--- /dev/null
+From 82e8a3abf7bbce0819d2b28030b19ff9380e4f9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 15:07:46 +0100
+Subject: ARM: 8955/1: virt: Relax arch timer version check during early boot
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 6849b5eba1965ceb0cad3a75877ef4569dd3638e ]
+
+Updates to the Generic Timer architecture allow ID_PFR1.GenTimer to
+have values other than 0 or 1 while still preserving backward
+compatibility. At the moment, Linux is quite strict in the way it
+handles this field at early boot and will not configure arch timer if
+it doesn't find the value 1.
+
+Since here use ubfx for arch timer version extraction (hyb-stub build
+with -march=armv7-a, so it is safe)
+
+To help backports (even though the code was correct at the time of writing)
+
+Fixes: 8ec58be9f3ff ("ARM: virt: arch_timers: enable access to physical timers")
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/hyp-stub.S | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index ae5020302de49..6607fa817bba9 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -146,10 +146,9 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE
+ #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER)
+ @ make CNTP_* and CNTPCT accessible from PL1
+ mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1
+- lsr r7, #16
+- and r7, #0xf
+- cmp r7, #1
+- bne 1f
++ ubfx r7, r7, #16, #4
++ teq r7, #0
++ beq 1f
+ mrc p15, 4, r7, c14, c1, 0 @ CNTHCTL
+ orr r7, r7, #3 @ PL1PCEN | PL1PCTEN
+ mcr p15, 4, r7, c14, c1, 0 @ CNTHCTL
+--
+2.20.1
+
--- /dev/null
+From 6273922bcf357d06e8947cc35363370b16df92fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 16:09:08 +0300
+Subject: ARM: dts: am335x-boneblack-common: fix memory size
+
+From: Matwey V. Kornilov <matwey@sai.msu.ru>
+
+[ Upstream commit 5abd45ea0fc3060f7805e131753fdcbafd6c6618 ]
+
+BeagleBone Black series is equipped with 512MB RAM
+whereas only 256MB is included from am335x-bone-common.dtsi
+
+This leads to an issue with unusual setups when devicetree
+is loaded by GRUB2 directly.
+
+Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-boneblack-common.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am335x-boneblack-common.dtsi b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+index 7ad079861efd6..91f93bc89716d 100644
+--- a/arch/arm/boot/dts/am335x-boneblack-common.dtsi
++++ b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+@@ -131,6 +131,11 @@
+ };
+
+ / {
++ memory@80000000 {
++ device_type = "memory";
++ reg = <0x80000000 0x20000000>; /* 512 MB */
++ };
++
+ clk_mcasp0_fixed: clk_mcasp0_fixed {
+ #clock-cells = <0>;
+ compatible = "fixed-clock";
+--
+2.20.1
+
--- /dev/null
+From abf2551b05da23d6f3f379d71ae9fef2b2318104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jan 2020 16:58:59 +0530
+Subject: ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
+
+From: Raag Jadav <raagjadav@gmail.com>
+
+[ Upstream commit b0b03951544534d6d9ad4aa2787eefec988fff20 ]
+
+Set d0 and d1 pin directions for spi0 and spi1 as per their pinmux.
+
+Signed-off-by: Raag Jadav <raagjadav@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am43x-epos-evm.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index 078cb473fa7dc..a6fbc088daa86 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -848,6 +848,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi0_pins_default>;
+ pinctrl-1 = <&spi0_pins_sleep>;
++ ti,pindir-d0-out-d1-in = <1>;
+ };
+
+ &spi1 {
+@@ -855,6 +856,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi1_pins_default>;
+ pinctrl-1 = <&spi1_pins_sleep>;
++ ti,pindir-d0-out-d1-in = <1>;
+ };
+
+ &usb2_phy1 {
+--
+2.20.1
+
--- /dev/null
+From 14660d32974d27e106c69c48456ae93e1d06e399 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 14:21:22 +0530
+Subject: ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint
+ dt nodes
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 81cc0877840f72210e809bbedd6346d686560fc1 ]
+
+PERST# line in the PCIE connector is driven by the host mode and not
+EP mode. The gpios property here is used for driving the PERST# line.
+Remove gpios property from all endpoint device tree nodes.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am571x-idk.dts | 4 ----
+ arch/arm/boot/dts/am572x-idk-common.dtsi | 4 ----
+ arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 4 ----
+ 3 files changed, 12 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
+index 9d6a872c2b236..10105a497c1ac 100644
+--- a/arch/arm/boot/dts/am571x-idk.dts
++++ b/arch/arm/boot/dts/am571x-idk.dts
+@@ -170,10 +170,6 @@
+ gpios = <&gpio5 18 GPIO_ACTIVE_HIGH>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+-};
+-
+ &mmc1 {
+ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
+diff --git a/arch/arm/boot/dts/am572x-idk-common.dtsi b/arch/arm/boot/dts/am572x-idk-common.dtsi
+index a064f13b38802..ddf123620e962 100644
+--- a/arch/arm/boot/dts/am572x-idk-common.dtsi
++++ b/arch/arm/boot/dts/am572x-idk-common.dtsi
+@@ -147,10 +147,6 @@
+ gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+-};
+-
+ &mailbox5 {
+ status = "okay";
+ mbox_ipu1_ipc3x: mbox_ipu1_ipc3x {
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+index bc76f1705c0f6..9a94c96b0350e 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+@@ -547,10 +547,6 @@
+ gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
+-};
+-
+ &mcasp3 {
+ #sound-dai-cells = <0>;
+ assigned-clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>;
+--
+2.20.1
+
--- /dev/null
+From 2cc8c3a055f9fac7be7ff02a234ca1096dec58a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 14:21:24 +0530
+Subject: ARM: dts: beagle-x15-common: Model 5V0 regulator
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit e17e7c498d4f734df93c300441e100818ed58168 ]
+
+On am57xx-beagle-x15, 5V0 is connected to P16, P17, P18 and P19
+connectors. On am57xx-evm, 5V0 regulator is used to get 3V6 regulator
+which is connected to the COMQ port. Model 5V0 regulator here in order
+for it to be used in am57xx-evm to model 3V6 regulator.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/am57xx-beagle-x15-common.dtsi | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+index 9a94c96b0350e..a813a0cf3ff39 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+@@ -29,6 +29,27 @@
+ reg = <0x0 0x80000000 0x0 0x80000000>;
+ };
+
++ main_12v0: fixedregulator-main_12v0 {
++ /* main supply */
++ compatible = "regulator-fixed";
++ regulator-name = "main_12v0";
++ regulator-min-microvolt = <12000000>;
++ regulator-max-microvolt = <12000000>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
++ evm_5v0: fixedregulator-evm_5v0 {
++ /* Output of TPS54531D */
++ compatible = "regulator-fixed";
++ regulator-name = "evm_5v0";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ vin-supply = <&main_12v0>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
+ vdd_3v3: fixedregulator-vdd_3v3 {
+ compatible = "regulator-fixed";
+ regulator-name = "vdd_3v3";
+--
+2.20.1
+
--- /dev/null
+From 4cadea45726b8b34dabccb662eaadaace959953c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 15:52:17 +0100
+Subject: ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 1c226017d3ec93547b58082bdf778d9db7401c95 ]
+
+Current USB3503 driver ignores GPIO polarity and always operates as if the
+GPIO lines were flagged as ACTIVE_HIGH. Fix the polarity for the existing
+USB3503 chip applications to match the chip specification and common
+convention for naming the pins. The only pin, which has to be ACTIVE_LOW
+is the reset pin. The remaining are ACTIVE_HIGH. This change allows later
+to fix the USB3503 driver to properly use generic GPIO bindings and read
+polarity from DT.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+index fb928503ad45d..d9be511f054f0 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+@@ -101,7 +101,7 @@
+ initial-mode = <1>; /* initialize in HUB mode */
+ disabled-ports = <1>;
+ intn-gpios = <&pio 7 5 GPIO_ACTIVE_HIGH>; /* PH5 */
+- reset-gpios = <&pio 4 16 GPIO_ACTIVE_HIGH>; /* PE16 */
++ reset-gpios = <&pio 4 16 GPIO_ACTIVE_LOW>; /* PE16 */
+ connect-gpios = <&pio 4 17 GPIO_ACTIVE_HIGH>; /* PE17 */
+ refclk-frequency = <19200000>;
+ };
+--
+2.20.1
+
--- /dev/null
+From bb1482fbdebbe253000f6c895db2f1c399445dde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 14:19:00 +0100
+Subject: arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt
+
+From: Guillaume La Roque <glaroque@baylibre.com>
+
+[ Upstream commit 30388cc075720aa0af4f2cb5933afa1f8f39d313 ]
+
+add gpio irq to support interrupt trigger mode.
+
+Signed-off-by: Guillaume La Roque <glaroque@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts b/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts
+index 3435aaa4e8db5..5d6a8dafe8dc0 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts
+@@ -361,6 +361,8 @@
+
+ bluetooth {
+ compatible = "brcm,bcm43438-bt";
++ interrupt-parent = <&gpio_intc>;
++ interrupts = <95 IRQ_TYPE_LEVEL_HIGH>;
+ shutdown-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>;
+ max-speed = <2000000>;
+ clocks = <&wifi32k>;
+--
+2.20.1
+
--- /dev/null
+From b251ead41b2f8578264c57f5388d04201dfbd2b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 17:57:51 -0600
+Subject: ASoC: hdac_hda: Fix error in driver removal after failed probe
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 552b1a85da9f63856e7e341b81c16e0e078204f1 ]
+
+In case system has multiple HDA codecs, and codec probe fails for
+at least one but not all codecs, driver will end up cancelling
+a non-initialized timer context upon driver removal.
+
+Call trace of typical case:
+
+[ 60.593646] WARNING: CPU: 1 PID: 1147 at kernel/workqueue.c:3032
+__flush_work+0x18b/0x1a0
+[...]
+[ 60.593670] __cancel_work_timer+0x11f/0x1a0
+[ 60.593673] hdac_hda_dev_remove+0x25/0x30 [snd_soc_hdac_hda]
+[ 60.593674] device_release_driver_internal+0xe0/0x1c0
+[ 60.593675] bus_remove_device+0xd6/0x140
+[ 60.593677] device_del+0x175/0x3e0
+[ 60.593679] ? widget_tree_free.isra.7+0x90/0xb0 [snd_hda_core]
+[ 60.593680] snd_hdac_device_unregister+0x34/0x50 [snd_hda_core]
+[ 60.593682] snd_hdac_ext_bus_device_remove+0x2a/0x60 [snd_hda_ext_core]
+[ 60.593684] hda_dsp_remove+0x26/0x100 [snd_sof_intel_hda_common]
+[ 60.593686] snd_sof_device_remove+0x84/0xa0 [snd_sof]
+[ 60.593687] sof_pci_remove+0x10/0x30 [snd_sof_pci]
+[ 60.593689] pci_device_remove+0x36/0xb0
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200110235751.3404-9-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hda.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
+index 4570f662fb48b..d78f4d856aaff 100644
+--- a/sound/soc/codecs/hdac_hda.c
++++ b/sound/soc/codecs/hdac_hda.c
+@@ -498,7 +498,9 @@ static int hdac_hda_dev_remove(struct hdac_device *hdev)
+ struct hdac_hda_priv *hda_pvt;
+
+ hda_pvt = dev_get_drvdata(&hdev->dev);
+- cancel_delayed_work_sync(&hda_pvt->codec.jackpoll_work);
++ if (hda_pvt && hda_pvt->codec.registered)
++ cancel_delayed_work_sync(&hda_pvt->codec.jackpoll_work);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4f35e8d05af8ae00753984ad0e4a9fe779a82803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 04:47:07 +0300
+Subject: ASoC: rt5640: Fix NULL dereference on module unload
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 89b71b3f02d8ae5a08a1dd6f4a2098b7b868d498 ]
+
+The rt5640->jack is NULL if jack is already disabled at the time of
+driver's module unloading.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20200106014707.11378-1-digetx@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5640.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index adbae1f36a8af..747ca248bf10c 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -2432,6 +2432,13 @@ static void rt5640_disable_jack_detect(struct snd_soc_component *component)
+ {
+ struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component);
+
++ /*
++ * soc_remove_component() force-disables jack and thus rt5640->jack
++ * could be NULL at the time of driver's module unloading.
++ */
++ if (!rt5640->jack)
++ return;
++
+ disable_irq(rt5640->irq);
+ rt5640_cancel_work(rt5640);
+
+--
+2.20.1
+
--- /dev/null
+From 8a0d41edce338e48164604ce63b180b9048b5d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 17:57:50 -0600
+Subject: ASoC: SOF: Intel: fix HDA codec driver probe with multiple
+ controllers
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 2c63bea714780f8e1fc9cb7bc10deda26fada25b ]
+
+In case system has multiple HDA controllers, it can happen that
+same HDA codec driver is used for codecs of multiple controllers.
+In this case, SOF may fail to probe the HDA driver and SOF
+initialization fails.
+
+SOF HDA code currently relies that a call to request_module() will
+also run device matching logic to attach driver to the codec instance.
+However if driver for another HDA controller was already loaded and it
+already loaded the HDA codec driver, this breaks current logic in SOF.
+In this case the request_module() SOF does becomes a no-op and HDA
+Codec driver is not attached to the codec instance sitting on the HDA
+bus SOF is controlling. Typical scenario would be a system with both
+external and internal GPUs, with driver of the external GPU loaded
+first.
+
+Fix this by adding similar logic as is used in legacy HDA driver
+where an explicit device_attach() call is done after request_module().
+
+Also add logic to propagate errors reported by device_attach() back
+to caller. This also works in the case where drivers are not built
+as modules.
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200110235751.3404-8-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-codec.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-codec.c b/sound/soc/sof/intel/hda-codec.c
+index 3ca6795a89ba3..9e8233c10d860 100644
+--- a/sound/soc/sof/intel/hda-codec.c
++++ b/sound/soc/sof/intel/hda-codec.c
+@@ -24,19 +24,18 @@
+ #define IDISP_VID_INTEL 0x80860000
+
+ /* load the legacy HDA codec driver */
+-#ifdef MODULE
+-static void hda_codec_load_module(struct hda_codec *codec)
++static int hda_codec_load_module(struct hda_codec *codec)
+ {
++#ifdef MODULE
+ char alias[MODULE_NAME_LEN];
+ const char *module = alias;
+
+ snd_hdac_codec_modalias(&codec->core, alias, sizeof(alias));
+ dev_dbg(&codec->core.dev, "loading codec module: %s\n", module);
+ request_module(module);
+-}
+-#else
+-static void hda_codec_load_module(struct hda_codec *codec) {}
+ #endif
++ return device_attach(hda_codec_dev(codec));
++}
+
+ /* enable controller wake up event for all codecs with jack connectors */
+ void hda_codec_jack_wake_enable(struct snd_sof_dev *sdev)
+@@ -116,10 +115,16 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address)
+ /* use legacy bus only for HDA codecs, idisp uses ext bus */
+ if ((resp & 0xFFFF0000) != IDISP_VID_INTEL) {
+ hdev->type = HDA_DEV_LEGACY;
+- hda_codec_load_module(&hda_priv->codec);
++ ret = hda_codec_load_module(&hda_priv->codec);
++ /*
++ * handle ret==0 (no driver bound) as an error, but pass
++ * other return codes without modification
++ */
++ if (ret == 0)
++ ret = -ENOENT;
+ }
+
+- return 0;
++ return ret;
+ #else
+ hdev = devm_kzalloc(sdev->dev, sizeof(*hdev), GFP_KERNEL);
+ if (!hdev)
+--
+2.20.1
+
--- /dev/null
+From f2f1d676856ce7b8dc1f1a3f352f32d05eb09593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 11:04:00 +0100
+Subject: ASoC: sti: fix possible sleep-in-atomic
+
+From: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+
+[ Upstream commit ce780a47c3c01e1e179d0792df6b853a913928f1 ]
+
+Change mutex and spinlock management to avoid sleep
+in atomic issue.
+
+Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Link: https://lore.kernel.org/r/20200113100400.30472-1-arnaud.pouliquen@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sti/uniperif_player.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
+index 48ea915b24ba2..2ed92c990b97c 100644
+--- a/sound/soc/sti/uniperif_player.c
++++ b/sound/soc/sti/uniperif_player.c
+@@ -226,7 +226,6 @@ static void uni_player_set_channel_status(struct uniperif *player,
+ * sampling frequency. If no sample rate is already specified, then
+ * set one.
+ */
+- mutex_lock(&player->ctrl_lock);
+ if (runtime) {
+ switch (runtime->rate) {
+ case 22050:
+@@ -303,7 +302,6 @@ static void uni_player_set_channel_status(struct uniperif *player,
+ player->stream_settings.iec958.status[3 + (n * 4)] << 24;
+ SET_UNIPERIF_CHANNEL_STA_REGN(player, n, status);
+ }
+- mutex_unlock(&player->ctrl_lock);
+
+ /* Update the channel status */
+ if (player->ver < SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0)
+@@ -365,8 +363,10 @@ static int uni_player_prepare_iec958(struct uniperif *player,
+
+ SET_UNIPERIF_CTRL_ZERO_STUFF_HW(player);
+
++ mutex_lock(&player->ctrl_lock);
+ /* Update the channel status */
+ uni_player_set_channel_status(player, runtime);
++ mutex_unlock(&player->ctrl_lock);
+
+ /* Clear the user validity user bits */
+ SET_UNIPERIF_USER_VALIDITY_VALIDITY_LR(player, 0);
+@@ -598,7 +598,6 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
+ iec958->status[1] = ucontrol->value.iec958.status[1];
+ iec958->status[2] = ucontrol->value.iec958.status[2];
+ iec958->status[3] = ucontrol->value.iec958.status[3];
+- mutex_unlock(&player->ctrl_lock);
+
+ spin_lock_irqsave(&player->irq_lock, flags);
+ if (player->substream && player->substream->runtime)
+@@ -608,6 +607,8 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
+ uni_player_set_channel_status(player, NULL);
+
+ spin_unlock_irqrestore(&player->irq_lock, flags);
++ mutex_unlock(&player->ctrl_lock);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 87058e8dca6c3ecb0ae52d1275ee0e775fac06b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2020 12:35:38 +0100
+Subject: btrfs: dev-replace: remove warning for unknown return codes when
+ finished
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 4cea9037f82a6deed0f2f61e4054b7ae2519ef87 ]
+
+The fstests btrfs/011 triggered a warning at the end of device replace,
+
+ [ 1891.998975] BTRFS warning (device vdd): failed setting block group ro: -28
+ [ 1892.038338] BTRFS error (device vdd): btrfs_scrub_dev(/dev/vdd, 1, /dev/vdb) failed -28
+ [ 1892.059993] ------------[ cut here ]------------
+ [ 1892.063032] WARNING: CPU: 2 PID: 2244 at fs/btrfs/dev-replace.c:506 btrfs_dev_replace_start.cold+0xf9/0x140 [btrfs]
+ [ 1892.074346] CPU: 2 PID: 2244 Comm: btrfs Not tainted 5.5.0-rc7-default+ #942
+ [ 1892.079956] RIP: 0010:btrfs_dev_replace_start.cold+0xf9/0x140 [btrfs]
+
+ [ 1892.096576] RSP: 0018:ffffbb58c7b3fd10 EFLAGS: 00010286
+ [ 1892.098311] RAX: 00000000ffffffe4 RBX: 0000000000000001 RCX: 8888888888888889
+ [ 1892.100342] RDX: 0000000000000001 RSI: ffff9e889645f5d8 RDI: ffffffff92821080
+ [ 1892.102291] RBP: ffff9e889645c000 R08: 000001b8878fe1f6 R09: 0000000000000000
+ [ 1892.104239] R10: ffffbb58c7b3fd08 R11: 0000000000000000 R12: ffff9e88a0017000
+ [ 1892.106434] R13: ffff9e889645f608 R14: ffff9e88794e1000 R15: ffff9e88a07b5200
+ [ 1892.108642] FS: 00007fcaed3f18c0(0000) GS:ffff9e88bda00000(0000) knlGS:0000000000000000
+ [ 1892.111558] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 1892.113492] CR2: 00007f52509ff420 CR3: 00000000603dd002 CR4: 0000000000160ee0
+
+ [ 1892.115814] Call Trace:
+ [ 1892.116896] btrfs_dev_replace_by_ioctl+0x35/0x60 [btrfs]
+ [ 1892.118962] btrfs_ioctl+0x1d62/0x2550 [btrfs]
+
+caused by the previous patch ("btrfs: scrub: Require mandatory block
+group RO for dev-replace"). Hitting ENOSPC is possible and could happen
+when the block group is set read-only, preventing NOCOW writes to the
+area that's being accessed by dev-replace.
+
+This has happend with scratch devices of size 12G but not with 5G and
+20G, so this is depends on timing and other activity on the filesystem.
+The whole replace operation is restartable, the space state should be
+examined by the user in any case.
+
+The error code is propagated back to the ioctl caller so the kernel
+warning is causing false alerts.
+
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/dev-replace.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 48890826b5e66..4a1d60c81ef9a 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -500,11 +500,8 @@ static int btrfs_dev_replace_start(struct btrfs_fs_info *fs_info,
+ &dev_replace->scrub_progress, 0, 1);
+
+ ret = btrfs_dev_replace_finishing(fs_info, ret);
+- if (ret == -EINPROGRESS) {
++ if (ret == -EINPROGRESS)
+ ret = BTRFS_IOCTL_DEV_REPLACE_RESULT_SCRUB_INPROGRESS;
+- } else if (ret != -ECANCELED) {
+- WARN_ON(ret);
+- }
+
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From 97c88a5219e15331047cc81dc4226fff1b08f479 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Dec 2019 14:55:31 +0000
+Subject: cfg80211: Fix radar event during another phy CAC
+
+From: Orr Mazor <orr.mazor@tandemg.com>
+
+[ Upstream commit 26ec17a1dc5ecdd8d91aba63ead6f8b5ad5dea0d ]
+
+In case a radar event of CAC_FINISHED or RADAR_DETECTED
+happens during another phy is during CAC we might need
+to cancel that CAC.
+
+If we got a radar in a channel that another phy is now
+doing CAC on then the CAC should be canceled there.
+
+If, for example, 2 phys doing CAC on the same channels,
+or on comptable channels, once on of them will finish his
+CAC the other might need to cancel his CAC, since it is no
+longer relevant.
+
+To fix that the commit adds an callback and implement it in
+mac80211 to end CAC.
+This commit also adds a call to said callback if after a radar
+event we see the CAC is no longer relevant
+
+Signed-off-by: Orr Mazor <Orr.Mazor@tandemg.com>
+Reviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Link: https://lore.kernel.org/r/20191222145449.15792-1-Orr.Mazor@tandemg.com
+[slightly reformat/reword commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cfg80211.h | 5 +++++
+ net/mac80211/cfg.c | 23 +++++++++++++++++++++++
+ net/wireless/rdev-ops.h | 10 ++++++++++
+ net/wireless/reg.c | 23 ++++++++++++++++++++++-
+ net/wireless/trace.h | 5 +++++
+ 5 files changed, 65 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 4ab2c49423dcb..68782ba8b6e8d 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3537,6 +3537,9 @@ struct cfg80211_update_owe_info {
+ *
+ * @start_radar_detection: Start radar detection in the driver.
+ *
++ * @end_cac: End running CAC, probably because a related CAC
++ * was finished on another phy.
++ *
+ * @update_ft_ies: Provide updated Fast BSS Transition information to the
+ * driver. If the SME is in the driver/firmware, this information can be
+ * used in building Authentication and Reassociation Request frames.
+@@ -3863,6 +3866,8 @@ struct cfg80211_ops {
+ struct net_device *dev,
+ struct cfg80211_chan_def *chandef,
+ u32 cac_time_ms);
++ void (*end_cac)(struct wiphy *wiphy,
++ struct net_device *dev);
+ int (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
+ struct cfg80211_update_ft_ies_params *ftie);
+ int (*crit_proto_start)(struct wiphy *wiphy,
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 70739e746c13e..0daaf7e37a211 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2954,6 +2954,28 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
+ return err;
+ }
+
++static void ieee80211_end_cac(struct wiphy *wiphy,
++ struct net_device *dev)
++{
++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++ struct ieee80211_local *local = sdata->local;
++
++ mutex_lock(&local->mtx);
++ list_for_each_entry(sdata, &local->interfaces, list) {
++ /* it might be waiting for the local->mtx, but then
++ * by the time it gets it, sdata->wdev.cac_started
++ * will no longer be true
++ */
++ cancel_delayed_work(&sdata->dfs_cac_timer_work);
++
++ if (sdata->wdev.cac_started) {
++ ieee80211_vif_release_channel(sdata);
++ sdata->wdev.cac_started = false;
++ }
++ }
++ mutex_unlock(&local->mtx);
++}
++
+ static struct cfg80211_beacon_data *
+ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
+ {
+@@ -4023,6 +4045,7 @@ const struct cfg80211_ops mac80211_config_ops = {
+ #endif
+ .get_channel = ieee80211_cfg_get_channel,
+ .start_radar_detection = ieee80211_start_radar_detection,
++ .end_cac = ieee80211_end_cac,
+ .channel_switch = ieee80211_channel_switch,
+ .set_qos_map = ieee80211_set_qos_map,
+ .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index 3dd9515c836bc..e0d34f796d0b3 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1171,6 +1171,16 @@ rdev_start_radar_detection(struct cfg80211_registered_device *rdev,
+ return ret;
+ }
+
++static inline void
++rdev_end_cac(struct cfg80211_registered_device *rdev,
++ struct net_device *dev)
++{
++ trace_rdev_end_cac(&rdev->wiphy, dev);
++ if (rdev->ops->end_cac)
++ rdev->ops->end_cac(&rdev->wiphy, dev);
++ trace_rdev_return_void(&rdev->wiphy);
++}
++
+ static inline int
+ rdev_set_mcast_rate(struct cfg80211_registered_device *rdev,
+ struct net_device *dev,
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 3c2070040277d..fff9a74891fc4 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3892,6 +3892,25 @@ bool regulatory_pre_cac_allowed(struct wiphy *wiphy)
+ }
+ EXPORT_SYMBOL(regulatory_pre_cac_allowed);
+
++static void cfg80211_check_and_end_cac(struct cfg80211_registered_device *rdev)
++{
++ struct wireless_dev *wdev;
++ /* If we finished CAC or received radar, we should end any
++ * CAC running on the same channels.
++ * the check !cfg80211_chandef_dfs_usable contain 2 options:
++ * either all channels are available - those the CAC_FINISHED
++ * event has effected another wdev state, or there is a channel
++ * in unavailable state in wdev chandef - those the RADAR_DETECTED
++ * event has effected another wdev state.
++ * In both cases we should end the CAC on the wdev.
++ */
++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
++ if (wdev->cac_started &&
++ !cfg80211_chandef_dfs_usable(&rdev->wiphy, &wdev->chandef))
++ rdev_end_cac(rdev, wdev->netdev);
++ }
++}
++
+ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
+ struct cfg80211_chan_def *chandef,
+ enum nl80211_dfs_state dfs_state,
+@@ -3918,8 +3937,10 @@ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
+ cfg80211_set_dfs_state(&rdev->wiphy, chandef, dfs_state);
+
+ if (event == NL80211_RADAR_DETECTED ||
+- event == NL80211_RADAR_CAC_FINISHED)
++ event == NL80211_RADAR_CAC_FINISHED) {
+ cfg80211_sched_dfs_chan_update(rdev);
++ cfg80211_check_and_end_cac(rdev);
++ }
+
+ nl80211_radar_notify(rdev, chandef, event, NULL, GFP_KERNEL);
+ }
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index d98ad2b3143b0..8677d7ab7d692 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -646,6 +646,11 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_flush_pmksa,
+ TP_ARGS(wiphy, netdev)
+ );
+
++DEFINE_EVENT(wiphy_netdev_evt, rdev_end_cac,
++ TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
++ TP_ARGS(wiphy, netdev)
++);
++
+ DECLARE_EVENT_CLASS(station_add_change,
+ TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u8 *mac,
+ struct station_parameters *params),
+--
+2.20.1
+
--- /dev/null
+From d7cd9ad766d96e3ce3f1939ab4645d9eb1edad15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:04:54 +0100
+Subject: clk: mmp2: Fix the order of timer mux parents
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 8bea5ac0fbc5b2103f8779ddff216122e3c2e1ad ]
+
+Determined empirically, no documentation is available.
+
+The OLPC XO-1.75 laptop used parent 1, that one being VCTCXO/4 (65MHz), but
+thought it's a VCTCXO/2 (130MHz). The mmp2 timer driver, not knowing
+what is going on, ended up just dividing the rate as of
+commit f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")'
+
+Link: https://lore.kernel.org/r/20191218190454.420358-3-lkundrak@v3.sk
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mmp/clk-of-mmp2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
+index a60a1be937ad6..b4a95cbbda989 100644
+--- a/drivers/clk/mmp/clk-of-mmp2.c
++++ b/drivers/clk/mmp/clk-of-mmp2.c
+@@ -134,7 +134,7 @@ static DEFINE_SPINLOCK(ssp3_lock);
+ static const char *ssp_parent_names[] = {"vctcxo_4", "vctcxo_2", "vctcxo", "pll1_16"};
+
+ static DEFINE_SPINLOCK(timer_lock);
+-static const char *timer_parent_names[] = {"clk32", "vctcxo_2", "vctcxo_4", "vctcxo"};
++static const char *timer_parent_names[] = {"clk32", "vctcxo_4", "vctcxo_2", "vctcxo"};
+
+ static DEFINE_SPINLOCK(reset_lock);
+
+--
+2.20.1
+
--- /dev/null
+From 7bc7cb5c3c1754acf499e56a9710415c82912043 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 20:59:22 -0600
+Subject: clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 0c545240aebc2ccb8f661dc54283a14d64659804 ]
+
+According to the BSP source code, both the AR100 and R_APB2 clocks have
+PLL_PERIPH0 as mux index 3, not 2 as it was on previous chips. The pre-
+divider used for PLL_PERIPH0 should be changed to index 3 to match.
+
+This was verified by running a rough benchmark on the AR100 with various
+clock settings:
+
+ | mux | pre-divider | iterations/second | clock source |
+ |=====|=============|===================|==============|
+ | 0 | 0 | 19033 (stable) | osc24M |
+ | 2 | 5 | 11466 (unstable) | iosc/osc16M |
+ | 2 | 17 | 11422 (unstable) | iosc/osc16M |
+ | 3 | 5 | 85338 (stable) | pll-periph0 |
+ | 3 | 17 | 27167 (stable) | pll-periph0 |
+
+The relative performance numbers all match up (with pll-periph0 running
+at its default 600MHz).
+
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+index 45a1ed3fe6742..ab194143e06ce 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+@@ -23,9 +23,9 @@
+ */
+
+ static const char * const ar100_r_apb2_parents[] = { "osc24M", "osc32k",
+- "pll-periph0", "iosc" };
++ "iosc", "pll-periph0" };
+ static const struct ccu_mux_var_prediv ar100_r_apb2_predivs[] = {
+- { .index = 2, .shift = 0, .width = 5 },
++ { .index = 3, .shift = 0, .width = 5 },
+ };
+
+ static struct ccu_div ar100_clk = {
+--
+2.20.1
+
--- /dev/null
+From 9dbb57cffdc33cd8a7d8be6a775aab91e2532969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 20:59:20 -0600
+Subject: clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 47d64fef1f3ffbdf960d3330b9865fc9f12fdf84 ]
+
+According to the BSP source code, the APB0 clock on the H3 and H5 has a
+normal M divider, not a power-of-two divider. This matches the hardware
+in the A83T (as described in both the BSP source code and the manual).
+Since the A83T and H3/A64 clocks are actually the same, we can merge the
+definitions.
+
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-r.c | 21 +++------------------
+ 1 file changed, 3 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-r.c b/drivers/clk/sunxi-ng/ccu-sun8i-r.c
+index 4646fdc61053b..4c8c491b87c27 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-r.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-r.c
+@@ -51,19 +51,7 @@ static struct ccu_div ar100_clk = {
+
+ static CLK_FIXED_FACTOR_HW(ahb0_clk, "ahb0", &ar100_clk.common.hw, 1, 1, 0);
+
+-static struct ccu_div apb0_clk = {
+- .div = _SUNXI_CCU_DIV_FLAGS(0, 2, CLK_DIVIDER_POWER_OF_TWO),
+-
+- .common = {
+- .reg = 0x0c,
+- .hw.init = CLK_HW_INIT_HW("apb0",
+- &ahb0_clk.hw,
+- &ccu_div_ops,
+- 0),
+- },
+-};
+-
+-static SUNXI_CCU_M(a83t_apb0_clk, "apb0", "ahb0", 0x0c, 0, 2, 0);
++static SUNXI_CCU_M(apb0_clk, "apb0", "ahb0", 0x0c, 0, 2, 0);
+
+ /*
+ * Define the parent as an array that can be reused to save space
+@@ -127,7 +115,7 @@ static struct ccu_mp a83t_ir_clk = {
+
+ static struct ccu_common *sun8i_a83t_r_ccu_clks[] = {
+ &ar100_clk.common,
+- &a83t_apb0_clk.common,
++ &apb0_clk.common,
+ &apb0_pio_clk.common,
+ &apb0_ir_clk.common,
+ &apb0_timer_clk.common,
+@@ -167,7 +155,7 @@ static struct clk_hw_onecell_data sun8i_a83t_r_hw_clks = {
+ .hws = {
+ [CLK_AR100] = &ar100_clk.common.hw,
+ [CLK_AHB0] = &ahb0_clk.hw,
+- [CLK_APB0] = &a83t_apb0_clk.common.hw,
++ [CLK_APB0] = &apb0_clk.common.hw,
+ [CLK_APB0_PIO] = &apb0_pio_clk.common.hw,
+ [CLK_APB0_IR] = &apb0_ir_clk.common.hw,
+ [CLK_APB0_TIMER] = &apb0_timer_clk.common.hw,
+@@ -282,9 +270,6 @@ static void __init sunxi_r_ccu_init(struct device_node *node,
+
+ static void __init sun8i_a83t_r_ccu_setup(struct device_node *node)
+ {
+- /* Fix apb0 bus gate parents here */
+- apb0_gate_parent[0] = &a83t_apb0_clk.common.hw;
+-
+ sunxi_r_ccu_init(node, &sun8i_a83t_r_ccu_desc);
+ }
+ CLK_OF_DECLARE(sun8i_a83t_r_ccu, "allwinner,sun8i-a83t-r-ccu",
+--
+2.20.1
+
--- /dev/null
+From 7ffa785bc28a8e2f09c309742907668d725d4447 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 20:58:32 +0800
+Subject: clk: sunxi-ng: v3s: Fix incorrect number of hw_clks.
+
+From: Yunhao Tian <18373444@buaa.edu.cn>
+
+[ Upstream commit 4ff40d140e2a2060ef6051800a4a9eab07624f42 ]
+
+The hws field of sun8i_v3s_hw_clks has only 74
+members. However, the number specified by CLK_NUMBER
+is 77 (= CLK_I2S0 + 1). This leads to runtime segmentation
+fault that is not always reproducible.
+
+This patch fixes the problem by specifying correct clock number.
+
+Signed-off-by: Yunhao Tian <18373444@buaa.edu.cn>
+[Maxime: Also remove the CLK_NUMBER definition]
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 4 ++--
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.h | 2 --
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index 5c779eec454b6..0e36ca3bf3d52 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -618,7 +618,7 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
+ [CLK_MBUS] = &mbus_clk.common.hw,
+ [CLK_MIPI_CSI] = &mipi_csi_clk.common.hw,
+ },
+- .num = CLK_NUMBER,
++ .num = CLK_PLL_DDR1 + 1,
+ };
+
+ static struct clk_hw_onecell_data sun8i_v3_hw_clks = {
+@@ -700,7 +700,7 @@ static struct clk_hw_onecell_data sun8i_v3_hw_clks = {
+ [CLK_MBUS] = &mbus_clk.common.hw,
+ [CLK_MIPI_CSI] = &mipi_csi_clk.common.hw,
+ },
+- .num = CLK_NUMBER,
++ .num = CLK_I2S0 + 1,
+ };
+
+ static struct ccu_reset_map sun8i_v3s_ccu_resets[] = {
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+index b0160d305a677..108eeeedcbf76 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+@@ -51,6 +51,4 @@
+
+ #define CLK_PLL_DDR1 74
+
+-#define CLK_NUMBER (CLK_I2S0 + 1)
+-
+ #endif /* _CCU_SUN8I_H3_H_ */
+--
+2.20.1
+
--- /dev/null
+From 16b639951812b57a77a13cd2ae71962bc5d43230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 11:28:17 -0800
+Subject: i40e: Fix virtchnl_queue_select bitmap validation
+
+From: Brett Creeley <brett.creeley@intel.com>
+
+[ Upstream commit d9d6a9aed3f66f8ce5fa3ca6ca26007d75032296 ]
+
+Currently in i40e_vc_disable_queues_msg() we are incorrectly
+validating the virtchnl queue select bitmaps. The
+virtchnl_queue_select rx_queues and tx_queue bitmap is being
+compared against ICE_MAX_VF_QUEUES, but the problem is that
+these bitmaps can have a value greater than I40E_MAX_VF_QUEUES.
+Fix this by comparing the bitmaps against BIT(I40E_MAX_VF_QUEUES).
+
+Also, add the function i40e_vc_validate_vqs_bitmaps() that checks to see
+if both virtchnl_queue_select bitmaps are empty along with checking that
+the bitmaps only have valid bits set. This function can then be used in
+both the queue enable and disable flows.
+
+Suggested-by: Arkady Gilinksky <arkady.gilinsky@harmonicinc.com>
+Signed-off-by: Brett Creeley <brett.creeley@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 22 +++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index 3d24408388226..3515ace0f0201 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2322,6 +2322,22 @@ static int i40e_ctrl_vf_rx_rings(struct i40e_vsi *vsi, unsigned long q_map,
+ return ret;
+ }
+
++/**
++ * i40e_vc_validate_vqs_bitmaps - validate Rx/Tx queue bitmaps from VIRTHCHNL
++ * @vqs: virtchnl_queue_select structure containing bitmaps to validate
++ *
++ * Returns true if validation was successful, else false.
++ */
++static bool i40e_vc_validate_vqs_bitmaps(struct virtchnl_queue_select *vqs)
++{
++ if ((!vqs->rx_queues && !vqs->tx_queues) ||
++ vqs->rx_queues >= BIT(I40E_MAX_VF_QUEUES) ||
++ vqs->tx_queues >= BIT(I40E_MAX_VF_QUEUES))
++ return false;
++
++ return true;
++}
++
+ /**
+ * i40e_vc_enable_queues_msg
+ * @vf: pointer to the VF info
+@@ -2347,7 +2363,7 @@ static int i40e_vc_enable_queues_msg(struct i40e_vf *vf, u8 *msg)
+ goto error_param;
+ }
+
+- if ((0 == vqs->rx_queues) && (0 == vqs->tx_queues)) {
++ if (i40e_vc_validate_vqs_bitmaps(vqs)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto error_param;
+ }
+@@ -2409,9 +2425,7 @@ static int i40e_vc_disable_queues_msg(struct i40e_vf *vf, u8 *msg)
+ goto error_param;
+ }
+
+- if ((vqs->rx_queues == 0 && vqs->tx_queues == 0) ||
+- vqs->rx_queues > I40E_MAX_VF_QUEUES ||
+- vqs->tx_queues > I40E_MAX_VF_QUEUES) {
++ if (i40e_vc_validate_vqs_bitmaps(vqs)) {
+ aq_ret = I40E_ERR_PARAM;
+ goto error_param;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3099281572bce5df19635bb9d9451ba118062f7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 11:29:23 +0100
+Subject: iavf: remove current MAC address filter on VF reset
+
+From: Stefan Assmann <sassmann@kpanic.de>
+
+[ Upstream commit 9e05229190380f6b8f702da39aaeb97a0fc80dc3 ]
+
+Currently MAC filters are not altered during a VF reset event. This may
+lead to a stale filter when an administratively set MAC is forced by the
+PF.
+
+For an administratively set MAC the PF driver deletes the VFs filters,
+overwrites the VFs MAC address and triggers a VF reset. However
+the VF driver itself is not aware of the filter removal, which is what
+the VF reset is for.
+The VF reset queues all filters present in the VF driver to be re-added
+to the PF filter list (including the filter for the now stale VF MAC
+address) and triggers a VIRTCHNL_OP_GET_VF_RESOURCES event, which
+provides the new MAC address to the VF.
+
+When this happens i40e will complain and reject the stale MAC filter,
+at least in the untrusted VF case.
+i40e 0000:08:00.0: Setting MAC 3c:fa:fa:fa:fa:01 on VF 0
+iavf 0000:08:02.0: Reset warning received from the PF
+iavf 0000:08:02.0: Scheduling reset task
+i40e 0000:08:00.0: Bring down and up the VF interface to make this change effective.
+i40e 0000:08:00.0: VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation
+i40e 0000:08:00.0: VF 0 failed opcode 10, retval: -1
+iavf 0000:08:02.0: Failed to add MAC filter, error IAVF_ERR_NVM
+
+To avoid re-adding the stale MAC filter it needs to be removed from the
+VF driver's filter list before queuing the existing filters. Then during
+the VIRTCHNL_OP_GET_VF_RESOURCES event the correct filter needs to be
+added again, at which point the MAC address has been updated.
+
+As a bonus this change makes bringing the VF down and up again
+superfluous for the administratively set MAC case.
+
+Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf.h | 2 ++
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 17 +++++++++++++----
+ drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 3 +++
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h
+index 29de3ae96ef22..bd1b1ed323f4f 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf.h
++++ b/drivers/net/ethernet/intel/iavf/iavf.h
+@@ -415,4 +415,6 @@ void iavf_enable_channels(struct iavf_adapter *adapter);
+ void iavf_disable_channels(struct iavf_adapter *adapter);
+ void iavf_add_cloud_filter(struct iavf_adapter *adapter);
+ void iavf_del_cloud_filter(struct iavf_adapter *adapter);
++struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter,
++ const u8 *macaddr);
+ #endif /* _IAVF_H_ */
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 821987da5698a..8e16be960e96b 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -743,9 +743,8 @@ iavf_mac_filter *iavf_find_filter(struct iavf_adapter *adapter,
+ *
+ * Returns ptr to the filter object or NULL when no memory available.
+ **/
+-static struct
+-iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter,
+- const u8 *macaddr)
++struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter,
++ const u8 *macaddr)
+ {
+ struct iavf_mac_filter *f;
+
+@@ -2065,9 +2064,9 @@ static void iavf_reset_task(struct work_struct *work)
+ struct virtchnl_vf_resource *vfres = adapter->vf_res;
+ struct net_device *netdev = adapter->netdev;
+ struct iavf_hw *hw = &adapter->hw;
++ struct iavf_mac_filter *f, *ftmp;
+ struct iavf_vlan_filter *vlf;
+ struct iavf_cloud_filter *cf;
+- struct iavf_mac_filter *f;
+ u32 reg_val;
+ int i = 0, err;
+ bool running;
+@@ -2181,6 +2180,16 @@ static void iavf_reset_task(struct work_struct *work)
+
+ spin_lock_bh(&adapter->mac_vlan_list_lock);
+
++ /* Delete filter for the current MAC address, it could have
++ * been changed by the PF via administratively set MAC.
++ * Will be re-added via VIRTCHNL_OP_GET_VF_RESOURCES.
++ */
++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) {
++ if (ether_addr_equal(f->macaddr, adapter->hw.mac.addr)) {
++ list_del(&f->list);
++ kfree(f);
++ }
++ }
+ /* re-add all MAC filters */
+ list_for_each_entry(f, &adapter->mac_filter_list, list) {
+ f->add = true;
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+index c46770eba320e..1ab9cb339acb4 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+@@ -1359,6 +1359,9 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
+ ether_addr_copy(netdev->perm_addr,
+ adapter->hw.mac.addr);
+ }
++ spin_lock_bh(&adapter->mac_vlan_list_lock);
++ iavf_add_filter(adapter, adapter->hw.mac.addr);
++ spin_unlock_bh(&adapter->mac_vlan_list_lock);
+ iavf_process_config(adapter);
+ }
+ break;
+--
+2.20.1
+
--- /dev/null
+From 85ccf527ced626fb628a27774959478897cc03f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 11:40:26 +0100
+Subject: igb: Fix SGMII SFP module discovery for 100FX/LX.
+
+From: Manfred Rudigier <manfred.rudigier@omicronenergy.com>
+
+[ Upstream commit 5365ec1aeff5b9f2962a9c9b31d63f9dad7e0e2d ]
+
+Changing the link mode should also be done for 100BaseFX SGMII modules,
+otherwise they just don't work when the default link mode in CTRL_EXT
+coming from the EEPROM is SERDES.
+
+Additionally 100Base-LX SGMII SFP modules are also supported now, which
+was not the case before.
+
+Tested with an i210 using Flexoptix S.1303.2M.G 100FX and
+S.1303.10.G 100LX SGMII SFP modules.
+
+Signed-off-by: Manfred Rudigier <manfred.rudigier@omicronenergy.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/e1000_82575.c | 8 ++------
+ drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 +-
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
+index 8a6ef35141292..438b42ce2cd9a 100644
+--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
++++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
+@@ -530,7 +530,7 @@ static s32 igb_set_sfp_media_type_82575(struct e1000_hw *hw)
+ dev_spec->module_plugged = true;
+ if (eth_flags->e1000_base_lx || eth_flags->e1000_base_sx) {
+ hw->phy.media_type = e1000_media_type_internal_serdes;
+- } else if (eth_flags->e100_base_fx) {
++ } else if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) {
+ dev_spec->sgmii_active = true;
+ hw->phy.media_type = e1000_media_type_internal_serdes;
+ } else if (eth_flags->e1000_base_t) {
+@@ -657,14 +657,10 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
+ break;
+ }
+
+- /* do not change link mode for 100BaseFX */
+- if (dev_spec->eth_flags.e100_base_fx)
+- break;
+-
+ /* change current link mode setting */
+ ctrl_ext &= ~E1000_CTRL_EXT_LINK_MODE_MASK;
+
+- if (hw->phy.media_type == e1000_media_type_copper)
++ if (dev_spec->sgmii_active)
+ ctrl_ext |= E1000_CTRL_EXT_LINK_MODE_SGMII;
+ else
+ ctrl_ext |= E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES;
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index 3182b059bf55c..8959418776f67 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -181,7 +181,7 @@ static int igb_get_link_ksettings(struct net_device *netdev,
+ advertising &= ~ADVERTISED_1000baseKX_Full;
+ }
+ }
+- if (eth_flags->e100_base_fx) {
++ if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) {
+ supported |= SUPPORTED_100baseT_Full;
+ advertising |= ADVERTISED_100baseT_Full;
+ }
+--
+2.20.1
+
--- /dev/null
+From 5c4f071eb8536f23776a658057371741e561a166 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 11:59:52 -0800
+Subject: Input: aiptek - use descriptors of current altsetting
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cfa4f6a99fb183742cace65ec551b444852b8ef6 ]
+
+Make sure to always use the descriptors of the current alternate setting
+to avoid future issues when accessing fields that may differ between
+settings.
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Vladis Dronov <vdronov@redhat.com>
+Link: https://lore.kernel.org/r/20191210113737.4016-4-johan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/tablet/aiptek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
+index 06d0ffef4a171..e08b0ef078e81 100644
+--- a/drivers/input/tablet/aiptek.c
++++ b/drivers/input/tablet/aiptek.c
+@@ -1713,7 +1713,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
+
+ aiptek->inputdev = inputdev;
+ aiptek->intf = intf;
+- aiptek->ifnum = intf->altsetting[0].desc.bInterfaceNumber;
++ aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+ aiptek->inDelay = 0;
+ aiptek->endDelay = 0;
+ aiptek->previousJitterable = 0;
+--
+2.20.1
+
--- /dev/null
+From 55f119e50c1dd2e93cf411723a8552f1d70240c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 15:10:16 -0800
+Subject: Input: evdev - convert kzalloc()/vzalloc() to kvzalloc()
+
+From: Miles Chen <miles.chen@mediatek.com>
+
+[ Upstream commit 7f439bc2d7e8c8cc4e1bab08ab7fe1bb73c9b268 ]
+
+We observed a large(order-3) allocation in evdev_open() and it may
+cause an OOM kernel panic in kzalloc(), before we getting to the
+vzalloc() fallback.
+
+Fix it by converting kzalloc()/vzalloc() to kvzalloc() to avoid the
+OOM killer logic as we have a vmalloc fallback.
+
+InputReader invoked oom-killer: gfp_mask=0x240c2c0
+(GFP_KERNEL|__GFP_NOWARN|__GFP_COMP|__GFP_ZERO), nodemask=0, order=3,
+oom_score_adj=-900
+...
+(dump_backtrace) from (show_stack+0x18/0x1c)
+(show_stack) from (dump_stack+0x94/0xa8)
+(dump_stack) from (dump_header+0x7c/0xe4)
+(dump_header) from (out_of_memory+0x334/0x348)
+(out_of_memory) from (__alloc_pages_nodemask+0xe9c/0xeb8)
+(__alloc_pages_nodemask) from (kmalloc_order_trace+0x34/0x128)
+(kmalloc_order_trace) from (__kmalloc+0x258/0x36c)
+(__kmalloc) from (evdev_open+0x5c/0x17c)
+(evdev_open) from (chrdev_open+0x100/0x204)
+(chrdev_open) from (do_dentry_open+0x21c/0x354)
+(do_dentry_open) from (vfs_open+0x58/0x84)
+(vfs_open) from (path_openat+0x640/0xc98)
+(path_openat) from (do_filp_open+0x78/0x11c)
+(do_filp_open) from (do_sys_open+0x130/0x244)
+(do_sys_open) from (SyS_openat+0x14/0x18)
+(SyS_openat) from (__sys_trace_return+0x0/0x10)
+...
+Normal: 12488*4kB (UMEH) 6984*8kB (UMEH) 2101*16kB (UMEH) 0*32kB
+0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 139440kB
+HighMem: 206*4kB (H) 131*8kB (H) 42*16kB (H) 2*32kB (H) 0*64kB
+0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 2608kB
+...
+Kernel panic - not syncing: Out of memory and no killable processes...
+
+Signed-off-by: Miles Chen <miles.chen@mediatek.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/evdev.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index f918fca9ada32..cb6e3a5f509c8 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -484,10 +484,7 @@ static int evdev_open(struct inode *inode, struct file *file)
+ struct evdev_client *client;
+ int error;
+
+- client = kzalloc(struct_size(client, buffer, bufsize),
+- GFP_KERNEL | __GFP_NOWARN);
+- if (!client)
+- client = vzalloc(struct_size(client, buffer, bufsize));
++ client = kvzalloc(struct_size(client, buffer, bufsize), GFP_KERNEL);
+ if (!client)
+ return -ENOMEM;
+
+--
+2.20.1
+
--- /dev/null
+From 58c6d3991c749c02149c32f6c4c5196de72a6c1d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 10:22:12 -0800
+Subject: Input: max77650-onkey - add of_match table
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit ce535a2efb48d8d4c4e4b97e2764d7cee73d9b55 ]
+
+We need the of_match table if we want to use the compatible string in
+the pmic's child node and get the onkey driver loaded automatically.
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/misc/max77650-onkey.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/misc/max77650-onkey.c b/drivers/input/misc/max77650-onkey.c
+index 4d875f2ac13d6..ee55f22dbca54 100644
+--- a/drivers/input/misc/max77650-onkey.c
++++ b/drivers/input/misc/max77650-onkey.c
+@@ -108,9 +108,16 @@ static int max77650_onkey_probe(struct platform_device *pdev)
+ return input_register_device(onkey->input);
+ }
+
++static const struct of_device_id max77650_onkey_of_match[] = {
++ { .compatible = "maxim,max77650-onkey" },
++ { }
++};
++MODULE_DEVICE_TABLE(of, max77650_onkey_of_match);
++
+ static struct platform_driver max77650_onkey_driver = {
+ .driver = {
+ .name = "max77650-onkey",
++ .of_match_table = max77650_onkey_of_match,
+ },
+ .probe = max77650_onkey_probe,
+ };
+--
+2.20.1
+
--- /dev/null
+From 9595388d6fe978b35cec31a4ef9f88aa71c4697d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 20:06:22 +0200
+Subject: iwlwifi: dbg: force stop the debug monitor HW
+
+From: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+
+[ Upstream commit 990aba28f5001f6e90fdd84e13612b560a75deda ]
+
+The driver is required to stop the debug monitor HW recording regardless
+of the debug configuration since the driver is responsible to halt the
+FW DBGC.
+
+Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+index 87421807e040b..386ca67ec7b4e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
+@@ -2490,12 +2490,7 @@ int iwl_fw_dbg_stop_restart_recording(struct iwl_fw_runtime *fwrt,
+ {
+ int ret = 0;
+
+- /* if the FW crashed or not debug monitor cfg was given, there is
+- * no point in changing the recording state
+- */
+- if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status) ||
+- (!fwrt->trans->dbg.dest_tlv &&
+- fwrt->trans->dbg.ini_dest == IWL_FW_INI_LOCATION_INVALID))
++ if (test_bit(STATUS_FW_ERROR, &fwrt->trans->status))
+ return 0;
+
+ if (fw_has_capa(&fwrt->fw->ucode_capa,
+--
+2.20.1
+
--- /dev/null
+From e33c125b9251fa70cdc9b518057f06f93e83c51f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 14:55:58 -0500
+Subject: iwlwifi: Don't ignore the cap field upon mcc update
+
+From: Haim Dreyfuss <haim.dreyfuss@intel.com>
+
+[ Upstream commit 2763bba6328c53c455d8f7f5302b80030551c31b ]
+
+When receiving a new MCC driver get all the data about the new country
+code and its regulatory information.
+Mistakenly, we ignored the cap field, which includes global regulatory
+information which should be applies to every channel.
+Fix it.
+
+Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 48 ++++++++++++++++++-
+ .../wireless/intel/iwlwifi/iwl-nvm-parse.h | 6 +--
+ .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +-
+ 3 files changed, 51 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index c8972f6e38bac..5d546dac78142 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -225,6 +225,34 @@ enum iwl_nvm_channel_flags {
+ NVM_CHANNEL_DC_HIGH = BIT(12),
+ };
+
++/**
++ * enum iwl_reg_capa_flags - global flags applied for the whole regulatory
++ * domain.
++ * @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
++ * 2.4Ghz band is allowed.
++ * @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
++ * 5Ghz band is allowed.
++ * @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
++ * @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
++ * @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed.
++ */
++enum iwl_reg_capa_flags {
++ REG_CAPA_BF_CCD_LOW_BAND = BIT(0),
++ REG_CAPA_BF_CCD_HIGH_BAND = BIT(1),
++ REG_CAPA_160MHZ_ALLOWED = BIT(2),
++ REG_CAPA_80MHZ_ALLOWED = BIT(3),
++ REG_CAPA_MCS_8_ALLOWED = BIT(4),
++ REG_CAPA_MCS_9_ALLOWED = BIT(5),
++ REG_CAPA_40MHZ_FORBIDDEN = BIT(7),
++ REG_CAPA_DC_HIGH_ENABLED = BIT(9),
++};
++
+ static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
+ int chan, u32 flags)
+ {
+@@ -1031,6 +1059,7 @@ IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
+
+ static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
+ int ch_idx, u16 nvm_flags,
++ u16 cap_flags,
+ const struct iwl_cfg *cfg)
+ {
+ u32 flags = NL80211_RRF_NO_HT40;
+@@ -1069,13 +1098,27 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u16 *nvm_chan,
+ (flags & NL80211_RRF_NO_IR))
+ flags |= NL80211_RRF_GO_CONCURRENT;
+
++ /*
++ * cap_flags is per regulatory domain so apply it for every channel
++ */
++ if (ch_idx >= NUM_2GHZ_CHANNELS) {
++ if (cap_flags & REG_CAPA_40MHZ_FORBIDDEN)
++ flags |= NL80211_RRF_NO_HT40;
++
++ if (!(cap_flags & REG_CAPA_80MHZ_ALLOWED))
++ flags |= NL80211_RRF_NO_80MHZ;
++
++ if (!(cap_flags & REG_CAPA_160MHZ_ALLOWED))
++ flags |= NL80211_RRF_NO_160MHZ;
++ }
++
+ return flags;
+ }
+
+ struct ieee80211_regdomain *
+ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ int num_of_ch, __le32 *channels, u16 fw_mcc,
+- u16 geo_info)
++ u16 geo_info, u16 cap)
+ {
+ int ch_idx;
+ u16 ch_flags;
+@@ -1133,7 +1176,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ }
+
+ reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+- ch_flags, cfg);
++ ch_flags, cap,
++ cfg);
+
+ /* we can't continue the same rule */
+ if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+index b7e1ddf8f177b..4eeedb41e9ac7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+@@ -7,7 +7,7 @@
+ *
+ * Copyright(c) 2008 - 2015 Intel Corporation. All rights reserved.
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -29,7 +29,7 @@
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -103,7 +103,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+ struct ieee80211_regdomain *
+ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ int num_of_ch, __le32 *channels, u16 fw_mcc,
+- u16 geo_info);
++ u16 geo_info, u16 cap);
+
+ /**
+ * struct iwl_nvm_section - describes an NVM section in memory.
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 49aeab7c27a27..18ccc2692437f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -256,7 +256,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
+ __le32_to_cpu(resp->n_channels),
+ resp->channels,
+ __le16_to_cpu(resp->mcc),
+- __le16_to_cpu(resp->geo_info));
++ __le16_to_cpu(resp->geo_info),
++ __le16_to_cpu(resp->cap));
+ /* Store the return source id */
+ src_id = resp->source_id;
+ kfree(resp);
+--
+2.20.1
+
--- /dev/null
+From 5dfd6137e2fc8da2850d52020bd22fa3460358a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 13:21:58 +0200
+Subject: iwlwifi: mvm: fix NVM check for 3168 devices
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit b3f20e098293892388d6a0491d6bbb2efb46fbff ]
+
+We had a check on !NVM_EXT and then a check for NVM_SDP in the else
+block of this if. The else block, obviously, could only be reached if
+using NVM_EXT, so it would never be NVM_SDP.
+
+Fix that by checking whether the nvm_type is IWL_NVM instead of
+checking for !IWL_NVM_EXT to solve this issue.
+
+Reported-by: Stefan Sperling <stsp@stsp.name>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index 945c1ea5cda86..493bcc54a8485 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -281,7 +281,7 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
+ int regulatory_type;
+
+ /* Checking for required sections */
+- if (mvm->trans->cfg->nvm_type != IWL_NVM_EXT) {
++ if (mvm->trans->cfg->nvm_type == IWL_NVM) {
+ if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
+ !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) {
+ IWL_ERR(mvm, "Can't parse empty OTP/NVM sections\n");
+--
+2.20.1
+
--- /dev/null
+From 441517abad2a6e870f50be0316d7b5b1e7f64df9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 09:09:34 +0100
+Subject: iwlwifi: pcie: allocate smaller dev_cmd for TX headers
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit a89c72ffd07369f5ccc74f0332d2785a7077241d ]
+
+As noted in the previous commit, due to the way we allocate the
+dev_cmd headers with 324 byte size, and 4/8 byte alignment, the
+part we use of them (bytes 20..40-68) could still cross a page
+and thus 2^32 boundary.
+
+Address this by using alignment to ensure that the allocation
+cannot cross a page boundary, on hardware that's affected. To
+make that not cause more memory consumption, reduce the size of
+the allocations to the necessary size - we go from 324 bytes in
+each allocation to 60/68 on gen2 depending on family, and ~120
+or so on gen1 (so on gen1 it's a pure reduction in size, since
+we don't need alignment there).
+
+To avoid size and clearing issues, add a new structure that's
+just the header, and use kmem_cache_zalloc().
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 3 +-
+ .../net/wireless/intel/iwlwifi/iwl-trans.c | 10 +++---
+ .../net/wireless/intel/iwlwifi/iwl-trans.h | 26 +++++++++++----
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 15 +++------
+ .../wireless/intel/iwlwifi/pcie/internal.h | 6 ++--
+ .../net/wireless/intel/iwlwifi/pcie/trans.c | 32 ++++++++++++++-----
+ .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 21 ++++++++----
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 20 ++++++------
+ 8 files changed, 84 insertions(+), 49 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+index 3029e3f6de63b..621cd7206b7c7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c
+@@ -267,7 +267,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+ struct iwl_station_priv *sta_priv = NULL;
+ struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS];
+- struct iwl_device_cmd *dev_cmd;
++ struct iwl_device_tx_cmd *dev_cmd;
+ struct iwl_tx_cmd *tx_cmd;
+ __le16 fc;
+ u8 hdr_len;
+@@ -348,7 +348,6 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
+ if (unlikely(!dev_cmd))
+ goto drop_unlock_priv;
+
+- memset(dev_cmd, 0, sizeof(*dev_cmd));
+ dev_cmd->hdr.cmd = REPLY_TX;
+ tx_cmd = (struct iwl_tx_cmd *) dev_cmd->payload;
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
+index 28bdc9a9617eb..f91197e4ae402 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c
+@@ -66,7 +66,9 @@
+
+ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,
+ struct device *dev,
+- const struct iwl_trans_ops *ops)
++ const struct iwl_trans_ops *ops,
++ unsigned int cmd_pool_size,
++ unsigned int cmd_pool_align)
+ {
+ struct iwl_trans *trans;
+ #ifdef CONFIG_LOCKDEP
+@@ -90,10 +92,8 @@ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,
+ "iwl_cmd_pool:%s", dev_name(trans->dev));
+ trans->dev_cmd_pool =
+ kmem_cache_create(trans->dev_cmd_pool_name,
+- sizeof(struct iwl_device_cmd),
+- sizeof(void *),
+- SLAB_HWCACHE_ALIGN,
+- NULL);
++ cmd_pool_size, cmd_pool_align,
++ SLAB_HWCACHE_ALIGN, NULL);
+ if (!trans->dev_cmd_pool)
+ return NULL;
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+index a31408188ed05..1e85d59b91613 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h
+@@ -193,6 +193,18 @@ struct iwl_device_cmd {
+ };
+ } __packed;
+
++/**
++ * struct iwl_device_tx_cmd - buffer for TX command
++ * @hdr: the header
++ * @payload: the payload placeholder
++ *
++ * The actual structure is sized dynamically according to need.
++ */
++struct iwl_device_tx_cmd {
++ struct iwl_cmd_header hdr;
++ u8 payload[];
++} __packed;
++
+ #define TFD_MAX_PAYLOAD_SIZE (sizeof(struct iwl_device_cmd))
+
+ /*
+@@ -544,7 +556,7 @@ struct iwl_trans_ops {
+ int (*send_cmd)(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
+
+ int (*tx)(struct iwl_trans *trans, struct sk_buff *skb,
+- struct iwl_device_cmd *dev_cmd, int queue);
++ struct iwl_device_tx_cmd *dev_cmd, int queue);
+ void (*reclaim)(struct iwl_trans *trans, int queue, int ssn,
+ struct sk_buff_head *skbs);
+
+@@ -921,22 +933,22 @@ iwl_trans_dump_data(struct iwl_trans *trans, u32 dump_mask)
+ return trans->ops->dump_data(trans, dump_mask);
+ }
+
+-static inline struct iwl_device_cmd *
++static inline struct iwl_device_tx_cmd *
+ iwl_trans_alloc_tx_cmd(struct iwl_trans *trans)
+ {
+- return kmem_cache_alloc(trans->dev_cmd_pool, GFP_ATOMIC);
++ return kmem_cache_zalloc(trans->dev_cmd_pool, GFP_ATOMIC);
+ }
+
+ int iwl_trans_send_cmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
+
+ static inline void iwl_trans_free_tx_cmd(struct iwl_trans *trans,
+- struct iwl_device_cmd *dev_cmd)
++ struct iwl_device_tx_cmd *dev_cmd)
+ {
+ kmem_cache_free(trans->dev_cmd_pool, dev_cmd);
+ }
+
+ static inline int iwl_trans_tx(struct iwl_trans *trans, struct sk_buff *skb,
+- struct iwl_device_cmd *dev_cmd, int queue)
++ struct iwl_device_tx_cmd *dev_cmd, int queue)
+ {
+ if (unlikely(test_bit(STATUS_FW_ERROR, &trans->status)))
+ return -EIO;
+@@ -1239,7 +1251,9 @@ static inline bool iwl_trans_dbg_ini_valid(struct iwl_trans *trans)
+ *****************************************************/
+ struct iwl_trans *iwl_trans_alloc(unsigned int priv_size,
+ struct device *dev,
+- const struct iwl_trans_ops *ops);
++ const struct iwl_trans_ops *ops,
++ unsigned int cmd_pool_size,
++ unsigned int cmd_pool_align);
+ void iwl_trans_free(struct iwl_trans *trans);
+
+ /*****************************************************
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index d9d82f6b5e875..2b92980a49e68 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -487,13 +487,13 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
+ /*
+ * Allocates and sets the Tx cmd the driver data pointers in the skb
+ */
+-static struct iwl_device_cmd *
++static struct iwl_device_tx_cmd *
+ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
+ struct ieee80211_tx_info *info, int hdrlen,
+ struct ieee80211_sta *sta, u8 sta_id)
+ {
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+- struct iwl_device_cmd *dev_cmd;
++ struct iwl_device_tx_cmd *dev_cmd;
+ struct iwl_tx_cmd *tx_cmd;
+
+ dev_cmd = iwl_trans_alloc_tx_cmd(mvm->trans);
+@@ -501,11 +501,6 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
+ if (unlikely(!dev_cmd))
+ return NULL;
+
+- /* Make sure we zero enough of dev_cmd */
+- BUILD_BUG_ON(sizeof(struct iwl_tx_cmd_gen2) > sizeof(*tx_cmd));
+- BUILD_BUG_ON(sizeof(struct iwl_tx_cmd_gen3) > sizeof(*tx_cmd));
+-
+- memset(dev_cmd, 0, sizeof(dev_cmd->hdr) + sizeof(*tx_cmd));
+ dev_cmd->hdr.cmd = TX_CMD;
+
+ if (iwl_mvm_has_new_tx_api(mvm)) {
+@@ -594,7 +589,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
+ }
+
+ static void iwl_mvm_skb_prepare_status(struct sk_buff *skb,
+- struct iwl_device_cmd *cmd)
++ struct iwl_device_tx_cmd *cmd)
+ {
+ struct ieee80211_tx_info *skb_info = IEEE80211_SKB_CB(skb);
+
+@@ -713,7 +708,7 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+ {
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ struct ieee80211_tx_info info;
+- struct iwl_device_cmd *dev_cmd;
++ struct iwl_device_tx_cmd *dev_cmd;
+ u8 sta_id;
+ int hdrlen = ieee80211_hdrlen(hdr->frame_control);
+ __le16 fc = hdr->frame_control;
+@@ -1075,7 +1070,7 @@ static int iwl_mvm_tx_mpdu(struct iwl_mvm *mvm, struct sk_buff *skb,
+ {
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ struct iwl_mvm_sta *mvmsta;
+- struct iwl_device_cmd *dev_cmd;
++ struct iwl_device_tx_cmd *dev_cmd;
+ __le16 fc;
+ u16 seq_number = 0;
+ u8 tid = IWL_MAX_TID_COUNT;
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+index 1047d48beaa5d..9b5b96e34456f 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -305,7 +305,7 @@ struct iwl_cmd_meta {
+ #define IWL_FIRST_TB_SIZE_ALIGN ALIGN(IWL_FIRST_TB_SIZE, 64)
+
+ struct iwl_pcie_txq_entry {
+- struct iwl_device_cmd *cmd;
++ void *cmd;
+ struct sk_buff *skb;
+ /* buffer to free after command completes */
+ const void *free_buf;
+@@ -690,7 +690,7 @@ void iwl_trans_pcie_txq_set_shared_mode(struct iwl_trans *trans, u32 txq_id,
+ void iwl_trans_pcie_log_scd_error(struct iwl_trans *trans,
+ struct iwl_txq *txq);
+ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
+- struct iwl_device_cmd *dev_cmd, int txq_id);
++ struct iwl_device_tx_cmd *dev_cmd, int txq_id);
+ void iwl_pcie_txq_check_wrptrs(struct iwl_trans *trans);
+ int iwl_trans_pcie_send_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
+ void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx);
+@@ -1111,7 +1111,7 @@ int iwl_trans_pcie_dyn_txq_alloc(struct iwl_trans *trans,
+ unsigned int timeout);
+ void iwl_trans_pcie_dyn_txq_free(struct iwl_trans *trans, int queue);
+ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+- struct iwl_device_cmd *dev_cmd, int txq_id);
++ struct iwl_device_tx_cmd *dev_cmd, int txq_id);
+ int iwl_trans_pcie_gen2_send_hcmd(struct iwl_trans *trans,
+ struct iwl_host_cmd *cmd);
+ void iwl_trans_pcie_gen2_stop_device(struct iwl_trans *trans);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index d3db38c3095be..c76d26708e659 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -79,6 +79,7 @@
+ #include "iwl-agn-hw.h"
+ #include "fw/error-dump.h"
+ #include "fw/dbg.h"
++#include "fw/api/tx.h"
+ #include "internal.h"
+ #include "iwl-fh.h"
+
+@@ -3462,19 +3463,34 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ {
+ struct iwl_trans_pcie *trans_pcie;
+ struct iwl_trans *trans;
+- int ret, addr_size;
++ int ret, addr_size, txcmd_size, txcmd_align;
++ const struct iwl_trans_ops *ops = &trans_ops_pcie_gen2;
++
++ if (!cfg_trans->gen2) {
++ ops = &trans_ops_pcie;
++ txcmd_size = sizeof(struct iwl_tx_cmd);
++ txcmd_align = sizeof(void *);
++ } else if (cfg_trans->device_family < IWL_DEVICE_FAMILY_AX210) {
++ txcmd_size = sizeof(struct iwl_tx_cmd_gen2);
++ txcmd_align = 64;
++ } else {
++ txcmd_size = sizeof(struct iwl_tx_cmd_gen3);
++ txcmd_align = 128;
++ }
++
++ txcmd_size += sizeof(struct iwl_cmd_header);
++ txcmd_size += 36; /* biggest possible 802.11 header */
++
++ /* Ensure device TX cmd cannot reach/cross a page boundary in gen2 */
++ if (WARN_ON(cfg_trans->gen2 && txcmd_size >= txcmd_align))
++ return ERR_PTR(-EINVAL);
+
+ ret = pcim_enable_device(pdev);
+ if (ret)
+ return ERR_PTR(ret);
+
+- if (cfg_trans->gen2)
+- trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
+- &pdev->dev, &trans_ops_pcie_gen2);
+- else
+- trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie),
+- &pdev->dev, &trans_ops_pcie);
+-
++ trans = iwl_trans_alloc(sizeof(struct iwl_trans_pcie), &pdev->dev, ops,
++ txcmd_size, txcmd_align);
+ if (!trans)
+ return ERR_PTR(-ENOMEM);
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 97cb3a8d505cd..ff4c34d7b74f7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -243,7 +243,8 @@ static int iwl_pcie_gen2_set_tb(struct iwl_trans *trans,
+ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ struct sk_buff *skb,
+ struct iwl_tfh_tfd *tfd, int start_len,
+- u8 hdr_len, struct iwl_device_cmd *dev_cmd)
++ u8 hdr_len,
++ struct iwl_device_tx_cmd *dev_cmd)
+ {
+ #ifdef CONFIG_INET
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+@@ -371,7 +372,7 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ static struct
+ iwl_tfh_tfd *iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans *trans,
+ struct iwl_txq *txq,
+- struct iwl_device_cmd *dev_cmd,
++ struct iwl_device_tx_cmd *dev_cmd,
+ struct sk_buff *skb,
+ struct iwl_cmd_meta *out_meta,
+ int hdr_len,
+@@ -403,6 +404,10 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx_amsdu(struct iwl_trans *trans,
+ tb_phys = dma_map_single(trans->dev, tb1_addr, len, DMA_TO_DEVICE);
+ if (unlikely(dma_mapping_error(trans->dev, tb_phys)))
+ goto out_err;
++ /*
++ * No need for _with_wa(), we ensure (via alignment) that the data
++ * here can never cross or end at a page boundary.
++ */
+ iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, len);
+
+ if (iwl_pcie_gen2_build_amsdu(trans, skb, tfd,
+@@ -456,7 +461,7 @@ static int iwl_pcie_gen2_tx_add_frags(struct iwl_trans *trans,
+ static struct
+ iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans,
+ struct iwl_txq *txq,
+- struct iwl_device_cmd *dev_cmd,
++ struct iwl_device_tx_cmd *dev_cmd,
+ struct sk_buff *skb,
+ struct iwl_cmd_meta *out_meta,
+ int hdr_len,
+@@ -496,6 +501,10 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans,
+ tb_phys = dma_map_single(trans->dev, tb1_addr, tb1_len, DMA_TO_DEVICE);
+ if (unlikely(dma_mapping_error(trans->dev, tb_phys)))
+ goto out_err;
++ /*
++ * No need for _with_wa(), we ensure (via alignment) that the data
++ * here can never cross or end at a page boundary.
++ */
+ iwl_pcie_gen2_set_tb(trans, tfd, tb_phys, tb1_len);
+ trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), &dev_cmd->hdr,
+ IWL_FIRST_TB_SIZE + tb1_len, hdr_len);
+@@ -540,7 +549,7 @@ iwl_tfh_tfd *iwl_pcie_gen2_build_tx(struct iwl_trans *trans,
+ static
+ struct iwl_tfh_tfd *iwl_pcie_gen2_build_tfd(struct iwl_trans *trans,
+ struct iwl_txq *txq,
+- struct iwl_device_cmd *dev_cmd,
++ struct iwl_device_tx_cmd *dev_cmd,
+ struct sk_buff *skb,
+ struct iwl_cmd_meta *out_meta)
+ {
+@@ -580,7 +589,7 @@ struct iwl_tfh_tfd *iwl_pcie_gen2_build_tfd(struct iwl_trans *trans,
+ }
+
+ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+- struct iwl_device_cmd *dev_cmd, int txq_id)
++ struct iwl_device_tx_cmd *dev_cmd, int txq_id)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ struct iwl_cmd_meta *out_meta;
+@@ -605,7 +614,7 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+
+ /* don't put the packet on the ring, if there is no room */
+ if (unlikely(iwl_queue_space(trans, txq) < 3)) {
+- struct iwl_device_cmd **dev_cmd_ptr;
++ struct iwl_device_tx_cmd **dev_cmd_ptr;
+
+ dev_cmd_ptr = (void *)((u8 *)skb->cb +
+ trans_pcie->dev_cmd_offs);
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 4806a04cec8c4..d3b58334e13ea 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -213,8 +213,8 @@ static void iwl_pcie_txq_update_byte_cnt_tbl(struct iwl_trans *trans,
+ u8 sec_ctl = 0;
+ u16 len = byte_cnt + IWL_TX_CRC_SIZE + IWL_TX_DELIMITER_SIZE;
+ __le16 bc_ent;
+- struct iwl_tx_cmd *tx_cmd =
+- (void *)txq->entries[txq->write_ptr].cmd->payload;
++ struct iwl_device_tx_cmd *dev_cmd = txq->entries[txq->write_ptr].cmd;
++ struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;
+ u8 sta_id = tx_cmd->sta_id;
+
+ scd_bc_tbl = trans_pcie->scd_bc_tbls.addr;
+@@ -257,8 +257,8 @@ static void iwl_pcie_txq_inval_byte_cnt_tbl(struct iwl_trans *trans,
+ int read_ptr = txq->read_ptr;
+ u8 sta_id = 0;
+ __le16 bc_ent;
+- struct iwl_tx_cmd *tx_cmd =
+- (void *)txq->entries[read_ptr].cmd->payload;
++ struct iwl_device_tx_cmd *dev_cmd = txq->entries[read_ptr].cmd;
++ struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;
+
+ WARN_ON(read_ptr >= TFD_QUEUE_SIZE_MAX);
+
+@@ -1196,7 +1196,7 @@ void iwl_trans_pcie_reclaim(struct iwl_trans *trans, int txq_id, int ssn,
+
+ while (!skb_queue_empty(&overflow_skbs)) {
+ struct sk_buff *skb = __skb_dequeue(&overflow_skbs);
+- struct iwl_device_cmd *dev_cmd_ptr;
++ struct iwl_device_tx_cmd *dev_cmd_ptr;
+
+ dev_cmd_ptr = *(void **)((u8 *)skb->cb +
+ trans_pcie->dev_cmd_offs);
+@@ -2099,7 +2099,8 @@ static void iwl_compute_pseudo_hdr_csum(void *iph, struct tcphdr *tcph,
+ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
+ struct iwl_txq *txq, u8 hdr_len,
+ struct iwl_cmd_meta *out_meta,
+- struct iwl_device_cmd *dev_cmd, u16 tb1_len)
++ struct iwl_device_tx_cmd *dev_cmd,
++ u16 tb1_len)
+ {
+ struct iwl_tx_cmd *tx_cmd = (void *)dev_cmd->payload;
+ struct iwl_trans_pcie *trans_pcie = txq->trans_pcie;
+@@ -2281,7 +2282,8 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
+ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
+ struct iwl_txq *txq, u8 hdr_len,
+ struct iwl_cmd_meta *out_meta,
+- struct iwl_device_cmd *dev_cmd, u16 tb1_len)
++ struct iwl_device_tx_cmd *dev_cmd,
++ u16 tb1_len)
+ {
+ /* No A-MSDU without CONFIG_INET */
+ WARN_ON(1);
+@@ -2291,7 +2293,7 @@ static int iwl_fill_data_tbs_amsdu(struct iwl_trans *trans, struct sk_buff *skb,
+ #endif /* CONFIG_INET */
+
+ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
+- struct iwl_device_cmd *dev_cmd, int txq_id)
++ struct iwl_device_tx_cmd *dev_cmd, int txq_id)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+ struct ieee80211_hdr *hdr;
+@@ -2348,7 +2350,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
+
+ /* don't put the packet on the ring, if there is no room */
+ if (unlikely(iwl_queue_space(trans, txq) < 3)) {
+- struct iwl_device_cmd **dev_cmd_ptr;
++ struct iwl_device_tx_cmd **dev_cmd_ptr;
+
+ dev_cmd_ptr = (void *)((u8 *)skb->cb +
+ trans_pcie->dev_cmd_offs);
+--
+2.20.1
+
--- /dev/null
+From 55e27956e55c4775f24cfbc13b2679b8457836f6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 17:03:55 +0800
+Subject: ixgbe: Fix calculation of queue with VFs and flow director on
+ interface flap
+
+From: Cambda Zhu <cambda@linux.alibaba.com>
+
+[ Upstream commit 4fad78ad6422d9bca62135bbed8b6abc4cbb85b8 ]
+
+This patch fixes the calculation of queue when we restore flow director
+filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's
+vf may be zero which makes the queue outside of the rx_ring array.
+
+The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry().
+
+Signed-off-by: Cambda Zhu <cambda@linux.alibaba.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++++++++++++++-----
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index c6404abf2dd18..a26f9fb95ac0a 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -5239,7 +5239,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct hlist_node *node2;
+ struct ixgbe_fdir_filter *filter;
+- u64 action;
++ u8 queue;
+
+ spin_lock(&adapter->fdir_perfect_lock);
+
+@@ -5248,17 +5248,34 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+
+ hlist_for_each_entry_safe(filter, node2,
+ &adapter->fdir_filter_list, fdir_node) {
+- action = filter->action;
+- if (action != IXGBE_FDIR_DROP_QUEUE && action != 0)
+- action =
+- (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1;
++ if (filter->action == IXGBE_FDIR_DROP_QUEUE) {
++ queue = IXGBE_FDIR_DROP_QUEUE;
++ } else {
++ u32 ring = ethtool_get_flow_spec_ring(filter->action);
++ u8 vf = ethtool_get_flow_spec_ring_vf(filter->action);
++
++ if (!vf && (ring >= adapter->num_rx_queues)) {
++ e_err(drv, "FDIR restore failed without VF, ring: %u\n",
++ ring);
++ continue;
++ } else if (vf &&
++ ((vf > adapter->num_vfs) ||
++ ring >= adapter->num_rx_queues_per_pool)) {
++ e_err(drv, "FDIR restore failed with VF, vf: %hhu, ring: %u\n",
++ vf, ring);
++ continue;
++ }
++
++ /* Map the ring onto the absolute queue index */
++ if (!vf)
++ queue = adapter->rx_ring[ring]->reg_idx;
++ else
++ queue = ((vf - 1) *
++ adapter->num_rx_queues_per_pool) + ring;
++ }
+
+ ixgbe_fdir_write_perfect_filter_82599(hw,
+- &filter->filter,
+- filter->sw_idx,
+- (action == IXGBE_FDIR_DROP_QUEUE) ?
+- IXGBE_FDIR_DROP_QUEUE :
+- adapter->rx_ring[action]->reg_idx);
++ &filter->filter, filter->sw_idx, queue);
+ }
+
+ spin_unlock(&adapter->fdir_perfect_lock);
+--
+2.20.1
+
--- /dev/null
+From 75ce8d0f026c9a702593786a83b7ea3c89a26702 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 15:24:52 +0100
+Subject: ixgbevf: Remove limit of 10 entries for unicast filter list
+
+From: Radoslaw Tyl <radoslawx.tyl@intel.com>
+
+[ Upstream commit aa604651d523b1493988d0bf6710339f3ee60272 ]
+
+Currently, though the FDB entry is added to VF, it does not appear in
+RAR filters. VF driver only allows to add 10 entries. Attempting to add
+another causes an error. This patch removes limitation and allows use of
+all free RAR entries for the FDB if needed.
+
+Fixes: 46ec20ff7d ("ixgbevf: Add macvlan support in the set rx mode op")
+Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 076f2da36f278..64ec0e7c64b49 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -2081,11 +2081,6 @@ static int ixgbevf_write_uc_addr_list(struct net_device *netdev)
+ struct ixgbe_hw *hw = &adapter->hw;
+ int count = 0;
+
+- if ((netdev_uc_count(netdev)) > 10) {
+- pr_err("Too many unicast filters - No Space\n");
+- return -ENOSPC;
+- }
+-
+ if (!netdev_uc_empty(netdev)) {
+ struct netdev_hw_addr *ha;
+
+--
+2.20.1
+
--- /dev/null
+From c0e22d6ac2ecdf8ba2b85ec390f7b03f7e25a885 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 10:11:13 +0300
+Subject: l2t_seq_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 66018a102f7756cf72db4d2704e1b93969d9d332 ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+index 1a407d3c1d67c..e6fe2870137b0 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+@@ -682,8 +682,7 @@ static void *l2t_seq_start(struct seq_file *seq, loff_t *pos)
+ static void *l2t_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = l2t_get_idx(seq, *pos);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 05ab81f6048f0bfb2d87cefc7b5c3ebd70b4e519 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 11:08:32 +0100
+Subject: led: max77650: add of_match table
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit 2424415d25a765d4302ddfb4de75427e9294dc09 ]
+
+We need the of_match table if we want to use the compatible string in
+the pmic's child node and get the led driver loaded automatically.
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-max77650.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/leds/leds-max77650.c b/drivers/leds/leds-max77650.c
+index 4c2d0b3c6dadc..a0d4b725c9178 100644
+--- a/drivers/leds/leds-max77650.c
++++ b/drivers/leds/leds-max77650.c
+@@ -135,9 +135,16 @@ static int max77650_led_probe(struct platform_device *pdev)
+ return rv;
+ }
+
++static const struct of_device_id max77650_led_of_match[] = {
++ { .compatible = "maxim,max77650-led" },
++ { }
++};
++MODULE_DEVICE_TABLE(of, max77650_led_of_match);
++
+ static struct platform_driver max77650_led_driver = {
+ .driver = {
+ .name = "max77650-led",
++ .of_match_table = max77650_led_of_match,
+ },
+ .probe = max77650_led_probe,
+ };
+--
+2.20.1
+
--- /dev/null
+From f827ef878b33f1af5dd5e51caab4d255239a8c5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 16:35:22 -0800
+Subject: lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit 0e31e3573f0cd94d7b821117db854187ffc85765 ]
+
+When building ARCH=um with CONFIG_UML_X86=y and CONFIG_64BIT=y we get
+the build errors:
+
+drivers/misc/lkdtm/bugs.c: In function ‘lkdtm_UNSET_SMEP’:
+drivers/misc/lkdtm/bugs.c:288:8: error: implicit declaration of function ‘native_read_cr4’ [-Werror=implicit-function-declaration]
+ cr4 = native_read_cr4();
+ ^~~~~~~~~~~~~~~
+drivers/misc/lkdtm/bugs.c:290:13: error: ‘X86_CR4_SMEP’ undeclared (first use in this function); did you mean ‘X86_FEATURE_SMEP’?
+ if ((cr4 & X86_CR4_SMEP) != X86_CR4_SMEP) {
+ ^~~~~~~~~~~~
+ X86_FEATURE_SMEP
+drivers/misc/lkdtm/bugs.c:290:13: note: each undeclared identifier is reported only once for each function it appears in
+drivers/misc/lkdtm/bugs.c:297:2: error: implicit declaration of function ‘native_write_cr4’; did you mean ‘direct_write_cr4’? [-Werror=implicit-function-declaration]
+ native_write_cr4(cr4);
+ ^~~~~~~~~~~~~~~~
+ direct_write_cr4
+
+So specify that this block of code should only build when
+CONFIG_X86_64=y *AND* CONFIG_UML is unset.
+
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20191213003522.66450-1-brendanhiggins@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/lkdtm/bugs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c
+index 7284a22b1a09e..4d5a512769e99 100644
+--- a/drivers/misc/lkdtm/bugs.c
++++ b/drivers/misc/lkdtm/bugs.c
+@@ -274,7 +274,7 @@ void lkdtm_STACK_GUARD_PAGE_TRAILING(void)
+
+ void lkdtm_UNSET_SMEP(void)
+ {
+-#ifdef CONFIG_X86_64
++#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML)
+ #define MOV_CR4_DEPTH 64
+ void (*direct_write_cr4)(unsigned long val);
+ unsigned char *insn;
+--
+2.20.1
+
--- /dev/null
+From f744c3271b02f7ef429a25700033e4c82d2f1a7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 17:35:45 +0200
+Subject: mac80211: Fix TKIP replay protection immediately after key setup
+
+From: Jouni Malinen <j@w1.fi>
+
+[ Upstream commit 6f601265215a421f425ba3a4850a35861d024643 ]
+
+TKIP replay protection was skipped for the very first frame received
+after a new key is configured. While this is potentially needed to avoid
+dropping a frame in some cases, this does leave a window for replay
+attacks with group-addressed frames at the station side. Any earlier
+frame sent by the AP using the same key would be accepted as a valid
+frame and the internal RSC would then be updated to the TSC from that
+frame. This would allow multiple previously transmitted group-addressed
+frames to be replayed until the next valid new group-addressed frame
+from the AP is received by the station.
+
+Fix this by limiting the no-replay-protection exception to apply only
+for the case where TSC=0, i.e., when this is for the very first frame
+protected using the new key, and the local RSC had not been set to a
+higher value when configuring the key (which may happen with GTK).
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+Link: https://lore.kernel.org/r/20200107153545.10934-1-j@w1.fi
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tkip.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
+index 727dc9f3f3b3a..e7f57bb18f6e0 100644
+--- a/net/mac80211/tkip.c
++++ b/net/mac80211/tkip.c
+@@ -263,9 +263,21 @@ int ieee80211_tkip_decrypt_data(struct arc4_ctx *ctx,
+ if ((keyid >> 6) != key->conf.keyidx)
+ return TKIP_DECRYPT_INVALID_KEYIDX;
+
+- if (rx_ctx->ctx.state != TKIP_STATE_NOT_INIT &&
+- (iv32 < rx_ctx->iv32 ||
+- (iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16)))
++ /* Reject replays if the received TSC is smaller than or equal to the
++ * last received value in a valid message, but with an exception for
++ * the case where a new key has been set and no valid frame using that
++ * key has yet received and the local RSC was initialized to 0. This
++ * exception allows the very first frame sent by the transmitter to be
++ * accepted even if that transmitter were to use TSC 0 (IEEE 802.11
++ * described TSC to be initialized to 1 whenever a new key is taken into
++ * use).
++ */
++ if (iv32 < rx_ctx->iv32 ||
++ (iv32 == rx_ctx->iv32 &&
++ (iv16 < rx_ctx->iv16 ||
++ (iv16 == rx_ctx->iv16 &&
++ (rx_ctx->iv32 || rx_ctx->iv16 ||
++ rx_ctx->ctx.state != TKIP_STATE_NOT_INIT)))))
+ return TKIP_DECRYPT_REPLAY;
+
+ if (only_iv) {
+--
+2.20.1
+
--- /dev/null
+From e956e3167fb42e18a60b6124b8c1c7a2e9114b4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 19:06:44 +0100
+Subject: mac80211: mesh: restrict airtime metric to peered established plinks
+
+From: Markus Theil <markus.theil@tu-ilmenau.de>
+
+[ Upstream commit 02a614499600af836137c3fbc4404cd96365fff2 ]
+
+The following warning is triggered every time an unestablished mesh peer
+gets dumped. Checks if a peer link is established before retrieving the
+airtime link metric.
+
+[ 9563.022567] WARNING: CPU: 0 PID: 6287 at net/mac80211/mesh_hwmp.c:345
+ airtime_link_metric_get+0xa2/0xb0 [mac80211]
+[ 9563.022697] Hardware name: PC Engines apu2/apu2, BIOS v4.10.0.3
+[ 9563.022756] RIP: 0010:airtime_link_metric_get+0xa2/0xb0 [mac80211]
+[ 9563.022838] Call Trace:
+[ 9563.022897] sta_set_sinfo+0x936/0xa10 [mac80211]
+[ 9563.022964] ieee80211_dump_station+0x6d/0x90 [mac80211]
+[ 9563.023062] nl80211_dump_station+0x154/0x2a0 [cfg80211]
+[ 9563.023120] netlink_dump+0x17b/0x370
+[ 9563.023130] netlink_recvmsg+0x2a4/0x480
+[ 9563.023140] ____sys_recvmsg+0xa6/0x160
+[ 9563.023154] ___sys_recvmsg+0x93/0xe0
+[ 9563.023169] __sys_recvmsg+0x7e/0xd0
+[ 9563.023210] do_syscall_64+0x4e/0x140
+[ 9563.023217] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
+Link: https://lore.kernel.org/r/20191203180644.70653-1-markus.theil@tu-ilmenau.de
+[rewrite commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_hwmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 68af623063858..d699833703819 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -328,6 +328,9 @@ u32 airtime_link_metric_get(struct ieee80211_local *local,
+ unsigned long fail_avg =
+ ewma_mesh_fail_avg_read(&sta->mesh->fail_avg);
+
++ if (sta->mesh->plink_state != NL80211_PLINK_ESTAB)
++ return MAX_METRIC;
++
+ /* Try to get rate based on HW/SW RC algorithm.
+ * Rate is returned in units of Kbps, correct this
+ * to comply with airtime calculation units
+--
+2.20.1
+
--- /dev/null
+From cbc492b77ca6b478e47fae139ec0f06ad81fb7cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 12:33:28 -0800
+Subject: net: Fix skb->csum update in inet_proto_csum_replace16().
+
+From: Praveen Chaudhary <praveen5582@gmail.com>
+
+[ Upstream commit 189c9b1e94539b11c80636bc13e9cf47529e7bba ]
+
+skb->csum is updated incorrectly, when manipulation for
+NF_NAT_MANIP_SRC\DST is done on IPV6 packet.
+
+Fix:
+There is no need to update skb->csum in inet_proto_csum_replace16(),
+because update in two fields a.) IPv6 src/dst address and b.) L4 header
+checksum cancels each other for skb->csum calculation. Whereas
+inet_proto_csum_replace4 function needs to update skb->csum, because
+update in 3 fields a.) IPv4 src/dst address, b.) IPv4 Header checksum
+and c.) L4 header checksum results in same diff as L4 Header checksum
+for skb->csum calculation.
+
+[ pablo@netfilter.org: a few comestic documentation edits ]
+Signed-off-by: Praveen Chaudhary <pchaudhary@linkedin.com>
+Signed-off-by: Zhenggen Xu <zxu@linkedin.com>
+Signed-off-by: Andy Stracner <astracner@linkedin.com>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/utils.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/utils.c b/net/core/utils.c
+index 6b6e51db9f3b9..1f31a39236d52 100644
+--- a/net/core/utils.c
++++ b/net/core/utils.c
+@@ -438,6 +438,23 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+ }
+ EXPORT_SYMBOL(inet_proto_csum_replace4);
+
++/**
++ * inet_proto_csum_replace16 - update layer 4 header checksum field
++ * @sum: Layer 4 header checksum field
++ * @skb: sk_buff for the packet
++ * @from: old IPv6 address
++ * @to: new IPv6 address
++ * @pseudohdr: True if layer 4 header checksum includes pseudoheader
++ *
++ * Update layer 4 header as per the update in IPv6 src/dst address.
++ *
++ * There is no need to update skb->csum in this function, because update in two
++ * fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other
++ * for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to
++ * update skb->csum, because update in 3 fields a.) IPv4 src/dst address,
++ * b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as
++ * L4 Header checksum for skb->csum calculation.
++ */
+ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ const __be32 *from, const __be32 *to,
+ bool pseudohdr)
+@@ -449,9 +466,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ if (skb->ip_summed != CHECKSUM_PARTIAL) {
+ *sum = csum_fold(csum_partial(diff, sizeof(diff),
+ ~csum_unfold(*sum)));
+- if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
+- skb->csum = ~csum_partial(diff, sizeof(diff),
+- ~skb->csum);
+ } else if (pseudohdr)
+ *sum = ~csum_fold(csum_partial(diff, sizeof(diff),
+ csum_unfold(*sum)));
+--
+2.20.1
+
--- /dev/null
+From 5b86a175cad62acfd8855a30218be33f232ea494 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:15:14 +0200
+Subject: net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 457bfc0a4bf531487ecc3cf82ec728a5e114fb1e ]
+
+As the only 10G PHY interface type defined at the moment the code
+was developed was XGMII, although the PHY interface mode used was
+not XGMII, XGMII was used in the code to denote 10G. This patch
+renames the 10G interface mode to remove the ambiguity.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_memac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index 41c6fa200e746..e1901874c19f0 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -110,7 +110,7 @@ do { \
+ /* Interface Mode Register (IF_MODE) */
+
+ #define IF_MODE_MASK 0x00000003 /* 30-31 Mask on i/f mode bits */
+-#define IF_MODE_XGMII 0x00000000 /* 30-31 XGMII (10G) interface */
++#define IF_MODE_10G 0x00000000 /* 30-31 10G interface */
+ #define IF_MODE_GMII 0x00000002 /* 30-31 GMII (1G) interface */
+ #define IF_MODE_RGMII 0x00000004
+ #define IF_MODE_RGMII_AUTO 0x00008000
+@@ -440,7 +440,7 @@ static int init(struct memac_regs __iomem *regs, struct memac_cfg *cfg,
+ tmp = 0;
+ switch (phy_if) {
+ case PHY_INTERFACE_MODE_XGMII:
+- tmp |= IF_MODE_XGMII;
++ tmp |= IF_MODE_10G;
+ break;
+ default:
+ tmp |= IF_MODE_GMII;
+--
+2.20.1
+
--- /dev/null
+From 7177055df9159b8bc0a94122d9ef8820e594a8f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:20:29 +0200
+Subject: net/fsl: treat fsl,erratum-a011043
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 1d3ca681b9d9575ccf696ebc2840a1ebb1fd4074 ]
+
+When fsl,erratum-a011043 is set, adjust for erratum A011043:
+MDIO reads to internal PCS registers may result in having
+the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no
+error and read data (MDIO_DATA[MDIO_DATA]) is correct.
+Software may get false read error when reading internal
+PCS registers through MDIO. As a workaround, all internal
+MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/xgmac_mdio.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/xgmac_mdio.c b/drivers/net/ethernet/freescale/xgmac_mdio.c
+index e03b30c60dcfd..c82c85ef5fb34 100644
+--- a/drivers/net/ethernet/freescale/xgmac_mdio.c
++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c
+@@ -49,6 +49,7 @@ struct tgec_mdio_controller {
+ struct mdio_fsl_priv {
+ struct tgec_mdio_controller __iomem *mdio_base;
+ bool is_little_endian;
++ bool has_a011043;
+ };
+
+ static u32 xgmac_read32(void __iomem *regs,
+@@ -226,7 +227,8 @@ static int xgmac_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
+ return ret;
+
+ /* Return all Fs if nothing was there */
+- if (xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) {
++ if ((xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) &&
++ !priv->has_a011043) {
+ dev_err(&bus->dev,
+ "Error while reading PHY%d reg at %d.%hhu\n",
+ phy_id, dev_addr, regnum);
+@@ -274,6 +276,9 @@ static int xgmac_mdio_probe(struct platform_device *pdev)
+ priv->is_little_endian = of_property_read_bool(pdev->dev.of_node,
+ "little-endian");
+
++ priv->has_a011043 = of_property_read_bool(pdev->dev.of_node,
++ "fsl,erratum-a011043");
++
+ ret = of_mdiobus_register(bus, np);
+ if (ret) {
+ dev_err(&pdev->dev, "cannot register MDIO bus\n");
+--
+2.20.1
+
--- /dev/null
+From f1b1a49721338e93218f17187bcba79f845c3613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2020 13:10:50 +0100
+Subject: netfilter: conntrack: sctp: use distinct states for new SCTP
+ connections
+
+From: Jiri Wiesner <jwiesner@suse.com>
+
+[ Upstream commit ab658b9fa7a2c467f79eac8b53ea308b8f98113d ]
+
+The netlink notifications triggered by the INIT and INIT_ACK chunks
+for a tracked SCTP association do not include protocol information
+for the corresponding connection - SCTP state and verification tags
+for the original and reply direction are missing. Since the connection
+tracking implementation allows user space programs to receive
+notifications about a connection and then create a new connection
+based on the values received in a notification, it makes sense that
+INIT and INIT_ACK notifications should contain the SCTP state
+and verification tags available at the time when a notification
+is sent. The missing verification tags cause a newly created
+netfilter connection to fail to verify the tags of SCTP packets
+when this connection has been created from the values previously
+received in an INIT or INIT_ACK notification.
+
+A PROTOINFO event is cached in sctp_packet() when the state
+of a connection changes. The CLOSED and COOKIE_WAIT state will
+be used for connections that have seen an INIT and INIT_ACK chunk,
+respectively. The distinct states will cause a connection state
+change in sctp_packet().
+
+Signed-off-by: Jiri Wiesner <jwiesner@suse.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_proto_sctp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c
+index 0399ae8f1188f..4f897b14b6069 100644
+--- a/net/netfilter/nf_conntrack_proto_sctp.c
++++ b/net/netfilter/nf_conntrack_proto_sctp.c
+@@ -114,7 +114,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
+ {
+ /* ORIGINAL */
+ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
+-/* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA},
++/* init */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA},
+ /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA},
+ /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL},
+ /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
+@@ -130,7 +130,7 @@ static const u8 sctp_conntracks[2][11][SCTP_CONNTRACK_MAX] = {
+ /* REPLY */
+ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */
+ /* init */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},/* INIT in sCL Big TODO */
+-/* init_ack */ {sIV, sCL, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},
++/* init_ack */ {sIV, sCW, sCW, sCE, sES, sSS, sSR, sSA, sIV, sHA},
+ /* abort */ {sIV, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sIV, sCL},
+ /* shutdown */ {sIV, sCL, sCW, sCE, sSR, sSS, sSR, sSA, sIV, sSR},
+ /* shutdown_ack */ {sIV, sCL, sCW, sCE, sES, sSA, sSA, sSA, sIV, sHA},
+@@ -316,7 +316,7 @@ sctp_new(struct nf_conn *ct, const struct sk_buff *skb,
+ ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = sh->vtag;
+ }
+
+- ct->proto.sctp.state = new_state;
++ ct->proto.sctp.state = SCTP_CONNTRACK_NONE;
+ }
+
+ return true;
+--
+2.20.1
+
--- /dev/null
+From 921c0de8af083f0e728f5c4d7540b0994e81583c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jan 2020 13:18:30 +0800
+Subject: netfilter: nf_tables_offload: fix check the chain offload flag
+
+From: wenxu <wenxu@ucloud.cn>
+
+[ Upstream commit c83de17dd6308fb74696923e5245de0e3c427206 ]
+
+In the nft_indr_block_cb the chain should check the flag with
+NFT_CHAIN_HW_OFFLOAD.
+
+Fixes: 9a32669fecfb ("netfilter: nf_tables_offload: support indr block call")
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
+index 96a64e7594a51..914cd0618d5a6 100644
+--- a/net/netfilter/nf_tables_offload.c
++++ b/net/netfilter/nf_tables_offload.c
+@@ -437,7 +437,7 @@ static void nft_indr_block_cb(struct net_device *dev,
+
+ mutex_lock(&net->nft.commit_mutex);
+ chain = __nft_offload_get_chain(dev);
+- if (chain) {
++ if (chain && chain->flags & NFT_CHAIN_HW_OFFLOAD) {
+ struct nft_base_chain *basechain;
+
+ basechain = nft_base_chain(chain);
+--
+2.20.1
+
--- /dev/null
+From a2d9d80bc9a13b82f2ff4c92e0ab8991296c9d70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 17:39:25 +0100
+Subject: parisc: Use proper printk format for resource_size_t
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 4f80b70e1953cb846dbdd1ce72cb17333d4c8d11 ]
+
+resource_size_t should be printed with its own size-independent format
+to fix warnings when compiling on 64-bit platform (e.g. with
+COMPILE_TEST):
+
+ arch/parisc/kernel/drivers.c: In function 'print_parisc_device':
+ arch/parisc/kernel/drivers.c:892:9: warning:
+ format '%p' expects argument of type 'void *',
+ but argument 4 has type 'resource_size_t {aka unsigned int}' [-Wformat=]
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/drivers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index a6c9f49c66128..a5f3e50fe9761 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -889,8 +889,8 @@ static void print_parisc_device(struct parisc_device *dev)
+ static int count;
+
+ print_pa_hwpath(dev, hw_path);
+- pr_info("%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
+- ++count, dev->name, (void*) dev->hpa.start, hw_path, dev->id.hw_type,
++ pr_info("%d. %s at %pap [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
++ ++count, dev->name, &(dev->hpa.start), hw_path, dev->id.hw_type,
+ dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);
+
+ if (dev->num_addrs) {
+--
+2.20.1
+
--- /dev/null
+From 2376a1030173db5c9eecc1ab29c50615cdcfadd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 12:15:11 -0800
+Subject: perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit e74383045119fb8055cf31cb39e0fe951d67163a ]
+
+The IMC uncore support is missed for E3-1585 v5 CPU.
+
+Intel Xeon E3 V5 Family has Sky Lake CPU.
+Add the PCI ID of IMC for Intel Xeon E3 V5 Family.
+
+Reported-by: Rosales-fernandez, Carlos <carlos.rosales-fernandez@intel.com>
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Rosales-fernandez, Carlos <carlos.rosales-fernandez@intel.com>
+Link: https://lkml.kernel.org/r/1578687311-158748-1-git-send-email-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/uncore_snb.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
+index dbaa1b088a30e..c37cb12d0ef68 100644
+--- a/arch/x86/events/intel/uncore_snb.c
++++ b/arch/x86/events/intel/uncore_snb.c
+@@ -15,6 +15,7 @@
+ #define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910
+ #define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f
+ #define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f
++#define PCI_DEVICE_ID_INTEL_SKL_E3_IMC 0x1918
+ #define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c
+ #define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904
+ #define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914
+@@ -657,6 +658,10 @@ static const struct pci_device_id skl_uncore_pci_ids[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC),
+ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+ },
++ { /* IMC */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_E3_IMC),
++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
++ },
+ { /* IMC */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC),
+ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0),
+@@ -826,6 +831,7 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {
+ IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core H Quad Core */
+ IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Dual Core */
+ IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Quad Core */
++ IMC_DEV(SKL_E3_IMC, &skl_uncore_pci_driver), /* Xeon E3 V5 Gen Core processor */
+ IMC_DEV(KBL_Y_IMC, &skl_uncore_pci_driver), /* 7th Gen Core Y */
+ IMC_DEV(KBL_U_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U */
+ IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U Quad Core */
+--
+2.20.1
+
--- /dev/null
+From d5279d576d545727cdb62f5bf89d7985fd1d816f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 12:02:10 -0800
+Subject: perf/x86/intel/uncore: Remove PCIe3 unit for SNR
+
+From: Kan Liang <kan.liang@linux.intel.com>
+
+[ Upstream commit 2167f1625c2f04a33145f325db0de285630f7bd1 ]
+
+The PCIe Root Port driver for CPU Complex PCIe Root Ports are not
+loaded on SNR.
+
+The device ID for SNR PCIe3 unit is used by both uncore driver and the
+PCIe Root Port driver. If uncore driver is loaded, the PCIe Root Port
+driver never be probed.
+
+Remove the PCIe3 unit for SNR for now. The support for PCIe3 unit will
+be added later separately.
+
+Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lkml.kernel.org/r/20200116200210.18937-2-kan.liang@linux.intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/intel/uncore_snbep.c | 24 ------------------------
+ 1 file changed, 24 deletions(-)
+
+diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c
+index 011644802ce78..ad20220af303a 100644
+--- a/arch/x86/events/intel/uncore_snbep.c
++++ b/arch/x86/events/intel/uncore_snbep.c
+@@ -369,11 +369,6 @@
+ #define SNR_M2M_PCI_PMON_BOX_CTL 0x438
+ #define SNR_M2M_PCI_PMON_UMASK_EXT 0xff
+
+-/* SNR PCIE3 */
+-#define SNR_PCIE3_PCI_PMON_CTL0 0x508
+-#define SNR_PCIE3_PCI_PMON_CTR0 0x4e8
+-#define SNR_PCIE3_PCI_PMON_BOX_CTL 0x4e4
+-
+ /* SNR IMC */
+ #define SNR_IMC_MMIO_PMON_FIXED_CTL 0x54
+ #define SNR_IMC_MMIO_PMON_FIXED_CTR 0x38
+@@ -4328,27 +4323,12 @@ static struct intel_uncore_type snr_uncore_m2m = {
+ .format_group = &snr_m2m_uncore_format_group,
+ };
+
+-static struct intel_uncore_type snr_uncore_pcie3 = {
+- .name = "pcie3",
+- .num_counters = 4,
+- .num_boxes = 1,
+- .perf_ctr_bits = 48,
+- .perf_ctr = SNR_PCIE3_PCI_PMON_CTR0,
+- .event_ctl = SNR_PCIE3_PCI_PMON_CTL0,
+- .event_mask = SNBEP_PMON_RAW_EVENT_MASK,
+- .box_ctl = SNR_PCIE3_PCI_PMON_BOX_CTL,
+- .ops = &ivbep_uncore_pci_ops,
+- .format_group = &ivbep_uncore_format_group,
+-};
+-
+ enum {
+ SNR_PCI_UNCORE_M2M,
+- SNR_PCI_UNCORE_PCIE3,
+ };
+
+ static struct intel_uncore_type *snr_pci_uncores[] = {
+ [SNR_PCI_UNCORE_M2M] = &snr_uncore_m2m,
+- [SNR_PCI_UNCORE_PCIE3] = &snr_uncore_pcie3,
+ NULL,
+ };
+
+@@ -4357,10 +4337,6 @@ static const struct pci_device_id snr_uncore_pci_ids[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x344a),
+ .driver_data = UNCORE_PCI_DEV_FULL_DATA(12, 0, SNR_PCI_UNCORE_M2M, 0),
+ },
+- { /* PCIe3 */
+- PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x334a),
+- .driver_data = UNCORE_PCI_DEV_FULL_DATA(4, 0, SNR_PCI_UNCORE_PCIE3, 0),
+- },
+ { /* end: all zeroes */ }
+ };
+
+--
+2.20.1
+
--- /dev/null
+From a77c698678e76d1c29612bb0715bd7b897c78204 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 15:42:19 +0100
+Subject: platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature
+ limits
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1f27dbd8265dbb379926c8f6a4453fe7fe26d7a3 ]
+
+Allow the user to configure the fan to turn on / speed-up at lower
+thresholds then before (20 degrees Celcius as minimum instead of 40) and
+likewise also allow the user to delay the fan speeding-up till the
+temperature hits 90 degrees Celcius (was 70).
+
+Cc: Jason Anderson <jasona.594@gmail.com>
+Reported-by: Jason Anderson <jasona.594@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gpd-pocket-fan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/gpd-pocket-fan.c b/drivers/platform/x86/gpd-pocket-fan.c
+index 73eb1572b9662..b471b86c28fe8 100644
+--- a/drivers/platform/x86/gpd-pocket-fan.c
++++ b/drivers/platform/x86/gpd-pocket-fan.c
+@@ -127,7 +127,7 @@ static int gpd_pocket_fan_probe(struct platform_device *pdev)
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(temp_limits); i++) {
+- if (temp_limits[i] < 40000 || temp_limits[i] > 70000) {
++ if (temp_limits[i] < 20000 || temp_limits[i] > 90000) {
+ dev_err(&pdev->dev, "Invalid temp-limit %d (must be between 40000 and 70000)\n",
+ temp_limits[i]);
+ temp_limits[0] = TEMP_LIMIT0_DEFAULT;
+--
+2.20.1
+
--- /dev/null
+From d961bf429cd1b47a37ce7a41c8a01d447739a8e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 17:57:00 +0800
+Subject: platform/x86: intel_pmc_core: update Comet Lake platform driver
+
+From: Harry Pan <harry.pan@intel.com>
+
+[ Upstream commit 515ff674bb9bf06186052e352c4587dab8defaf0 ]
+
+Adding new CML CPU model ID into platform driver support list.
+
+Signed-off-by: Harry Pan <harry.pan@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_pmc_core_pltdrv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/intel_pmc_core_pltdrv.c b/drivers/platform/x86/intel_pmc_core_pltdrv.c
+index 6fe829f30997d..e1266f5c63593 100644
+--- a/drivers/platform/x86/intel_pmc_core_pltdrv.c
++++ b/drivers/platform/x86/intel_pmc_core_pltdrv.c
+@@ -44,6 +44,8 @@ static const struct x86_cpu_id intel_pmc_core_platform_ids[] = {
+ INTEL_CPU_FAM6(KABYLAKE, pmc_core_device),
+ INTEL_CPU_FAM6(CANNONLAKE_L, pmc_core_device),
+ INTEL_CPU_FAM6(ICELAKE_L, pmc_core_device),
++ INTEL_CPU_FAM6(COMETLAKE, pmc_core_device),
++ INTEL_CPU_FAM6(COMETLAKE_L, pmc_core_device),
+ {}
+ };
+ MODULE_DEVICE_TABLE(x86cpu, intel_pmc_core_platform_ids);
+--
+2.20.1
+
--- /dev/null
+From a069de141df0584f79b8b4c26e912d3ac4fb16ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:20:28 +0200
+Subject: powerpc/fsl/dts: add fsl,erratum-a011043
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 73d527aef68f7644e59f22ce7f9ac75e7b533aea ]
+
+Add fsl,erratum-a011043 to internal MDIO buses.
+Software may get false read error when reading internal
+PCS registers through MDIO. As a workaround, all internal
+MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi | 1 +
+ 18 files changed, 18 insertions(+)
+
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+index e1a961f05dcd5..baa0c503e741b 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+index c288f3c6c6378..93095600e8086 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy6: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+index 94f3e71750124..ff4bd38f06459 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+index 94a76982d214b..1fa38ed6f59e2 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy7: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+index b5ff5f71c6b8b..a8cc9780c0c42 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+index ee44182c63485..8b8bd70c93823 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+index f05f0d775039b..619c880b54d8d 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy2: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+index a9114ec510759..d7ebb73a400d0 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy3: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+index 44dd00ac7367f..b151d696a0699 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy4: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+index 5b1b84b58602f..adc0ae0013a3c 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy5: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+index 0e1daaef9e74b..435047e0e250e 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy14: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+index 68c5ef779266a..c098657cca0a7 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy15: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+index 605363cc1117f..9d06824815f34 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy8: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+index 1955dfa136348..70e947730c4ba 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy9: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+index 2c1476454ee01..ad96e65295959 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy10: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+index b8b541ff5fb03..034bc4b71f7a5 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy11: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+index 4b2cfddd1b155..93ca23d82b39b 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy12: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+index 0a52ddf7cc171..23b3117a2fd2a 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy13: ethernet-phy@0 {
+ reg = <0x0>;
+--
+2.20.1
+
--- /dev/null
+From 8f07ddb5b1bebc69ff866c4909e78949105dc146 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 01:43:38 -0800
+Subject: qlcnic: Fix CPU soft lockup while collecting firmware dump
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 22e984493a41bf8081f13d9ed84def3ca8cfd427 ]
+
+Driver while collecting firmware dump takes longer time to
+collect/process some of the firmware dump entries/memories.
+Bigger capture masks makes it worse as it results in larger
+amount of data being collected and results in CPU soft lockup.
+Place cond_resched() in some of the driver flows that are
+expectedly time consuming to relinquish the CPU to avoid CPU
+soft lockup panic.
+
+Signed-off-by: Shahed Shaikh <shshaikh@marvell.com>
+Tested-by: Yonggen Xu <Yonggen.Xu@dell.com>
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 +
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+index a496390b8632f..07f9067affc65 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2043,6 +2043,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
+ break;
+ }
+ entry += p_hdr->size;
++ cond_resched();
+ }
+ p_dev->ahw->reset.seq_index = index;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+index afa10a163da1f..f34ae8c75bc5e 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+@@ -703,6 +703,7 @@ static u32 qlcnic_read_memory_test_agent(struct qlcnic_adapter *adapter,
+ addr += 16;
+ reg_read -= 16;
+ ret += 16;
++ cond_resched();
+ }
+ out:
+ mutex_unlock(&adapter->ahw->mem_lock);
+@@ -1383,6 +1384,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter)
+ buf_offset += entry->hdr.cap_size;
+ entry_offset += entry->hdr.offset;
+ buffer = fw_dump->data + buf_offset;
++ cond_resched();
+ }
+
+ fw_dump->clr = 1;
+--
+2.20.1
+
--- /dev/null
+From 62aebfc7430bb837bcf502c5aeb5f523c7c59799 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 14:57:40 +0100
+Subject: qmi_wwan: Add support for Quectel RM500Q
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kristian Evensen <kristian.evensen@gmail.com>
+
+[ Upstream commit a9ff44f0e61d074f29770413fef6a5452be7b83e ]
+
+RM500Q is a 5G module from Quectel, supporting both standalone and
+non-standalone modes. The normal Quectel quirks apply (DTR and dynamic
+interface numbers).
+
+Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 4196c0e327403..9485c8d1de8a3 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1062,6 +1062,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+--
+2.20.1
+
--- /dev/null
+From c8e6848097b62a3ab18a895d00e0e8184595560b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:12 +0800
+Subject: r8152: avoid the MCU to clear the lanwake
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 19813162895a696c5814d76e5f8fb6203d70f6e0 ]
+
+Avoid the MCU to clear the lanwake after suspending. It may cause the
+WOL fail. Disable LANWAKE_CLR_EN before suspending. Besides,enable it
+and reset the lanwake status when resuming or initializing.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 1f61859baa531..5f59affa94d0c 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -63,6 +63,7 @@
+ #define PLA_LED_FEATURE 0xdd92
+ #define PLA_PHYAR 0xde00
+ #define PLA_BOOT_CTRL 0xe004
++#define PLA_LWAKE_CTRL_REG 0xe007
+ #define PLA_GPHY_INTR_IMR 0xe022
+ #define PLA_EEE_CR 0xe040
+ #define PLA_EEEP_CR 0xe080
+@@ -90,6 +91,7 @@
+ #define PLA_TALLYCNT 0xe890
+ #define PLA_SFF_STS_7 0xe8de
+ #define PLA_PHYSTATUS 0xe908
++#define PLA_CONFIG6 0xe90a /* CONFIG6 */
+ #define PLA_BP_BA 0xfc26
+ #define PLA_BP_0 0xfc28
+ #define PLA_BP_1 0xfc2a
+@@ -286,6 +288,9 @@
+ #define LINK_ON_WAKE_EN 0x0010
+ #define LINK_OFF_WAKE_EN 0x0008
+
++/* PLA_CONFIG6 */
++#define LANWAKE_CLR_EN BIT(0)
++
+ /* PLA_CONFIG5 */
+ #define BWF_EN 0x0040
+ #define MWF_EN 0x0020
+@@ -342,6 +347,9 @@
+ /* PLA_BOOT_CTRL */
+ #define AUTOLOAD_DONE 0x0002
+
++/* PLA_LWAKE_CTRL_REG */
++#define LANWAKE_PIN BIT(7)
++
+ /* PLA_SUSPEND_FLAG */
+ #define LINK_CHG_EVENT BIT(0)
+
+@@ -4004,6 +4012,8 @@ static void rtl8152_down(struct r8152 *tp)
+
+ static void rtl8153_up(struct r8152 *tp)
+ {
++ u32 ocp_data;
++
+ if (test_bit(RTL8152_UNPLUG, &tp->flags))
+ return;
+
+@@ -4011,6 +4021,15 @@ static void rtl8153_up(struct r8152 *tp)
+ r8153_u2p3en(tp, false);
+ r8153_aldps_en(tp, false);
+ r8153_first_init(tp);
++
++ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
++ ocp_data |= LANWAKE_CLR_EN;
++ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6, ocp_data);
++
++ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG);
++ ocp_data &= ~LANWAKE_PIN;
++ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG, ocp_data);
++
+ r8153_aldps_en(tp, true);
+
+ switch (tp->version) {
+@@ -4029,11 +4048,17 @@ static void rtl8153_up(struct r8152 *tp)
+
+ static void rtl8153_down(struct r8152 *tp)
+ {
++ u32 ocp_data;
++
+ if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+
++ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
++ ocp_data &= ~LANWAKE_CLR_EN;
++ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6, ocp_data);
++
+ r8153_u1u2en(tp, false);
+ r8153_u2p3en(tp, false);
+ r8153_power_cut_en(tp, false);
+@@ -4465,6 +4490,14 @@ static void r8153_init(struct r8152 *tp)
+ r8153_mac_clk_spd(tp, false);
+ usb_enable_lpm(tp->udev);
+
++ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6);
++ ocp_data |= LANWAKE_CLR_EN;
++ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6, ocp_data);
++
++ ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG);
++ ocp_data &= ~LANWAKE_PIN;
++ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG, ocp_data);
++
+ /* rx aggregation */
+ ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
+ ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
+--
+2.20.1
+
--- /dev/null
+From 4dd4f812ddd67ffcc85a93f5e4bc4e68a6f8d64c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:13 +0800
+Subject: r8152: disable DelayPhyPwrChg
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit aa475d935272481c9ffb1ae54eeca5c1819fbe1a ]
+
+When enabling this, the device would wait an internal signal which
+wouldn't be triggered. Then, the device couldn't enter P3 mode, so
+the power consumption is increased.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 5f59affa94d0c..6912624eed4ad 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -29,7 +29,7 @@
+ #define NETNEXT_VERSION "10"
+
+ /* Information for net */
+-#define NET_VERSION "10"
++#define NET_VERSION "11"
+
+ #define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION
+ #define DRIVER_AUTHOR "Realtek linux nic maintainers <nic_swsd@realtek.com>"
+@@ -104,6 +104,7 @@
+ #define PLA_BP_EN 0xfc38
+
+ #define USB_USB2PHY 0xb41e
++#define USB_SSPHYLINK1 0xb426
+ #define USB_SSPHYLINK2 0xb428
+ #define USB_U2P3_CTRL 0xb460
+ #define USB_CSR_DUMMY1 0xb464
+@@ -363,6 +364,9 @@
+ #define USB2PHY_SUSPEND 0x0001
+ #define USB2PHY_L1 0x0002
+
++/* USB_SSPHYLINK1 */
++#define DELAY_PHY_PWR_CHG BIT(1)
++
+ /* USB_SSPHYLINK2 */
+ #define pwd_dn_scale_mask 0x3ffe
+ #define pwd_dn_scale(x) ((x) << 1)
+@@ -4030,6 +4034,10 @@ static void rtl8153_up(struct r8152 *tp)
+ ocp_data &= ~LANWAKE_PIN;
+ ocp_write_byte(tp, MCU_TYPE_PLA, PLA_LWAKE_CTRL_REG, ocp_data);
+
++ ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_SSPHYLINK1);
++ ocp_data &= ~DELAY_PHY_PWR_CHG;
++ ocp_write_word(tp, MCU_TYPE_USB, USB_SSPHYLINK1, ocp_data);
++
+ r8153_aldps_en(tp, true);
+
+ switch (tp->version) {
+--
+2.20.1
+
--- /dev/null
+From 0213b5a341159bab9e1e9b2a9aa496edd6d27384 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:09 +0800
+Subject: r8152: Disable PLA MCU clock speed down
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 08997b5eec08a2c29367f19a74abdea54b299406 ]
+
+PLA MCU clock speed down could only be enabled when tx/rx are disabled.
+Otherwise, the packet loss may occur.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index debab2c27f638..2d3374a373f83 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -310,6 +310,7 @@
+ #define MAC_CLK_SPDWN_EN BIT(15)
+
+ /* PLA_MAC_PWR_CTRL3 */
++#define PLA_MCU_SPDWN_EN BIT(14)
+ #define PKT_AVAIL_SPDWN_EN 0x0100
+ #define SUSPEND_SPDWN_EN 0x0004
+ #define U1U2_SPDWN_EN 0x0002
+@@ -4042,6 +4043,8 @@ static void rtl8153_down(struct r8152 *tp)
+
+ static void rtl8153b_up(struct r8152 *tp)
+ {
++ u32 ocp_data;
++
+ if (test_bit(RTL8152_UNPLUG, &tp->flags))
+ return;
+
+@@ -4052,17 +4055,27 @@ static void rtl8153b_up(struct r8152 *tp)
+ r8153_first_init(tp);
+ ocp_write_dword(tp, MCU_TYPE_USB, USB_RX_BUF_TH, RX_THR_B);
+
++ ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3);
++ ocp_data &= ~PLA_MCU_SPDWN_EN;
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
++
+ r8153_aldps_en(tp, true);
+ r8153b_u1u2en(tp, true);
+ }
+
+ static void rtl8153b_down(struct r8152 *tp)
+ {
++ u32 ocp_data;
++
+ if (test_bit(RTL8152_UNPLUG, &tp->flags)) {
+ rtl_drop_queued_tx(tp);
+ return;
+ }
+
++ ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3);
++ ocp_data |= PLA_MCU_SPDWN_EN;
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
++
+ r8153b_u1u2en(tp, false);
+ r8153_u2p3en(tp, false);
+ r8153b_power_cut_en(tp, false);
+@@ -4523,6 +4536,10 @@ static void r8153b_init(struct r8152 *tp)
+ ocp_data |= MAC_CLK_SPDWN_EN;
+ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, ocp_data);
+
++ ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3);
++ ocp_data &= ~PLA_MCU_SPDWN_EN;
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
++
+ set_bit(GREEN_ETHERNET, &tp->flags);
+
+ /* rx aggregation */
+--
+2.20.1
+
--- /dev/null
+From f2c00be1cba4f35863785910d6463626775fb1b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:10 +0800
+Subject: r8152: disable test IO for RTL8153B
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit d7f1b59655efb5a285d227c8f9853a98eab5c2fd ]
+
+For RTL8153B with QFN32, disable test IO. Otherwise, it may cause
+abnormal behavior for the device randomly.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 2d3374a373f83..1f61859baa531 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -298,6 +298,7 @@
+ /* PLA_PHY_PWR */
+ #define TX_10M_IDLE_EN 0x0080
+ #define PFM_PWM_SWITCH 0x0040
++#define TEST_IO_OFF BIT(4)
+
+ /* PLA_MAC_PWR_CTRL */
+ #define D3_CLK_GATED_EN 0x00004000
+@@ -4540,6 +4541,15 @@ static void r8153b_init(struct r8152 *tp)
+ ocp_data &= ~PLA_MCU_SPDWN_EN;
+ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, ocp_data);
+
++ if (tp->version == RTL_VER_09) {
++ /* Disable Test IO for 32QFN */
++ if (ocp_read_byte(tp, MCU_TYPE_PLA, 0xdc00) & BIT(5)) {
++ ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_PHY_PWR);
++ ocp_data |= TEST_IO_OFF;
++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_PHY_PWR, ocp_data);
++ }
++ }
++
+ set_bit(GREEN_ETHERNET, &tp->flags);
+
+ /* rx aggregation */
+--
+2.20.1
+
--- /dev/null
+From 2fca891ed262c348f914cd40a9944e64f9fc805a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:08 +0800
+Subject: r8152: disable U2P3 for RTL8153B
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 809a7fc6593f288d6f820ef6cc57b9d69b5f9474 ]
+
+Enable U2P3 may miss zero packet for bulk-in.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index df993a1c60c0e..debab2c27f638 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -3175,7 +3175,6 @@ static void rtl8153b_runtime_enable(struct r8152 *tp, bool enable)
+ r8153b_ups_en(tp, false);
+ r8153_queue_wake(tp, false);
+ rtl_runtime_suspend_enable(tp, false);
+- r8153_u2p3en(tp, true);
+ r8153b_u1u2en(tp, true);
+ }
+ }
+@@ -3703,7 +3702,6 @@ static void r8153b_hw_phy_cfg(struct r8152 *tp)
+
+ r8153_aldps_en(tp, true);
+ r8152b_enable_fc(tp);
+- r8153_u2p3en(tp, true);
+
+ set_bit(PHY_RESET, &tp->flags);
+ }
+@@ -4055,7 +4053,6 @@ static void rtl8153b_up(struct r8152 *tp)
+ ocp_write_dword(tp, MCU_TYPE_USB, USB_RX_BUF_TH, RX_THR_B);
+
+ r8153_aldps_en(tp, true);
+- r8153_u2p3en(tp, true);
+ r8153b_u1u2en(tp, true);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 42776b9c2f1aecbdf180dd4797e40ffe2d23b8a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:07 +0800
+Subject: r8152: get default setting of WOL before initializing
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 9583a3638dc07cc1878f41265e85ed497f72efcb ]
+
+Initailization would reset runtime suspend by tp->saved_wolopts, so
+the tp->saved_wolopts should be set before initializing.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 9e4b7a4002843..df993a1c60c0e 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5690,6 +5690,11 @@ static int rtl8152_probe(struct usb_interface *intf,
+
+ intf->needs_remote_wakeup = 1;
+
++ if (!rtl_can_wakeup(tp))
++ __rtl_set_wol(tp, 0);
++ else
++ tp->saved_wolopts = __rtl_get_wol(tp);
++
+ tp->rtl_ops.init(tp);
+ queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+ set_ethernet_addr(tp);
+@@ -5703,10 +5708,6 @@ static int rtl8152_probe(struct usb_interface *intf,
+ goto out1;
+ }
+
+- if (!rtl_can_wakeup(tp))
+- __rtl_set_wol(tp, 0);
+-
+- tp->saved_wolopts = __rtl_get_wol(tp);
+ if (tp->saved_wolopts)
+ device_set_wakeup_enable(&udev->dev, true);
+ else
+--
+2.20.1
+
--- /dev/null
+From 6599c27ec62d62bb5a63ab07243e64d860aa3919 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 13:32:42 +0200
+Subject: riscv: delete temporary files
+
+From: Ilie Halip <ilie.halip@gmail.com>
+
+[ Upstream commit 95f4d9cced96afa9c69b3da8e79e96102c84fc60 ]
+
+Temporary files used in the VDSO build process linger on even after make
+mrproper: vdso-dummy.o.tmp, vdso.so.dbg.tmp.
+
+Delete them once they're no longer needed.
+
+Signed-off-by: Ilie Halip <ilie.halip@gmail.com>
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/vdso/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index 49a5852fd07dd..33b16f4212f7a 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -58,7 +58,8 @@ quiet_cmd_vdsold = VDSOLD $@
+ cmd_vdsold = $(CC) $(KBUILD_CFLAGS) $(call cc-option, -no-pie) -nostdlib -nostartfiles $(SYSCFLAGS_$(@F)) \
+ -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp && \
+ $(CROSS_COMPILE)objcopy \
+- $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
++ $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@ && \
++ rm $@.tmp
+
+ # install commands for the unstripped file
+ quiet_cmd_vdso_install = INSTALL $@
+--
+2.20.1
+
--- /dev/null
+From 392017f99aaac824c9abf613ff54500e822edd43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 20:06:31 -0800
+Subject: riscv: Less inefficient gcc tishift helpers (and export their
+ symbols)
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit fc585d4a5cf614727f64d86550b794bcad29d5c3 ]
+
+The existing __lshrti3 was really inefficient, and the other two helpers
+are also needed to compile some modules.
+
+Add the missing versions, and export all of the symbols like arm64
+already does.
+
+This code is based on the assembly generated by libgcc builds.
+
+This fixes a build break triggered by ubsan:
+
+riscv64-unknown-linux-gnu-ld: lib/ubsan.o: in function `.L2':
+ubsan.c:(.text.unlikely+0x38): undefined reference to `__ashlti3'
+riscv64-unknown-linux-gnu-ld: ubsan.c:(.text.unlikely+0x42): undefined reference to `__ashrti3'
+
+Signed-off-by: Olof Johansson <olof@lixom.net>
+[paul.walmsley@sifive.com: use SYM_FUNC_{START,END} instead of
+ ENTRY/ENDPROC; note libgcc origin]
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/asm-prototypes.h | 4 ++
+ arch/riscv/lib/tishift.S | 75 +++++++++++++++++++------
+ 2 files changed, 61 insertions(+), 18 deletions(-)
+
+diff --git a/arch/riscv/include/asm/asm-prototypes.h b/arch/riscv/include/asm/asm-prototypes.h
+index c9fecd120d187..8ae9708a8eee8 100644
+--- a/arch/riscv/include/asm/asm-prototypes.h
++++ b/arch/riscv/include/asm/asm-prototypes.h
+@@ -4,4 +4,8 @@
+ #include <linux/ftrace.h>
+ #include <asm-generic/asm-prototypes.h>
+
++long long __lshrti3(long long a, int b);
++long long __ashrti3(long long a, int b);
++long long __ashlti3(long long a, int b);
++
+ #endif /* _ASM_RISCV_PROTOTYPES_H */
+diff --git a/arch/riscv/lib/tishift.S b/arch/riscv/lib/tishift.S
+index 15f9d54c7db63..ef90075c4b0a9 100644
+--- a/arch/riscv/lib/tishift.S
++++ b/arch/riscv/lib/tishift.S
+@@ -4,34 +4,73 @@
+ */
+
+ #include <linux/linkage.h>
++#include <asm-generic/export.h>
+
+-ENTRY(__lshrti3)
++SYM_FUNC_START(__lshrti3)
+ beqz a2, .L1
+ li a5,64
+ sub a5,a5,a2
+- addi sp,sp,-16
+ sext.w a4,a5
+ blez a5, .L2
+ sext.w a2,a2
+- sll a4,a1,a4
+ srl a0,a0,a2
+- srl a1,a1,a2
++ sll a4,a1,a4
++ srl a2,a1,a2
+ or a0,a0,a4
+- sd a1,8(sp)
+- sd a0,0(sp)
+- ld a0,0(sp)
+- ld a1,8(sp)
+- addi sp,sp,16
+- ret
++ mv a1,a2
+ .L1:
+ ret
+ .L2:
+- negw a4,a4
+- srl a1,a1,a4
+- sd a1,0(sp)
+- sd zero,8(sp)
+- ld a0,0(sp)
+- ld a1,8(sp)
+- addi sp,sp,16
++ negw a0,a4
++ li a2,0
++ srl a0,a1,a0
++ mv a1,a2
++ ret
++SYM_FUNC_END(__lshrti3)
++EXPORT_SYMBOL(__lshrti3)
++
++SYM_FUNC_START(__ashrti3)
++ beqz a2, .L3
++ li a5,64
++ sub a5,a5,a2
++ sext.w a4,a5
++ blez a5, .L4
++ sext.w a2,a2
++ srl a0,a0,a2
++ sll a4,a1,a4
++ sra a2,a1,a2
++ or a0,a0,a4
++ mv a1,a2
++.L3:
++ ret
++.L4:
++ negw a0,a4
++ srai a2,a1,0x3f
++ sra a0,a1,a0
++ mv a1,a2
++ ret
++SYM_FUNC_END(__ashrti3)
++EXPORT_SYMBOL(__ashrti3)
++
++SYM_FUNC_START(__ashlti3)
++ beqz a2, .L5
++ li a5,64
++ sub a5,a5,a2
++ sext.w a4,a5
++ blez a5, .L6
++ sext.w a2,a2
++ sll a1,a1,a2
++ srl a4,a0,a4
++ sll a2,a0,a2
++ or a1,a1,a4
++ mv a0,a2
++.L5:
++ ret
++.L6:
++ negw a1,a4
++ li a2,0
++ sll a1,a0,a1
++ mv a0,a2
+ ret
+-ENDPROC(__lshrti3)
++SYM_FUNC_END(__ashlti3)
++EXPORT_SYMBOL(__ashlti3)
+--
+2.20.1
+
--- /dev/null
+From 74504e523f98126eb485aa27c8e6855a3f456652 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:17:12 -0500
+Subject: rseq: Unregister rseq for clone CLONE_VM
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+[ Upstream commit 463f550fb47bede3a5d7d5177f363a6c3b45d50b ]
+
+It has been reported by Google that rseq is not behaving properly
+with respect to clone when CLONE_VM is used without CLONE_THREAD.
+
+It keeps the prior thread's rseq TLS registered when the TLS of the
+thread has moved, so the kernel can corrupt the TLS of the parent.
+
+The approach of clearing the per task-struct rseq registration
+on clone with CLONE_THREAD flag is incomplete. It does not cover
+the use-case of clone with CLONE_VM set, but without CLONE_THREAD.
+
+Here is the rationale for unregistering rseq on clone with CLONE_VM
+flag set:
+
+1) CLONE_THREAD requires CLONE_SIGHAND, which requires CLONE_VM to be
+ set. Therefore, just checking for CLONE_VM covers all CLONE_THREAD
+ uses. There is no point in checking for both CLONE_THREAD and
+ CLONE_VM,
+
+2) There is the possibility of an unlikely scenario where CLONE_SETTLS
+ is used without CLONE_VM. In order to be an issue, it would require
+ that the rseq TLS is in a shared memory area.
+
+ I do not plan on adding CLONE_SETTLS to the set of clone flags which
+ unregister RSEQ, because it would require that we also unregister RSEQ
+ on set_thread_area(2) and arch_prctl(2) ARCH_SET_FS for completeness.
+ So rather than doing a partial solution, it appears better to let
+ user-space explicitly perform rseq unregistration across clone if
+ needed in scenarios where CLONE_VM is not set.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20191211161713.4490-3-mathieu.desnoyers@efficios.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 775503573ed70..b968d736833bb 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1915,11 +1915,11 @@ static inline void rseq_migrate(struct task_struct *t)
+
+ /*
+ * If parent process has a registered restartable sequences area, the
+- * child inherits. Only applies when forking a process, not a thread.
++ * child inherits. Unregister rseq for a clone with CLONE_VM set.
+ */
+ static inline void rseq_fork(struct task_struct *t, unsigned long clone_flags)
+ {
+- if (clone_flags & CLONE_THREAD) {
++ if (clone_flags & CLONE_VM) {
+ t->rseq = NULL;
+ t->rseq_sig = 0;
+ t->rseq_event_mask = 0;
+--
+2.20.1
+
--- /dev/null
+From 45395bd212a6d1c709e746ba00dff0c2df0f1f1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 16:30:06 +0100
+Subject: s390/zcrypt: move ap device reset from bus to driver code
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 0c874cd04292c7ee22d70eefc341fa2648f41f46 ]
+
+This patch moves the reset invocation of an ap device when
+fresh detected from the ap bus to the probe() function of
+the driver responsible for this device.
+
+The virtualisation of ap devices makes it necessary to
+remove unconditioned resets on fresh appearing apqn devices.
+It may be that such a device is already enabled for guest
+usage. So there may be a race condition between host ap bus
+and guest ap bus doing the reset. This patch moves the
+reset from the ap bus to the zcrypt drivers. So if there
+is no zcrypt driver bound to an ap device - for example
+the ap device is bound to the vfio device driver - the
+ap device is untouched passed to the vfio device driver.
+
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/ap_bus.c | 2 --
+ drivers/s390/crypto/ap_bus.h | 2 +-
+ drivers/s390/crypto/ap_queue.c | 5 +++--
+ drivers/s390/crypto/zcrypt_cex2a.c | 1 +
+ drivers/s390/crypto/zcrypt_cex2c.c | 2 ++
+ drivers/s390/crypto/zcrypt_cex4.c | 1 +
+ 6 files changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
+index a1915061932eb..5256e3ce84e56 100644
+--- a/drivers/s390/crypto/ap_bus.c
++++ b/drivers/s390/crypto/ap_bus.c
+@@ -793,8 +793,6 @@ static int ap_device_probe(struct device *dev)
+ drvres = ap_drv->flags & AP_DRIVER_FLAG_DEFAULT;
+ if (!!devres != !!drvres)
+ return -ENODEV;
+- /* (re-)init queue's state machine */
+- ap_queue_reinit_state(to_ap_queue(dev));
+ }
+
+ /* Add queue/card to list of active queues/cards */
+diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
+index 433b7b64368d6..bb35ba4a8d243 100644
+--- a/drivers/s390/crypto/ap_bus.h
++++ b/drivers/s390/crypto/ap_bus.h
+@@ -261,7 +261,7 @@ void ap_queue_prepare_remove(struct ap_queue *aq);
+ void ap_queue_remove(struct ap_queue *aq);
+ void ap_queue_suspend(struct ap_device *ap_dev);
+ void ap_queue_resume(struct ap_device *ap_dev);
+-void ap_queue_reinit_state(struct ap_queue *aq);
++void ap_queue_init_state(struct ap_queue *aq);
+
+ struct ap_card *ap_card_create(int id, int queue_depth, int raw_device_type,
+ int comp_device_type, unsigned int functions);
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index dad2be333d826..37c3bdc3642dc 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -638,7 +638,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
+ aq->ap_dev.device.type = &ap_queue_type;
+ aq->ap_dev.device_type = device_type;
+ aq->qid = qid;
+- aq->state = AP_STATE_RESET_START;
++ aq->state = AP_STATE_UNBOUND;
+ aq->interrupt = AP_INTR_DISABLED;
+ spin_lock_init(&aq->lock);
+ INIT_LIST_HEAD(&aq->list);
+@@ -771,10 +771,11 @@ void ap_queue_remove(struct ap_queue *aq)
+ spin_unlock_bh(&aq->lock);
+ }
+
+-void ap_queue_reinit_state(struct ap_queue *aq)
++void ap_queue_init_state(struct ap_queue *aq)
+ {
+ spin_lock_bh(&aq->lock);
+ aq->state = AP_STATE_RESET_START;
+ ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
+ spin_unlock_bh(&aq->lock);
+ }
++EXPORT_SYMBOL(ap_queue_init_state);
+diff --git a/drivers/s390/crypto/zcrypt_cex2a.c b/drivers/s390/crypto/zcrypt_cex2a.c
+index c50f3e86cc748..7cbb384ec5352 100644
+--- a/drivers/s390/crypto/zcrypt_cex2a.c
++++ b/drivers/s390/crypto/zcrypt_cex2a.c
+@@ -175,6 +175,7 @@ static int zcrypt_cex2a_queue_probe(struct ap_device *ap_dev)
+ zq->queue = aq;
+ zq->online = 1;
+ atomic_set(&zq->load, 0);
++ ap_queue_init_state(aq);
+ ap_queue_init_reply(aq, &zq->reply);
+ aq->request_timeout = CEX2A_CLEANUP_TIME,
+ aq->private = zq;
+diff --git a/drivers/s390/crypto/zcrypt_cex2c.c b/drivers/s390/crypto/zcrypt_cex2c.c
+index 35c7c6672713b..c78c0d119806f 100644
+--- a/drivers/s390/crypto/zcrypt_cex2c.c
++++ b/drivers/s390/crypto/zcrypt_cex2c.c
+@@ -220,6 +220,7 @@ static int zcrypt_cex2c_queue_probe(struct ap_device *ap_dev)
+ zq->queue = aq;
+ zq->online = 1;
+ atomic_set(&zq->load, 0);
++ ap_rapq(aq->qid);
+ rc = zcrypt_cex2c_rng_supported(aq);
+ if (rc < 0) {
+ zcrypt_queue_free(zq);
+@@ -231,6 +232,7 @@ static int zcrypt_cex2c_queue_probe(struct ap_device *ap_dev)
+ else
+ zq->ops = zcrypt_msgtype(MSGTYPE06_NAME,
+ MSGTYPE06_VARIANT_NORNG);
++ ap_queue_init_state(aq);
+ ap_queue_init_reply(aq, &zq->reply);
+ aq->request_timeout = CEX2C_CLEANUP_TIME;
+ aq->private = zq;
+diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
+index 442e3d6162f76..6fabc906114c0 100644
+--- a/drivers/s390/crypto/zcrypt_cex4.c
++++ b/drivers/s390/crypto/zcrypt_cex4.c
+@@ -381,6 +381,7 @@ static int zcrypt_cex4_queue_probe(struct ap_device *ap_dev)
+ zq->queue = aq;
+ zq->online = 1;
+ atomic_set(&zq->load, 0);
++ ap_queue_init_state(aq);
+ ap_queue_init_reply(aq, &zq->reply);
+ aq->request_timeout = CEX4_CLEANUP_TIME,
+ aq->private = zq;
+--
+2.20.1
+
--- /dev/null
+From b98eca6ad39d5c64baa4e95b33ff86357226d716 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 11:20:53 +0100
+Subject: scsi: fnic: do not queue commands during fwreset
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 0e2209629fec427ba75a6351486153a9feddd36b ]
+
+When a link is going down the driver will be calling fnic_cleanup_io(),
+which will traverse all commands and calling 'done' for each found command.
+While the traversal is handled under the host_lock, calling 'done' happens
+after the host_lock is being dropped.
+
+As fnic_queuecommand_lck() is being called with the host_lock held, it
+might well be that it will pick the command being selected for abortion
+from the above routine and enqueue it for sending, but then 'done' is being
+called on that very command from the above routine.
+
+Which of course confuses the hell out of the scsi midlayer.
+
+So fix this by not queueing commands when fnic_cleanup_io is active.
+
+Link: https://lore.kernel.org/r/20200116102053.62755-1-hare@suse.de
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_scsi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index 80608b53897bb..e3f5c91d5e4fe 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -439,6 +439,9 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc, void (*done)(struct scsi_
+ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_IO_BLOCKED)))
+ return SCSI_MLQUEUE_HOST_BUSY;
+
++ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_FWRESET)))
++ return SCSI_MLQUEUE_HOST_BUSY;
++
+ rport = starget_to_rport(scsi_target(sc->device));
+ if (!rport) {
+ FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+--
+2.20.1
+
--- /dev/null
+From e588322555db54282af562e96c4932145fd302b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 10:11:08 +0300
+Subject: seq_tab_next() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 70a87287c821e9721b62463777f55ba588ac4623 ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index fb8ade9a05a97..2ce96cc1bad48 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -70,8 +70,7 @@ static void *seq_tab_start(struct seq_file *seq, loff_t *pos)
+ static void *seq_tab_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = seq_tab_get_idx(seq->private, *pos + 1);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+--
+2.20.1
+
ttyprintk-fix-a-potential-deadlock-in-interrupt-context-issue.patch
bluetooth-fix-race-condition-in-hci_release_sock.patch
cgroup-prevent-double-killing-of-css-when-enabling-threaded-cgroup.patch
+clk-sunxi-ng-v3s-fix-incorrect-number-of-hw_clks.patch
+arm64-dts-meson-sm1-sei610-add-gpio-bluetooth-interr.patch
+arm-dts-sun8i-a83t-correct-usb3503-gpios-polarity.patch
+arm-dts-am57xx-beagle-x15-am57xx-idk-remove-gpios-fo.patch
+arm-dts-beagle-x15-common-model-5v0-regulator.patch
+soc-ti-wkup_m3_ipc-fix-race-condition-with-rproc_boo.patch
+tools-lib-traceevent-fix-memory-leakage-in-filter_ev.patch
+rseq-unregister-rseq-for-clone-clone_vm.patch
+clk-sunxi-ng-sun8i-r-fix-divider-on-apb0-clock.patch
+clk-sunxi-ng-h6-r-fix-ar100-r_apb2-parent-order.patch
+mac80211-mesh-restrict-airtime-metric-to-peered-esta.patch
+clk-mmp2-fix-the-order-of-timer-mux-parents.patch
+asoc-rt5640-fix-null-dereference-on-module-unload.patch
+s390-zcrypt-move-ap-device-reset-from-bus-to-driver-.patch
+i40e-fix-virtchnl_queue_select-bitmap-validation.patch
+ixgbevf-remove-limit-of-10-entries-for-unicast-filte.patch
+ixgbe-fix-calculation-of-queue-with-vfs-and-flow-dir.patch
+igb-fix-sgmii-sfp-module-discovery-for-100fx-lx.patch
+iavf-remove-current-mac-address-filter-on-vf-reset.patch
+platform-x86-gpd-pocket-fan-allow-somewhat-lower-hig.patch
+platform-x86-intel_pmc_core-update-comet-lake-platfo.patch
+asoc-sof-intel-fix-hda-codec-driver-probe-with-multi.patch
+asoc-hdac_hda-fix-error-in-driver-removal-after-fail.patch
+asoc-sti-fix-possible-sleep-in-atomic.patch
+qmi_wwan-add-support-for-quectel-rm500q.patch
+parisc-use-proper-printk-format-for-resource_size_t.patch
+lkdtm-bugs-fix-build-error-in-lkdtm_unset_smep.patch
+wireless-fix-enabling-channel-12-for-custom-regulato.patch
+cfg80211-fix-radar-event-during-another-phy-cac.patch
+mac80211-fix-tkip-replay-protection-immediately-afte.patch
+wireless-wext-avoid-gcc-o3-warning.patch
+perf-x86-intel-uncore-add-pci-id-of-imc-for-xeon-e3-.patch
+perf-x86-intel-uncore-remove-pcie3-unit-for-snr.patch
+riscv-delete-temporary-files.patch
+riscv-less-inefficient-gcc-tishift-helpers-and-expor.patch
+xarray-fix-xas_pause-at-ulong_max.patch
+iwlwifi-pcie-allocate-smaller-dev_cmd-for-tx-headers.patch
+iwlwifi-mvm-fix-nvm-check-for-3168-devices.patch
+iwlwifi-don-t-ignore-the-cap-field-upon-mcc-update.patch
+iwlwifi-dbg-force-stop-the-debug-monitor-hw.patch
+input-evdev-convert-kzalloc-vzalloc-to-kvzalloc.patch
+input-aiptek-use-descriptors-of-current-altsetting.patch
+arm-dts-am335x-boneblack-common-fix-memory-size.patch
+vti-6-fix-packet-tx-through-bpf_redirect.patch
+xfrm-interface-fix-packet-tx-through-bpf_redirect.patch
+xfrm-interface-do-not-confirm-neighbor-when-do-pmtu-.patch
+input-max77650-onkey-add-of_match-table.patch
+scsi-fnic-do-not-queue-commands-during-fwreset.patch
+arm-8955-1-virt-relax-arch-timer-version-check-durin.patch
+led-max77650-add-of_match-table.patch
+tee-optee-fix-compilation-issue-with-nommu.patch
+r8152-get-default-setting-of-wol-before-initializing.patch
+r8152-disable-u2p3-for-rtl8153b.patch
+r8152-disable-pla-mcu-clock-speed-down.patch
+r8152-disable-test-io-for-rtl8153b.patch
+r8152-avoid-the-mcu-to-clear-the-lanwake.patch
+r8152-disable-delayphypwrchg.patch
+arm-dts-am43x-epos-evm-set-data-pin-directions-for-s.patch
+qlcnic-fix-cpu-soft-lockup-while-collecting-firmware.patch
+powerpc-fsl-dts-add-fsl-erratum-a011043.patch
+net-fsl-treat-fsl-erratum-a011043.patch
+net-fsl-fman-rename-if_mode_xgmii-to-if_mode_10g.patch
+seq_tab_next-should-increase-position-index.patch
+l2t_seq_next-should-increase-position-index.patch
+netfilter-conntrack-sctp-use-distinct-states-for-new.patch
+netfilter-nf_tables_offload-fix-check-the-chain-offl.patch
+net-fix-skb-csum-update-in-inet_proto_csum_replace16.patch
+btrfs-dev-replace-remove-warning-for-unknown-return-.patch
--- /dev/null
+From 7f0dcb31c61dff56e54380e08edd4fb25a65c845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 22:03:14 -0600
+Subject: soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
+
+From: Dave Gerlach <d-gerlach@ti.com>
+
+[ Upstream commit 03729cfa0d543bc996bf959e762ec999afc8f3d2 ]
+
+Any user of wkup_m3_ipc calls wkup_m3_ipc_get to get a handle and this
+checks the value of the static variable m3_ipc_state to see if the
+wkup_m3 is ready. Currently this is populated during probe before
+rproc_boot has been called, meaning there is a window of time that
+wkup_m3_ipc_get can return a valid handle but the wkup_m3 itself is not
+ready, leading to invalid IPC calls to the wkup_m3 and system
+instability.
+
+To avoid this, move the population of the m3_ipc_state variable until
+after rproc_boot has succeeded to guarantee a valid and usable handle
+is always returned.
+
+Reported-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
+Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/wkup_m3_ipc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
+index 378369d9364ae..e9ece45d7a333 100644
+--- a/drivers/soc/ti/wkup_m3_ipc.c
++++ b/drivers/soc/ti/wkup_m3_ipc.c
+@@ -419,6 +419,8 @@ static void wkup_m3_rproc_boot_thread(struct wkup_m3_ipc *m3_ipc)
+ ret = rproc_boot(m3_ipc->rproc);
+ if (ret)
+ dev_err(dev, "rproc_boot failed\n");
++ else
++ m3_ipc_state = m3_ipc;
+
+ do_exit(0);
+ }
+@@ -505,8 +507,6 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
+ goto err_put_rproc;
+ }
+
+- m3_ipc_state = m3_ipc;
+-
+ return 0;
+
+ err_put_rproc:
+--
+2.20.1
+
--- /dev/null
+From de9f12c0b5dfe287aad836e6907da4c375fb2e52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 12:28:07 +0000
+Subject: tee: optee: Fix compilation issue with nommu
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit 9e0caab8e0f96f0af7d1dd388e62f44184a75372 ]
+
+The optee driver uses specific page table types to verify if a memory
+region is normal. These types are not defined in nommu systems. Trying
+to compile the driver in these systems results in a build error:
+
+ linux/drivers/tee/optee/call.c: In function ‘is_normal_memory’:
+ linux/drivers/tee/optee/call.c:533:26: error: ‘L_PTE_MT_MASK’ undeclared
+ (first use in this function); did you mean ‘PREEMPT_MASK’?
+ return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
+ ^~~~~~~~~~~~~
+ PREEMPT_MASK
+ linux/drivers/tee/optee/call.c:533:26: note: each undeclared identifier is
+ reported only once for each function it appears in
+ linux/drivers/tee/optee/call.c:533:44: error: ‘L_PTE_MT_WRITEALLOC’ undeclared
+ (first use in this function)
+ return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
+ ^~~~~~~~~~~~~~~~~~~
+
+Make the optee driver depend on MMU to fix the compilation issue.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+[jw: update commit title]
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig
+index d1ad512e17089..3ca71e3812ed4 100644
+--- a/drivers/tee/optee/Kconfig
++++ b/drivers/tee/optee/Kconfig
+@@ -3,6 +3,7 @@
+ config OPTEE
+ tristate "OP-TEE"
+ depends on HAVE_ARM_SMCCC
++ depends on MMU
+ help
+ This implements the OP-TEE Trusted Execution Environment (TEE)
+ driver.
+--
+2.20.1
+
--- /dev/null
+From a033f560af0aba747e9c857bde9e567003ca4e5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 01:35:49 -0500
+Subject: tools lib traceevent: Fix memory leakage in filter_event
+
+From: Hewenliang <hewenliang4@huawei.com>
+
+[ Upstream commit f84ae29a6169318f9c929720c49d96323d2bbab9 ]
+
+It is necessary to call free_arg(arg) when add_filter_type() returns NULL
+in filter_event().
+
+Signed-off-by: Hewenliang <hewenliang4@huawei.com>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
+Link: http://lore.kernel.org/lkml/20191209063549.59941-1-hewenliang4@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/traceevent/parse-filter.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
+index f3cbf86e51acf..20eed719542e5 100644
+--- a/tools/lib/traceevent/parse-filter.c
++++ b/tools/lib/traceevent/parse-filter.c
+@@ -1228,8 +1228,10 @@ filter_event(struct tep_event_filter *filter, struct tep_event *event,
+ }
+
+ filter_type = add_filter_type(filter, event->id);
+- if (filter_type == NULL)
++ if (filter_type == NULL) {
++ free_arg(arg);
+ return TEP_ERRNO__MEM_ALLOC_FAILED;
++ }
+
+ if (filter_type->filter)
+ free_arg(filter_type->filter);
+--
+2.20.1
+
--- /dev/null
+From 2fbe08e705c5357eb9f1232c2eebeeb54567e90f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 09:32:46 +0100
+Subject: vti[6]: fix packet tx through bpf_redirect()
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 95224166a9032ff5d08fca633d37113078ce7d01 ]
+
+With an ebpf program that redirects packets through a vti[6] interface,
+the packets are dropped because no dst is attached.
+
+This could also be reproduced with an AF_PACKET socket, with the following
+python script (vti1 is an ip_vti interface):
+
+ import socket
+ send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
+ # scapy
+ # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
+ # raw(p)
+ req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
+ send_s.sendto(req, ('vti1', 0x800, 0, 0))
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_vti.c | 13 +++++++++++--
+ net/ipv6/ip6_vti.c | 13 +++++++++++--
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index fb9f6d60c27cd..79eef5db336a4 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -187,8 +187,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+ int mtu;
+
+ if (!dst) {
+- dev->stats.tx_carrier_errors++;
+- goto tx_error_icmp;
++ struct rtable *rt;
++
++ fl->u.ip4.flowi4_oif = dev->ifindex;
++ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++ if (IS_ERR(rt)) {
++ dev->stats.tx_carrier_errors++;
++ goto tx_error_icmp;
++ }
++ dst = &rt->dst;
++ skb_dst_set(skb, dst);
+ }
+
+ dst_hold(dst);
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 6f08b760c2a7c..524006aa0d78a 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -449,8 +449,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int err = -1;
+ int mtu;
+
+- if (!dst)
+- goto tx_err_link_failure;
++ if (!dst) {
++ fl->u.ip6.flowi6_oif = dev->ifindex;
++ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ dst = NULL;
++ goto tx_err_link_failure;
++ }
++ skb_dst_set(skb, dst);
++ }
+
+ dst_hold(dst);
+ dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
+--
+2.20.1
+
--- /dev/null
+From bd1f55e69229f3ec2e848f4932ceb63b6cf5bfd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 10:14:32 +0000
+Subject: wireless: fix enabling channel 12 for custom regulatory domain
+
+From: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+
+[ Upstream commit c4b9d655e445a8be0bff624aedea190606b5ebbc ]
+
+Commit e33e2241e272 ("Revert "cfg80211: Use 5MHz bandwidth by
+default when checking usable channels"") fixed a broken
+regulatory (leaving channel 12 open for AP where not permitted).
+Apply a similar fix to custom regulatory domain processing.
+
+Signed-off-by: Cathy Luo <xiaohua.luo@nxp.com>
+Signed-off-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Link: https://lore.kernel.org/r/1576836859-8945-1-git-send-email-ganapathi.bhat@nxp.com
+[reword commit message, fix coding style, add a comment]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 446c76d44e65a..3c2070040277d 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2261,14 +2261,15 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
+
+ static void handle_channel_custom(struct wiphy *wiphy,
+ struct ieee80211_channel *chan,
+- const struct ieee80211_regdomain *regd)
++ const struct ieee80211_regdomain *regd,
++ u32 min_bw)
+ {
+ u32 bw_flags = 0;
+ const struct ieee80211_reg_rule *reg_rule = NULL;
+ const struct ieee80211_power_rule *power_rule = NULL;
+ u32 bw;
+
+- for (bw = MHZ_TO_KHZ(20); bw >= MHZ_TO_KHZ(5); bw = bw / 2) {
++ for (bw = MHZ_TO_KHZ(20); bw >= min_bw; bw = bw / 2) {
+ reg_rule = freq_reg_info_regd(MHZ_TO_KHZ(chan->center_freq),
+ regd, bw);
+ if (!IS_ERR(reg_rule))
+@@ -2324,8 +2325,14 @@ static void handle_band_custom(struct wiphy *wiphy,
+ if (!sband)
+ return;
+
++ /*
++ * We currently assume that you always want at least 20 MHz,
++ * otherwise channel 12 might get enabled if this rule is
++ * compatible to US, which permits 2402 - 2472 MHz.
++ */
+ for (i = 0; i < sband->n_channels; i++)
+- handle_channel_custom(wiphy, &sband->channels[i], regd);
++ handle_channel_custom(wiphy, &sband->channels[i], regd,
++ MHZ_TO_KHZ(20));
+ }
+
+ /* Used by drivers prior to wiphy registration */
+--
+2.20.1
+
--- /dev/null
+From 3b0fe16e19cb448e088d5bb7bd6cf7077b805dd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:07:35 +0100
+Subject: wireless: wext: avoid gcc -O3 warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e16119655c9e6c4aa5767cd971baa9c491f41b13 ]
+
+After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3,
+the wext code produces a bogus warning:
+
+In function 'iw_handler_get_iwstats',
+ inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9,
+ inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10,
+ inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8,
+ inlined from 'wext_handle_ioctl':
+net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull]
+ memcpy(extra, stats, sizeof(struct iw_statistics));
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In file included from arch/x86/include/asm/string.h:5,
+net/wireless/wext-core.c: In function 'wext_handle_ioctl':
+arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here
+
+The problem is that ioctl_standard_call() sometimes calls the handler
+with a NULL argument that would cause a problem for iw_handler_get_iwstats.
+However, iw_handler_get_iwstats never actually gets called that way.
+
+Marking that function as noinline avoids the warning and leads
+to slightly smaller object code as well.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107200741.3588770-1-arnd@arndb.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/wext-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index 5e677dac2a0ce..69102fda9ebd4 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -657,7 +657,8 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev)
+ return NULL;
+ }
+
+-static int iw_handler_get_iwstats(struct net_device * dev,
++/* noinline to avoid a bogus warning with -O3 */
++static noinline int iw_handler_get_iwstats(struct net_device * dev,
+ struct iw_request_info * info,
+ union iwreq_data * wrqu,
+ char * extra)
+--
+2.20.1
+
--- /dev/null
+From 899c0cd6194a56a663d4e76ad008afd54f3aad77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 22:49:11 -0500
+Subject: XArray: Fix xas_pause at ULONG_MAX
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit 82a22311b7a68a78709699dc8c098953b70e4fd2 ]
+
+If we were unlucky enough to call xas_pause() when the index was at
+ULONG_MAX (or a multi-slot entry which ends at ULONG_MAX), we would
+wrap the index back around to 0 and restart the iteration from the
+beginning. Use the XAS_BOUNDS state to indicate that we should just
+stop the iteration.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_xarray.c | 22 ++++++++++++++++++++++
+ lib/xarray.c | 8 +++++---
+ 2 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/lib/test_xarray.c b/lib/test_xarray.c
+index 03c3f42966cec..55c14e8c88591 100644
+--- a/lib/test_xarray.c
++++ b/lib/test_xarray.c
+@@ -1160,6 +1160,27 @@ static noinline void check_move_tiny(struct xarray *xa)
+ XA_BUG_ON(xa, !xa_empty(xa));
+ }
+
++static noinline void check_move_max(struct xarray *xa)
++{
++ XA_STATE(xas, xa, 0);
++
++ xa_store_index(xa, ULONG_MAX, GFP_KERNEL);
++ rcu_read_lock();
++ XA_BUG_ON(xa, xas_find(&xas, ULONG_MAX) != xa_mk_index(ULONG_MAX));
++ XA_BUG_ON(xa, xas_find(&xas, ULONG_MAX) != NULL);
++ rcu_read_unlock();
++
++ xas_set(&xas, 0);
++ rcu_read_lock();
++ XA_BUG_ON(xa, xas_find(&xas, ULONG_MAX) != xa_mk_index(ULONG_MAX));
++ xas_pause(&xas);
++ XA_BUG_ON(xa, xas_find(&xas, ULONG_MAX) != NULL);
++ rcu_read_unlock();
++
++ xa_erase_index(xa, ULONG_MAX);
++ XA_BUG_ON(xa, !xa_empty(xa));
++}
++
+ static noinline void check_move_small(struct xarray *xa, unsigned long idx)
+ {
+ XA_STATE(xas, xa, 0);
+@@ -1268,6 +1289,7 @@ static noinline void check_move(struct xarray *xa)
+ xa_destroy(xa);
+
+ check_move_tiny(xa);
++ check_move_max(xa);
+
+ for (i = 0; i < 16; i++)
+ check_move_small(xa, 1UL << i);
+diff --git a/lib/xarray.c b/lib/xarray.c
+index 47e17d46e5f85..1d9fab7db8dad 100644
+--- a/lib/xarray.c
++++ b/lib/xarray.c
+@@ -968,6 +968,7 @@ void xas_pause(struct xa_state *xas)
+ if (xas_invalid(xas))
+ return;
+
++ xas->xa_node = XAS_RESTART;
+ if (node) {
+ unsigned int offset = xas->xa_offset;
+ while (++offset < XA_CHUNK_SIZE) {
+@@ -975,10 +976,11 @@ void xas_pause(struct xa_state *xas)
+ break;
+ }
+ xas->xa_index += (offset - xas->xa_offset) << node->shift;
++ if (xas->xa_index == 0)
++ xas->xa_node = XAS_BOUNDS;
+ } else {
+ xas->xa_index++;
+ }
+- xas->xa_node = XAS_RESTART;
+ }
+ EXPORT_SYMBOL_GPL(xas_pause);
+
+@@ -1080,7 +1082,7 @@ void *xas_find(struct xa_state *xas, unsigned long max)
+ {
+ void *entry;
+
+- if (xas_error(xas))
++ if (xas_error(xas) || xas->xa_node == XAS_BOUNDS)
+ return NULL;
+ if (xas->xa_index > max)
+ return set_bounds(xas);
+@@ -1088,7 +1090,7 @@ void *xas_find(struct xa_state *xas, unsigned long max)
+ if (!xas->xa_node) {
+ xas->xa_index = 1;
+ return set_bounds(xas);
+- } else if (xas_top(xas->xa_node)) {
++ } else if (xas->xa_node == XAS_RESTART) {
+ entry = xas_load(xas);
+ if (entry || xas_not_node(xas->xa_node))
+ return entry;
+--
+2.20.1
+
--- /dev/null
+From f6afe2b75ac874b0a29e4497ea0af55eaf229ef4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 09:00:36 +0000
+Subject: xfrm: interface: do not confirm neighbor when do pmtu update
+
+From: Xu Wang <vulab@iscas.ac.cn>
+
+[ Upstream commit 8aaea2b0428b6aad7c7e22d3fddc31a78bb1d724 ]
+
+When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end,
+we should not call dst_confirm_neigh() as there is no two-way communication.
+
+Signed-off-by: Xu Wang <vulab@iscas.ac.cn>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index a3db19d93fc5b..4d5627e274fe3 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -294,7 +294,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+
+ mtu = dst_mtu(dst);
+ if (!skb->ignore_df && skb->len > mtu) {
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+ if (mtu < IPV6_MIN_MTU)
+--
+2.20.1
+
--- /dev/null
+From 26cfa5f1682a19d3c04b8864b52ac242fa1003ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 09:32:47 +0100
+Subject: xfrm interface: fix packet tx through bpf_redirect()
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit f042365dbffea98fb8148c98c700402e8d099f02 ]
+
+With an ebpf program that redirects packets through a xfrm interface,
+packets are dropped because no dst is attached to skb.
+
+This could also be reproduced with an AF_PACKET socket, with the following
+python script (xfrm1 is a xfrm interface):
+
+ import socket
+ send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
+ # scapy
+ # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
+ # raw(p)
+ req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
+ send_s.sendto(req, ('xfrm1', 0x800, 0, 0))
+
+It was also not possible to send an ip packet through an AF_PACKET socket
+because a LL header was expected. Let's remove those LL header constraints.
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 0f5131bc3342d..a3db19d93fc5b 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int err = -1;
+ int mtu;
+
+- if (!dst)
+- goto tx_err_link_failure;
+-
+ dst_hold(dst);
+ dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
+ if (IS_ERR(dst)) {
+@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+ struct net_device_stats *stats = &xi->dev->stats;
++ struct dst_entry *dst = skb_dst(skb);
+ struct flowi fl;
+ int ret;
+
+@@ -352,10 +350,33 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ case htons(ETH_P_IPV6):
+ xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ if (!dst) {
++ fl.u.ip6.flowi6_oif = dev->ifindex;
++ fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, dst);
++ }
+ break;
+ case htons(ETH_P_IP):
+ xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ if (!dst) {
++ struct rtable *rt;
++
++ fl.u.ip4.flowi4_oif = dev->ifindex;
++ fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
++ if (IS_ERR(rt)) {
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, &rt->dst);
++ }
+ break;
+ default:
+ goto tx_err;
+@@ -563,12 +584,9 @@ static void xfrmi_dev_setup(struct net_device *dev)
+ {
+ dev->netdev_ops = &xfrmi_netdev_ops;
+ dev->type = ARPHRD_NONE;
+- dev->hard_header_len = ETH_HLEN;
+- dev->min_header_len = ETH_HLEN;
+ dev->mtu = ETH_DATA_LEN;
+ dev->min_mtu = ETH_MIN_MTU;
+- dev->max_mtu = ETH_DATA_LEN;
+- dev->addr_len = ETH_ALEN;
++ dev->max_mtu = IP_MAX_MTU;
+ dev->flags = IFF_NOARP;
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = xfrmi_dev_free;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
