fails.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Reviewed-by: Peng Hao <peng.hao2@zte.com.cn>
+CC: Zhao Qiang <qiang.zhao@nxp.com>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: netdev@vger.kernel.org
+CC: linuxppc-dev@lists.ozlabs.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 18b648648adb2..289dff262948d 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -1114,7 +1114,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ if (register_hdlc_device(dev)) {
+ ret = -ENOBUFS;
+ pr_err("ucc_hdlc: unable to register hdlc device\n");
+- free_netdev(dev);
+ goto free_dev;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4f0e9cc37baba59d514e72e5e453d542a9f78905 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:32:53 -0800
+Subject: ocfs2: clear journal dirty flag after shutdown journal
+
+From: Junxiao Bi <junxiao.bi@oracle.com>
+
+[ Upstream commit d85400af790dba2aa294f0a77e712f166681f977 ]
+
+Dirty flag of the journal should be cleared at the last stage of umount,
+if do it before jbd2_journal_destroy(), then some metadata in uncommitted
+transaction could be lost due to io error, but as dirty flag of journal
+was already cleared, we can't find that until run a full fsck. This may
+cause system panic or other corruption.
+
+Link: http://lkml.kernel.org/r/20181121020023.3034-3-junxiao.bi@oracle.com
+Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
+Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index f7fba58618ef3..2459ae9d2234f 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ mlog_errno(status);
+ }
+
+- if (status == 0) {
++ /* Shutdown the kernel journal system */
++ if (!jbd2_journal_destroy(journal->j_journal) && !status) {
+ /*
+ * Do not toggle if flush was unsuccessful otherwise
+ * will leave dirty metadata in a "clean" journal
+@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ if (status < 0)
+ mlog_errno(status);
+ }
+-
+- /* Shutdown the kernel journal system */
+- jbd2_journal_destroy(journal->j_journal);
+ journal->j_journal = NULL;
+
+ OCFS2_I(inode)->ip_open_count--;
+--
+2.20.1
+
--- /dev/null
+From 56009023fc40f5a01bdb3881499b9bea0d86d3a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 13:20:47 +0100
+Subject: openrisc: Fix broken paths to arch/or32
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 57ce8ba0fd3a95bf29ed741df1c52bd591bf43ff ]
+
+OpenRISC was mainlined as "openrisc", not "or32".
+vmlinux.lds is generated from vmlinux.lds.S.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 2 +-
+ arch/openrisc/kernel/head.S | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index b16e95a4e875f..1107d34e45bf1 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -184,7 +184,7 @@ handler: ;\
+ * occured. in fact they never do. if you need them use
+ * values saved on stack (for SPR_EPC, SPR_ESR) or content
+ * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE()
+- * in 'arch/or32/kernel/head.S'
++ * in 'arch/openrisc/kernel/head.S'
+ */
+
+ /* =====================================================[ exceptions] === */
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index 90979acdf165b..4d878d13b8606 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -1551,7 +1551,7 @@ _string_nl:
+
+ /*
+ * .data section should be page aligned
+- * (look into arch/or32/kernel/vmlinux.lds)
++ * (look into arch/openrisc/kernel/vmlinux.lds.S)
+ */
+ .section .data,"aw"
+ .align 8192
+--
+2.20.1
+
--- /dev/null
+From 2a1f6ce84e8693d67c1c8ec8c96b575cf8dc0c73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:06:34 +0100
+Subject: parisc: Fix HP SDC hpa address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit c4bff35ca1bfba886da6223c9fed76a2b1382b8e ]
+
+Show the hpa address of the HP SDC instead of a hashed value, e.g.:
+HP SDC: HP SDC at 0xf0201000, IRQ 23 (NMI IRQ 24)
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/hp_sdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
+index 8eef6849d0660..5585823ced19d 100644
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -887,8 +887,8 @@ static int __init hp_sdc_init(void)
+ "HP SDC NMI", &hp_sdc))
+ goto err2;
+
+- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n",
+- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
++ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n",
++ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
+
+ hp_sdc_status_in8();
+ hp_sdc_data_in8();
+--
+2.20.1
+
--- /dev/null
+From 924e819f1469afcfa6b45cf9f4b9b328cf554d67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:09:59 +0100
+Subject: parisc: Fix serio address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 785145171d17af2554128becd6a7c8f89e101141 ]
+
+We want the hpa addresses printed in the serio modules, not some
+virtual ioremap()ed address, e.g.:
+
+ serio: gsc-ps2-keyboard port at 0xf0108000 irq 22 @ 2:0:11
+ serio: gsc-ps2-mouse port at 0xf0108100 irq 22 @ 2:0:12
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/gscps2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
+index aa9f29b875dea..d84e3b70215ad 100644
+--- a/drivers/input/serio/gscps2.c
++++ b/drivers/input/serio/gscps2.c
+@@ -382,9 +382,9 @@ static int __init gscps2_probe(struct parisc_device *dev)
+ goto fail;
+ #endif
+
+- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n",
++ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n",
+ ps2port->port->name,
+- ps2port->addr,
++ hpa,
+ ps2port->padev->irq,
+ ps2port->port->phys);
+
+--
+2.20.1
+
--- /dev/null
+From 1aab9b9241a9814a1cb2383bca95d45839fe7d54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jan 2019 17:31:29 -0600
+Subject: PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 77f88abd4a6f73a1a68dbdc0e3f21575fd508fc3 ]
+
+The API of pci_alloc_irq_vectors_affinity() says it returns -ENOSPC if
+fewer than @min_vecs interrupt vectors are available for @dev.
+
+However, if a device supports MSI-X but not MSI and a caller requests
+@min_vecs that can't be satisfied by MSI-X, we previously returned -EINVAL
+(from the failed attempt to enable MSI), not -ENOSPC.
+
+When -ENOSPC is returned, callers may reduce the number IRQs they request
+and try again. Most callers can use the @min_vecs and @max_vecs
+parameters to avoid this retry loop, but that doesn't work when using IRQ
+affinity "nr_sets" because rebalancing the sets is driver-specific.
+
+This return value bug has been present since pci_alloc_irq_vectors() was
+added in v4.10 by aff171641d18 ("PCI: Provide sensible IRQ vector
+alloc/free routines"), but it wasn't an issue because @min_vecs/@max_vecs
+removed the need for callers to iteratively reduce the number of IRQs
+requested and retry the allocation, so they didn't need to distinguish
+-ENOSPC from -EINVAL.
+
+In v5.0, 6da4b3ab9a6e ("genirq/affinity: Add support for allocating
+interrupt sets") added IRQ sets to the interface, which reintroduced the
+need to check for -ENOSPC and possibly reduce the number of IRQs requested
+and retry the allocation.
+
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+[bhelgaas: changelog]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Jens Axboe <axboe@fb.com>
+Cc: Keith Busch <keith.busch@intel.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index 536e9a5cd2b14..d66ef88e13cf1 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -1156,7 +1156,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ const struct irq_affinity *affd)
+ {
+ static const struct irq_affinity msi_default_affd;
+- int vecs = -ENOSPC;
++ int msix_vecs = -ENOSPC;
++ int msi_vecs = -ENOSPC;
+
+ if (flags & PCI_IRQ_AFFINITY) {
+ if (!affd)
+@@ -1167,16 +1168,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ }
+
+ if (flags & PCI_IRQ_MSIX) {
+- vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
+- affd);
+- if (vecs > 0)
+- return vecs;
++ msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs,
++ max_vecs, affd);
++ if (msix_vecs > 0)
++ return msix_vecs;
+ }
+
+ if (flags & PCI_IRQ_MSI) {
+- vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd);
+- if (vecs > 0)
+- return vecs;
++ msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs,
++ affd);
++ if (msi_vecs > 0)
++ return msi_vecs;
+ }
+
+ /* use legacy irq if allowed */
+@@ -1187,7 +1189,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ }
+ }
+
+- return vecs;
++ if (msix_vecs == -ENOSPC)
++ return -ENOSPC;
++ return msi_vecs;
+ }
+ EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity);
+
+--
+2.20.1
+
--- /dev/null
+From d876089b3cf0a2eb9dd79af9e1789d193df66f14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:09:56 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1b99d0c80bbe1810572c2cb77b90f67886adfa8d ]
+
+The Port F Control Register 3 (PFCR3) contains only a single field.
+However, counting from left to right, it is the fourth field, not the
+first field.
+Insert the missing dummy configuration values (3 fields of 16 values) to
+fix this.
+
+The descriptor for the Port F Control Register 0 (PFCR0) lacks the
+description for the 4th field (PF0 Mode, PF0MD[2:0]).
+Add the missing configuration values to fix this.
+
+Fixes: a8d42fc4217b1ea1 ("sh-pfc: Add sh7264 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 8070765311dbf..e1c34e19222ee 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) {
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PF12MD_000, PF12MD_001, 0, PF12MD_011,
+ PF12MD_100, PF12MD_101, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0 }
+@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011,
+ PF1MD_100, PF1MD_101, 0, 0,
+- 0, 0, 0, 0, 0, 0, 0, 0
+- }
++ 0, 0, 0, 0, 0, 0, 0, 0,
++ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011,
++ PF0MD_100, PF0MD_101, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0 }
+ },
+
+ { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) {
+--
+2.20.1
+
--- /dev/null
+From 75a1154fb7d3aec0144bfa07e2d94314ccccac0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:41:11 +0100
+Subject: pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 054f2400f706327f96770219c3065b5131f8f154 ]
+
+Some values in the Peripheral Function Select Register 10 descriptor are
+shifted by one position, which may cause a peripheral function to be
+programmed incorrectly.
+
+Fixing this makes all HSCIF0 pins use Function 4 (value 3), like was
+already the case for the HSCK0 pin in field IP10[5:3].
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 6502e676d3686..33232041ee86d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ /* IP10_22 [1] */
+ FN_CAN_CLK_A, FN_RX4_D,
+ /* IP10_21_19 [3] */
+- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B,
+- FN_LCD_M_DISP_B, 0, 0, 0,
++ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B,
++ FN_LCD_M_DISP_B, 0, 0,
+ /* IP10_18_16 [3] */
+- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B,
+- FN_LCD_VEPWC_B, 0, 0, 0,
++ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B,
++ FN_LCD_VEPWC_B, 0, 0,
+ /* IP10_15 [1] */
+ FN_AUDIO_CLKB_A, FN_LCD_CLK_B,
+ /* IP10_14_12 [3] */
+ FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B,
+ FN_LCD_FLM_B, 0, 0, 0,
+ /* IP10_11_9 [3] */
+- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B,
+- FN_LCD_CL2_B, 0, 0, 0,
++ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B,
++ FN_LCD_CL2_B, 0, 0,
+ /* IP10_8_6 [3] */
+- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B,
+- FN_LCD_CL1_B, 0, 0, 0,
++ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B,
++ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+ FN_LCD_DON_B, 0, 0, 0,
+--
+2.20.1
+
--- /dev/null
+From 0e435ff820d29d46c6db2faef4fbe58b913550f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 08:48:25 +0100
+Subject: pinctrl: xway: fix gpio-hog related boot issues
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 9b4924da4711674e62d97d4f5360446cc78337af ]
+
+This patch is based on commit a86caa9ba5d7 ("pinctrl: msm: fix gpio-hog
+related boot issues").
+
+It fixes the issue that the gpio ranges needs to be defined before
+gpiochip_add().
+
+Therefore, we also have to swap the order of registering the pinctrl
+driver and registering the gpio chip.
+
+You also have to add the "gpio-ranges" property to the pinctrl device
+node to get it finally working.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Acked-by: John Crispin <john@phrozen.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-xway.c | 39 +++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
+index f9e98a7d4f0ce..1b0c5958c56a7 100644
+--- a/drivers/pinctrl/pinctrl-xway.c
++++ b/drivers/pinctrl/pinctrl-xway.c
+@@ -1748,14 +1748,6 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ }
+ xway_pctrl_desc.pins = xway_info.pads;
+
+- /* register the gpio chip */
+- xway_chip.parent = &pdev->dev;
+- ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
+- if (ret) {
+- dev_err(&pdev->dev, "Failed to register gpio chip\n");
+- return ret;
+- }
+-
+ /* setup the data needed by pinctrl */
+ xway_pctrl_desc.name = dev_name(&pdev->dev);
+ xway_pctrl_desc.npins = xway_chip.ngpio;
+@@ -1777,10 +1769,33 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- /* finish with registering the gpio range in pinctrl */
+- xway_gpio_range.npins = xway_chip.ngpio;
+- xway_gpio_range.base = xway_chip.base;
+- pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ /* register the gpio chip */
++ xway_chip.parent = &pdev->dev;
++ xway_chip.owner = THIS_MODULE;
++ xway_chip.of_node = pdev->dev.of_node;
++ ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to register gpio chip\n");
++ return ret;
++ }
++
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) {
++ /* finish with registering the gpio range in pinctrl */
++ xway_gpio_range.npins = xway_chip.ngpio;
++ xway_gpio_range.base = xway_chip.base;
++ pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ }
++
+ dev_info(&pdev->dev, "Init done\n");
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3aefaa67c67c83391d49154d5c37ef7df967afd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 21:52:11 +0100
+Subject: PM / AVS: SmartReflex: NULL check before some freeing functions is
+ not needed
+
+From: Thomas Meyer <thomas@m3y3r.de>
+
+[ Upstream commit 14d338a857f05f894ba3badd9e6d3039c68b8180 ]
+
+NULL check before some freeing functions is not needed.
+
+Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/avs/smartreflex.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c
+index 974fd684bab2c..4b6fddc183948 100644
+--- a/drivers/power/avs/smartreflex.c
++++ b/drivers/power/avs/smartreflex.c
+@@ -994,8 +994,7 @@ static int omap_sr_remove(struct platform_device *pdev)
+
+ if (sr_info->autocomp_active)
+ sr_stop_vddautocomp(sr_info);
+- if (sr_info->dbg_dir)
+- debugfs_remove_recursive(sr_info->dbg_dir);
++ debugfs_remove_recursive(sr_info->dbg_dir);
+
+ pm_runtime_disable(&pdev->dev);
+ list_del(&sr_info->node);
+--
+2.20.1
+
--- /dev/null
+From bfae2888e6ec910267d3006ade2b4108a853d026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 13:27:33 +1100
+Subject: powerpc/44x/bamboo: Fix PCI range
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit 3cfb9ebe906b51f2942b1e251009bb251efd2ba6 ]
+
+The bamboo dts has a bug: it uses a non-naturally aligned range
+for PCI memory space. This isnt' supported by the code, thus
+causing PCI to break on this system.
+
+This is due to the fact that while the chip memory map has 1G
+reserved for PCI memory, it's only 512M aligned. The code doesn't
+know how to split that into 2 different PMMs and fails, so limit
+the region to 512M.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/bamboo.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts
+index aa68911f6560a..084b82ba74933 100644
+--- a/arch/powerpc/boot/dts/bamboo.dts
++++ b/arch/powerpc/boot/dts/bamboo.dts
+@@ -268,8 +268,10 @@
+ /* Outbound ranges, one memory and one IO,
+ * later cannot be changed. Chip supports a second
+ * IO range but we don't use it for now
++ * The chip also supports a larger memory range but
++ * it's not naturally aligned, so our code will break
+ */
+- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000
++ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000
+ 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000
+ 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>;
+
+--
+2.20.1
+
--- /dev/null
+From 8fae83a640cdbb235c3695ba109e6e562199ac98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:41:29 +0000
+Subject: powerpc/83xx: handle machine check caused by watchdog timer
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 0deae39cec6dab3a66794f3e9e83ca4dc30080f1 ]
+
+When the watchdog timer is set in interrupt mode, it causes a
+machine check when it times out. The purpose of this mode is to
+ease debugging, not to crash the kernel and reboot the machine.
+
+This patch implements a special handling for that, in order to not
+crash the kernel if the watchdog times out while in interrupt or
+within the idle task.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[scottwood: added missing #include]
+Signed-off-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/cputable.h | 1 +
+ arch/powerpc/include/asm/reg.h | 2 ++
+ arch/powerpc/kernel/cputable.c | 10 ++++++----
+ arch/powerpc/platforms/83xx/misc.c | 17 +++++++++++++++++
+ 4 files changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 7e3ccf21830e6..e4451b30d7e32 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -45,6 +45,7 @@ extern int machine_check_e500(struct pt_regs *regs);
+ extern int machine_check_e200(struct pt_regs *regs);
+ extern int machine_check_47x(struct pt_regs *regs);
+ int machine_check_8xx(struct pt_regs *regs);
++int machine_check_83xx(struct pt_regs *regs);
+
+ extern void cpu_down_flush_e500v2(void);
+ extern void cpu_down_flush_e500mc(void);
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index b779f3ccd4126..05f3c2b3aa0ec 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -733,6 +733,8 @@
+ #define SRR1_PROGTRAP 0x00020000 /* Trap */
+ #define SRR1_PROGADDR 0x00010000 /* SRR0 contains subsequent addr */
+
++#define SRR1_MCE_MCP 0x00080000 /* Machine check signal caused interrupt */
++
+ #define SPRN_HSRR0 0x13A /* Save/Restore Register 0 */
+ #define SPRN_HSRR1 0x13B /* Save/Restore Register 1 */
+ #define HSRR1_DENORM 0x00100000 /* Denorm exception */
+diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
+index 760872916013d..da4b0e3792380 100644
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -1185,6 +1185,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .machine_check = machine_check_generic,
+ .platform = "ppc603",
+ },
++#ifdef CONFIG_PPC_83xx
+ { /* e300c1 (a 603e core, plus some) on 83xx */
+ .pvr_mask = 0x7fff0000,
+ .pvr_value = 0x00830000,
+@@ -1195,7 +1196,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */
+@@ -1209,7 +1210,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c3 (e300c1, plus one IU, half cache size) on 83xx */
+@@ -1223,7 +1224,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+@@ -1240,12 +1241,13 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+ .platform = "ppc603",
+ },
++#endif
+ { /* default match, we assume split I/D cache & TB (non-601)... */
+ .pvr_mask = 0x00000000,
+ .pvr_value = 0x00000000,
+diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c
+index d75c9816a5c92..2b6589fe812dd 100644
+--- a/arch/powerpc/platforms/83xx/misc.c
++++ b/arch/powerpc/platforms/83xx/misc.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/pci.h>
+
++#include <asm/debug.h>
+ #include <asm/io.h>
+ #include <asm/hw_irq.h>
+ #include <asm/ipic.h>
+@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void)
+
+ mpc83xx_setup_pci();
+ }
++
++int machine_check_83xx(struct pt_regs *regs)
++{
++ u32 mask = 1 << (31 - IPIC_MCP_WDT);
++
++ if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask))
++ return machine_check_generic(regs);
++ ipic_clear_mcp_status(mask);
++
++ if (debugger_fault_handler(regs))
++ return 1;
++
++ die("Watchdog NMI Reset", regs, 0);
++
++ return 1;
++}
+--
+2.20.1
+
--- /dev/null
+From 6cc9690748f2134cc982626a62b4059da920c927 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:27:42 +0000
+Subject: powerpc/book3s/32: fix number of bats in p/v_block_mapped()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit e93ba1b7eb5b188c749052df7af1c90821c5f320 ]
+
+This patch fixes the loop in p_block_mapped() and v_block_mapped()
+to scan the entire bat_addrs[] array.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/ppc_mmu_32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c
+index 2a049fb8523d5..96c52271e9c2d 100644
+--- a/arch/powerpc/mm/ppc_mmu_32.c
++++ b/arch/powerpc/mm/ppc_mmu_32.c
+@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */
+ phys_addr_t v_block_mapped(unsigned long va)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (va >= bat_addrs[b].start && va < bat_addrs[b].limit)
+ return bat_addrs[b].phys + (va - bat_addrs[b].start);
+ return 0;
+@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va)
+ unsigned long p_block_mapped(phys_addr_t pa)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (pa >= bat_addrs[b].phys
+ && pa < (bat_addrs[b].limit-bat_addrs[b].start)
+ +bat_addrs[b].phys)
+--
+2.20.1
+
--- /dev/null
+From 63a669e1b70546b2e4d2d99605434010cab70b5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 15:23:33 +0000
+Subject: powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 49a502ea23bf9dec47f8f3c3960909ff409cd1bb ]
+
+As several other arches including x86, this patch makes it explicit
+that a bad page fault is a NULL pointer dereference when the fault
+address is lower than PAGE_SIZE
+
+In the mean time, this page makes all bad_page_fault() messages
+shorter so that they remain on one single line. And it prefixes them
+by "BUG: " so that they get easily grepped.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Avoid pr_cont()]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 52863deed65df..5fc8a010fdf07 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -581,21 +581,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+ switch (regs->trap) {
+ case 0x300:
+ case 0x380:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "data at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: %s at 0x%08lx\n",
++ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" :
++ "Unable to handle kernel data access", regs->dar);
+ break;
+ case 0x400:
+ case 0x480:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "instruction fetch\n");
++ pr_alert("BUG: Unable to handle kernel instruction fetch%s",
++ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n");
+ break;
+ case 0x600:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unaligned access at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n",
++ regs->dar);
+ break;
+ default:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unknown fault\n");
++ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n",
++ regs->dar);
+ break;
+ }
+ printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
+--
+2.20.1
+
--- /dev/null
+From 963fcb8968d89e0f8a59a4c956511bbfda020d64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2017 19:42:40 +0530
+Subject: powerpc/perf: Fix unit_sel/cache_sel checks
+
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+
+[ Upstream commit 2d46d4877b1afd14059393a48bdb8ce27955174c ]
+
+Raw event code has couple of fields "unit" and "cache" in it, to capture
+the "unit" to monitor for a given pmcxsel and cache reload qualifier to
+program in MMCR1.
+
+isa207_get_constraint() refers "unit" field to update the MMCRC (L2/L3)
+Event bus control fields with "cache" bits of the raw event code.
+These are power8 specific and not supported by PowerISA v3.0 pmu. So wrap
+the checks to be power8 specific. Also, "cache" bit field is referred to
+update MMCR1[16:17] and this check can be power8 specific.
+
+Fixes: 7ffd948fae4cd ('powerpc/perf: factor out power8 pmu functions')
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 25 ++++++++++++++++++-------
+ arch/powerpc/perf/isa207-common.h | 4 ++--
+ 2 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index cf9c35aa0cf45..7ecea7143e587 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -150,6 +150,14 @@ static bool is_thresh_cmp_valid(u64 event)
+ return true;
+ }
+
++static unsigned int dc_ic_rld_quad_l1_sel(u64 event)
++{
++ unsigned int cache;
++
++ cache = (event >> EVENT_CACHE_SEL_SHIFT) & MMCR1_DC_IC_QUAL_MASK;
++ return cache;
++}
++
+ static inline u64 isa207_find_source(u64 idx, u32 sub_idx)
+ {
+ u64 ret = PERF_MEM_NA;
+@@ -290,10 +298,10 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ * have a cache selector of zero. The bank selector (bit 3) is
+ * irrelevant, as long as the rest of the value is 0.
+ */
+- if (cache & 0x7)
++ if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7))
+ return -1;
+
+- } else if (event & EVENT_IS_L1) {
++ } else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) {
+ mask |= CNST_L1_QUAL_MASK;
+ value |= CNST_L1_QUAL_VAL(cache);
+ }
+@@ -396,11 +404,14 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
+ /* In continuous sampling mode, update SDAR on TLB miss */
+ mmcra_sdar_mode(event[i], &mmcra);
+
+- if (event[i] & EVENT_IS_L1) {
+- cache = event[i] >> EVENT_CACHE_SEL_SHIFT;
+- mmcr1 |= (cache & 1) << MMCR1_IC_QUAL_SHIFT;
+- cache >>= 1;
+- mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT;
++ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++ cache = dc_ic_rld_quad_l1_sel(event[i]);
++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++ } else {
++ if (event[i] & EVENT_IS_L1) {
++ cache = dc_ic_rld_quad_l1_sel(event[i]);
++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++ }
+ }
+
+ if (is_event_marked(event[i])) {
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index 6c737d675792e..493e5cc5fa8a6 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -232,8 +232,8 @@
+ #define MMCR1_COMBINE_SHIFT(pmc) (35 - ((pmc) - 1))
+ #define MMCR1_PMCSEL_SHIFT(pmc) (24 - (((pmc) - 1)) * 8)
+ #define MMCR1_FAB_SHIFT 36
+-#define MMCR1_DC_QUAL_SHIFT 47
+-#define MMCR1_IC_QUAL_SHIFT 46
++#define MMCR1_DC_IC_QUAL_MASK 0x3
++#define MMCR1_DC_IC_QUAL_SHIFT 46
+
+ /* MMCR1 Combine bits macro for power9 */
+ #define p9_MMCR1_COMBINE_SHIFT(pmc) (38 - ((pmc - 1) * 2))
+--
+2.20.1
+
--- /dev/null
+From f76d702907344a9fc4f027353399eb978e47b720 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 15:25:17 +1100
+Subject: powerpc/powernv/eeh/npu: Fix uninitialized variables in
+ opal_pci_eeh_freeze_status
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit c20577014f85f36d4e137d3d52a1f61225b4a3d2 ]
+
+The current implementation of the OPAL_PCI_EEH_FREEZE_STATUS call in
+skiboot's NPU driver does not touch the pci_error_type parameter so
+it might have garbage but the powernv code analyzes it nevertheless.
+
+This initializes pcierr and fstate to zero in all call sites.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/eeh-powernv.c | 8 ++++----
+ arch/powerpc/platforms/powernv/pci-ioda.c | 4 ++--
+ arch/powerpc/platforms/powernv/pci.c | 4 ++--
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
+index 8864065eba227..fa2965c96155b 100644
+--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
+@@ -548,8 +548,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe)
+ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result = 0;
+
+@@ -587,8 +587,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ static int pnv_eeh_get_pe_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result;
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index ddef22e00ddd7..d3d5796f7df60 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -598,8 +598,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt)
+ static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no)
+ {
+ struct pnv_ioda_pe *slave, *pe;
+- u8 fstate, state;
+- __be16 pcierr;
++ u8 fstate = 0, state;
++ __be16 pcierr = 0;
+ s64 rc;
+
+ /* Sanity check on PE number */
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index 5422f4a6317ca..e2d031a3ec157 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -600,8 +600,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
+ static void pnv_pci_config_check_eeh(struct pci_dn *pdn)
+ {
+ struct pnv_phb *phb = pdn->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ unsigned int pe_no;
+ s64 rc;
+
+--
+2.20.1
+
--- /dev/null
+From 8a7be5d3bfb21ef1d53f9d644406eda00469cc0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 10:27:47 +0000
+Subject: powerpc/prom: fix early DEBUG messages
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit b18f0ae92b0a1db565c3e505fa87b6971ad3b641 ]
+
+This patch fixes early DEBUG messages in prom.c:
+- Use %px instead of %p to see the addresses
+- Cast memblock_phys_mem_size() with (unsigned long long) to
+avoid build failure when phys_addr_t is not 64 bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index f830562974417..d96b284150904 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -128,7 +128,7 @@ static void __init move_device_tree(void)
+ p = __va(memblock_alloc(size, PAGE_SIZE));
+ memcpy(p, initial_boot_params, size);
+ initial_boot_params = p;
+- DBG("Moved device tree to 0x%p\n", p);
++ DBG("Moved device tree to 0x%px\n", p);
+ }
+
+ DBG("<- move_device_tree\n");
+@@ -662,7 +662,7 @@ void __init early_init_devtree(void *params)
+ {
+ phys_addr_t limit;
+
+- DBG(" -> early_init_devtree(%p)\n", params);
++ DBG(" -> early_init_devtree(%px)\n", params);
+
+ /* Too early to BUG_ON(), do it by hand */
+ if (!early_init_dt_verify(params))
+@@ -722,7 +722,7 @@ void __init early_init_devtree(void *params)
+ memblock_allow_resize();
+ memblock_dump_all();
+
+- DBG("Phys. mem: %llx\n", memblock_phys_mem_size());
++ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size());
+
+ /* We may need to relocate the flat tree, do it now.
+ * FIXME .. and the initrd too? */
+--
+2.20.1
+
--- /dev/null
+From c688dbcdd10d43f192acfc68753f96ed19ea9eb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2019 10:42:40 +0800
+Subject: powerpc/pseries/dlpar: Fix a missing check in
+ dlpar_parse_cc_property()
+
+From: Gen Zhang <blackgod016574@gmail.com>
+
+[ Upstream commit efa9ace68e487ddd29c2b4d6dd23242158f1f607 ]
+
+In dlpar_parse_cc_property(), 'prop->name' is allocated by kstrdup().
+kstrdup() may return NULL, so it should be checked and handle error.
+And prop should be freed if 'prop->name' is NULL.
+
+Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index f4e6565dd7a94..fb2876a84fbe6 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa)
+
+ name = (char *)ccwa + be32_to_cpu(ccwa->name_offset);
+ prop->name = kstrdup(name, GFP_KERNEL);
++ if (!prop->name) {
++ dlpar_free_cc_property(prop);
++ return NULL;
++ }
+
+ prop->length = be32_to_cpu(ccwa->prop_length);
+ value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset);
+--
+2.20.1
+
--- /dev/null
+From 90fb495e00bb56cb9339d7ddfd0d69d0f589a0d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 19:16:44 +1100
+Subject: powerpc/pseries: Fix node leak in update_lmb_associativity_index()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 47918bc68b7427e961035949cc1501a864578a69 ]
+
+In update_lmb_associativity_index() we lookup dr_node using
+of_find_node_by_path() which takes a reference for us. In the
+non-error case we forget to drop the reference. Note that
+find_aa_index() does modify properties of the node, but doesn't need
+an extra reference held once it's returned.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-memory.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index 99a3cf51c5ba4..fdfce7a46d733 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -295,6 +295,7 @@ static u32 lookup_lmb_associativity_index(struct of_drconf_cell *lmb)
+
+ aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+
++ of_node_put(dr_node);
+ dlpar_free_cc_nodes(lmb_node);
+ return aa_index;
+ }
+--
+2.20.1
+
--- /dev/null
+From 533ec2f9eae1caf88954db9d4ae3bfff69498b07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:31:08 +0000
+Subject: powerpc/xmon: fix dump_segments()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 32c8c4c621897199e690760c2d57054f8b84b6e6 ]
+
+mfsrin() takes segment num from bits 31-28 (IBM bits 0-3).
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Clarify bit numbering]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/xmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 5a739588aa505..51a53fd517229 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -3293,7 +3293,7 @@ void dump_segments(void)
+
+ printf("sr0-15 =");
+ for (i = 0; i < 16; ++i)
+- printf(" %x", mfsrin(i));
++ printf(" %x", mfsrin(i << 28));
+ printf("\n");
+ }
+ #endif
+--
+2.20.1
+
--- /dev/null
+From a2be2cccf8a7b1d28fe16e331fea6752b7329607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 21:22:18 +0200
+Subject: pwm: bcm-iproc: Prevent unloading the driver module while in use
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ]
+
+The owner member of struct pwm_ops must be set to THIS_MODULE to
+increase the reference count of the module such that the module cannot
+be removed while its code is in use.
+
+Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm-iproc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index d961a8207b1cb..31b01035d0ab3 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ static const struct pwm_ops iproc_pwm_ops = {
+ .apply = iproc_pwmc_apply,
+ .get_state = iproc_pwmc_get_state,
++ .owner = THIS_MODULE,
+ };
+
+ static int iproc_pwmc_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From f1f1396df828826da3f2f4fd0375f70a1e5a5e4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 13:39:24 +0300
+Subject: pwm: clps711x: Fix period calculation
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit b0f17570b8203c22f139459c86cfbaa0311313ed ]
+
+Commit e39c0df1be5a ("pwm: Introduce the pwm_args concept") has
+changed the variable for the period for clps711x-pwm driver, so now
+pwm_get/set_period() works with pwm->state.period variable instead
+of pwm->args.period.
+This patch changes the period variable in other places where it is used.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-clps711x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c
+index 26ec24e457b12..7e16b7def0dcb 100644
+--- a/drivers/pwm/pwm-clps711x.c
++++ b/drivers/pwm/pwm-clps711x.c
+@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v)
+ static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v)
+ {
+ /* Duty cycle 0..15 max */
+- return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm));
++ return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period);
+ }
+
+ static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
+@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ struct clps711x_chip *priv = to_clps711x_chip(chip);
+ unsigned int duty;
+
+- if (period_ns != pwm_get_period(pwm))
++ if (period_ns != pwm->args.period)
+ return -EINVAL;
+
+ duty = clps711x_get_duty(pwm, duty_ns);
+--
+2.20.1
+
--- /dev/null
+From 13ed1c68a38fa7a336f5f4b22f1658eb0a1735b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 13:20:36 -0800
+Subject: RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 2ee00f6a98c36f7e4ba07cc33f24cc5a69060cc9 ]
+
+This patch avoids that the SCSI mid-layer keeps retrying forever if
+ib_post_send() fails. This was discovered while testing immediate
+data support and passing a too large num_sge value to ib_post_send().
+
+Cc: Sergey Gorenko <sergeygo@mellanox.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 3f5b5893792cd..9f7287f45d06f 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2210,6 +2210,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
+
+ if (srp_post_send(ch, iu, len)) {
+ shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
++ scmnd->result = DID_ERROR << 16;
+ goto err_unmap;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 606116f71fa1343a21ec11b3a4e34c73e7ebbd2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 17:17:25 +0200
+Subject: RDMA/vmw_pvrdma: Use atomic memory allocation in create AH
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit a276a4d93bf1580d737f38d1810e5f4b166f3edd ]
+
+Create address handle callback should not sleep, use GFP_ATOMIC instead of
+GFP_KERNEL for memory allocation.
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Cc: Adit Ranadive <aditr@vmware.com>
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+index aa533f08e0171..5c7aa6ff15382 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+@@ -550,7 +550,7 @@ struct ib_ah *pvrdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr,
+ if (!atomic_add_unless(&dev->num_ahs, 1, dev->dsr->caps.max_ah))
+ return ERR_PTR(-ENOMEM);
+
+- ah = kzalloc(sizeof(*ah), GFP_KERNEL);
++ ah = kzalloc(sizeof(*ah), GFP_ATOMIC);
+ if (!ah) {
+ atomic_dec(&dev->num_ahs);
+ return ERR_PTR(-ENOMEM);
+--
+2.20.1
+
--- /dev/null
+From e03fc1a2f2e7d76f9b6f0a2801bbcbc185c79335 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:29:19 -0600
+Subject: regulator: tps65910: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit cd07e3701fa6a4c68f8493ee1d12caa18d46ec6a ]
+
+tps65910_reg_set_bits() may fail. The fix checks if it fails, and if so,
+returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65910-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index 81672a58fcc23..194fa0cbbc048 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, pmic);
+
+ /* Give control of all register to control port */
+- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
++ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
+ DEVCTRL_SR_CTL_I2C_SEL_MASK);
++ if (err < 0)
++ return err;
+
+ switch (tps65910_chip_id(tps65910)) {
+ case TPS65910:
+--
+2.20.1
+
--- /dev/null
+From d1be92656e0e51586ba97a8ba97dae3b00282ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 14:06:23 +0530
+Subject: reset: Fix memory leak in reset_control_array_put()
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 532f9cd6ee994ed10403e856ca27501428048597 ]
+
+Memory allocated for 'struct reset_control_array' in
+of_reset_control_array_get() is never freed in
+reset_control_array_put() resulting in kmemleak showing
+the following backtrace.
+
+ backtrace:
+ [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0
+ [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180
+ [<000000004cc02754>] 0xffff800008c669e4
+ [<0000000050a83b24>] platform_drv_probe+0x50/0xa0
+ [<00000000d3a0b0bc>] really_probe+0x108/0x348
+ [<000000005aa458ac>] driver_probe_device+0x58/0x100
+ [<000000008853626c>] device_driver_attach+0x6c/0x90
+ [<0000000085308d19>] __driver_attach+0x84/0xc8
+ [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8
+ [<00000000dd7f015b>] driver_attach+0x20/0x28
+ [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0
+ [<0000000061473b66>] driver_register+0x60/0x110
+ [<00000000c5bec167>] __platform_driver_register+0x40/0x48
+ [<000000007c764b4f>] 0xffff800008c6c020
+ [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0
+ [<0000000093d4b50d>] do_init_module+0x54/0x1d0
+
+Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index 72b96b5c75a8f..7e0a14211c88a 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -513,6 +513,7 @@ static void reset_control_array_put(struct reset_control_array *resets)
+ for (i = 0; i < resets->num_rstcs; i++)
+ __reset_control_put_internal(resets->rstc[i]);
+ mutex_unlock(&reset_list_mutex);
++ kfree(resets);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 85a8675c102fad3f725a0768db76937d9833744b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 20:57:06 -0700
+Subject: reset: fix reset_control_ops kerneldoc comment
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ]
+
+Add a missing short description to the reset_control_ops documentation.
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[p.zabel@pengutronix.de: rebased and updated commit message]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset-controller.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
+index adb88f8cefbcd..576caaf0c9af5 100644
+--- a/include/linux/reset-controller.h
++++ b/include/linux/reset-controller.h
+@@ -7,7 +7,7 @@
+ struct reset_controller_dev;
+
+ /**
+- * struct reset_control_ops
++ * struct reset_control_ops - reset controller driver callbacks
+ *
+ * @reset: for self-deasserting resets, does all necessary
+ * things to reset the device
+--
+2.20.1
+
--- /dev/null
+From 4113d02e738d6a120de287a4ed7b275c96db6fd9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:48:10 +0800
+Subject: rtl818x: fix potential use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit afbb1947db94eacc5a13302eee88a9772fb78935 ]
+
+entry is released via usb_put_urb just after calling usb_submit_urb.
+However, entry is used if the submission fails, resulting in a use after
+free bug. The patch fixes this.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+index 9a1d15b3ce453..518caaaf8a987 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
+ skb_queue_tail(&priv->rx_queue, skb);
+ usb_anchor_urb(entry, &priv->anchored);
+ ret = usb_submit_urb(entry, GFP_KERNEL);
+- usb_put_urb(entry);
+ if (ret) {
+ skb_unlink(skb, &priv->rx_queue);
+ usb_unanchor_urb(entry);
++ usb_put_urb(entry);
+ goto err;
+ }
++ usb_put_urb(entry);
+ }
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From 6c08b5606863a359afa6db0db4d88137c3a7602d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 21:17:06 -0800
+Subject: scripts/gdb: fix debugging modules compiled with hot/cold
+ partitioning
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ]
+
+gcc's -freorder-blocks-and-partition option makes it group frequently
+and infrequently used code in .text.hot and .text.unlikely sections
+respectively. At least when building modules on s390, this option is
+used by default.
+
+gdb assumes that all code is located in .text section, and that .text
+section is located at module load address. With such modules this is no
+longer the case: there is code in .text.hot and .text.unlikely, and
+either of them might precede .text.
+
+Fix by explicitly telling gdb the addresses of code sections.
+
+It might be tempting to do this for all sections, not only the ones in
+the white list. Unfortunately, gdb appears to have an issue, when
+telling it about e.g. loadable .note.gnu.build-id section causes it to
+think that non-loadable .note.Linux section is loaded at address 0,
+which in turn causes NULL pointers to be resolved to bogus symbols. So
+keep using the white list approach for the time being.
+
+Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/symbols.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 004b0ac7fa72d..4644f1a83b578 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -99,7 +99,8 @@ lx-symbols command."""
+ attrs[n]['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
++ ".text", ".text.hot", ".text.unlikely"]:
+ address = section_name_to_address.get(section_name)
+ if address:
+ args.append(" -s {name} {addr}".format(
+--
+2.20.1
+
--- /dev/null
+From 4ce58afc3821ff64eede5c7a88da34fb2b226186 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:42:50 +0530
+Subject: scsi: csiostor: fix incorrect dma device in case of vport
+
+From: Varun Prakash <varun@chelsio.com>
+
+[ Upstream commit 9934613edcb40b92a216122876cd3b7e76d08390 ]
+
+In case of ->vport_create() call scsi_add_host_with_dma() instead of
+scsi_add_host() to pass correct dma device.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
+index 28a9c7d706cb0..03c7b1603dbc1 100644
+--- a/drivers/scsi/csiostor/csio_init.c
++++ b/drivers/scsi/csiostor/csio_init.c
+@@ -649,7 +649,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev,
+ if (csio_lnode_init(ln, hw, pln))
+ goto err_shost_put;
+
+- if (scsi_add_host(shost, dev))
++ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev))
+ goto err_lnode_exit;
+
+ return ln;
+--
+2.20.1
+
--- /dev/null
+From 9849f40fd2dc6b34015b37bbb77eef72f4be383d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:27 +0800
+Subject: scsi: libsas: Check SMP PHY control function result
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 01929a65dfa13e18d89264ab1378854a91857e59 ]
+
+Currently the SMP PHY control execution result is checked, however the
+function result for the command is not.
+
+As such, we may be missing all potential errors, like SMP FUNCTION FAILED,
+INVALID REQUEST FRAME LENGTH, etc., meaning the PHY control request has
+failed.
+
+In some scenarios we need to ensure the function result is accepted, so add
+a check for this.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 63c44eaabf69e..f77d72f01da91 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -614,7 +614,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id,
+ }
+
+ res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE);
+-
++ if (res) {
++ pr_err("ex %016llx phy%02d PHY control failed: %d\n",
++ SAS_ADDR(dev->sas_addr), phy_id, res);
++ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) {
++ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n",
++ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]);
++ res = pc_resp[2];
++ }
+ kfree(pc_resp);
+ kfree(pc_req);
+ return res;
+--
+2.20.1
+
--- /dev/null
+From 701d7303950c9fee312ae0fdc07628f0a8efae4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:28 +0800
+Subject: scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+ discovery
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit cec9771d2e954650095aa37a6a97722c8194e7d2 ]
+
+ +----------+ +----------+
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ |initiator | | |
+ | device |--- 3.0 G ---| Expander |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ | | | |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ +----------+ +----------+
+
+According to Serial Attached SCSI - 1.1 (SAS-1.1):
+If an expander PHY attached to a SATA PHY is using a physical link rate
+greater than the maximum connection rate supported by the pathway from an
+STP initiator port, a management application client should use the SMP PHY
+CONTROL function (see 10.4.3.10) to set the PROGRAMMED MAXIMUM PHYSICAL
+LINK RATE field of the expander PHY to the maximum connection rate
+supported by the pathway from that STP initiator port.
+
+Currently libsas does not support checking if this condition occurs, nor
+rectifying when it does.
+
+Such a condition is not at all common, however it has been seen on some
+pre-silicon environments where the initiator PHY only supports a 1.5 Gbit
+maximum linkrate, mated with 12G expander PHYs and 3/6G SATA phy.
+
+This patch adds support for checking and rectifying this condition during
+initial device discovery only.
+
+We do support checking min pathway connection rate during revalidation phase,
+when new devices can be detected in the topology. However we do not
+support in the case of the the user reprogramming PHY linkrates, such that
+min pathway condition is not met/maintained.
+
+A note on root port PHY rates:
+The libsas root port PHY rates calculation is broken. Libsas sets the
+rates (min, max, and current linkrate) of a root port to the same linkrate
+of the first PHY member of that same port. In doing so, it assumes that
+all other PHYs which subsequently join the port to have the same
+negotiated linkrate, when they could actually be different.
+
+In practice this doesn't happen, as initiator and expander PHYs are
+normally initialised with consistent min/max linkrates.
+
+This has not caused an issue so far, so leave alone for now.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 7f2d00354a850..63c44eaabf69e 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -817,6 +817,26 @@ static struct domain_device *sas_ex_discover_end_dev(
+
+ #ifdef CONFIG_SCSI_SAS_ATA
+ if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) {
++ if (child->linkrate > parent->min_linkrate) {
++ struct sas_phy_linkrates rates = {
++ .maximum_linkrate = parent->min_linkrate,
++ .minimum_linkrate = parent->min_linkrate,
++ };
++ int ret;
++
++ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ ret = sas_smp_phy_control(parent, phy_id,
++ PHY_FUNC_LINK_RESET, &rates);
++ if (ret) {
++ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n",
++ SAS_ADDR(child->sas_addr), phy_id, ret);
++ goto out_free;
++ }
++ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ child->linkrate = child->min_linkrate;
++ }
+ res = sas_get_ata_info(child, phy);
+ if (res)
+ goto out_free;
+--
+2.20.1
+
--- /dev/null
+From d82b9e8fdc9109b53031c616b91fec20a8fb7a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 19:37:01 -0800
+Subject: scsi: lpfc: Enable Management features for IF_TYPE=6
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 719162bd5bb968203397b9b1d0dd30a9797bbd09 ]
+
+Addition of support for if_type=6 missed several checks for interface type,
+resulting in the failure of several key management features such as
+firmware dump and loopback testing.
+
+Correct the checks on the if_type so that both SLI4 IF_TYPE's 2 and 6 are
+supported.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_attr.c | 4 ++--
+ drivers/scsi/lpfc/lpfc_bsg.c | 6 +++---
+ drivers/scsi/lpfc/lpfc_els.c | 2 +-
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +-
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index 3da242201cb45..82ce5d1930189 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -1178,7 +1178,7 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode)
+ return -EACCES;
+
+ if ((phba->sli_rev < LPFC_SLI_REV4) ||
+- (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2))
+ return -EPERM;
+
+@@ -4056,7 +4056,7 @@ lpfc_link_speed_store(struct device *dev, struct device_attribute *attr,
+ uint32_t prev_val, if_type;
+
+ if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf);
+- if (if_type == LPFC_SLI_INTF_IF_TYPE_2 &&
++ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2 &&
+ phba->hba_flag & HBA_FORCED_LINK_SPEED)
+ return -EPERM;
+
+diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
+index d89816222b230..6dde21dc82a3c 100644
+--- a/drivers/scsi/lpfc/lpfc_bsg.c
++++ b/drivers/scsi/lpfc/lpfc_bsg.c
+@@ -2221,7 +2221,7 @@ lpfc_bsg_diag_loopback_mode(struct bsg_job *job)
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+ rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job);
+- else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) ==
++ else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=
+ LPFC_SLI_INTF_IF_TYPE_2)
+ rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job);
+ else
+@@ -2261,7 +2261,7 @@ lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job)
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+ return -ENODEV;
+- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2)
+ return -ENODEV;
+
+@@ -2353,7 +2353,7 @@ lpfc_sli4_bsg_link_diag_test(struct bsg_job *job)
+ rc = -ENODEV;
+ goto job_error;
+ }
+- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2) {
+ rc = -ENODEV;
+ goto job_error;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index a31f87eb1e621..c851fd14ff3e9 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -5550,7 +5550,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
+ struct ls_rjt stat;
+
+ if (phba->sli_rev < LPFC_SLI_REV4 ||
+- bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2) {
+ rjt_err = LSRJT_UNABLE_TPC;
+ rjt_expl = LSEXP_REQ_UNSUPPORTED;
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index d850077c5e226..3f88f3d796227 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4769,7 +4769,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
+ if (phba->sli_rev == LPFC_SLI_REV4 &&
+ (!(vport->load_flag & FC_UNLOADING)) &&
+ (bf_get(lpfc_sli_intf_if_type,
+- &phba->sli4_hba.sli_intf) ==
++ &phba->sli4_hba.sli_intf) >=
+ LPFC_SLI_INTF_IF_TYPE_2) &&
+ (kref_read(&ndlp->kref) > 0)) {
+ mbox->context1 = lpfc_nlp_get(ndlp);
+--
+2.20.1
+
--- /dev/null
+From ce9a5e2e5a8391bb81afcc1d1db4a68be8401952 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:40 -0800
+Subject: scsi: lpfc: Fix dif and first burst use in write commands
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 7c4042a4d0b7532cfbc90478fd3084b2dab5849e ]
+
+When dif and first burst is used in a write command wqe, the driver was not
+properly setting fields in the io command request. This resulted in no dif
+bytes being sent and invalid xfer_rdy's, resulting in the io being aborted
+by the hardware.
+
+Correct the wqe initializaton when both dif and first burst are used.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 07cb671bb8550..2eba0c39ac1c4 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -2714,6 +2714,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd
+@@ -2819,6 +2820,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ return 0;
+ err:
+ if (lpfc_cmd->seg_cnt)
+@@ -3371,6 +3380,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd
+@@ -3486,6 +3496,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ /*
+ * If the OAS driver feature is enabled and the lun is enabled for
+ * OAS, set the oas iocb related flags.
+--
+2.20.1
+
--- /dev/null
+From 64d138567e10bdf34c6445e9cfedec0bb7a1c6e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:32 -0800
+Subject: scsi: lpfc: Fix kernel Oops due to null pring pointers
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 5a9eeff57f340238c39c95d8e7e54c96fc722de7 ]
+
+Driver is hitting null pring pointers in lpfc_do_work().
+
+Pointer assignment occurs based on SLI-revision. If recovering after an
+error, its possible the sli revision for the port was cleared, making the
+lpfc_phba_elsring() not return a ring pointer, thus the null pointer.
+
+Add SLI revision checking to lpfc_phba_elsring() and status checking to all
+callers.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc.h | 6 ++++++
+ drivers/scsi/lpfc/lpfc_els.c | 2 ++
+ drivers/scsi/lpfc/lpfc_init.c | 7 ++++++-
+ drivers/scsi/lpfc/lpfc_sli.c | 2 ++
+ 4 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index bc61cc8bc6f02..03e95a3216c8c 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -1239,6 +1239,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
+ static inline struct lpfc_sli_ring *
+ lpfc_phba_elsring(struct lpfc_hba *phba)
+ {
++ /* Return NULL if sli_rev has become invalid due to bad fw */
++ if (phba->sli_rev != LPFC_SLI_REV4 &&
++ phba->sli_rev != LPFC_SLI_REV3 &&
++ phba->sli_rev != LPFC_SLI_REV2)
++ return NULL;
++
+ if (phba->sli_rev == LPFC_SLI_REV4) {
+ if (phba->sli4_hba.els_wq)
+ return phba->sli4_hba.els_wq->pring;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index e5db20e8979d5..a31f87eb1e621 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1337,6 +1337,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba)
+ Fabric_DID);
+
+ pring = lpfc_phba_elsring(phba);
++ if (unlikely(!pring))
++ return -EIO;
+
+ /*
+ * Check the txcmplq for an iocb that matches the nport the driver is
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index 15bcd00dd7a23..c69c2a2b2eadf 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -1773,7 +1773,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action,
+ lpfc_offline(phba);
+ /* release interrupt for possible resource change */
+ lpfc_sli4_disable_intr(phba);
+- lpfc_sli_brdrestart(phba);
++ rc = lpfc_sli_brdrestart(phba);
++ if (rc) {
++ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
++ "6309 Failed to restart board\n");
++ return rc;
++ }
+ /* request and enable interrupt */
+ intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode);
+ if (intr_mode == LPFC_INTR_ERROR) {
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index ebf7d3cda3677..62bea4ffdc25a 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -4421,6 +4421,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba)
+ hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED;
+
+ rc = lpfc_sli4_brdreset(phba);
++ if (rc)
++ return rc;
+
+ spin_lock_irq(&phba->hbalock);
+ phba->pport->stopped = 0;
+--
+2.20.1
+
--- /dev/null
+From ff5b4afaee1411f85cceb524888e96839ccb52af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:48:45 -0700
+Subject: scsi: qla2xxx: deadlock by configfs_depend_item
+
+From: Anatoliy Glagolev <glagolig@gmail.com>
+
+[ Upstream commit 17b18eaa6f59044a5172db7d07149e31ede0f920 ]
+
+The intent of invoking configfs_depend_item in commit 7474f52a82d51
+("tcm_qla2xxx: Perform configfs depend/undepend for base_tpg")
+was to prevent a physical Fibre Channel port removal when
+virtual (NPIV) ports announced through that physical port are active.
+The change does not work as expected: it makes enabled physical port
+dependent on target configfs subsystem (the port's parent), something
+the configfs guarantees anyway.
+
+Besides, scheduling work in a worker thread and waiting for the work's
+completion is not really a valid workaround for the requirement not to call
+configfs_depend_item from a configfs callback: the call occasionally
+deadlocks.
+
+Thus, removing configfs_depend_item calls does not break anything and fixes
+the deadlock problem.
+
+Signed-off-by: Anatoliy Glagolev <glagolig@gmail.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 48 +++++-------------------------
+ drivers/scsi/qla2xxx/tcm_qla2xxx.h | 3 --
+ 2 files changed, 8 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 2fcdaadd10fa5..e08ac431bc496 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -903,38 +903,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item,
+ atomic_read(&tpg->lport_tpg_enabled));
+ }
+
+-static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 1);
+- qlt_enable_vha(base_vha);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 0);
+- target_undepend_item(&se_tpg->tpg_group.cg_item);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ const char *page, size_t count)
+ {
+ struct se_portal_group *se_tpg = to_tpg(item);
++ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
++ struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
++ struct tcm_qla2xxx_lport, lport_wwn);
++ struct scsi_qla_host *vha = lport->qla_vha;
+ struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+ struct tcm_qla2xxx_tpg, se_tpg);
+ unsigned long op;
+@@ -953,24 +929,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ if (atomic_read(&tpg->lport_tpg_enabled))
+ return -EEXIST;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 1);
++ qlt_enable_vha(vha);
+ } else {
+ if (!atomic_read(&tpg->lport_tpg_enabled))
+ return count;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 0);
++ qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+ }
+- init_completion(&tpg->tpg_base_comp);
+- schedule_work(&tpg->tpg_base_work);
+- wait_for_completion(&tpg->tpg_base_comp);
+
+- if (op) {
+- if (!atomic_read(&tpg->lport_tpg_enabled))
+- return -ENODEV;
+- } else {
+- if (atomic_read(&tpg->lport_tpg_enabled))
+- return -EPERM;
+- }
+ return count;
+ }
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+index 7550ba2831c36..147cf6c903666 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg {
+ struct tcm_qla2xxx_tpg_attrib tpg_attrib;
+ /* Returned by tcm_qla2xxx_make_tpg() */
+ struct se_portal_group se_tpg;
+- /* Items for dealing with configfs_depend_item */
+- struct completion tpg_base_comp;
+- struct work_struct tpg_base_work;
+ };
+
+ struct tcm_qla2xxx_fc_loopid {
+--
+2.20.1
+
--- /dev/null
+From b2e2a0f9245b582de9581a61d3890faf9ca7435b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 09:45:26 +0100
+Subject: sctp: don't compare hb_timer expire date before starting it
+
+From: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+
+[ Upstream commit d1f20c03f48102e52eb98b8651d129b83134cae4 ]
+
+hb_timer might not start at all for a particular transport because its
+start is conditional. In a result a node is not sending heartbeats.
+
+Function sctp_transport_reset_hb_timer has two roles:
+ - initial start of hb_timer for a given transport,
+ - update expire date of hb_timer for a given transport.
+The function is optimized to update timer's expire only if it is before
+a new calculated one but this comparison is invalid for a timer which
+has not yet started. Such a timer has expire == 0 and if a new expire
+value is bigger than (MAX_JIFFIES / 2 + 2) then "time_before" macro will
+fail and timer will not start resulting in no heartbeat packets send by
+the node.
+
+This was found when association was initialized within first 5 mins
+after system boot due to jiffies init value which is near to MAX_JIFFIES.
+
+Test kernel version: 4.9.154 (ARCH=arm)
+hb_timer.expire = 0; //initialized, not started timer
+new_expire = MAX_JIFFIES / 2 + 2; //or more
+time_before(hb_timer.expire, new_expire) == false
+
+Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often")
+Reported-by: Marcin Stojek <marcin.stojek@nokia.com>
+Tested-by: Marcin Stojek <marcin.stojek@nokia.com>
+Signed-off-by: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/transport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 43105cf04bc45..274df899e7bfa 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -210,7 +210,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
+
+ /* When a data chunk is sent, reset the heartbeat interval. */
+ expires = jiffies + sctp_transport_timeout(transport);
+- if (time_before(transport->hb_timer.expires, expires) &&
++ if ((time_before(transport->hb_timer.expires, expires) ||
++ !timer_pending(&transport->hb_timer)) &&
+ !mod_timer(&transport->hb_timer,
+ expires + prandom_u32_max(transport->rto)))
+ sctp_transport_hold(transport);
+--
+2.20.1
+
--- /dev/null
+From c0a127630b5e15f08bdb5042e474487e277b0594 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 17:00:19 +0800
+Subject: serial: 8250: Fix serial8250 initialization crash
+
+From: He Zhe <zhe.he@windriver.com>
+
+[ Upstream commit 352c4cf40c4a7d439fa5d30aa2160f54b394da82 ]
+
+The initialization code of interrupt backoff work might reference NULL
+pointer and cause the following crash, if no port was found.
+
+[ 10.017727] CPU 0 Unable to handle kernel paging request at virtual address 000001b0, epc == 807088e0, ra == 8070863c
+---- snip ----
+[ 11.704470] [<807088e0>] serial8250_register_8250_port+0x318/0x4ac
+[ 11.747251] [<80708d74>] serial8250_probe+0x148/0x1c0
+[ 11.789301] [<80728450>] platform_drv_probe+0x40/0x94
+[ 11.830515] [<807264f8>] really_probe+0xf8/0x318
+[ 11.870876] [<80726b7c>] __driver_attach+0x110/0x12c
+[ 11.910960] [<80724374>] bus_for_each_dev+0x78/0xcc
+[ 11.951134] [<80725958>] bus_add_driver+0x200/0x234
+[ 11.989756] [<807273d8>] driver_register+0x84/0x148
+[ 12.029832] [<80d72f84>] serial8250_init+0x138/0x198
+[ 12.070447] [<80100e6c>] do_one_initcall+0x5c/0x2a0
+[ 12.110104] [<80d3a208>] kernel_init_freeable+0x370/0x484
+[ 12.150722] [<80a49420>] kernel_init+0x10/0xf8
+[ 12.191517] [<8010756c>] ret_from_kernel_thread+0x14/0x1c
+
+This patch makes sure the initialization code can be reached only if a port
+is found.
+
+Fixes: 6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during input overruns")
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Reviewed-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_core.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index ceeea4b159c4b..c698ebab6d3bd 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1077,15 +1077,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+
+ ret = 0;
+ }
+- }
+
+- /* Initialise interrupt backoff work if required */
+- if (up->overrun_backoff_time_ms > 0) {
+- uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
+- INIT_DELAYED_WORK(&uart->overrun_backoff,
+- serial_8250_overrun_backoff_work);
+- } else {
+- uart->overrun_backoff_time_ms = 0;
++ /* Initialise interrupt backoff work if required */
++ if (up->overrun_backoff_time_ms > 0) {
++ uart->overrun_backoff_time_ms =
++ up->overrun_backoff_time_ms;
++ INIT_DELAYED_WORK(&uart->overrun_backoff,
++ serial_8250_overrun_backoff_work);
++ } else {
++ uart->overrun_backoff_time_ms = 0;
++ }
+ }
+
+ mutex_unlock(&serial_mutex);
+--
+2.20.1
+
--- /dev/null
+From 2d455ae8123589f24c0cd233ac4d18e9ea53523a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:29:09 +1300
+Subject: serial: 8250: Rate limit serial port rx interrupts during input
+ overruns
+
+From: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+
+[ Upstream commit 6d7f677a2afa1c82d7fc7af7f9159cbffd5dc010 ]
+
+When a serial port gets faulty or gets flooded with inputs, its interrupt
+handler starts to work double time to get the characters to the workqueue
+for the tty layer to handle them. When this busy time on the serial/tty
+subsystem happens during boot, where it is also busy on the userspace
+trying to initialise, some processes can continuously get preempted
+and will be on hold until the interrupts subside.
+
+The fix is to backoff on processing received characters for a specified
+amount of time when an input overrun is seen (received a new character
+before the previous one is processed). This only stops receive and will
+continue to transmit characters to serial port. After the backoff period
+is done, it receive will be re-enabled. This is optional and will only
+be enabled by setting 'overrun-throttle-ms' in the dts.
+
+Signed-off-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_core.c | 25 +++++++++++++++++++++++++
+ drivers/tty/serial/8250/8250_fsl.c | 23 ++++++++++++++++++++++-
+ drivers/tty/serial/8250/8250_of.c | 5 +++++
+ include/linux/serial_8250.h | 4 ++++
+ 4 files changed, 56 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index d29b512a7d9fa..ceeea4b159c4b 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -953,6 +953,21 @@ static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port *
+ return NULL;
+ }
+
++static void serial_8250_overrun_backoff_work(struct work_struct *work)
++{
++ struct uart_8250_port *up =
++ container_of(to_delayed_work(work), struct uart_8250_port,
++ overrun_backoff);
++ struct uart_port *port = &up->port;
++ unsigned long flags;
++
++ spin_lock_irqsave(&port->lock, flags);
++ up->ier |= UART_IER_RLSI | UART_IER_RDI;
++ up->port.read_status_mask |= UART_LSR_DR;
++ serial_out(up, UART_IER, up->ier);
++ spin_unlock_irqrestore(&port->lock, flags);
++}
++
+ /**
+ * serial8250_register_8250_port - register a serial port
+ * @up: serial port template
+@@ -1063,6 +1078,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ ret = 0;
+ }
+ }
++
++ /* Initialise interrupt backoff work if required */
++ if (up->overrun_backoff_time_ms > 0) {
++ uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
++ INIT_DELAYED_WORK(&uart->overrun_backoff,
++ serial_8250_overrun_backoff_work);
++ } else {
++ uart->overrun_backoff_time_ms = 0;
++ }
++
+ mutex_unlock(&serial_mutex);
+
+ return ret;
+diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c
+index 910bfee5a88b7..cc138c24ae889 100644
+--- a/drivers/tty/serial/8250/8250_fsl.c
++++ b/drivers/tty/serial/8250/8250_fsl.c
+@@ -48,8 +48,29 @@ int fsl8250_handle_irq(struct uart_port *port)
+
+ lsr = orig_lsr = up->port.serial_in(&up->port, UART_LSR);
+
+- if (lsr & (UART_LSR_DR | UART_LSR_BI))
++ /* Process incoming characters first */
++ if ((lsr & (UART_LSR_DR | UART_LSR_BI)) &&
++ (up->ier & (UART_IER_RLSI | UART_IER_RDI))) {
+ lsr = serial8250_rx_chars(up, lsr);
++ }
++
++ /* Stop processing interrupts on input overrun */
++ if ((orig_lsr & UART_LSR_OE) && (up->overrun_backoff_time_ms > 0)) {
++ unsigned long delay;
++
++ up->ier = port->serial_in(port, UART_IER);
++ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++ port->ops->stop_rx(port);
++ } else {
++ /* Keep restarting the timer until
++ * the input overrun subsides.
++ */
++ cancel_delayed_work(&up->overrun_backoff);
++ }
++
++ delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
++ schedule_delayed_work(&up->overrun_backoff, delay);
++ }
+
+ serial8250_modem_status(up);
+
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index ec510e342e06c..c51044ba503c3 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -232,6 +232,11 @@ static int of_platform_serial_probe(struct platform_device *ofdev)
+ if (of_property_read_bool(ofdev->dev.of_node, "auto-flow-control"))
+ port8250.capabilities |= UART_CAP_AFE;
+
++ if (of_property_read_u32(ofdev->dev.of_node,
++ "overrun-throttle-ms",
++ &port8250.overrun_backoff_time_ms) != 0)
++ port8250.overrun_backoff_time_ms = 0;
++
+ ret = serial8250_register_8250_port(&port8250);
+ if (ret < 0)
+ goto err_dispose;
+diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
+index a27ef5f564317..791a6be0e3949 100644
+--- a/include/linux/serial_8250.h
++++ b/include/linux/serial_8250.h
+@@ -134,6 +134,10 @@ struct uart_8250_port {
+ void (*dl_write)(struct uart_8250_port *, int);
+
+ struct uart_8250_em485 *em485;
++
++ /* Serial port overrun backoff */
++ struct delayed_work overrun_backoff;
++ u32 overrun_backoff_time_ms;
+ };
+
+ static inline struct uart_8250_port *up_to_u8250p(struct uart_port *up)
+--
+2.20.1
+
--- /dev/null
+From cc60d99f3595c0c1b5e1322261c2362a84ecade5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 14:19:20 +0300
+Subject: serial: max310x: Fix tx_empty() callback
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit a8da3c7873ea57acb8f9cea58c0af477522965aa ]
+
+Function max310x_tx_empty() accesses the IRQSTS register, which is
+cleared by IC when reading, so if there is an interrupt status, we
+will lose it. This patch implement the transmitter check only by
+the current FIFO level.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index 0969a0d97b2be..cec995ec11eab 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -769,12 +769,9 @@ static void max310x_start_tx(struct uart_port *port)
+
+ static unsigned int max310x_tx_empty(struct uart_port *port)
+ {
+- unsigned int lvl, sts;
++ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+
+- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+- sts = max310x_port_read(port, MAX310X_IRQSTS_REG);
+-
+- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0;
++ return lvl ? 0 : TIOCSER_TEMT;
+ }
+
+ static unsigned int max310x_get_mctrl(struct uart_port *port)
+--
+2.20.1
+
--- /dev/null
+clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch
+asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch
+asoc-compress-fix-unsigned-integer-overflow-check.patch
+reset-fix-memory-leak-in-reset_control_array_put.patch
+asoc-kirkwood-fix-external-clock-probe-defer.patch
+clk-samsung-exynos5420-preserve-pll-configuration-du.patch
+reset-fix-reset_control_ops-kerneldoc-comment.patch
+clk-at91-avoid-sleeping-early.patch
+clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch
+idr-fix-idr_alloc_u32-on-32-bit-systems.patch
+x86-resctrl-prevent-null-pointer-dereference-when-re.patch
+clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch
+net-fec-add-missed-clk_disable_unprepare-in-remove.patch
+bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch
+can-peak_usb-report-bus-recovery-as-well.patch
+can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
+can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch
+can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch
+can-rx-offload-can_rx_offload_offload_one-increment-.patch
+can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch
+can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch
+can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch
+watchdog-meson-fix-the-wrong-value-of-left-time.patch
+scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
+net-bcmgenet-reapply-manual-settings-to-the-phy.patch
+ceph-return-einval-if-given-fsc-mount-option-on-kern.patch
+mac80211-fix-station-inactive_time-shortly-after-boo.patch
+block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
+pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
+scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch
+scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
+arm-dts-fix-up-sq201-flash-access.patch
+arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
+arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
+parisc-fix-serio-address-output.patch
+parisc-fix-hp-sdc-hpa-address-output.patch
+arm64-mm-prevent-mismatched-52-bit-va-support.patch
+arm64-smp-handle-errors-reported-by-the-firmware.patch
+arm-omap1-fix-usb-configuration-for-device-only-setu.patch
+rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch
+pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
+arm-ks8695-fix-section-mismatch-warning.patch
+acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
+scsi-lpfc-enable-management-features-for-if_type-6.patch
+crypto-user-support-incremental-algorithm-dumps.patch
+mwifiex-fix-potential-null-dereference-and-use-after.patch
+mwifiex-debugfs-correct-histogram-spacing-formatting.patch
+rtl818x-fix-potential-use-after-free.patch
+xfs-require-both-realtime-inodes-to-mount.patch
+ubi-put-mtd-device-after-it-is-not-used.patch
+ubi-do-not-drop-ubi-device-reference-before-using.patch
+microblaze-adjust-the-help-to-the-real-behavior.patch
+microblaze-move-.-is-ready-messages-to-arch-microbla.patch
+iwlwifi-move-iwl_nvm_check_version-into-dvm.patch
+gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
+kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch
+vsock-bind-to-random-port-for-vmaddr_port_any.patch
+mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch
+mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch
+btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
+hid-intel-ish-hid-fixes-incorrect-error-handling.patch
+serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch
+kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch
+xen-pciback-check-dev_data-before-using-it.patch
+vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch
+pinctrl-xway-fix-gpio-hog-related-boot-issues.patch
+net-mlx5-continue-driver-initialization-despite-debu.patch
+exofs_mount-fix-leaks-on-failure-exits.patch
+bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch
+bnxt_en-query-force-speeds-before-disabling-autoneg-.patch
+kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
+pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
+pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
+hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
+dm-flakey-properly-corrupt-multi-page-bios.patch
+gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
+xfs-align-compat-attrlist_by_handle-with-native-impl.patch
+xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch
+ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
+clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch
+vxlan-fix-error-path-in-__vxlan_dev_create.patch
+powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
+powerpc-xmon-fix-dump_segments.patch
+drivers-regulator-fix-a-missing-check-of-return-valu.patch
+bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch
+serial-max310x-fix-tx_empty-callback.patch
+openrisc-fix-broken-paths-to-arch-or32.patch
+rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
+scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
+scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
+ath6kl-only-use-match-sets-when-firmware-supports-it.patch
+ath6kl-fix-off-by-one-error-in-scan-completion.patch
+powerpc-perf-fix-unit_sel-cache_sel-checks.patch
+powerpc-prom-fix-early-debug-messages.patch
+powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
+powerpc-44x-bamboo-fix-pci-range.patch
+vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch
+powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch
+drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch
+drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
+drbd-do-not-block-when-adjusting-disk-options-while-.patch
+drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
+ib-rxe-make-counters-thread-safe.patch
+regulator-tps65910-fix-a-missing-check-of-return-val.patch
+powerpc-83xx-handle-machine-check-caused-by-watchdog.patch
+powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch
+crypto-mxc-scc-fix-build-warnings-on-arm64.patch
+pwm-clps711x-fix-period-calculation.patch
+net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch
+net-net_namespace-check-the-return-value-of-register.patch
+f2fs-fix-to-dirty-inode-synchronously.patch
+um-make-gcov-depend-on-kcov.patch
+net-cpts-fix-a-missing-check-of-clk_prepare.patch
+net-stmicro-fix-a-missing-check-of-clk_prepare.patch
+net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch
+atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
+tipc-fix-a-missing-check-of-genlmsg_put.patch
+net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch
+ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
+vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch
+lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch
+lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
+fork-fix-some-wmissing-prototypes-warnings.patch
+drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch
+lib-genalloc.c-include-vmalloc.h.patch
+mtd-check-add_mtd_device-ret-code.patch
+tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
+net-core-neighbour-tell-kmemleak-about-hash-tables.patch
+pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch
+net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
+serial-8250-fix-serial8250-initialization-crash.patch
+gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch
+sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
+ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch
+decnet-fix-dn_ifreq_size.patch
+net-smc-prevent-races-between-smc_lgr_terminate-and-.patch
+blktrace-show-requests-without-sector.patch
+tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
+sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
+net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
+sctp-don-t-compare-hb_timer-expire-date-before-start.patch
+bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch
+net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
+kvm-properly-check-debugfs-dentry-before-using-it.patch
+bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch
+net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch
+iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch
+apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch
+scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
+acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch
+acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
+scsi-libsas-check-smp-phy-control-function-result.patch
+f2fs-fix-to-data-block-override-node-segment-by-mist.patch
+powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
+mtd-remove-a-debug-trace-in-mtdpart.c.patch
--- /dev/null
+From d51d229f70e0b1a6b82e9f79cb599126ce803af3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 13:10:00 +0000
+Subject: sfc: initialise found bitmap in efx_ef10_mtd_probe
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+[ Upstream commit c65285428b6e7797f1bb063f33b0ae7e93397b7b ]
+
+The bitmap of found partitions in efx_ef10_mtd_probe was not
+initialised, causing partitions to be suppressed based off whatever
+value was in the bitmap at the start.
+
+Fixes: 3366463513f5 ("sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe")
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index cc3be94d05622..2d92a9fe4606c 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -5918,7 +5918,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+- DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+--
+2.20.1
+
--- /dev/null
+From ff69edf325b8d455122e699e82472f86b71689e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jan 2019 19:02:17 +0000
+Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
+
+From: Edward Cree <ecree@solarflare.com>
+
+[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ]
+
+Use a bitmap to keep track of which partition types we've already seen;
+ for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and
+ thus skip adding that partition.
+Duplicate partitions occur because of the A/B backup scheme used by newer
+ sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because
+ they have the same name, causing us not to expose any MTDs at all.
+
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 09352ee43b55c..cc3be94d05622 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -5852,22 +5852,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
+ { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" },
+ { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" },
+ };
++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types)
+
+ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ struct efx_mcdi_mtd_partition *part,
+- unsigned int type)
++ unsigned int type,
++ unsigned long *found)
+ {
+ MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
+ const struct efx_ef10_nvram_type_info *info;
+ size_t size, erase_size, outlen;
++ int type_idx = 0;
+ bool protected;
+ int rc;
+
+- for (info = efx_ef10_nvram_types; ; info++) {
+- if (info ==
+- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
++ for (type_idx = 0; ; type_idx++) {
++ if (type_idx == EF10_NVRAM_PARTITION_COUNT)
+ return -ENODEV;
++ info = efx_ef10_nvram_types + type_idx;
+ if ((type & ~info->type_mask) == info->type)
+ break;
+ }
+@@ -5880,6 +5883,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ if (protected)
+ return -ENODEV; /* hide it */
+
++ /* If we've already exposed a partition of this type, hide this
++ * duplicate. All operations on MTDs are keyed by the type anyway,
++ * so we can't act on the duplicate.
++ */
++ if (__test_and_set_bit(type_idx, found))
++ return -EEXIST;
++
+ part->nvram_type = type;
+
+ MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
+@@ -5908,6 +5918,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+@@ -5936,11 +5947,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ for (i = 0; i < n_parts_total; i++) {
+ type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
+ i);
+- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+- if (rc == 0)
+- n_parts++;
+- else if (rc != -ENODEV)
++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
++ found);
++ if (rc == -EEXIST || rc == -ENODEV)
++ continue;
++ if (rc)
+ goto fail;
++ n_parts++;
+ }
+
+ rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+--
+2.20.1
+
--- /dev/null
+From 0698e10dfc6290111453c290b6b84c56b1e0248b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 00:09:04 -0600
+Subject: tipc: fix a missing check of genlmsg_put
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 46273cf7e009231d2b6bc10a926e82b8928a9fb2 ]
+
+genlmsg_put could fail. The fix inserts a check of its return value, and
+if it fails, returns -EMSGSIZE.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 1c8ac0c11008c..91d51a595ac23 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -974,6 +974,8 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
++ if (!hdr)
++ return -EMSGSIZE;
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From 5ccf526ece1fe7c8fd93ac68f074af5bd7b125ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 10:52:23 -0600
+Subject: tipc: fix memory leak in tipc_nl_compat_publ_dump
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit f87d8ad9233f115db92c6c087d58403b0009ed36 ]
+
+There is a memory leak in case genlmsg_put fails.
+
+Fix this by freeing *args* before return.
+
+Addresses-Coverity-ID: 1476406 ("Resource leak")
+Fixes: 46273cf7e009 ("tipc: fix a missing check of genlmsg_put")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 91d51a595ac23..bbd05707c4e07 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -974,8 +974,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
+- if (!hdr)
++ if (!hdr) {
++ kfree_skb(args);
+ return -EMSGSIZE;
++ }
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From 287ba5648f601d9c31fd7c690ad707bc97581b41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 09:18:28 +0700
+Subject: tipc: fix skb may be leaky in tipc_link_input
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit 7384b538d3aed2ed49d3575483d17aeee790fb06 ]
+
+When we free skb at tipc_data_input, we return a 'false' boolean.
+Then, skb passed to subcalling tipc_link_input in tipc_link_rcv,
+
+<snip>
+1303 int tipc_link_rcv:
+...
+1354 if (!tipc_data_input(l, skb, l->inputq))
+1355 rc |= tipc_link_input(l, skb, l->inputq);
+</snip>
+
+Fix it by simple changing to a 'true' boolean when skb is being free-ed.
+Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above
+condition.
+
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <maloy@donjonn.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 631bfc7e9127e..da749916faac4 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1073,7 +1073,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
+ default:
+ pr_warn("Dropping received illegal msg type\n");
+ kfree_skb(skb);
+- return false;
++ return true;
+ };
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2c1209a19c0ff62b8e06c9752903a66a4b2d6331 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 11:20:03 +0800
+Subject: ubi: Do not drop UBI device reference before using
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e542087701f09418702673631a908429feb3eae0 ]
+
+The UBI device reference is dropped but then the device is used as a
+parameter of ubi_err. The bug is introduced in changing ubi_err's
+behavior. The old ubi_err does not require a UBI device as its first
+parameter, but the new one does.
+
+Fixes: 32608703310 ("UBI: Extend UBI layer debug/messaging capabilities")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/kapi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
+index d4b2e87444986..c2cf6bd3c162a 100644
+--- a/drivers/mtd/ubi/kapi.c
++++ b/drivers/mtd/ubi/kapi.c
+@@ -227,9 +227,9 @@ out_unlock:
+ out_free:
+ kfree(desc);
+ out_put_ubi:
+- ubi_put_device(ubi);
+ ubi_err(ubi, "cannot open device %d, volume %d, error %d",
+ ubi_num, vol_id, err);
++ ubi_put_device(ubi);
+ return ERR_PTR(err);
+ }
+ EXPORT_SYMBOL_GPL(ubi_open_volume);
+--
+2.20.1
+
--- /dev/null
+From a6b19ae308e338ea6780a8971d8fba49df1c7aeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:57:33 +0800
+Subject: ubi: Put MTD device after it is not used
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit b95f83ab762dd6211351b9140f99f43644076ca8 ]
+
+The MTD device reference is dropped via put_mtd_device, however its
+field ->index is read and passed to ubi_msg. To fix this, the patch
+moves the reference dropping after calling ubi_msg.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/build.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index 6445c693d9359..0104d9537329f 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1092,10 +1092,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
+ ubi_wl_close(ubi);
+ ubi_free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+- put_mtd_device(ubi->mtd);
+ vfree(ubi->peb_buf);
+ vfree(ubi->fm_buf);
+ ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index);
++ put_mtd_device(ubi->mtd);
+ put_device(&ubi->dev);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From e396963ba945705a3479498203591826a92dfa15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 12:58:12 +0100
+Subject: um: Make GCOV depend on !KCOV
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 550ed0e2036663b35cec12374b835444f9c60454 ]
+
+Both do more or less the same thing and are mutually exclusive.
+If both are enabled the build will fail.
+Sooner or later we can kill UML's GCOV.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug
+index 967d3109689ff..39d44bfb241d5 100644
+--- a/arch/um/Kconfig.debug
++++ b/arch/um/Kconfig.debug
+@@ -19,6 +19,7 @@ config GPROF
+ config GCOV
+ bool "Enable gcov support"
+ depends on DEBUG_INFO
++ depends on !KCOV
+ help
+ This option allows developers to retrieve coverage data from a UML
+ session.
+--
+2.20.1
+
--- /dev/null
+From a5ad66fd4ac418a3bbc1e2031055d81b06c2400b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 11:04:27 -0700
+Subject: vfio-mdev/samples: Use u8 instead of char for handle functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8ba35b3a0046d6573c98f00461d9bd1b86250d35 ]
+
+Clang warns:
+
+samples/vfio-mdev/mtty.c:592:39: warning: implicit conversion from 'int'
+to 'char' changes value from 162 to -94 [-Wconstant-conversion]
+ *buf = UART_MSR_DSR | UART_MSR_DDSR | UART_MSR_DCD;
+ ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
+1 warning generated.
+
+Turns out that all uses of buf in this function ultimately end up stored
+or cast to an unsigned type. Just use u8, which has the same number of
+bits but can store this larger number so Clang no longer warns.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfio-mdev/mtty.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
+index ca495686b9c31..f8c7249fa705d 100644
+--- a/samples/vfio-mdev/mtty.c
++++ b/samples/vfio-mdev/mtty.c
+@@ -171,7 +171,7 @@ static struct mdev_state *find_mdev_state_by_uuid(uuid_le uuid)
+ return NULL;
+ }
+
+-void dump_buffer(char *buf, uint32_t count)
++void dump_buffer(u8 *buf, uint32_t count)
+ {
+ #if defined(DEBUG)
+ int i;
+@@ -250,7 +250,7 @@ static void mtty_create_config_space(struct mdev_state *mdev_state)
+ }
+
+ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+- char *buf, u32 count)
++ u8 *buf, u32 count)
+ {
+ u32 cfg_addr, bar_mask, bar_index = 0;
+
+@@ -304,7 +304,7 @@ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+ }
+
+ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+- u16 offset, char *buf, u32 count)
++ u16 offset, u8 *buf, u32 count)
+ {
+ u8 data = *buf;
+
+@@ -475,7 +475,7 @@ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+ }
+
+ static void handle_bar_read(unsigned int index, struct mdev_state *mdev_state,
+- u16 offset, char *buf, u32 count)
++ u16 offset, u8 *buf, u32 count)
+ {
+ /* Handle read requests by guest */
+ switch (offset) {
+@@ -650,7 +650,7 @@ static void mdev_read_base(struct mdev_state *mdev_state)
+ }
+ }
+
+-static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
++static ssize_t mdev_access(struct mdev_device *mdev, u8 *buf, size_t count,
+ loff_t pos, bool is_write)
+ {
+ struct mdev_state *mdev_state;
+@@ -698,7 +698,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n",
+ __func__, index, offset, wr_reg[offset],
+- (u8)*buf, mdev_state->s[index].dlab);
++ *buf, mdev_state->s[index].dlab);
+ #endif
+ handle_bar_write(index, mdev_state, offset, buf, count);
+ } else {
+@@ -708,7 +708,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n",
+ __func__, index, offset, rd_reg[offset],
+- (u8)*buf, mdev_state->s[index].dlab);
++ *buf, mdev_state->s[index].dlab);
+ #endif
+ }
+ break;
+@@ -827,7 +827,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ if (count >= 4 && !(*ppos % 4)) {
+ u32 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -839,7 +839,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ } else if (count >= 2 && !(*ppos % 2)) {
+ u16 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -851,7 +851,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ } else {
+ u8 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -889,7 +889,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+@@ -901,7 +901,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+@@ -913,7 +913,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+--
+2.20.1
+
--- /dev/null
+From e71d5c2d166a6eb1850e26796d89be534ef575f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Oct 2018 13:22:31 +1000
+Subject: vfio/spapr_tce: Get rid of possible infinite loop
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 517ad4ae8aa93dccdb9a88c27257ecb421c9e848 ]
+
+As a part of cleanup, the SPAPR TCE IOMMU subdriver releases preregistered
+memory. If there is a bug in memory release, the loop in
+tce_iommu_release() becomes infinite; this actually happened to me.
+
+This makes the loop finite and prints a warning on every failure to make
+the code more bug prone.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Acked-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_spapr_tce.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
+index b4c68f3b82be9..eba9aaf3cc17c 100644
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -409,6 +409,7 @@ static void tce_iommu_release(void *iommu_data)
+ {
+ struct tce_container *container = iommu_data;
+ struct tce_iommu_group *tcegrp;
++ struct tce_iommu_prereg *tcemem, *tmtmp;
+ long i;
+
+ while (tce_groups_attached(container)) {
+@@ -431,13 +432,8 @@ static void tce_iommu_release(void *iommu_data)
+ tce_iommu_free_table(container, tbl);
+ }
+
+- while (!list_empty(&container->prereg_list)) {
+- struct tce_iommu_prereg *tcemem;
+-
+- tcemem = list_first_entry(&container->prereg_list,
+- struct tce_iommu_prereg, next);
+- WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem));
+- }
++ list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next)
++ WARN_ON(tce_iommu_prereg_free(container, tcemem));
+
+ tce_iommu_disable(container);
+ if (container->mm)
+--
+2.20.1
+
--- /dev/null
+From 7aae3298013bed6ad103d921630760f3c0d65567 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:34:36 -0800
+Subject: vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA
+ is n
+
+From: Wei Yang <richard.weiyang@gmail.com>
+
+[ Upstream commit 8b09549c2bfd9f3f8f4cdad74107ef4f4ff9cdd7 ]
+
+Commit fa5e084e43eb ("vmscan: do not unconditionally treat zones that
+fail zone_reclaim() as full") changed the return value of
+node_reclaim(). The original return value 0 means NODE_RECLAIM_SOME
+after this commit.
+
+While the return value of node_reclaim() when CONFIG_NUMA is n is not
+changed. This will leads to call zone_watermark_ok() again.
+
+This patch fixes the return value by adjusting to NODE_RECLAIM_NOSCAN.
+Since node_reclaim() is only called in page_alloc.c, move it to
+mm/internal.h.
+
+Link: http://lkml.kernel.org/r/20181113080436.22078-1-richard.weiyang@gmail.com
+Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/swap.h | 6 ------
+ mm/internal.h | 10 ++++++++++
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index e643866912b70..411953964c345 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -363,14 +363,8 @@ extern unsigned long vm_total_pages;
+ extern int node_reclaim_mode;
+ extern int sysctl_min_unmapped_ratio;
+ extern int sysctl_min_slab_ratio;
+-extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
+ #else
+ #define node_reclaim_mode 0
+-static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
+- unsigned int order)
+-{
+- return 0;
+-}
+ #endif
+
+ extern int page_evictable(struct page *page);
+diff --git a/mm/internal.h b/mm/internal.h
+index 1df011f624801..a182506242c43 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -455,6 +455,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn,
+ #define NODE_RECLAIM_SOME 0
+ #define NODE_RECLAIM_SUCCESS 1
+
++#ifdef CONFIG_NUMA
++extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
++#else
++static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
++ unsigned int order)
++{
++ return NODE_RECLAIM_NOSCAN;
++}
++#endif
++
+ extern int hwpoison_filter(struct page *p);
+
+ extern u32 hwpoison_filter_dev_major;
+--
+2.20.1
+
--- /dev/null
+From 5fbc694ceb37755090309441dd3ad315105cf985 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 11:12:55 -0800
+Subject: VSOCK: bind to random port for VMADDR_PORT_ANY
+
+From: Lepton Wu <ytht.net@gmail.com>
+
+[ Upstream commit 8236b08cf50f85bbfaf48910a0b3ee68318b7c4b ]
+
+The old code always starts from fixed port for VMADDR_PORT_ANY. Sometimes
+when VMM crashed, there is still orphaned vsock which is waiting for
+close timer, then it could cause connection time out for new started VM
+if they are trying to connect to same port with same guest cid since the
+new packets could hit that orphaned vsock. We could also fix this by doing
+more in vhost_vsock_reset_orphans, but any way, it should be better to start
+from a random local port instead of a fixed one.
+
+Signed-off-by: Lepton Wu <ytht.net@gmail.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 1939b77e98b72..73eac97e19fb1 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -107,6 +107,7 @@
+ #include <linux/mutex.h>
+ #include <linux/net.h>
+ #include <linux/poll.h>
++#include <linux/random.h>
+ #include <linux/skbuff.h>
+ #include <linux/smp.h>
+ #include <linux/socket.h>
+@@ -487,9 +488,13 @@ out:
+ static int __vsock_bind_stream(struct vsock_sock *vsk,
+ struct sockaddr_vm *addr)
+ {
+- static u32 port = LAST_RESERVED_PORT + 1;
++ static u32 port = 0;
+ struct sockaddr_vm new_addr;
+
++ if (!port)
++ port = LAST_RESERVED_PORT + 1 +
++ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT);
++
+ vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
+
+ if (addr->svm_port == VMADDR_PORT_ANY) {
+--
+2.20.1
+
--- /dev/null
+From 4449a337cb0da78805aae727151f245bdad50df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 13:16:00 +0000
+Subject: vxlan: Fix error path in __vxlan_dev_create()
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 6db9246871394b3a136cd52001a0763676563840 ]
+
+When a failure occurs in rtnl_configure_link(), the current code
+calls unregister_netdevice() to roll back the earlier call to
+register_netdevice(), and jumps to errout, which calls
+vxlan_fdb_destroy().
+
+However unregister_netdevice() calls transitively ndo_uninit, which is
+vxlan_uninit(), and that already takes care of deleting the default FDB
+entry by calling vxlan_fdb_delete_default(). Since the entry added
+earlier in __vxlan_dev_create() is exactly the default entry, the
+cleanup code in the errout block always leads to double free and thus a
+panic.
+
+Besides, since vxlan_fdb_delete_default() always destroys the FDB entry
+with notification enabled, the deletion of the default entry is notified
+even before the addition was notified.
+
+Instead, move the unregister_netdevice() call after the manual destroy,
+which solves both problems.
+
+Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 6d26bbd190dd6..153a81ece9fe4 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3217,6 +3217,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ struct vxlan_dev *vxlan = netdev_priv(dev);
+ struct vxlan_fdb *f = NULL;
++ bool unregister = false;
+ int err;
+
+ err = vxlan_dev_configure(net, dev, conf, false, extack);
+@@ -3242,12 +3243,11 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ err = register_netdevice(dev);
+ if (err)
+ goto errout;
++ unregister = true;
+
+ err = rtnl_configure_link(dev, NULL);
+- if (err) {
+- unregister_netdevice(dev);
++ if (err)
+ goto errout;
+- }
+
+ /* notify default fdb entry */
+ if (f)
+@@ -3255,9 +3255,16 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+
+ list_add(&vxlan->next, &vn->vxlan_list);
+ return 0;
++
+ errout:
++ /* unregister_netdevice() destroys the default FDB entry with deletion
++ * notification. But the addition notification was not sent yet, so
++ * destroy the entry by hand here.
++ */
+ if (f)
+ vxlan_fdb_destroy(vxlan, f, false);
++ if (unregister)
++ unregister_netdevice(dev);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 95d348d2d9571c83a3093d72511858f420bb499d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 18:53:49 +0800
+Subject: watchdog: meson: Fix the wrong value of left time
+
+From: Xingyu Chen <xingyu.chen@amlogic.com>
+
+[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ]
+
+The left time value is wrong when we get it by sysfs. The left time value
+should be equal to preset timeout value minus elapsed time value. According
+to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value
+is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved
+to BIT[16-31] of the WATCHDOG_TCNT.
+
+[0]: http://linux-meson.com
+
+Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver")
+Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/meson_gxbb_wdt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
+index 69a5a57f14462..61297a6ab43a0 100644
+--- a/drivers/watchdog/meson_gxbb_wdt.c
++++ b/drivers/watchdog/meson_gxbb_wdt.c
+@@ -137,8 +137,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
+
+ reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
+
+- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
+- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
+ }
+
+ static const struct watchdog_ops meson_gxbb_wdt_ops = {
+--
+2.20.1
+
--- /dev/null
+From 7f9bc8f5775521302ab2eab69a45fc4e46ef9869 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 13:25:02 +0800
+Subject: x86/resctrl: Prevent NULL pointer dereference when reading mondata
+
+From: Xiaochen Shen <xiaochen.shen@intel.com>
+
+[ Upstream commit 26467b0f8407cbd628fa5b7bcfd156e772004155 ]
+
+When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED
+in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed
+until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later.
+
+During the window of deleting a mon group, if an application calls
+rdtgroup_mondata_show() to read mondata under this mon group,
+'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when
+rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path:
+rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count().
+Thus it results in NULL pointer dereference in mon_event_count().
+
+Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT
+immediately when reading mondata during the window of deleting a mon
+group.
+
+Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data")
+Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: pei.p.jia@intel.com
+Cc: Reinette Chatre <reinette.chatre@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+index f6ea94f8954a7..f892cb0b485e1 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+@@ -313,6 +313,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
+ int ret = 0;
+
+ rdtgrp = rdtgroup_kn_lock_live(of->kn);
++ if (!rdtgrp) {
++ ret = -ENOENT;
++ goto out;
++ }
+
+ md.priv = of->kn->priv;
+ resid = md.u.rid;
+--
+2.20.1
+
--- /dev/null
+From 697ed25db6adb283f73835a95d83aed7c096f31b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:55:45 +0000
+Subject: xen/pciback: Check dev_data before using it
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+[ Upstream commit 1669907e3d1abfa3f7586e2d55dbbc117b5adba2 ]
+
+If pcistub_init_device fails, the release function will be called with
+dev_data set to NULL. Check it before using it to avoid a NULL pointer
+dereference.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xen-pciback/pci_stub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index 9e480fdebe1f0..8c250f4a3a97a 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref)
+ * is called from "unbind" which takes a device_lock mutex.
+ */
+ __pci_reset_function_locked(dev);
+- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
++ if (dev_data &&
++ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+ dev_info(&dev->dev, "Could not reload PCI state\n");
+ else
+ pci_restore_state(dev);
+--
+2.20.1
+
--- /dev/null
+From 651d6848e24c169cf6fe8ed965ce9ffc95dc2c67 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Align compat attrlist_by_handle with native implementation.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit c456d64449efe37da50832b63d91652a85ea1d20 ]
+
+While inspecting the ioctl implementations, I noticed that the compat
+implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the
+same thing as the native implementation. Specifically, the "cursor"
+does not appear to be written out to userspace on the compat path,
+like it is on the native path.
+
+This adjusts the compat implementation to copy out the cursor just
+like the native implementation does. The attrlist cursor does not
+require any special compat handling. This fixes xfstests xfs/269
+on both IA-32 and x32 userspace, when running on an amd64 kernel.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace")
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index fa0bc4d46065a..d3c0e4b8bf421 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -347,6 +347,7 @@ xfs_compat_attrlist_by_handle(
+ {
+ int error;
+ attrlist_cursor_kern_t *cursor;
++ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg;
+ compat_xfs_fsop_attrlist_handlereq_t al_hreq;
+ struct dentry *dentry;
+ char *kbuf;
+@@ -381,6 +382,11 @@ xfs_compat_attrlist_by_handle(
+ if (error)
+ goto out_kfree;
+
++ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
++ error = -EFAULT;
++ goto out_kfree;
++ }
++
+ if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen))
+ error = -EFAULT;
+
+--
+2.20.1
+
--- /dev/null
+From 92b35359d620346cc107784a097e2da43d2ace03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Fix bulkstat compat ioctls on x32 userspace.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit 7ca860e3c1a74ad6bd8949364073ef1044cad758 ]
+
+The bulkstat family of ioctls are problematic on x32, because there is
+a mixup of native 32-bit and 64-bit conventions. The xfs_fsop_bulkreq
+struct contains pointers and 32-bit integers so that matches the native
+32-bit layout, and that means the ioctl implementation goes into the
+regular compat path on x32.
+
+However, the 'ubuffer' member of that struct in turn refers to either
+struct xfs_inogrp or xfs_bstat (or an array of these). On x32, those
+structures match the native 64-bit layout. The compat implementation
+writes out the 32-bit version of these structures. This is not the
+expected format for x32 userspace, causing problems.
+
+Fortunately the functions which actually output these xfs_inogrp and
+xfs_bstat structures have an easy way to select which output format
+is required, so we just need a little tweak to select the right format
+on x32.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index d3c0e4b8bf421..5f616a6a5358d 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -252,6 +252,32 @@ xfs_compat_ioc_bulkstat(
+ int done;
+ int error;
+
++ /*
++ * Output structure handling functions. Depending on the command,
++ * either the xfs_bstat and xfs_inogrp structures are written out
++ * to userpace memory via bulkreq.ubuffer. Normally the compat
++ * functions and structure size are the correct ones to use ...
++ */
++ inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat;
++ bulkstat_one_pf bs_one_func = xfs_bulkstat_one_compat;
++ size_t bs_one_size = sizeof(struct compat_xfs_bstat);
++
++#ifdef CONFIG_X86_X32
++ if (in_x32_syscall()) {
++ /*
++ * ... but on x32 the input xfs_fsop_bulkreq has pointers
++ * which must be handled in the "compat" (32-bit) way, while
++ * the xfs_bstat and xfs_inogrp structures follow native 64-
++ * bit layout convention. So adjust accordingly, otherwise
++ * the data written out in compat layout will not match what
++ * x32 userspace expects.
++ */
++ inumbers_func = xfs_inumbers_fmt;
++ bs_one_func = xfs_bulkstat_one;
++ bs_one_size = sizeof(struct xfs_bstat);
++ }
++#endif
++
+ /* done = 1 if there are more stats to get and if bulkstat */
+ /* should be called again (unused here, but used in dmapi) */
+
+@@ -283,15 +309,15 @@ xfs_compat_ioc_bulkstat(
+
+ if (cmd == XFS_IOC_FSINUMBERS_32) {
+ error = xfs_inumbers(mp, &inlast, &count,
+- bulkreq.ubuffer, xfs_inumbers_fmt_compat);
++ bulkreq.ubuffer, inumbers_func);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) {
+ int res;
+
+- error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
+- sizeof(compat_xfs_bstat_t), NULL, &res);
++ error = bs_one_func(mp, inlast, bulkreq.ubuffer,
++ bs_one_size, NULL, &res);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_32) {
+ error = xfs_bulkstat(mp, &inlast, &count,
+- xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
++ bs_one_func, bs_one_size,
+ bulkreq.ubuffer, &done);
+ } else
+ error = -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 21beaa11e346d5ac5dbe04a4e807221be0799433 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 15:18:52 -0800
+Subject: xfs: require both realtime inodes to mount
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 64bafd2f1e484e27071e7584642005d56516cb77 ]
+
+Since mkfs always formats the filesystem with the realtime bitmap and
+summary inodes immediately after the root directory, we should expect
+that both of them are present and loadable, even if there isn't a
+realtime volume attached. There's no reason to skip this if rbmino ==
+NULLFSINO; in fact, this causes an immediate crash if the there /is/ a
+realtime volume and someone writes to it.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Bill O'Donnell <billodo@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_rtalloc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index 488719d43ca82..cdcb7235e41ae 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -1214,13 +1214,11 @@ xfs_rtmount_inodes(
+ xfs_sb_t *sbp;
+
+ sbp = &mp->m_sb;
+- if (sbp->sb_rbmino == NULLFSINO)
+- return 0;
+ error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
+ if (error)
+ return error;
+ ASSERT(mp->m_rbmip != NULL);
+- ASSERT(sbp->sb_rsumino != NULLFSINO);
++
+ error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
+ if (error) {
+ IRELE(mp->m_rbmip);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
