--- /dev/null
+From 1c018afa0aa04fc23f4373ec715cc87c859d7445 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 14:27:54 -0600
+Subject: ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid
+ switch
+
+From: Jason Ekstrand <jason@jlekstrand.net>
+
+[ Upstream commit 0528904926aab19bffb2068879aa44db166c6d5f ]
+
+Running evemu-record on the lid switch event shows that the lid reports
+the first "close" but then never reports an "open". This causes systemd
+to continuously re-suspend the laptop every 30s. Resetting the _LID to
+"open" fixes the issue.
+
+Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/button.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index ce93a355bd1c8..985afc62da82a 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -89,6 +89,17 @@ static const struct dmi_system_id lid_blacklst[] = {
+ },
+ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+ },
++ {
++ /*
++ * Razer Blade Stealth 13 late 2019, notification of the LID device
++ * only happens on close, not on open and _LID always returns closed.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Razer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Razer Blade Stealth 13 Late 2019"),
++ },
++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
++ },
+ {}
+ };
+
+--
+2.20.1
+
--- /dev/null
+From cf837dd479b8c9e8ba5ca16b7d51fe7776b369f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 20:14:11 +0800
+Subject: ACPI/IORT: Fix 'Number of IDs' handling in iort_id_map()
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 3c23b83a88d00383e1d498cfa515249aa2fe0238 ]
+
+The IORT specification [0] (Section 3, table 4, page 9) defines the
+'Number of IDs' as 'The number of IDs in the range minus one'.
+
+However, the IORT ID mapping function iort_id_map() treats the 'Number
+of IDs' field as if it were the full IDs mapping count, with the
+following check in place to detect out of boundary input IDs:
+
+InputID >= Input base + Number of IDs
+
+This check is flawed in that it considers the 'Number of IDs' field as
+the full number of IDs mapping and disregards the 'minus one' from
+the IDs count.
+
+The correct check in iort_id_map() should be implemented as:
+
+InputID > Input base + Number of IDs
+
+this implements the specification correctly but unfortunately it breaks
+existing firmwares that erroneously set the 'Number of IDs' as the full
+IDs mapping count rather than IDs mapping count minus one.
+
+e.g.
+
+PCI hostbridge mapping entry 1:
+Input base: 0x1000
+ID Count: 0x100
+Output base: 0x1000
+Output reference: 0xC4 //ITS reference
+
+PCI hostbridge mapping entry 2:
+Input base: 0x1100
+ID Count: 0x100
+Output base: 0x2000
+Output reference: 0xD4 //ITS reference
+
+Two mapping entries which the second entry's Input base = the first
+entry's Input base + ID count, so for InputID 0x1100 and with the
+correct InputID check in place in iort_id_map() the kernel would map
+the InputID to ITS 0xC4 not 0xD4 as it would be expected.
+
+Therefore, to keep supporting existing flawed firmwares, introduce a
+workaround that instructs the kernel to use the old InputID range check
+logic in iort_id_map(), so that we can support both firmwares written
+with the flawed 'Number of IDs' logic and the correct one as defined in
+the specifications.
+
+[0]: http://infocenter.arm.com/help/topic/com.arm.doc.den0049d/DEN0049D_IO_Remapping_Table.pdf
+
+Reported-by: Pankaj Bansal <pankaj.bansal@nxp.com>
+Link: https://lore.kernel.org/linux-acpi/20191215203303.29811-1-pankaj.bansal@nxp.com/
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Pankaj Bansal <pankaj.bansal@nxp.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/arm64/iort.c | 57 +++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index 5a7551d060f25..161b609e4cdfb 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -298,6 +298,59 @@ out:
+ return status;
+ }
+
++struct iort_workaround_oem_info {
++ char oem_id[ACPI_OEM_ID_SIZE + 1];
++ char oem_table_id[ACPI_OEM_TABLE_ID_SIZE + 1];
++ u32 oem_revision;
++};
++
++static bool apply_id_count_workaround;
++
++static struct iort_workaround_oem_info wa_info[] __initdata = {
++ {
++ .oem_id = "HISI ",
++ .oem_table_id = "HIP07 ",
++ .oem_revision = 0,
++ }, {
++ .oem_id = "HISI ",
++ .oem_table_id = "HIP08 ",
++ .oem_revision = 0,
++ }
++};
++
++static void __init
++iort_check_id_count_workaround(struct acpi_table_header *tbl)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(wa_info); i++) {
++ if (!memcmp(wa_info[i].oem_id, tbl->oem_id, ACPI_OEM_ID_SIZE) &&
++ !memcmp(wa_info[i].oem_table_id, tbl->oem_table_id, ACPI_OEM_TABLE_ID_SIZE) &&
++ wa_info[i].oem_revision == tbl->oem_revision) {
++ apply_id_count_workaround = true;
++ pr_warn(FW_BUG "ID count for ID mapping entry is wrong, applying workaround\n");
++ break;
++ }
++ }
++}
++
++static inline u32 iort_get_map_max(struct acpi_iort_id_mapping *map)
++{
++ u32 map_max = map->input_base + map->id_count;
++
++ /*
++ * The IORT specification revision D (Section 3, table 4, page 9) says
++ * Number of IDs = The number of IDs in the range minus one, but the
++ * IORT code ignored the "minus one", and some firmware did that too,
++ * so apply a workaround here to keep compatible with both the spec
++ * compliant and non-spec compliant firmwares.
++ */
++ if (apply_id_count_workaround)
++ map_max--;
++
++ return map_max;
++}
++
+ static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
+ u32 *rid_out)
+ {
+@@ -314,8 +367,7 @@ static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
+ return -ENXIO;
+ }
+
+- if (rid_in < map->input_base ||
+- (rid_in >= map->input_base + map->id_count))
++ if (rid_in < map->input_base || rid_in > iort_get_map_max(map))
+ return -ENXIO;
+
+ *rid_out = map->output_base + (rid_in - map->input_base);
+@@ -1637,5 +1689,6 @@ void __init acpi_iort_init(void)
+ return;
+ }
+
++ iort_check_id_count_workaround(iort_table);
+ iort_init_platform_devices();
+ }
+--
+2.20.1
+
--- /dev/null
+From ed567aa0eb358a6466ced8bc8be5f459389d5b44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 11:35:20 -0800
+Subject: ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
+
+From: Erik Kaneda <erik.kaneda@intel.com>
+
+[ Upstream commit 5ddbd77181dfca61b16d2e2222382ea65637f1b9 ]
+
+ACPICA commit 29cc8dbc5463a93625bed87d7550a8bed8913bf4
+
+create_buffer_field is a deferred op that is typically processed in
+load pass 2. However, disassembly of control method contents walk the
+parse tree with ACPI_PARSE_LOAD_PASS1 and AML_CREATE operators are
+processed in a later walk. This is a problem when there is a control
+method that has the same name as the AML_CREATE object. In this case,
+any use of the name segment will be detected as a method call rather
+than a reference to a buffer field. If this is detected as a method
+call, it can result in a mal-formed parse tree if the control methods
+have parameters.
+
+This change in processing AML_CREATE ops earlier solves this issue by
+inserting the named object in the ACPI namespace so that references
+to this name would be detected as a name string rather than a method
+call.
+
+Link: https://github.com/acpica/acpica/commit/29cc8dbc
+Reported-by: Elia Geretto <elia.f.geretto@gmail.com>
+Tested-by: Elia Geretto <elia.f.geretto@gmail.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsfield.c | 2 +-
+ drivers/acpi/acpica/dswload.c | 21 +++++++++++++++++++++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c
+index cf4e061bb0f0b..8438e33aa4474 100644
+--- a/drivers/acpi/acpica/dsfield.c
++++ b/drivers/acpi/acpica/dsfield.c
+@@ -244,7 +244,7 @@ cleanup:
+ * FUNCTION: acpi_ds_get_field_names
+ *
+ * PARAMETERS: info - create_field info structure
+- * ` walk_state - Current method state
++ * walk_state - Current method state
+ * arg - First parser arg for the field name list
+ *
+ * RETURN: Status
+diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c
+index c88fd31208a5b..4bcf15bf03ded 100644
+--- a/drivers/acpi/acpica/dswload.c
++++ b/drivers/acpi/acpica/dswload.c
+@@ -410,6 +410,27 @@ acpi_status acpi_ds_load1_end_op(struct acpi_walk_state *walk_state)
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "Op=%p State=%p\n", op,
+ walk_state));
+
++ /*
++ * Disassembler: handle create field operators here.
++ *
++ * create_buffer_field is a deferred op that is typically processed in load
++ * pass 2. However, disassembly of control method contents walk the parse
++ * tree with ACPI_PARSE_LOAD_PASS1 and AML_CREATE operators are processed
++ * in a later walk. This is a problem when there is a control method that
++ * has the same name as the AML_CREATE object. In this case, any use of the
++ * name segment will be detected as a method call rather than a reference
++ * to a buffer field.
++ *
++ * This earlier creation during disassembly solves this issue by inserting
++ * the named object in the ACPI namespace so that references to this name
++ * would be a name string rather than a method call.
++ */
++ if ((walk_state->parse_flags & ACPI_PARSE_DISASSEMBLE) &&
++ (walk_state->op_info->flags & AML_CREATE)) {
++ status = acpi_ds_create_buffer_field(op, walk_state);
++ return_ACPI_STATUS(status);
++ }
++
+ /* We are only interested in opcodes that have an associated name */
+
+ if (!(walk_state->op_info->flags & (AML_NAMED | AML_FIELD))) {
+--
+2.20.1
+
--- /dev/null
+From 0027f1238425a0b106d03fc2a65bfbba9764726b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 21:58:46 -0800
+Subject: alarmtimer: Make alarmtimer platform device child of RTC device
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit c79108bd19a8490315847e0c95ac6526fcd8e770 ]
+
+The alarmtimer_suspend() function will fail if an RTC device is on a bus
+such as SPI or i2c and that RTC device registers and probes after
+alarmtimer_init() registers and probes the 'alarmtimer' platform device.
+
+This is because system wide suspend suspends devices in the reverse order
+of their probe. When alarmtimer_suspend() attempts to program the RTC for a
+wakeup it will try to program an RTC device on a bus that has already been
+suspended.
+
+Move the alarmtimer device registration to happen when the RTC which is
+used for wakeup is registered. Register the 'alarmtimer' platform device as
+a child of the RTC device too, so that it can be guaranteed that the RTC
+device won't be suspended when alarmtimer_suspend() is called.
+
+Reported-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20200124055849.154411-2-swboyd@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/time/alarmtimer.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index 4b11f0309eee4..b97401f6bc232 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -88,6 +88,7 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ unsigned long flags;
+ struct rtc_device *rtc = to_rtc_device(dev);
+ struct wakeup_source *__ws;
++ struct platform_device *pdev;
+ int ret = 0;
+
+ if (rtcdev)
+@@ -99,9 +100,11 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ return -1;
+
+ __ws = wakeup_source_register(dev, "alarmtimer");
++ pdev = platform_device_register_data(dev, "alarmtimer",
++ PLATFORM_DEVID_AUTO, NULL, 0);
+
+ spin_lock_irqsave(&rtcdev_lock, flags);
+- if (!rtcdev) {
++ if (__ws && !IS_ERR(pdev) && !rtcdev) {
+ if (!try_module_get(rtc->owner)) {
+ ret = -1;
+ goto unlock;
+@@ -112,10 +115,14 @@ static int alarmtimer_rtc_add_device(struct device *dev,
+ get_device(dev);
+ ws = __ws;
+ __ws = NULL;
++ pdev = NULL;
++ } else {
++ ret = -1;
+ }
+ unlock:
+ spin_unlock_irqrestore(&rtcdev_lock, flags);
+
++ platform_device_unregister(pdev);
+ wakeup_source_unregister(__ws);
+
+ return ret;
+@@ -876,8 +883,7 @@ static struct platform_driver alarmtimer_driver = {
+ */
+ static int __init alarmtimer_init(void)
+ {
+- struct platform_device *pdev;
+- int error = 0;
++ int error;
+ int i;
+
+ alarmtimer_rtc_timer_init();
+@@ -900,15 +906,7 @@ static int __init alarmtimer_init(void)
+ if (error)
+ goto out_if;
+
+- pdev = platform_device_register_simple("alarmtimer", -1, NULL, 0);
+- if (IS_ERR(pdev)) {
+- error = PTR_ERR(pdev);
+- goto out_drv;
+- }
+ return 0;
+-
+-out_drv:
+- platform_driver_unregister(&alarmtimer_driver);
+ out_if:
+ alarmtimer_rtc_interface_remove();
+ return error;
+--
+2.20.1
+
--- /dev/null
+From bded43bc652ca27761a4d95903f4e0e84e955819 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 18:33:47 +0900
+Subject: ALSA: ctl: allow TLV read operation for callback type of element in
+ locked case
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit d61fe22c2ae42d9fd76c34ef4224064cca4b04b0 ]
+
+A design of ALSA control core allows applications to execute three
+operations for TLV feature; read, write and command. Furthermore, it
+allows driver developers to process the operations by two ways; allocated
+array or callback function. In the former, read operation is just allowed,
+thus developers uses the latter when device driver supports variety of
+models or the target model is expected to dynamically change information
+stored in TLV container.
+
+The core also allows applications to lock any element so that the other
+applications can't perform write operation to the element for element
+value and TLV information. When the element is locked, write and command
+operation for TLV information are prohibited as well as element value.
+Any read operation should be allowed in the case.
+
+At present, when an element has callback function for TLV information,
+TLV read operation returns EPERM if the element is locked. On the
+other hand, the read operation is success when an element has allocated
+array for TLV information. In both cases, read operation is success for
+element value expectedly.
+
+This commit fixes the bug. This change can be backported to v4.14
+kernel or later.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20191223093347.15279-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/control.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/control.c b/sound/core/control.c
+index 7a4d8690ce41f..08ca7666e84cf 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1430,8 +1430,9 @@ static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
+ if (kctl->tlv.c == NULL)
+ return -ENXIO;
+
+- /* When locked, this is unavailable. */
+- if (vd->owner != NULL && vd->owner != file)
++ /* Write and command operations are not allowed for locked element. */
++ if (op_flag != SNDRV_CTL_TLV_OP_READ &&
++ vd->owner != NULL && vd->owner != file)
+ return -EPERM;
+
+ return kctl->tlv.c(kctl, op_flag, size, buf);
+--
+2.20.1
+
--- /dev/null
+From d3afad13d424a552a766d230d4716af620882202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 19:01:06 +0100
+Subject: ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Große <pegro@friiks.de>
+
+[ Upstream commit ef7d84caa5928b40b1c93a26dbe5a3f12737c6ab ]
+
+Lenovo Thinkpad T420s uses the same codec as T420, so apply the
+same quirk to enable audio output on a docking station.
+
+Signed-off-by: Peter Große <pegro@friiks.de>
+Link: https://lore.kernel.org/r/20200122180106.9351-1-pegro@friiks.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 90aa0f400a57d..1e20e85e9b466 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -922,6 +922,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
++ SND_PCI_QUIRK(0x17aa, 0x21d2, "Lenovo T420s", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
+--
+2.20.1
+
--- /dev/null
+From 08723e7c7dfdea7fd35520d902aa812dd693dba7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 18:01:17 +0200
+Subject: ALSA: hda/hdmi - add retry logic to parse_intel_hdmi()
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 2928fa0a97ebb9549cb877fdc99aed9b95438c3a ]
+
+The initial snd_hda_get_sub_node() can fail on certain
+devices (e.g. some Chromebook models using Intel GLK).
+The failure rate is very low, but as this is is part of
+the probe process, end-user impact is high.
+
+In observed cases, related hardware status registers have
+expected values, but the node query still fails. Retrying
+the node query does seem to help, so fix the problem by
+adding retry logic to the query. This does not impact
+non-Intel platforms.
+
+BugLink: https://github.com/thesofproject/linux/issues/1642
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20200120160117.29130-4-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 8ac805a634f4e..307ca1f036762 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2794,9 +2794,12 @@ static int alloc_intel_hdmi(struct hda_codec *codec)
+ /* parse and post-process for Intel codecs */
+ static int parse_intel_hdmi(struct hda_codec *codec)
+ {
+- int err;
++ int err, retries = 3;
++
++ do {
++ err = hdmi_parse_codec(codec);
++ } while (err < 0 && retries--);
+
+- err = hdmi_parse_codec(codec);
+ if (err < 0) {
+ generic_spec_free(codec);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From 666d99803b1385401bef9a2668d70e14f178f289 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jan 2020 09:11:19 +0100
+Subject: ALSA: hda/realtek - Apply mic mute LED quirk for Dell E7xx laptops,
+ too
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5fab5829674c279839a7408ab30c71c6dfe726b9 ]
+
+Dell E7xx laptops have also mic mute LED that is driven by the
+dell-laptop platform driver. Bind it with the capture control as
+already done for other models.
+
+A caveat is that the fixup hook for the mic mute LED has to be applied
+at last, otherwise it results in the invalid override of the callback.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205529
+Link: https://lore.kernel.org/r/20200105081119.21396-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a66d4be3516e6..f162e607fc6c3 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5852,6 +5852,7 @@ enum {
+ ALC288_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC288_FIXUP_DELL_XPS_13,
+ ALC288_FIXUP_DISABLE_AAMIX,
++ ALC292_FIXUP_DELL_E7X_AAMIX,
+ ALC292_FIXUP_DELL_E7X,
+ ALC292_FIXUP_DISABLE_AAMIX,
+ ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK,
+@@ -6547,12 +6548,19 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC293_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
+- [ALC292_FIXUP_DELL_E7X] = {
++ [ALC292_FIXUP_DELL_E7X_AAMIX] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_dell_xps13,
+ .chained = true,
+ .chain_id = ALC292_FIXUP_DISABLE_AAMIX
+ },
++ [ALC292_FIXUP_DELL_E7X] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = snd_hda_gen_fixup_micmute_led,
++ /* micmute fixup must be applied at last */
++ .chained_before = true,
++ .chain_id = ALC292_FIXUP_DELL_E7X_AAMIX,
++ },
+ [ALC298_FIXUP_ALIENWARE_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+--
+2.20.1
+
--- /dev/null
+From d00fb600384a75b835000fe0eaa6602b40e50061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jan 2020 15:48:23 +0100
+Subject: ALSA: sh: Fix compile warning wrt const
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit f1dd4795b1523fbca7ab4344dd5a8bb439cc770d ]
+
+A long-standing compile warning was seen during build test:
+ sound/sh/aica.c: In function 'load_aica_firmware':
+ sound/sh/aica.c:521:25: warning: passing argument 2 of 'spu_memload' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
+
+Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device")
+Link: https://lore.kernel.org/r/20200105144823.29547-69-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/aica.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/sh/aica.c b/sound/sh/aica.c
+index 52e9cfb4f8197..8421b2f9c9f38 100644
+--- a/sound/sh/aica.c
++++ b/sound/sh/aica.c
+@@ -101,10 +101,10 @@ static void spu_memset(u32 toi, u32 what, int length)
+ }
+
+ /* spu_memload - write to SPU address space */
+-static void spu_memload(u32 toi, void *from, int length)
++static void spu_memload(u32 toi, const void *from, int length)
+ {
+ unsigned long flags;
+- u32 *froml = from;
++ const u32 *froml = from;
+ u32 __iomem *to = (u32 __iomem *) (SPU_MEMORY_BASE + toi);
+ int i;
+ u32 val;
+--
+2.20.1
+
--- /dev/null
+From 340c664399155a5ca453261b40437b7001c50cd1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 12:00:57 +0100
+Subject: ALSA: sh: Fix unused variable warnings
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5da116f164ce265e397b8f59af5c39e4a61d61a5 ]
+
+Remove unused variables that are left over after the conversion of new
+PCM ops:
+ sound/sh/sh_dac_audio.c:166:26: warning: unused variable 'runtime'
+ sound/sh/sh_dac_audio.c:186:26: warning: unused variable 'runtime'
+ sound/sh/sh_dac_audio.c:205:26: warning: unused variable 'runtime'
+
+Fixes: 1cc2f8ba0b3e ("ALSA: sh: Convert to the new PCM ops")
+Link: https://lore.kernel.org/r/20200104110057.13875-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/sh_dac_audio.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c
+index ed877a138965d..7c46494466ff1 100644
+--- a/sound/sh/sh_dac_audio.c
++++ b/sound/sh/sh_dac_audio.c
+@@ -175,7 +175,6 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ if (copy_from_user_toio(chip->data_buffer + pos, src, count))
+ return -EFAULT;
+@@ -195,7 +194,6 @@ static int snd_sh_dac_pcm_copy_kernel(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ memcpy_toio(chip->data_buffer + pos, src, count);
+ chip->buffer_end = chip->data_buffer + pos + count;
+@@ -214,7 +212,6 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ memset_io(chip->data_buffer + pos, 0, count);
+ chip->buffer_end = chip->data_buffer + pos + count;
+--
+2.20.1
+
--- /dev/null
+From 34c67bc454cdae18e59832c984ee3a76dd802d29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 13:23:58 +0300
+Subject: ALSA: usb-audio: Add boot quirk for MOTU M Series
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+[ Upstream commit 73ac9f5e5b43a5dbadb61f27dae7a971f7ec0d22 ]
+
+Add delay to make sure that audio urbs are not sent too early.
+Otherwise the device hangs. Windows driver makes ~2s delay, so use
+about the same time delay value.
+
+snd_usb_apply_boot_quirk() is called 3 times for my MOTU M4, which
+is an overkill. Thus a quirk that is called only once is implemented.
+
+Also send two vendor-specific control messages before and after
+the delay. This behaviour is blindly copied from the Windows driver.
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Link: https://lore.kernel.org/r/20200112102358.18085-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 4 ++++
+ sound/usb/quirks.c | 38 ++++++++++++++++++++++++++++++++++++++
+ sound/usb/quirks.h | 5 +++++
+ 3 files changed, 47 insertions(+)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index db91dc76cc915..e6a618a239948 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -597,6 +597,10 @@ static int usb_audio_probe(struct usb_interface *intf,
+ }
+ }
+ if (! chip) {
++ err = snd_usb_apply_boot_quirk_once(dev, intf, quirk, id);
++ if (err < 0)
++ return err;
++
+ /* it's a fresh one.
+ * now look for an empty slot and create a new card instance
+ */
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 1ed25b1d2a6a2..7448ab07bd363 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1113,6 +1113,31 @@ free_buf:
+ return err;
+ }
+
++static int snd_usb_motu_m_series_boot_quirk(struct usb_device *dev)
++{
++ int ret;
++
++ if (snd_usb_pipe_sanity_check(dev, usb_sndctrlpipe(dev, 0)))
++ return -EINVAL;
++ ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
++ 1, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
++ 0x0, 0, NULL, 0, 1000);
++
++ if (ret < 0)
++ return ret;
++
++ msleep(2000);
++
++ ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
++ 1, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
++ 0x20, 0, NULL, 0, 1000);
++
++ if (ret < 0)
++ return ret;
++
++ return 0;
++}
++
+ /*
+ * Setup quirks
+ */
+@@ -1297,6 +1322,19 @@ int snd_usb_apply_boot_quirk(struct usb_device *dev,
+ return 0;
+ }
+
++int snd_usb_apply_boot_quirk_once(struct usb_device *dev,
++ struct usb_interface *intf,
++ const struct snd_usb_audio_quirk *quirk,
++ unsigned int id)
++{
++ switch (id) {
++ case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++ return snd_usb_motu_m_series_boot_quirk(dev);
++ }
++
++ return 0;
++}
++
+ /*
+ * check if the device uses big-endian samples
+ */
+diff --git a/sound/usb/quirks.h b/sound/usb/quirks.h
+index a80e0ddd07364..df0355843a4c1 100644
+--- a/sound/usb/quirks.h
++++ b/sound/usb/quirks.h
+@@ -20,6 +20,11 @@ int snd_usb_apply_boot_quirk(struct usb_device *dev,
+ const struct snd_usb_audio_quirk *quirk,
+ unsigned int usb_id);
+
++int snd_usb_apply_boot_quirk_once(struct usb_device *dev,
++ struct usb_interface *intf,
++ const struct snd_usb_audio_quirk *quirk,
++ unsigned int usb_id);
++
+ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+ struct audioformat *fmt);
+
+--
+2.20.1
+
--- /dev/null
+From eff308a8cb02aece47240dc74aa0d5201d6ce137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 18:13:58 +0300
+Subject: ALSA: usb-audio: add implicit fb quirk for MOTU M Series
+
+From: Alexander Tsoy <alexander@tsoy.me>
+
+[ Upstream commit c249177944b650816069f6c49b769baaa94339dc ]
+
+This fixes crackling sound during playback.
+
+Further note: MOTU is known for reusing Product IDs for different
+devices or different generations of the device (e.g. MicroBook
+I/II/IIc shares a single Product ID). This patch was only tested with
+M4 audio interface, but the same Product ID is also used by M2. Hope
+it will work for M2 as well.
+
+Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
+Link: https://lore.kernel.org/r/20200115151358.56672-1-alexander@tsoy.me
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/pcm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index fa24bd491cf6a..ad8f38380aa3e 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -348,6 +348,10 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ ep = 0x84;
+ ifnum = 0;
+ goto add_sync_ep_from_ifnum;
++ case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
++ ep = 0x81;
++ ifnum = 2;
++ goto add_sync_ep_from_ifnum;
+ case USB_ID(0x0582, 0x01d8): /* BOSS Katana */
+ /* BOSS Katana amplifiers do not need quirks */
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From cd6607727e34da1e174fd835d37d82194c4481f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2020 15:09:17 +0000
+Subject: ALSA: usb-audio: add quirks for Line6 Helix devices fw>=2.82
+
+From: Nicola Lunghi <nick83ola@gmail.com>
+
+[ Upstream commit b81cbf7abfc94878a3c6f0789f2185ee55b1cc21 ]
+
+With firmware 2.82 Line6 changed the usb id of some of the Helix
+devices but the quirks is still needed.
+
+Add it to the quirk list for line6 helix family of devices.
+
+Thanks to Jens for pointing out the missing ids.
+
+Signed-off-by: Nicola Lunghi <nick83ola@gmail.com>
+Link: https://lore.kernel.org/r/20200125150917.5040-1-nick83ola@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/format.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/usb/format.c b/sound/usb/format.c
+index 25668ba5e68e3..f4f0cf3deaf0c 100644
+--- a/sound/usb/format.c
++++ b/sound/usb/format.c
+@@ -296,6 +296,9 @@ static int line6_parse_audio_format_rates_quirk(struct snd_usb_audio *chip,
+ case USB_ID(0x0E41, 0x4242): /* Line6 Helix Rack */
+ case USB_ID(0x0E41, 0x4244): /* Line6 Helix LT */
+ case USB_ID(0x0E41, 0x4246): /* Line6 HX-Stomp */
++ case USB_ID(0x0E41, 0x4248): /* Line6 Helix >= fw 2.82 */
++ case USB_ID(0x0E41, 0x4249): /* Line6 Helix Rack >= fw 2.82 */
++ case USB_ID(0x0E41, 0x424a): /* Line6 Helix LT >= fw 2.82 */
+ /* supported rates: 48Khz */
+ kfree(fp->rate_table);
+ fp->rate_table = kmalloc(sizeof(int), GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From 6698e2bad4b1966f0cd564b80c252f44869cc04e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 20:46:04 +0300
+Subject: ALSA: usb-audio: unlock on error in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit a3afa29942b84b4e2548beacccc3a68b8d77e3dc ]
+
+We need to unlock before we returning on this error path.
+
+Fixes: 73ac9f5e5b43 ("ALSA: usb-audio: Add boot quirk for MOTU M Series")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200115174604.rhanfgy4j3uc65cx@kili.mountain
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index e6a618a239948..54f9ce38471e6 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -599,7 +599,7 @@ static int usb_audio_probe(struct usb_interface *intf,
+ if (! chip) {
+ err = snd_usb_apply_boot_quirk_once(dev, intf, quirk, id);
+ if (err < 0)
+- return err;
++ goto __error;
+
+ /* it's a fresh one.
+ * now look for an empty slot and create a new card instance
+--
+2.20.1
+
--- /dev/null
+From a536b317ad692983ad2048a45c23e2db8894a01e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 20:42:57 -0700
+Subject: ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit df4654bd6e42125d9b85ce3a26eaca2935290b98 ]
+
+Clang warns:
+
+../sound/usb/usx2y/usX2Yhwdep.c:122:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ info->version = USX2Y_DRIVER_VERSION;
+ ^
+../sound/usb/usx2y/usX2Yhwdep.c:120:2: note: previous statement is here
+ if (us428->chip_status & USX2Y_STAT_CHIP_INIT)
+ ^
+1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+This was introduced before the beginning of git history so no fixes tag.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/831
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218034257.54535-1-natechancellor@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/usx2y/usX2Yhwdep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
+index d1caa8ed9e681..9985fc139487b 100644
+--- a/sound/usb/usx2y/usX2Yhwdep.c
++++ b/sound/usb/usx2y/usX2Yhwdep.c
+@@ -119,7 +119,7 @@ static int snd_usX2Y_hwdep_dsp_status(struct snd_hwdep *hw,
+ info->num_dsps = 2; // 0: Prepad Data, 1: FPGA Code
+ if (us428->chip_status & USX2Y_STAT_CHIP_INIT)
+ info->chip_ready = 1;
+- info->version = USX2Y_DRIVER_VERSION;
++ info->version = USX2Y_DRIVER_VERSION;
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c667e6dedbcccb3a3d47a7284d3444da62094326 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 13:37:59 +0100
+Subject: ARM: 8951/1: Fix Kexec compilation issue.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit 76950f7162cad51d2200ebd22c620c14af38f718 ]
+
+To perform the reserve_crashkernel() operation kexec uses SECTION_SIZE to
+find a memblock in a range.
+SECTION_SIZE is not defined for nommu systems. Trying to compile kexec in
+these conditions results in a build error:
+
+ linux/arch/arm/kernel/setup.c: In function ‘reserve_crashkernel’:
+ linux/arch/arm/kernel/setup.c:1016:25: error: ‘SECTION_SIZE’ undeclared
+ (first use in this function); did you mean ‘SECTIONS_WIDTH’?
+ crash_size, SECTION_SIZE);
+ ^~~~~~~~~~~~
+ SECTIONS_WIDTH
+ linux/arch/arm/kernel/setup.c:1016:25: note: each undeclared identifier
+ is reported only once for each function it appears in
+ linux/scripts/Makefile.build:265: recipe for target 'arch/arm/kernel/setup.o'
+ failed
+
+Make KEXEC depend on MMU to fix the compilation issue.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 9fadf322a2b76..05c9bbfe444df 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1907,7 +1907,7 @@ config XIP_DEFLATED_DATA
+ config KEXEC
+ bool "Kexec system call (EXPERIMENTAL)"
+ depends on (!SMP || PM_SLEEP_SMP)
+- depends on !CPU_V7M
++ depends on MMU
+ select KEXEC_CORE
+ help
+ kexec is a system call that implements the ability to shutdown your
+--
+2.20.1
+
--- /dev/null
+From 7cb14c794eaf50bc1d8da9a3326db1c8947cb75a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 13:39:26 +0100
+Subject: ARM: 8952/1: Disable kmemleak on XIP kernels
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit bc420c6ceefbb86cbbc8c00061bd779c17fa6997 ]
+
+Kmemleak relies on specific symbols to register the read only data
+during init (e.g. __start_ro_after_init).
+Trying to build an XIP kernel on arm results in the linking error
+reported below because when this option is selected read only data
+after init are not allowed since .data is read only (.rodata).
+
+ arm-linux-gnueabihf-ld: mm/kmemleak.o: in function `kmemleak_init':
+ kmemleak.c:(.init.text+0x148): undefined reference to `__end_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x14c):
+ undefined reference to `__end_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x150):
+ undefined reference to `__start_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x156):
+ undefined reference to `__start_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x162):
+ undefined reference to `__start_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x16a):
+ undefined reference to `__start_ro_after_init'
+ linux/Makefile:1078: recipe for target 'vmlinux' failed
+
+Fix the issue enabling kmemleak only on non XIP kernels.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 39002d769d956..9fadf322a2b76 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -75,7 +75,7 @@ config ARM
+ select HAVE_CONTEXT_TRACKING
+ select HAVE_COPY_THREAD_TLS
+ select HAVE_C_RECORDMCOUNT
+- select HAVE_DEBUG_KMEMLEAK
++ select HAVE_DEBUG_KMEMLEAK if !XIP_KERNEL
+ select HAVE_DMA_CONTIGUOUS if MMU
+ select HAVE_DYNAMIC_FTRACE if !XIP_KERNEL && !CPU_ENDIAN_BE32 && MMU
+ select HAVE_DYNAMIC_FTRACE_WITH_REGS if HAVE_DYNAMIC_FTRACE
+--
+2.20.1
+
--- /dev/null
+From 4d2d7c6c655520b0b03ff52f1aa78dc60ff73618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:35 +0000
+Subject: arm: dts: allwinner: H3: Add PMU node
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 0388a110747bec0c9d9de995842bb2a03a26aae1 ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H3
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core. The numbers come from the manual and have
+been checked in U-Boot and with perf in Linux.
+
+Tested with perf record and taskset on an OrangePi Zero.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3.dtsi | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
+index e37c30e811d3b..6056f206c9e39 100644
+--- a/arch/arm/boot/dts/sun8i-h3.dtsi
++++ b/arch/arm/boot/dts/sun8i-h3.dtsi
+@@ -80,7 +80,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@1 {
++ cpu1: cpu@1 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <1>;
+@@ -90,7 +90,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@2 {
++ cpu2: cpu@2 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <2>;
+@@ -100,7 +100,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@3 {
++ cpu3: cpu@3 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <3>;
+@@ -111,6 +111,15 @@
+ };
+ };
+
++ pmu {
++ compatible = "arm,cortex-a7-pmu";
++ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++ };
++
+ timer {
+ compatible = "arm,armv7-timer";
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+--
+2.20.1
+
--- /dev/null
+From 78d1ca610f9833ceccf2bd5133ca8e097ecfe760 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 08:50:17 -0800
+Subject: ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit cd58a174e58649426fb43d7456e5f7d7eab58af1 ]
+
+RDU2 production units come with resistor connecting WP pin to
+correpsonding GPIO DNPed for both SD card slots. Drop any WP related
+configuration and mark both slots with "disable-wp".
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 93be00a60c887..7b5c0e9b0fcff 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -627,7 +627,7 @@
+ pinctrl-0 = <&pinctrl_usdhc2>;
+ bus-width = <4>;
+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+- wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
++ disable-wp;
+ vmmc-supply = <®_3p3v_sd>;
+ vqmmc-supply = <®_3p3v>;
+ no-1-8-v;
+@@ -640,7 +640,7 @@
+ pinctrl-0 = <&pinctrl_usdhc3>;
+ bus-width = <4>;
+ cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+- wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
++ disable-wp;
+ vmmc-supply = <®_3p3v_sd>;
+ vqmmc-supply = <®_3p3v>;
+ no-1-8-v;
+@@ -1055,7 +1055,6 @@
+ MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x17059
+ MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x17059
+ MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x17059
+- MX6QDL_PAD_NANDF_D3__GPIO2_IO03 0x40010040
+ MX6QDL_PAD_NANDF_D2__GPIO2_IO02 0x40010040
+ >;
+ };
+@@ -1068,7 +1067,6 @@
+ MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
+ MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
+ MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
+- MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x40010040
+ MX6QDL_PAD_NANDF_D0__GPIO2_IO00 0x40010040
+
+ >;
+--
+2.20.1
+
--- /dev/null
+From a832ec9b0477d5654f0c6fa0bbb49cf51bc7fc2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 08:50:18 -0800
+Subject: ARM: dts: imx6: rdu2: Limit USBH1 to Full Speed
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit 6bb1e09c4c375db29770444f689f35f5cbe696bc ]
+
+Cabling used to connect devices to USBH1 on RDU2 does not meet USB
+spec cable quality and cable length requirements to operate at High
+Speed, so limit the port to Full Speed only.
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 7b5c0e9b0fcff..a66c4fac6baf0 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -774,6 +774,7 @@
+ &usbh1 {
+ vbus-supply = <®_5p0v_main>;
+ disable-over-current;
++ maximum-speed = "full-speed";
+ status = "okay";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From c98ed2be171c2895ad22575e574032d68042b78d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 14:52:21 +0100
+Subject: ARM: dts: r8a7779: Add device node for ARM global timer
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 8443ffd1bbd5be74e9b12db234746d12e8ea93e2 ]
+
+Add a device node for the global timer, which is part of the Cortex-A9
+MPCore.
+
+The global timer can serve as an accurate (4 ns) clock source for
+scheduling and delay loops.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191211135222.26770-4-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7779.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index ebf5b7cfe2159..63341635bddf8 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -68,6 +68,14 @@
+ <0xf0000100 0x100>;
+ };
+
++ timer@f0000200 {
++ compatible = "arm,cortex-a9-global-timer";
++ reg = <0xf0000200 0x100>;
++ interrupts = <GIC_PPI 11
++ (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
++ clocks = <&cpg_clocks R8A7779_CLK_ZS>;
++ };
++
+ timer@f0000600 {
+ compatible = "arm,cortex-a9-twd-timer";
+ reg = <0xf0000600 0x20>;
+--
+2.20.1
+
--- /dev/null
+From 7ef1bae231c6e3ab9e9059356197fbd19d1da60f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:44:20 +0100
+Subject: ARM: dts: rockchip: add reg property to brcmf sub node for
+ rk3188-bqedison2qc
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit cf206bca178cd5b5a436494b2e0cea75295944f4 ]
+
+An experimental test with the command below gives this error:
+rk3188-bqedison2qc.dt.yaml: dwmmc@10218000: wifi@1:
+'reg' is a required property
+
+So fix this by adding a reg property to the brcmf sub node.
+Also add #address-cells and #size-cells to prevent more warnings.
+
+make ARCH=arm dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200110134420.11280-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3188-bqedison2qc.dts | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/boot/dts/rk3188-bqedison2qc.dts b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+index c8b62bbd6a4a4..ad1afd403052a 100644
+--- a/arch/arm/boot/dts/rk3188-bqedison2qc.dts
++++ b/arch/arm/boot/dts/rk3188-bqedison2qc.dts
+@@ -466,9 +466,12 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&sd1_clk>, <&sd1_cmd>, <&sd1_bus4>;
+ vmmcq-supply = <&vccio_wl>;
++ #address-cells = <1>;
++ #size-cells = <0>;
+ status = "okay";
+
+ brcmf: wifi@1 {
++ reg = <1>;
+ compatible = "brcm,bcm4329-fmac";
+ interrupt-parent = <&gpio3>;
+ interrupts = <RK_PD2 GPIO_ACTIVE_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From d8bf43acee190a362fd8190c64e48d6c89015460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 14:26:47 +0100
+Subject: ARM: dts: stm32: Add power-supply for DSI panel on stm32f469-disco
+
+From: Benjamin Gaignard <benjamin.gaignard@st.com>
+
+[ Upstream commit 0ff15a86d0c5a3f004fee2e92d65b88e56a3bc58 ]
+
+Add a fixed regulator and use it as power supply for DSI panel.
+
+Fixes: 18c8866266 ("ARM: dts: stm32: Add display support on stm32f469-disco")
+
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32f469-disco.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/stm32f469-disco.dts b/arch/arm/boot/dts/stm32f469-disco.dts
+index a3ff04940aec1..c6dc6d1a051b0 100644
+--- a/arch/arm/boot/dts/stm32f469-disco.dts
++++ b/arch/arm/boot/dts/stm32f469-disco.dts
+@@ -76,6 +76,13 @@
+ regulator-max-microvolt = <3300000>;
+ };
+
++ vdd_dsi: vdd-dsi {
++ compatible = "regulator-fixed";
++ regulator-name = "vdd_dsi";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ };
++
+ soc {
+ dma-ranges = <0xc0000000 0x0 0x10000000>;
+ };
+@@ -155,6 +162,7 @@
+ compatible = "orisetech,otm8009a";
+ reg = <0>; /* dsi virtual channel (0..3) */
+ reset-gpios = <&gpioh 7 GPIO_ACTIVE_LOW>;
++ power-supply = <&vdd_dsi>;
+ status = "okay";
+
+ port {
+--
+2.20.1
+
--- /dev/null
+From 6bea8cb5fc79b36d43811b65596d9f14328892e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:00:06 +0100
+Subject: ARM: exynos_defconfig: Bring back explicitly wanted options
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 9f9e2df2e64df197ff6548ef494f76be5b35d08a ]
+
+Few options KALLSYMS_ALL, SCSI, PM_DEVFREQ and mutex/spinlock debugging
+were removed with savedefconfig because they were selected by other
+options. However these are user-visible options and they might not be
+selected in the future. Exactly this happened with commit 0e4a459f56c3
+("tracing: Remove unnecessary DEBUG_FS dependency") removing the
+dependency between DEBUG_FS and TRACING.
+
+To avoid losing these options in the future, explicitly mention them in
+defconfig.
+
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/configs/exynos_defconfig | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm/configs/exynos_defconfig b/arch/arm/configs/exynos_defconfig
+index 736ed7a7bcf8e..34d4acbcee347 100644
+--- a/arch/arm/configs/exynos_defconfig
++++ b/arch/arm/configs/exynos_defconfig
+@@ -38,6 +38,7 @@ CONFIG_CRYPTO_SHA256_ARM=m
+ CONFIG_CRYPTO_SHA512_ARM=m
+ CONFIG_CRYPTO_AES_ARM_BS=m
+ CONFIG_CRYPTO_CHACHA20_NEON=m
++CONFIG_KALLSYMS_ALL=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_UNLOAD=y
+ CONFIG_PARTITION_ADVANCED=y
+@@ -92,6 +93,7 @@ CONFIG_BLK_DEV_LOOP=y
+ CONFIG_BLK_DEV_CRYPTOLOOP=y
+ CONFIG_BLK_DEV_RAM=y
+ CONFIG_BLK_DEV_RAM_SIZE=8192
++CONFIG_SCSI=y
+ CONFIG_BLK_DEV_SD=y
+ CONFIG_CHR_DEV_SG=y
+ CONFIG_ATA=y
+@@ -290,6 +292,7 @@ CONFIG_CROS_EC_SPI=y
+ CONFIG_COMMON_CLK_MAX77686=y
+ CONFIG_COMMON_CLK_S2MPS11=y
+ CONFIG_EXYNOS_IOMMU=y
++CONFIG_PM_DEVFREQ=y
+ CONFIG_DEVFREQ_GOV_PERFORMANCE=y
+ CONFIG_DEVFREQ_GOV_POWERSAVE=y
+ CONFIG_DEVFREQ_GOV_USERSPACE=y
+@@ -354,4 +357,7 @@ CONFIG_SOFTLOCKUP_DETECTOR=y
+ # CONFIG_DETECT_HUNG_TASK is not set
+ CONFIG_PROVE_LOCKING=y
+ CONFIG_DEBUG_ATOMIC_SLEEP=y
++CONFIG_DEBUG_RT_MUTEXES=y
++CONFIG_DEBUG_SPINLOCK=y
++CONFIG_DEBUG_MUTEXES=y
+ CONFIG_DEBUG_USER=y
+--
+2.20.1
+
--- /dev/null
+From 8946c9834ff7182a4119fb3091abdf314dd022c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 15:05:37 +0200
+Subject: ARM: OMAP2+: pdata-quirks: add PRM data for reset support
+
+From: Tero Kristo <t-kristo@ti.com>
+
+[ Upstream commit 8de44fb70659a5bc0c53a443e6129ea1bf00fd8b ]
+
+The parent clockdomain for reset must be in force wakeup mode, otherwise
+the reset may never complete. Add pdata quirks for this purpose for PRM
+driver.
+
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/pdata-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
+index 247e3f8acffe6..2657752b90670 100644
+--- a/arch/arm/mach-omap2/pdata-quirks.c
++++ b/arch/arm/mach-omap2/pdata-quirks.c
+@@ -24,6 +24,7 @@
+ #include <linux/platform_data/ti-sysc.h>
+ #include <linux/platform_data/wkup_m3.h>
+ #include <linux/platform_data/asoc-ti-mcbsp.h>
++#include <linux/platform_data/ti-prm.h>
+
+ #include "clockdomain.h"
+ #include "common.h"
+@@ -463,6 +464,12 @@ void omap_pcs_legacy_init(int irq, void (*rearm)(void))
+ pcs_pdata.rearm = rearm;
+ }
+
++static struct ti_prm_platform_data ti_prm_pdata = {
++ .clkdm_deny_idle = clkdm_deny_idle,
++ .clkdm_allow_idle = clkdm_allow_idle,
++ .clkdm_lookup = clkdm_lookup,
++};
++
+ /*
+ * GPIOs for TWL are initialized by the I2C bus and need custom
+ * handing until DSS has device tree bindings.
+@@ -565,6 +572,7 @@ static struct of_dev_auxdata omap_auxdata_lookup[] = {
+ /* Common auxdata */
+ OF_DEV_AUXDATA("ti,sysc", 0, NULL, &ti_sysc_pdata),
+ OF_DEV_AUXDATA("pinctrl-single", 0, NULL, &pcs_pdata),
++ OF_DEV_AUXDATA("ti,omap-prm-inst", 0, NULL, &ti_prm_pdata),
+ { /* sentinel */ },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 9f99bacfedc58cb328d693e46d08d012061e9d03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:34 +0000
+Subject: arm64: dts: allwinner: H5: Add PMU node
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit c35a516a46187c8eeb7a56c64505ec6f7e22a0c7 ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H5
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core.
+As with the A64, the interrupt numbers from the manual were wrong (off
+by 4), the actual SPI IDs have been gathered in U-Boot, and were
+verified with perf in Linux.
+
+Tested with perf record and taskset on an OrangePi PC2.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+index f002a496d7cbb..1d34e3eefda3f 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi
+@@ -54,21 +54,21 @@
+ enable-method = "psci";
+ };
+
+- cpu@1 {
++ cpu1: cpu@1 {
+ compatible = "arm,cortex-a53";
+ device_type = "cpu";
+ reg = <1>;
+ enable-method = "psci";
+ };
+
+- cpu@2 {
++ cpu2: cpu@2 {
+ compatible = "arm,cortex-a53";
+ device_type = "cpu";
+ reg = <2>;
+ enable-method = "psci";
+ };
+
+- cpu@3 {
++ cpu3: cpu@3 {
+ compatible = "arm,cortex-a53";
+ device_type = "cpu";
+ reg = <3>;
+@@ -76,6 +76,16 @@
+ };
+ };
+
++ pmu {
++ compatible = "arm,cortex-a53-pmu",
++ "arm,armv8-pmuv3";
++ interrupts = <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 117 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 118 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 119 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++ };
++
+ psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+--
+2.20.1
+
--- /dev/null
+From af0fa32ff22d0e105bbe443bf26bf48c707e1b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:33 +0000
+Subject: arm64: dts: allwinner: H6: Add PMU mode
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 7aa9b9eb7d6a8fde7acbe0446444f7e3fae1fe3b ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H6
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core. The numbers come from the manual and have
+been checked in U-Boot and with perf in Linux.
+
+Tested with perf record and taskset on a Pine H64.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index 0d5ea19336a19..d192538916724 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -70,6 +70,16 @@
+ clock-output-names = "ext_osc32k";
+ };
+
++ pmu {
++ compatible = "arm,cortex-a53-pmu",
++ "arm,armv8-pmuv3";
++ interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++ };
++
+ psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+--
+2.20.1
+
--- /dev/null
+From 5df0486825d906b49d47afaeed6dc76f02013c26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 15:22:45 -0800
+Subject: arm64: dts: qcom: db845c: Enable ath10k 8bit host-cap quirk
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 2e198c395a084ff3015d71896e35de049c40e3a4 ]
+
+The WiFi firmware used on db845c implements the 8bit host-capability
+message, so enable the quirk for this.
+
+Reviewed-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Link: https://lore.kernel.org/r/20191113232245.4039932-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+index f5a85caff1a39..751651a6cd819 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+@@ -517,6 +517,8 @@
+ vdd-1.8-xo-supply = <&vreg_l7a_1p8>;
+ vdd-1.3-rfa-supply = <&vreg_l17a_1p3>;
+ vdd-3.3-ch0-supply = <&vreg_l25a_3p3>;
++
++ qcom,snoc-host-cap-8bit-quirk;
+ };
+
+ /* PINCTRL - additions to nodes defined in sdm845.dtsi */
+--
+2.20.1
+
--- /dev/null
+From 5e01e47cc3906d41f4ea38750b384792778c9e3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 16:15:01 +0100
+Subject: arm64: dts: qcom: msm8996: Disable USB2 PHY suspend by core
+
+From: Manu Gautam <mgautam@codeaurora.org>
+
+[ Upstream commit d026c96b25b7ce5df89526aad2df988d553edb4d ]
+
+QUSB2 PHY on msm8996 doesn't work well when autosuspend by
+dwc3 core using USB2PHYCFG register is enabled. One of the
+issue seen is that PHY driver reports PLL lock failure and
+fails phy_init() if dwc3 core has USB2 PHY suspend enabled.
+Fix this by using quirks to disable USB2 PHY LPM/suspend and
+dwc3 core already takes care of explicitly suspending PHY
+during suspend if quirks are specified.
+
+Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
+Signed-off-by: Paolo Pisati <p.pisati@gmail.com>
+Link: https://lore.kernel.org/r/20191209151501.26993-1-p.pisati@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 87f4d9c1b0d4c..fbb8ce78f95be 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -1598,6 +1598,8 @@
+ interrupts = <0 138 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&hsusb_phy2>;
+ phy-names = "usb2-phy";
++ snps,dis_u2_susphy_quirk;
++ snps,dis_enblslpm_quirk;
+ };
+ };
+
+@@ -1628,6 +1630,8 @@
+ interrupts = <0 131 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&hsusb_phy1>, <&ssusb_phy_0>;
+ phy-names = "usb2-phy", "usb3-phy";
++ snps,dis_u2_susphy_quirk;
++ snps,dis_enblslpm_quirk;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 76043f61cd1077713826935643bfe5b1a84ccccc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 15:21:28 +0100
+Subject: arm64: dts: rockchip: add reg property to brcmf sub-nodes
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 96ff264bccb22175bbe2185a1eb5204ca3c5f03f ]
+
+An experimental test with the command below gives this error:
+rk3399-firefly.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-orangepi.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-khadas-edge.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-khadas-edge-captain.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+rk3399-khadas-edge-v.dt.yaml: dwmmc@fe310000: wifi@1:
+'reg' is a required property
+So fix this by adding a reg property to the brcmf sub node.
+Also add #address-cells and #size-cells to prevent more warnings.
+
+make ARCH=arm64 dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200110142128.13522-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/rk3399-firefly.dts | 3 +++
+ arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi | 3 +++
+ arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts | 3 +++
+ 3 files changed, 9 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+index c706db0ee9ec6..76f5db696009b 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts
+@@ -669,9 +669,12 @@
+ vqmmc-supply = &vcc1v8_s3; /* IO line */
+ vmmc-supply = &vcc_sdio; /* card's power */
+
++ #address-cells = <1>;
++ #size-cells = <0>;
+ status = "okay";
+
+ brcmf: wifi@1 {
++ reg = <1>;
+ compatible = "brcm,bcm4329-fmac";
+ interrupt-parent = <&gpio0>;
+ interrupts = <RK_PA3 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+index 4944d78a0a1cb..e87a04477440e 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-khadas-edge.dtsi
+@@ -654,9 +654,12 @@
+ sd-uhs-sdr104;
+ vqmmc-supply = <&vcc1v8_s3>;
+ vmmc-supply = <&vccio_sd>;
++ #address-cells = <1>;
++ #size-cells = <0>;
+ status = "okay";
+
+ brcmf: wifi@1 {
++ reg = <1>;
+ compatible = "brcm,bcm4329-fmac";
+ interrupt-parent = <&gpio0>;
+ interrupts = <RK_PA3 GPIO_ACTIVE_HIGH>;
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
+index 0541dfce924d6..9c659f3115c88 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-orangepi.dts
+@@ -648,9 +648,12 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&sdio0_bus4 &sdio0_cmd &sdio0_clk>;
+ sd-uhs-sdr104;
++ #address-cells = <1>;
++ #size-cells = <0>;
+ status = "okay";
+
+ brcmf: wifi@1 {
++ reg = <1>;
+ compatible = "brcm,bcm4329-fmac";
+ interrupt-parent = <&gpio0>;
+ interrupts = <RK_PA3 GPIO_ACTIVE_HIGH>;
+--
+2.20.1
+
--- /dev/null
+From a13062412f3ac852f2d73d74a65e3472eafbe78b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 17:12:00 +0100
+Subject: arm64: dts: rockchip: fix dwmmc clock name for px30
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 7f2147350291569acd1df5a26dcdfc573916016f ]
+
+An experimental test with the command below gives this error:
+px30-evb.dt.yaml: dwmmc@ff390000: clock-names:2:
+'ciu-drive' was expected
+
+'ciu-drv' is not a valid dwmmc clock name,
+so fix this by changing it to 'ciu-drive'.
+
+make ARCH=arm64 dtbs_check
+DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/20200110161200.22755-1-jbx6244@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/rockchip/px30.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/px30.dtsi b/arch/arm64/boot/dts/rockchip/px30.dtsi
+index eb992d60e6baf..9e09909a510a1 100644
+--- a/arch/arm64/boot/dts/rockchip/px30.dtsi
++++ b/arch/arm64/boot/dts/rockchip/px30.dtsi
+@@ -768,7 +768,7 @@
+ interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>,
+ <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>;
+- clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ fifo-depth = <0x100>;
+ max-frequency = <150000000>;
+ pinctrl-names = "default";
+@@ -783,7 +783,7 @@
+ interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>,
+ <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>;
+- clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ fifo-depth = <0x100>;
+ max-frequency = <150000000>;
+ pinctrl-names = "default";
+@@ -798,7 +798,7 @@
+ interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>,
+ <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>;
+- clock-names = "biu", "ciu", "ciu-drv", "ciu-sample";
++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample";
+ fifo-depth = <0x100>;
+ max-frequency = <150000000>;
+ power-domains = <&power PX30_PD_MMC_NAND>;
+--
+2.20.1
+
--- /dev/null
+From b09fc051dd657c1c865ea33b7347d27810c620e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2019 12:47:19 +0000
+Subject: arm64: dts: rockchip: Fix NanoPC-T4 cooling maps
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit a793e19c15f25a126138ac4ae9facf9204754af3 ]
+
+Although it appeared to follow logically from the bindings, apparently
+the thermal framework can't properly cope with a single cooling device
+being shared between multiple maps. The CPU zone is probably easier to
+overheat, so remove the references to the (optional) fan from the GPU
+cooling zone to avoid things getting confused. Hopefully GPU-intensive
+tasks will leak enough heat across to the CPU zone to still hit the
+fan trips before reaching critical GPU temperatures.
+
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Link: https://lore.kernel.org/r/5bb39f3115df1a487d717d3ae87e523b03749379.1573908197.git.robin.murphy@arm.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/rockchip/rk3399-nanopc-t4.dts | 27 -------------------
+ 1 file changed, 27 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
+index 2a127985ab171..d3ed8e5e770f1 100644
+--- a/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-nanopc-t4.dts
+@@ -94,33 +94,6 @@
+ };
+ };
+
+-&gpu_thermal {
+- trips {
+- gpu_warm: gpu_warm {
+- temperature = <55000>;
+- hysteresis = <2000>;
+- type = "active";
+- };
+-
+- gpu_hot: gpu_hot {
+- temperature = <65000>;
+- hysteresis = <2000>;
+- type = "active";
+- };
+- };
+- cooling-maps {
+- map1 {
+- trip = <&gpu_warm>;
+- cooling-device = <&fan THERMAL_NO_LIMIT 1>;
+- };
+-
+- map2 {
+- trip = <&gpu_hot>;
+- cooling-device = <&fan 2 THERMAL_NO_LIMIT>;
+- };
+- };
+-};
+-
+ &pinctrl {
+ ir {
+ ir_rx: ir-rx {
+--
+2.20.1
+
--- /dev/null
+From 28cf94647788eb486e611c7204c5942d7a74de4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 15:33:56 +0530
+Subject: arm64: dts: ti: k3-j721e-main: Add missing power-domains for smmu
+
+From: Lokesh Vutla <lokeshvutla@ti.com>
+
+[ Upstream commit 3f03a58b25753843ce9e4511e9e246c51bd11011 ]
+
+Add power-domains entry for smmu, so that the it is accessible as long
+as the driver is active. Without this device shutdown is throwing the
+below warning:
+"[ 44.736348] arm-smmu-v3 36600000.smmu: failed to clear cr0"
+
+Reported-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+index 698ef9a1d5b75..96445111e3985 100644
+--- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
++++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi
+@@ -43,6 +43,7 @@
+ smmu0: smmu@36600000 {
+ compatible = "arm,smmu-v3";
+ reg = <0x0 0x36600000 0x0 0x100000>;
++ power-domains = <&k3_pds 229 TI_SCI_PD_EXCLUSIVE>;
+ interrupt-parent = <&gic500>;
+ interrupts = <GIC_SPI 772 IRQ_TYPE_EDGE_RISING>,
+ <GIC_SPI 768 IRQ_TYPE_EDGE_RISING>;
+--
+2.20.1
+
--- /dev/null
+From 9dc5c280e4a5a14bf2df1679d78dc30b85fe750f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 12:46:52 -0700
+Subject: arm64: fix alternatives with LLVM's integrated assembler
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit c54f90c2627cc316d365e3073614731e17dbc631 ]
+
+LLVM's integrated assembler fails with the following error when
+building KVM:
+
+ <inline asm>:12:6: error: expected absolute expression
+ .if kvm_update_va_mask == 0
+ ^
+ <inline asm>:21:6: error: expected absolute expression
+ .if kvm_update_va_mask == 0
+ ^
+ <inline asm>:24:2: error: unrecognized instruction mnemonic
+ NOT_AN_INSTRUCTION
+ ^
+ LLVM ERROR: Error parsing inline asm
+
+These errors come from ALTERNATIVE_CB and __ALTERNATIVE_CFG,
+which test for the existence of the callback parameter in inline
+assembly using the following expression:
+
+ " .if " __stringify(cb) " == 0\n"
+
+This works with GNU as, but isn't supported by LLVM. This change
+splits __ALTERNATIVE_CFG and ALTINSTR_ENTRY into separate macros
+to fix the LLVM build.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/472
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/alternative.h | 32 ++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index b9f8d787eea9f..324e7d5ab37ed 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -35,13 +35,16 @@ void apply_alternatives_module(void *start, size_t length);
+ static inline void apply_alternatives_module(void *start, size_t length) { }
+ #endif
+
+-#define ALTINSTR_ENTRY(feature,cb) \
++#define ALTINSTR_ENTRY(feature) \
+ " .word 661b - .\n" /* label */ \
+- " .if " __stringify(cb) " == 0\n" \
+ " .word 663f - .\n" /* new instruction */ \
+- " .else\n" \
++ " .hword " __stringify(feature) "\n" /* feature bit */ \
++ " .byte 662b-661b\n" /* source len */ \
++ " .byte 664f-663f\n" /* replacement len */
++
++#define ALTINSTR_ENTRY_CB(feature, cb) \
++ " .word 661b - .\n" /* label */ \
+ " .word " __stringify(cb) "- .\n" /* callback */ \
+- " .endif\n" \
+ " .hword " __stringify(feature) "\n" /* feature bit */ \
+ " .byte 662b-661b\n" /* source len */ \
+ " .byte 664f-663f\n" /* replacement len */
+@@ -62,15 +65,14 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ *
+ * Alternatives with callbacks do not generate replacement instructions.
+ */
+-#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled, cb) \
++#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled) \
+ ".if "__stringify(cfg_enabled)" == 1\n" \
+ "661:\n\t" \
+ oldinstr "\n" \
+ "662:\n" \
+ ".pushsection .altinstructions,\"a\"\n" \
+- ALTINSTR_ENTRY(feature,cb) \
++ ALTINSTR_ENTRY(feature) \
+ ".popsection\n" \
+- " .if " __stringify(cb) " == 0\n" \
+ ".pushsection .altinstr_replacement, \"a\"\n" \
+ "663:\n\t" \
+ newinstr "\n" \
+@@ -78,17 +80,25 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ ".popsection\n\t" \
+ ".org . - (664b-663b) + (662b-661b)\n\t" \
+ ".org . - (662b-661b) + (664b-663b)\n" \
+- ".else\n\t" \
++ ".endif\n"
++
++#define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb) \
++ ".if "__stringify(cfg_enabled)" == 1\n" \
++ "661:\n\t" \
++ oldinstr "\n" \
++ "662:\n" \
++ ".pushsection .altinstructions,\"a\"\n" \
++ ALTINSTR_ENTRY_CB(feature, cb) \
++ ".popsection\n" \
+ "663:\n\t" \
+ "664:\n\t" \
+- ".endif\n" \
+ ".endif\n"
+
+ #define _ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg, ...) \
+- __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg), 0)
++ __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg))
+
+ #define ALTERNATIVE_CB(oldinstr, cb) \
+- __ALTERNATIVE_CFG(oldinstr, "NOT_AN_INSTRUCTION", ARM64_CB_PATCH, 1, cb)
++ __ALTERNATIVE_CFG_CB(oldinstr, ARM64_CB_PATCH, 1, cb)
+ #else
+
+ #include <asm/assembler.h>
+--
+2.20.1
+
--- /dev/null
+From 4a3662515304360f6797846fa7c84d2343de3115 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 12:57:05 -0700
+Subject: arm64: lse: fix LSE atomics with LLVM's integrated assembler
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit e0d5896bd356cd577f9710a02d7a474cdf58426b ]
+
+Unlike gcc, clang considers each inline assembly block to be independent
+and therefore, when using the integrated assembler for inline assembly,
+any preambles that enable features must be repeated in each block.
+
+This change defines __LSE_PREAMBLE and adds it to each inline assembly
+block that has LSE instructions, which allows them to be compiled also
+with clang's assembler.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/671
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Tested-by: Andrew Murray <andrew.murray@arm.com>
+Tested-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/atomic_lse.h | 19 +++++++++++++++++++
+ arch/arm64/include/asm/lse.h | 6 +++---
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h
+index 574808b9df4c8..da3280f639cd7 100644
+--- a/arch/arm64/include/asm/atomic_lse.h
++++ b/arch/arm64/include/asm/atomic_lse.h
+@@ -14,6 +14,7 @@
+ static inline void __lse_atomic_##op(int i, atomic_t *v) \
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " " #asm_op " %w[i], %[v]\n" \
+ : [i] "+r" (i), [v] "+Q" (v->counter) \
+ : "r" (v)); \
+@@ -30,6 +31,7 @@ ATOMIC_OP(add, stadd)
+ static inline int __lse_atomic_fetch_##op##name(int i, atomic_t *v) \
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " " #asm_op #mb " %w[i], %w[i], %[v]" \
+ : [i] "+r" (i), [v] "+Q" (v->counter) \
+ : "r" (v) \
+@@ -58,6 +60,7 @@ static inline int __lse_atomic_add_return##name(int i, atomic_t *v) \
+ u32 tmp; \
+ \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " ldadd" #mb " %w[i], %w[tmp], %[v]\n" \
+ " add %w[i], %w[i], %w[tmp]" \
+ : [i] "+r" (i), [v] "+Q" (v->counter), [tmp] "=&r" (tmp) \
+@@ -77,6 +80,7 @@ ATOMIC_OP_ADD_RETURN( , al, "memory")
+ static inline void __lse_atomic_and(int i, atomic_t *v)
+ {
+ asm volatile(
++ __LSE_PREAMBLE
+ " mvn %w[i], %w[i]\n"
+ " stclr %w[i], %[v]"
+ : [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -87,6 +91,7 @@ static inline void __lse_atomic_and(int i, atomic_t *v)
+ static inline int __lse_atomic_fetch_and##name(int i, atomic_t *v) \
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " mvn %w[i], %w[i]\n" \
+ " ldclr" #mb " %w[i], %w[i], %[v]" \
+ : [i] "+&r" (i), [v] "+Q" (v->counter) \
+@@ -106,6 +111,7 @@ ATOMIC_FETCH_OP_AND( , al, "memory")
+ static inline void __lse_atomic_sub(int i, atomic_t *v)
+ {
+ asm volatile(
++ __LSE_PREAMBLE
+ " neg %w[i], %w[i]\n"
+ " stadd %w[i], %[v]"
+ : [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -118,6 +124,7 @@ static inline int __lse_atomic_sub_return##name(int i, atomic_t *v) \
+ u32 tmp; \
+ \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " neg %w[i], %w[i]\n" \
+ " ldadd" #mb " %w[i], %w[tmp], %[v]\n" \
+ " add %w[i], %w[i], %w[tmp]" \
+@@ -139,6 +146,7 @@ ATOMIC_OP_SUB_RETURN( , al, "memory")
+ static inline int __lse_atomic_fetch_sub##name(int i, atomic_t *v) \
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " neg %w[i], %w[i]\n" \
+ " ldadd" #mb " %w[i], %w[i], %[v]" \
+ : [i] "+&r" (i), [v] "+Q" (v->counter) \
+@@ -159,6 +167,7 @@ ATOMIC_FETCH_OP_SUB( , al, "memory")
+ static inline void __lse_atomic64_##op(s64 i, atomic64_t *v) \
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " " #asm_op " %[i], %[v]\n" \
+ : [i] "+r" (i), [v] "+Q" (v->counter) \
+ : "r" (v)); \
+@@ -175,6 +184,7 @@ ATOMIC64_OP(add, stadd)
+ static inline long __lse_atomic64_fetch_##op##name(s64 i, atomic64_t *v)\
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " " #asm_op #mb " %[i], %[i], %[v]" \
+ : [i] "+r" (i), [v] "+Q" (v->counter) \
+ : "r" (v) \
+@@ -203,6 +213,7 @@ static inline long __lse_atomic64_add_return##name(s64 i, atomic64_t *v)\
+ unsigned long tmp; \
+ \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " ldadd" #mb " %[i], %x[tmp], %[v]\n" \
+ " add %[i], %[i], %x[tmp]" \
+ : [i] "+r" (i), [v] "+Q" (v->counter), [tmp] "=&r" (tmp) \
+@@ -222,6 +233,7 @@ ATOMIC64_OP_ADD_RETURN( , al, "memory")
+ static inline void __lse_atomic64_and(s64 i, atomic64_t *v)
+ {
+ asm volatile(
++ __LSE_PREAMBLE
+ " mvn %[i], %[i]\n"
+ " stclr %[i], %[v]"
+ : [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -232,6 +244,7 @@ static inline void __lse_atomic64_and(s64 i, atomic64_t *v)
+ static inline long __lse_atomic64_fetch_and##name(s64 i, atomic64_t *v) \
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " mvn %[i], %[i]\n" \
+ " ldclr" #mb " %[i], %[i], %[v]" \
+ : [i] "+&r" (i), [v] "+Q" (v->counter) \
+@@ -251,6 +264,7 @@ ATOMIC64_FETCH_OP_AND( , al, "memory")
+ static inline void __lse_atomic64_sub(s64 i, atomic64_t *v)
+ {
+ asm volatile(
++ __LSE_PREAMBLE
+ " neg %[i], %[i]\n"
+ " stadd %[i], %[v]"
+ : [i] "+&r" (i), [v] "+Q" (v->counter)
+@@ -263,6 +277,7 @@ static inline long __lse_atomic64_sub_return##name(s64 i, atomic64_t *v) \
+ unsigned long tmp; \
+ \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " neg %[i], %[i]\n" \
+ " ldadd" #mb " %[i], %x[tmp], %[v]\n" \
+ " add %[i], %[i], %x[tmp]" \
+@@ -284,6 +299,7 @@ ATOMIC64_OP_SUB_RETURN( , al, "memory")
+ static inline long __lse_atomic64_fetch_sub##name(s64 i, atomic64_t *v) \
+ { \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " neg %[i], %[i]\n" \
+ " ldadd" #mb " %[i], %[i], %[v]" \
+ : [i] "+&r" (i), [v] "+Q" (v->counter) \
+@@ -305,6 +321,7 @@ static inline s64 __lse_atomic64_dec_if_positive(atomic64_t *v)
+ unsigned long tmp;
+
+ asm volatile(
++ __LSE_PREAMBLE
+ "1: ldr %x[tmp], %[v]\n"
+ " subs %[ret], %x[tmp], #1\n"
+ " b.lt 2f\n"
+@@ -332,6 +349,7 @@ __lse__cmpxchg_case_##name##sz(volatile void *ptr, \
+ unsigned long tmp; \
+ \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " mov %" #w "[tmp], %" #w "[old]\n" \
+ " cas" #mb #sfx "\t%" #w "[tmp], %" #w "[new], %[v]\n" \
+ " mov %" #w "[ret], %" #w "[tmp]" \
+@@ -379,6 +397,7 @@ __lse__cmpxchg_double##name(unsigned long old1, \
+ register unsigned long x4 asm ("x4") = (unsigned long)ptr; \
+ \
+ asm volatile( \
++ __LSE_PREAMBLE \
+ " casp" #mb "\t%[old1], %[old2], %[new1], %[new2], %[v]\n"\
+ " eor %[old1], %[old1], %[oldval1]\n" \
+ " eor %[old2], %[old2], %[oldval2]\n" \
+diff --git a/arch/arm64/include/asm/lse.h b/arch/arm64/include/asm/lse.h
+index 80b3882781496..73834996c4b6d 100644
+--- a/arch/arm64/include/asm/lse.h
++++ b/arch/arm64/include/asm/lse.h
+@@ -6,6 +6,8 @@
+
+ #if defined(CONFIG_AS_LSE) && defined(CONFIG_ARM64_LSE_ATOMICS)
+
++#define __LSE_PREAMBLE ".arch armv8-a+lse\n"
++
+ #include <linux/compiler_types.h>
+ #include <linux/export.h>
+ #include <linux/jump_label.h>
+@@ -14,8 +16,6 @@
+ #include <asm/atomic_lse.h>
+ #include <asm/cpucaps.h>
+
+-__asm__(".arch_extension lse");
+-
+ extern struct static_key_false cpu_hwcap_keys[ARM64_NCAPS];
+ extern struct static_key_false arm64_const_caps_ready;
+
+@@ -34,7 +34,7 @@ static inline bool system_uses_lse_atomics(void)
+
+ /* In-line patching at runtime */
+ #define ARM64_LSE_ATOMIC_INSN(llsc, lse) \
+- ALTERNATIVE(llsc, lse, ARM64_HAS_LSE_ATOMICS)
++ ALTERNATIVE(llsc, __LSE_PREAMBLE lse, ARM64_HAS_LSE_ATOMICS)
+
+ #else /* CONFIG_AS_LSE && CONFIG_ARM64_LSE_ATOMICS */
+
+--
+2.20.1
+
--- /dev/null
+From 64afafa074cf04d53b50167e54b1dfa70319c7b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 17:36:59 -0800
+Subject: asm-generic/tlb: add missing CONFIG symbol
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 27796d03c9c4b2b937ed4cc2b10f21559ad5a8c9 ]
+
+Without this the symbol will not actually end up in .config files.
+
+Link: http://lkml.kernel.org/r/20200116064531.483522-6-aneesh.kumar@linux.ibm.com
+Fixes: a30e32bd79e9 ("asm-generic/tlb: Provide generic tlb_flush() based on flush_tlb_mm()")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/Kconfig | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index 43102756304c1..238dccfa76910 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -399,6 +399,9 @@ config HAVE_RCU_TABLE_FREE
+ config HAVE_MMU_GATHER_PAGE_SIZE
+ bool
+
++config MMU_GATHER_NO_RANGE
++ bool
++
+ config HAVE_MMU_GATHER_NO_GATHER
+ bool
+
+--
+2.20.1
+
--- /dev/null
+From 076d1821a2ee04d94bce9bb2680880e6cd41a2e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 21:32:42 +0800
+Subject: ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 8fea78029f5e6ed734ae1957bef23cfda1af4354 ]
+
+If CONFIG_SND_ATMEL_SOC_DMA=m, build error:
+
+sound/soc/atmel/atmel_ssc_dai.o: In function `atmel_ssc_set_audio':
+(.text+0x7cd): undefined reference to `atmel_pcm_dma_platform_register'
+
+Function atmel_pcm_dma_platform_register is defined under
+CONFIG SND_ATMEL_SOC_DMA, so select SND_ATMEL_SOC_DMA in
+CONFIG SND_ATMEL_SOC_SSC, same to CONFIG_SND_ATMEL_SOC_PDC.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Link: https://lore.kernel.org/r/20200113133242.144550-1-chenzhou10@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
+index f118c229ed829..d1dc8e6366dcb 100644
+--- a/sound/soc/atmel/Kconfig
++++ b/sound/soc/atmel/Kconfig
+@@ -19,6 +19,8 @@ config SND_ATMEL_SOC_DMA
+
+ config SND_ATMEL_SOC_SSC
+ tristate
++ select SND_ATMEL_SOC_DMA
++ select SND_ATMEL_SOC_PDC
+
+ config SND_ATMEL_SOC_SSC_PDC
+ tristate "SoC PCM DAI support for AT91 SSC controller using PDC"
+--
+2.20.1
+
--- /dev/null
+From b2501879ec05e13985057b2b6ca198136825c50f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 08:32:03 -0600
+Subject: ASoC: intel: sof_rt5682: Add quirk for number of HDMI DAI's
+
+From: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+
+[ Upstream commit c68e07970eca79106b0c35b88a12298569590081 ]
+
+TGL supports one more HDMI DAI than previous models.
+So add quirk support for number of HDMI DAI's.
+
+Signed-off-by: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+Signed-off-by: Jairaj Arava <jairaj.arava@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191126143205.21987-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_rt5682.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index 4f6e58c3954a2..377ff17dedb98 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -34,6 +34,10 @@
+ #define SOF_RT5682_SSP_AMP(quirk) \
+ (((quirk) << SOF_RT5682_SSP_AMP_SHIFT) & SOF_RT5682_SSP_AMP_MASK)
+ #define SOF_RT5682_MCLK_BYTCHT_EN BIT(9)
++#define SOF_RT5682_NUM_HDMIDEV_SHIFT 10
++#define SOF_RT5682_NUM_HDMIDEV_MASK (GENMASK(12, 10))
++#define SOF_RT5682_NUM_HDMIDEV(quirk) \
++ ((quirk << SOF_RT5682_NUM_HDMIDEV_SHIFT) & SOF_RT5682_NUM_HDMIDEV_MASK)
+
+ /* Default: MCLK on, MCLK 19.2M, SSP0 */
+ static unsigned long sof_rt5682_quirk = SOF_RT5682_MCLK_EN |
+@@ -585,6 +589,8 @@ static int sof_audio_probe(struct platform_device *pdev)
+ if (!ctx)
+ return -ENOMEM;
+
++ dmi_check_system(sof_rt5682_quirk_table);
++
+ if (soc_intel_is_byt() || soc_intel_is_cht()) {
+ is_legacy_cpu = 1;
+ dmic_be_num = 0;
+@@ -595,11 +601,13 @@ static int sof_audio_probe(struct platform_device *pdev)
+ SOF_RT5682_SSP_CODEC(2);
+ } else {
+ dmic_be_num = 2;
+- hdmi_num = 3;
++ hdmi_num = (sof_rt5682_quirk & SOF_RT5682_NUM_HDMIDEV_MASK) >>
++ SOF_RT5682_NUM_HDMIDEV_SHIFT;
++ /* default number of HDMI DAI's */
++ if (!hdmi_num)
++ hdmi_num = 3;
+ }
+
+- dmi_check_system(sof_rt5682_quirk_table);
+-
+ /* need to get main clock from pmc */
+ if (sof_rt5682_quirk & SOF_RT5682_MCLK_BYTCHT_EN) {
+ ctx->mclk = devm_clk_get(&pdev->dev, "pmc_plt_clk_3");
+--
+2.20.1
+
--- /dev/null
+From dcf7f582d5edc282f3608be5c30dbf39ac5e903d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 08:32:04 -0600
+Subject: ASoC: intel: sof_rt5682: Add support for tgl-max98357a-rt5682
+
+From: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+
+[ Upstream commit 6605f0ca3af3b964635287ec7c9dadc812b78eb0 ]
+
+This patch adds the driver data and updates quirk info
+for tgl with max98357a speaker amp and ALC5682 headset codec.
+
+Signed-off-by: Sathyanarayana Nujella <sathyanarayana.nujella@intel.com>
+Signed-off-by: Jairaj Arava <jairaj.arava@intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191126143205.21987-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_rt5682.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index 377ff17dedb98..9441ddfeea5e6 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -589,6 +589,9 @@ static int sof_audio_probe(struct platform_device *pdev)
+ if (!ctx)
+ return -ENOMEM;
+
++ if (pdev->id_entry && pdev->id_entry->driver_data)
++ sof_rt5682_quirk = (unsigned long)pdev->id_entry->driver_data;
++
+ dmi_check_system(sof_rt5682_quirk_table);
+
+ if (soc_intel_is_byt() || soc_intel_is_cht()) {
+@@ -680,6 +683,21 @@ static int sof_rt5682_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static const struct platform_device_id board_ids[] = {
++ {
++ .name = "sof_rt5682",
++ },
++ {
++ .name = "tgl_max98357a_rt5682",
++ .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN |
++ SOF_RT5682_SSP_CODEC(0) |
++ SOF_SPEAKER_AMP_PRESENT |
++ SOF_RT5682_SSP_AMP(1) |
++ SOF_RT5682_NUM_HDMIDEV(4)),
++ },
++ { }
++};
++
+ static struct platform_driver sof_audio = {
+ .probe = sof_audio_probe,
+ .remove = sof_rt5682_remove,
+@@ -687,6 +705,7 @@ static struct platform_driver sof_audio = {
+ .name = "sof_rt5682",
+ .pm = &snd_soc_pm_ops,
+ },
++ .id_table = board_ids,
+ };
+ module_platform_driver(sof_audio)
+
+@@ -696,3 +715,4 @@ MODULE_AUTHOR("Bard Liao <bard.liao@intel.com>");
+ MODULE_AUTHOR("Sathya Prakash M R <sathya.prakash.m.r@intel.com>");
+ MODULE_LICENSE("GPL v2");
+ MODULE_ALIAS("platform:sof_rt5682");
++MODULE_ALIAS("platform:tgl_max98357a_rt5682");
+--
+2.20.1
+
--- /dev/null
+From 6216886943141fcc35907d5cc926a64e2112d981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:50:19 +1100
+Subject: ASoC: Intel: sof_rt5682: Ignore the speaker amp when there isn't one.
+
+From: Sam McNally <sammc@chromium.org>
+
+[ Upstream commit d4b74e218a8d0d6cf58e546627ab9d4d4f2645ab ]
+
+Some members of the Google_Hatch family include a rt5682 jack codec, but
+no speaker amplifier. This uses the same driver (sof_rt5682) as a
+combination of rt5682 jack codec and max98357a speaker amplifier. Within
+the sof_rt5682 driver, these cases are not currently distinguishable,
+relying on a DMI quirk to decide the configuration. This causes an
+incorrect configuration when only the rt5682 is present on a
+Google_Hatch device.
+
+For CML, the jack codec is used as the primary key when matching,
+with a possible speaker amplifier described in quirk_data. The two cases
+of interest are the second and third 10EC5682 entries in
+snd_soc_acpi_intel_cml_machines[]. The second entry matches the
+combination of rt5682 and max98357a, resulting in the quirk_data field
+in the snd_soc_acpi_mach being non-null, pointing at
+max98357a_spk_codecs, the snd_soc_acpi_codecs for the matched speaker
+amplifier. The third entry matches just the rt5682, resulting in a null
+quirk_data.
+
+The sof_rt5682 driver's DMI data matching identifies that a speaker
+amplifier is present for all Google_Hatch family devices. Detect cases
+where there is no speaker amplifier by checking for a null quirk_data in
+the snd_soc_acpi_mach and remove the speaker amplifier bit in that case.
+
+Signed-off-by: Sam McNally <sammc@chromium.org>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200103124921.v3.1.Ib87c4a7fbb3fc818ea12198e291b87dc2d5bc8c2@changeid
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/sof_rt5682.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
+index 9441ddfeea5e6..06b7d6c6c9a04 100644
+--- a/sound/soc/intel/boards/sof_rt5682.c
++++ b/sound/soc/intel/boards/sof_rt5682.c
+@@ -594,6 +594,14 @@ static int sof_audio_probe(struct platform_device *pdev)
+
+ dmi_check_system(sof_rt5682_quirk_table);
+
++ mach = (&pdev->dev)->platform_data;
++
++ /* A speaker amp might not be present when the quirk claims one is.
++ * Detect this via whether the machine driver match includes quirk_data.
++ */
++ if ((sof_rt5682_quirk & SOF_SPEAKER_AMP_PRESENT) && !mach->quirk_data)
++ sof_rt5682_quirk &= ~SOF_SPEAKER_AMP_PRESENT;
++
+ if (soc_intel_is_byt() || soc_intel_is_cht()) {
+ is_legacy_cpu = 1;
+ dmic_be_num = 0;
+@@ -654,7 +662,6 @@ static int sof_audio_probe(struct platform_device *pdev)
+ INIT_LIST_HEAD(&ctx->hdmi_pcm_list);
+
+ sof_audio_card_rt5682.dev = &pdev->dev;
+- mach = (&pdev->dev)->platform_data;
+
+ /* set platform name for each dailink */
+ ret = snd_soc_fixup_dai_links_platform_name(&sof_audio_card_rt5682,
+--
+2.20.1
+
--- /dev/null
+From 115e900a7d9d7159198c6d3074017c8226d28feb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 13:59:52 -0600
+Subject: ASoC: soc-topology: fix endianness issues
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit 72bbeda0222bcd382ee33b3aff71346074410c21 ]
+
+Sparse complains about a series of easy warnings, fix.
+
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200102195952.9465-3-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-topology.c | 42 +++++++++++++++++++++-------------------
+ 1 file changed, 22 insertions(+), 20 deletions(-)
+
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index fef01e1dd15c5..d00203ef8305f 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -604,9 +604,11 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
+ ext_ops = tplg->bytes_ext_ops;
+ num_ops = tplg->bytes_ext_ops_count;
+ for (i = 0; i < num_ops; i++) {
+- if (!sbe->put && ext_ops[i].id == be->ext_ops.put)
++ if (!sbe->put &&
++ ext_ops[i].id == le32_to_cpu(be->ext_ops.put))
+ sbe->put = ext_ops[i].put;
+- if (!sbe->get && ext_ops[i].id == be->ext_ops.get)
++ if (!sbe->get &&
++ ext_ops[i].id == le32_to_cpu(be->ext_ops.get))
+ sbe->get = ext_ops[i].get;
+ }
+
+@@ -621,11 +623,11 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
+ num_ops = tplg->io_ops_count;
+ for (i = 0; i < num_ops; i++) {
+
+- if (k->put == NULL && ops[i].id == hdr->ops.put)
++ if (k->put == NULL && ops[i].id == le32_to_cpu(hdr->ops.put))
+ k->put = ops[i].put;
+- if (k->get == NULL && ops[i].id == hdr->ops.get)
++ if (k->get == NULL && ops[i].id == le32_to_cpu(hdr->ops.get))
+ k->get = ops[i].get;
+- if (k->info == NULL && ops[i].id == hdr->ops.info)
++ if (k->info == NULL && ops[i].id == le32_to_cpu(hdr->ops.info))
+ k->info = ops[i].info;
+ }
+
+@@ -638,11 +640,11 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr,
+ num_ops = ARRAY_SIZE(io_ops);
+ for (i = 0; i < num_ops; i++) {
+
+- if (k->put == NULL && ops[i].id == hdr->ops.put)
++ if (k->put == NULL && ops[i].id == le32_to_cpu(hdr->ops.put))
+ k->put = ops[i].put;
+- if (k->get == NULL && ops[i].id == hdr->ops.get)
++ if (k->get == NULL && ops[i].id == le32_to_cpu(hdr->ops.get))
+ k->get = ops[i].get;
+- if (k->info == NULL && ops[i].id == hdr->ops.info)
++ if (k->info == NULL && ops[i].id == le32_to_cpu(hdr->ops.info))
+ k->info = ops[i].info;
+ }
+
+@@ -931,7 +933,7 @@ static int soc_tplg_denum_create_texts(struct soc_enum *se,
+ if (se->dobj.control.dtexts == NULL)
+ return -ENOMEM;
+
+- for (i = 0; i < ec->items; i++) {
++ for (i = 0; i < le32_to_cpu(ec->items); i++) {
+
+ if (strnlen(ec->texts[i], SNDRV_CTL_ELEM_ID_NAME_MAXLEN) ==
+ SNDRV_CTL_ELEM_ID_NAME_MAXLEN) {
+@@ -1325,7 +1327,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create(
+ if (kc[i].name == NULL)
+ goto err_sm;
+ kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+- kc[i].access = mc->hdr.access;
++ kc[i].access = le32_to_cpu(mc->hdr.access);
+
+ /* we only support FL/FR channel mapping atm */
+ sm->reg = tplc_chan_get_reg(tplg, mc->channel,
+@@ -1337,10 +1339,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create(
+ sm->rshift = tplc_chan_get_shift(tplg, mc->channel,
+ SNDRV_CHMAP_FR);
+
+- sm->max = mc->max;
+- sm->min = mc->min;
+- sm->invert = mc->invert;
+- sm->platform_max = mc->platform_max;
++ sm->max = le32_to_cpu(mc->max);
++ sm->min = le32_to_cpu(mc->min);
++ sm->invert = le32_to_cpu(mc->invert);
++ sm->platform_max = le32_to_cpu(mc->platform_max);
+ sm->dobj.index = tplg->index;
+ INIT_LIST_HEAD(&sm->dobj.list);
+
+@@ -1401,7 +1403,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
+ goto err_se;
+
+ tplg->pos += (sizeof(struct snd_soc_tplg_enum_control) +
+- ec->priv.size);
++ le32_to_cpu(ec->priv.size));
+
+ dev_dbg(tplg->dev, " adding DAPM widget enum control %s\n",
+ ec->hdr.name);
+@@ -1411,7 +1413,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
+ if (kc[i].name == NULL)
+ goto err_se;
+ kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+- kc[i].access = ec->hdr.access;
++ kc[i].access = le32_to_cpu(ec->hdr.access);
+
+ /* we only support FL/FR channel mapping atm */
+ se->reg = tplc_chan_get_reg(tplg, ec->channel, SNDRV_CHMAP_FL);
+@@ -1420,8 +1422,8 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create(
+ se->shift_r = tplc_chan_get_shift(tplg, ec->channel,
+ SNDRV_CHMAP_FR);
+
+- se->items = ec->items;
+- se->mask = ec->mask;
++ se->items = le32_to_cpu(ec->items);
++ se->mask = le32_to_cpu(ec->mask);
+ se->dobj.index = tplg->index;
+
+ switch (le32_to_cpu(ec->hdr.ops.info)) {
+@@ -1523,9 +1525,9 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dbytes_create(
+ if (kc[i].name == NULL)
+ goto err_sbe;
+ kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER;
+- kc[i].access = be->hdr.access;
++ kc[i].access = le32_to_cpu(be->hdr.access);
+
+- sbe->max = be->max;
++ sbe->max = le32_to_cpu(be->max);
+ INIT_LIST_HEAD(&sbe->dobj.list);
+
+ /* map standard io handlers and check for external handlers */
+--
+2.20.1
+
--- /dev/null
+From 5cb1b856a9448fecd69adf1d27d18210a397ae55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 14:56:20 -0600
+Subject: ASoC: SOF: Intel: hda-dai: fix compilation warning in pcm_prepare
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+
+[ Upstream commit d873997192ddcacb5333575502be2f91ea4b47b8 ]
+
+Fix GCC warning with W=1, previous cleanup did not remove unnecessary
+variable.
+
+sound/soc/sof/intel/hda-dai.c: In function ‘hda_link_pcm_prepare’:
+
+sound/soc/sof/intel/hda-dai.c:265:31: warning: variable ‘hda_stream’
+set but not used [-Wunused-but-set-variable]
+ 265 | struct sof_intel_hda_stream *hda_stream;
+ | ^~~~~~~~~~
+
+Fixes: a3ebccb52efdf ("ASoC: SOF: Intel: hda: reset link DMA state in prepare")
+Cc: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200113205620.27285-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda-dai.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c
+index 896d21984b735..1923b0c36bcef 100644
+--- a/sound/soc/sof/intel/hda-dai.c
++++ b/sound/soc/sof/intel/hda-dai.c
+@@ -261,14 +261,11 @@ static int hda_link_pcm_prepare(struct snd_pcm_substream *substream,
+ {
+ struct hdac_ext_stream *link_dev =
+ snd_soc_dai_get_dma_data(dai, substream);
+- struct sof_intel_hda_stream *hda_stream;
+ struct snd_sof_dev *sdev =
+ snd_soc_component_get_drvdata(dai->component);
+ struct snd_soc_pcm_runtime *rtd = snd_pcm_substream_chip(substream);
+ int stream = substream->stream;
+
+- hda_stream = hstream_to_sof_hda_stream(link_dev);
+-
+ if (link_dev->link_prepared)
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From fe498ae45edc46b9b6d8ac5ddb669f402f84c67e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 12:40:54 +0100
+Subject: ASoC: SOF: Intel: hda: Fix SKL dai count
+
+From: Cezary Rojewski <cezary.rojewski@intel.com>
+
+[ Upstream commit a6947c9d86bcfd61b758b5693eba58defe7fd2ae ]
+
+With fourth pin added for iDisp for skl_dai, update SOF_SKL_DAI_NUM to
+account for the change. Without this, dais from the bottom of the list
+are skipped. In current state that's the case for 'Alt Analog CPU DAI'.
+
+Fixes: ac42b142cd76 ("ASoC: SOF: Intel: hda: Add iDisp4 DAI")
+Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200113114054.9716-1-cezary.rojewski@intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/intel/hda.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/intel/hda.h b/sound/soc/sof/intel/hda.h
+index 23e430d3e0568..4be53ef2eab6e 100644
+--- a/sound/soc/sof/intel/hda.h
++++ b/sound/soc/sof/intel/hda.h
+@@ -336,7 +336,7 @@
+
+ /* Number of DAIs */
+ #if IS_ENABLED(CONFIG_SND_SOC_SOF_HDA)
+-#define SOF_SKL_NUM_DAIS 14
++#define SOF_SKL_NUM_DAIS 15
+ #else
+ #define SOF_SKL_NUM_DAIS 8
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 962752704680d9feef4d8e7adb86caefd2e10a30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 12:42:28 +0530
+Subject: ath10k: Correct the DMA direction for management tx buffers
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 6ba8b3b6bd772f575f7736c8fd893c6981fcce16 ]
+
+The management packets, send to firmware via WMI, are
+mapped using the direction DMA_TO_DEVICE. Currently in
+case of wmi cleanup, these buffers are being unmapped
+using an incorrect DMA direction. This can cause unwanted
+behavior when the host driver is handling a restart
+of the wlan firmware.
+
+We might see a trace like below
+
+[<ffffff8008098b18>] __dma_inv_area+0x28/0x58
+[<ffffff8001176734>] ath10k_wmi_mgmt_tx_clean_up_pending+0x60/0xb0 [ath10k_core]
+[<ffffff80088c7c50>] idr_for_each+0x78/0xe4
+[<ffffff80011766a4>] ath10k_wmi_detach+0x4c/0x7c [ath10k_core]
+[<ffffff8001163d7c>] ath10k_core_stop+0x58/0x68 [ath10k_core]
+[<ffffff800114fb74>] ath10k_halt+0xec/0x13c [ath10k_core]
+[<ffffff8001165110>] ath10k_core_restart+0x11c/0x1a8 [ath10k_core]
+[<ffffff80080c36bc>] process_one_work+0x16c/0x31c
+
+Fix the incorrect DMA direction during the wmi
+management tx buffer cleanup.
+
+Tested HW: WCN3990
+Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1
+
+Fixes: dc405152bb6 ("ath10k: handle mgmt tx completion event")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 4f707c6394bba..90f1197a6ad84 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -9422,7 +9422,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr,
+
+ msdu = pkt_addr->vaddr;
+ dma_unmap_single(ar->dev, pkt_addr->paddr,
+- msdu->len, DMA_FROM_DEVICE);
++ msdu->len, DMA_TO_DEVICE);
+ ieee80211_free_txskb(ar->hw, msdu);
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 08b76448b477bc814bf1adacb2854dc0d6bbf646 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 09:21:32 +0200
+Subject: ath10k: correct the tlv len of ath10k_wmi_tlv_op_gen_config_pno_start
+
+From: Wen Gong <wgong@codeaurora.org>
+
+[ Upstream commit e01cc82c4d1ec3bddcbb7cd991cf5dc0131ed9a1 ]
+
+the tlv len is set to the total len of the wmi cmd, it will trigger
+firmware crash, correct the tlv len.
+
+Tested with QCA6174 SDIO with firmware
+WLAN.RMH.4.4.1-00017-QCARMSWP-1 and QCA6174
+PCIE with firmware WLAN.RM.4.4.1-00110-QCARMSWPZ-1.
+
+Fixes: ce834e280f2f875 ("ath10k: support NET_DETECT WoWLAN feature")
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+index 4d5d10c010645..eb0c963d9fd51 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+@@ -3650,6 +3650,7 @@ ath10k_wmi_tlv_op_gen_config_pno_start(struct ath10k *ar,
+ struct wmi_tlv *tlv;
+ struct sk_buff *skb;
+ __le32 *channel_list;
++ u16 tlv_len;
+ size_t len;
+ void *ptr;
+ u32 i;
+@@ -3707,10 +3708,12 @@ ath10k_wmi_tlv_op_gen_config_pno_start(struct ath10k *ar,
+ /* nlo_configured_parameters(nlo_list) */
+ cmd->no_of_ssids = __cpu_to_le32(min_t(u8, pno->uc_networks_count,
+ WMI_NLO_MAX_SSIDS));
++ tlv_len = __le32_to_cpu(cmd->no_of_ssids) *
++ sizeof(struct nlo_configured_parameters);
+
+ tlv = ptr;
+ tlv->tag = __cpu_to_le16(WMI_TLV_TAG_ARRAY_STRUCT);
+- tlv->len = __cpu_to_le16(len);
++ tlv->len = __cpu_to_le16(tlv_len);
+
+ ptr += sizeof(*tlv);
+ nlo_list = ptr;
+--
+2.20.1
+
--- /dev/null
+From e509e475f9e69558fbb3f0a4d99d74f04b54b5cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 07:40:16 -0800
+Subject: ath10k: Fix qmi init error handling
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit f8a595a87e93a33a10879f4b856be818d2f53c84 ]
+
+When ath10k_qmi_init() fails, the error handling does not free the irq
+resources, which causes an issue if we EPROBE_DEFER as we'll attempt to
+(re-)register irqs which are already registered.
+
+Fix this by doing a power off since we just powered on the hardware, and
+freeing the irqs as error handling.
+
+Fixes: ba94c753ccb4 ("ath10k: add QMI message handshake for wcn3990 client")
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/snoc.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c
+index fc15a0037f0e6..63607c3b8e818 100644
+--- a/drivers/net/wireless/ath/ath10k/snoc.c
++++ b/drivers/net/wireless/ath/ath10k/snoc.c
+@@ -1729,13 +1729,16 @@ static int ath10k_snoc_probe(struct platform_device *pdev)
+ ret = ath10k_qmi_init(ar, msa_size);
+ if (ret) {
+ ath10k_warn(ar, "failed to register wlfw qmi client: %d\n", ret);
+- goto err_core_destroy;
++ goto err_power_off;
+ }
+
+ ath10k_dbg(ar, ATH10K_DBG_SNOC, "snoc probe\n");
+
+ return 0;
+
++err_power_off:
++ ath10k_hw_power_off(ar);
++
+ err_free_irq:
+ ath10k_snoc_free_irq(ar);
+
+--
+2.20.1
+
--- /dev/null
+From 8722995e16cf621bd6ed316127a0a7a2f9410981 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:26 +0700
+Subject: b43legacy: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit 475eec112e4267232d10f4afe2f939a241692b6c ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43legacy/main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
+index 4325e91736eb3..8b6b657c4b85b 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1275,8 +1275,9 @@ static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
+ }
+
+ /* Interrupt handler bottom-half */
+-static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
++static void b43legacy_interrupt_tasklet(unsigned long data)
+ {
++ struct b43legacy_wldev *dev = (struct b43legacy_wldev *)data;
+ u32 reason;
+ u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
+ u32 merged_dma_reason = 0;
+@@ -3741,7 +3742,7 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
+ b43legacy_set_status(wldev, B43legacy_STAT_UNINIT);
+ wldev->bad_frames_preempt = modparam_bad_frames_preempt;
+ tasklet_init(&wldev->isr_tasklet,
+- (void (*)(unsigned long))b43legacy_interrupt_tasklet,
++ b43legacy_interrupt_tasklet,
+ (unsigned long)wldev);
+ if (modparam_pio)
+ wldev->__using_pio = true;
+--
+2.20.1
+
--- /dev/null
+From 2a352451d38a6846f14109097b86077d44062943 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:26 +0800
+Subject: bcache: cached_dev_free needs to put the sb page
+
+From: Liang Chen <liangchen.linux@gmail.com>
+
+[ Upstream commit e8547d42095e58bee658f00fef8e33d2a185c927 ]
+
+Same as cache device, the buffer page needs to be put while
+freeing cached_dev. Otherwise a page would be leaked every
+time a cached_dev is stopped.
+
+Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 64999c7a8033f..b86cf72033401 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1274,6 +1274,9 @@ static void cached_dev_free(struct closure *cl)
+
+ mutex_unlock(&bch_register_lock);
+
++ if (dc->sb_bio.bi_inline_vecs[0].bv_page)
++ put_page(bio_first_page_all(&dc->sb_bio));
++
+ if (!IS_ERR_OR_NULL(dc->bdev))
+ blkdev_put(dc->bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+
+--
+2.20.1
+
--- /dev/null
+From 52d449af46a844aea64fc2ae824927158eedc686 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 22:42:32 +0800
+Subject: bcache: explicity type cast in bset_bkey_last()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 7c02b0055f774ed9afb6e1c7724f33bf148ffdc0 ]
+
+In bset.h, macro bset_bkey_last() is defined as,
+ bkey_idx((struct bkey *) (i)->d, (i)->keys)
+
+Parameter i can be variable type of data structure, the macro always
+works once the type of struct i has member 'd' and 'keys'.
+
+bset_bkey_last() is also used in macro csum_set() to calculate the
+checksum of a on-disk data structure. When csum_set() is used to
+calculate checksum of on-disk bcache super block, the parameter 'i'
+data type is struct cache_sb_disk. Inside struct cache_sb_disk (also in
+struct cache_sb) the member keys is __u16 type. But bkey_idx() expects
+unsigned int (a 32bit width), so there is problem when sending
+parameters via stack to call bkey_idx().
+
+Sparse tool from Intel 0day kbuild system reports this incompatible
+problem. bkey_idx() is part of user space API, so the simplest fix is
+to cast the (i)->keys to unsigned int type in macro bset_bkey_last().
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/bset.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h
+index c71365e7c1fac..a50dcfda656f5 100644
+--- a/drivers/md/bcache/bset.h
++++ b/drivers/md/bcache/bset.h
+@@ -397,7 +397,8 @@ void bch_btree_keys_stats(struct btree_keys *b, struct bset_stats *state);
+
+ /* Bkey utility code */
+
+-#define bset_bkey_last(i) bkey_idx((struct bkey *) (i)->d, (i)->keys)
++#define bset_bkey_last(i) bkey_idx((struct bkey *) (i)->d, \
++ (unsigned int)(i)->keys)
+
+ static inline struct bkey *bset_bkey_idx(struct bset *i, unsigned int idx)
+ {
+--
+2.20.1
+
--- /dev/null
+From 7359cbce4b75a67d4f94af2667617de00ec20d9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 22:42:34 +0800
+Subject: bcache: fix incorrect data type usage in btree_flush_write()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit d1c3cc34f5a78b38d2b809b289d912c3560545df ]
+
+Dan Carpenter points out that from commit 2aa8c529387c ("bcache: avoid
+unnecessary btree nodes flushing in btree_flush_write()"), there is a
+incorrect data type usage which leads to the following static checker
+warning:
+ drivers/md/bcache/journal.c:444 btree_flush_write()
+ warn: 'ref_nr' unsigned <= 0
+
+drivers/md/bcache/journal.c
+ 422 static void btree_flush_write(struct cache_set *c)
+ 423 {
+ 424 struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR];
+ 425 unsigned int i, nr, ref_nr;
+ ^^^^^^
+
+ 426 atomic_t *fifo_front_p, *now_fifo_front_p;
+ 427 size_t mask;
+ 428
+ 429 if (c->journal.btree_flushing)
+ 430 return;
+ 431
+ 432 spin_lock(&c->journal.flush_write_lock);
+ 433 if (c->journal.btree_flushing) {
+ 434 spin_unlock(&c->journal.flush_write_lock);
+ 435 return;
+ 436 }
+ 437 c->journal.btree_flushing = true;
+ 438 spin_unlock(&c->journal.flush_write_lock);
+ 439
+ 440 /* get the oldest journal entry and check its refcount */
+ 441 spin_lock(&c->journal.lock);
+ 442 fifo_front_p = &fifo_front(&c->journal.pin);
+ 443 ref_nr = atomic_read(fifo_front_p);
+ 444 if (ref_nr <= 0) {
+ ^^^^^^^^^^^
+Unsigned can't be less than zero.
+
+ 445 /*
+ 446 * do nothing if no btree node references
+ 447 * the oldest journal entry
+ 448 */
+ 449 spin_unlock(&c->journal.lock);
+ 450 goto out;
+ 451 }
+ 452 spin_unlock(&c->journal.lock);
+
+As the warning information indicates, local varaible ref_nr in unsigned
+int type is wrong, which does not matche atomic_read() and the "<= 0"
+checking.
+
+This patch fixes the above error by defining local variable ref_nr as
+int type.
+
+Fixes: 2aa8c529387c ("bcache: avoid unnecessary btree nodes flushing in btree_flush_write()")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/journal.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 33ddc5269e8dc..6730820780b06 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -422,7 +422,8 @@ err:
+ static void btree_flush_write(struct cache_set *c)
+ {
+ struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR];
+- unsigned int i, nr, ref_nr;
++ unsigned int i, nr;
++ int ref_nr;
+ atomic_t *fifo_front_p, *now_fifo_front_p;
+ size_t mask;
+
+--
+2.20.1
+
--- /dev/null
+From f94dfd87192d0eeafe848c9d8385d5db58fe95b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 22:42:31 +0800
+Subject: bcache: fix memory corruption in bch_cache_accounting_clear()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 5bebf7486d4f4940b2a8e4009beb1dff5041853d ]
+
+Commit 83ff9318c44ba ("bcache: not use hard coded memset size in
+bch_cache_accounting_clear()") tries to make the code more easy to
+understand by removing the hard coded number with following change,
+ void bch_cache_accounting_clear(...)
+ {
+ memset(&acc->total.cache_hits,
+ 0,
+ - sizeof(unsigned long) * 7);
+ + sizeof(struct cache_stats));
+ }
+
+Unfortunately the change was wrong (it also tells us the original code
+was not easy to correctly understand). The hard coded number 7 is used
+because in struct cache_stats,
+ 15 struct cache_stats {
+ 16 struct kobject kobj;
+ 17
+ 18 unsigned long cache_hits;
+ 19 unsigned long cache_misses;
+ 20 unsigned long cache_bypass_hits;
+ 21 unsigned long cache_bypass_misses;
+ 22 unsigned long cache_readaheads;
+ 23 unsigned long cache_miss_collisions;
+ 24 unsigned long sectors_bypassed;
+ 25
+ 26 unsigned int rescale;
+ 27 };
+only members in LINE 18-24 want to be set to 0. It is wrong to use
+'sizeof(struct cache_stats)' to replace 'sizeof(unsigned long) * 7), the
+memory objects behind acc->total is staled by this change.
+
+Сорокин Артем Сергеевич reports that by the following steps, kernel
+panic will be triggered,
+1. Create new set: make-bcache -B /dev/nvme1n1 -C /dev/sda --wipe-bcache
+2. Run in /sys/fs/bcache/<uuid>:
+ echo 1 > clear_stats && cat stats_five_minute/cache_bypass_hits
+
+I can reproduce the panic and get following dmesg with KASAN enabled,
+[22613.172742] ==================================================================
+[22613.172862] BUG: KASAN: null-ptr-deref in sysfs_kf_seq_show+0x117/0x230
+[22613.172864] Read of size 8 at addr 0000000000000000 by task cat/6753
+
+[22613.172870] CPU: 1 PID: 6753 Comm: cat Not tainted 5.5.0-rc7-lp151.28.16-default+ #11
+[22613.172872] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
+[22613.172873] Call Trace:
+[22613.172964] dump_stack+0x8b/0xbb
+[22613.172968] ? sysfs_kf_seq_show+0x117/0x230
+[22613.172970] ? sysfs_kf_seq_show+0x117/0x230
+[22613.173031] __kasan_report+0x176/0x192
+[22613.173064] ? pr_cont_kernfs_name+0x40/0x60
+[22613.173067] ? sysfs_kf_seq_show+0x117/0x230
+[22613.173070] kasan_report+0xe/0x20
+[22613.173072] sysfs_kf_seq_show+0x117/0x230
+[22613.173105] seq_read+0x199/0x6d0
+[22613.173110] vfs_read+0xa5/0x1a0
+[22613.173113] ksys_read+0x110/0x160
+[22613.173115] ? kernel_write+0xb0/0xb0
+[22613.173177] do_syscall_64+0x77/0x290
+[22613.173238] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[22613.173241] RIP: 0033:0x7fc2c886ac61
+[22613.173244] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89
+[22613.173245] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[22613.173248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61
+[22613.173249] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003
+[22613.173250] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000
+[22613.173251] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000
+[22613.173253] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000
+[22613.173255] ==================================================================
+[22613.173256] Disabling lock debugging due to kernel taint
+[22613.173350] BUG: kernel NULL pointer dereference, address: 0000000000000000
+[22613.178380] #PF: supervisor read access in kernel mode
+[22613.180959] #PF: error_code(0x0000) - not-present page
+[22613.183444] PGD 0 P4D 0
+[22613.184867] Oops: 0000 [#1] SMP KASAN PTI
+[22613.186797] CPU: 1 PID: 6753 Comm: cat Tainted: G B 5.5.0-rc7-lp151.28.16-default+ #11
+[22613.191253] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/29/2019
+[22613.196706] RIP: 0010:sysfs_kf_seq_show+0x117/0x230
+[22613.199097] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48
+[22613.208016] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246
+[22613.210448] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6
+[22613.213691] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246
+[22613.216893] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd
+[22613.220075] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200
+[22613.223256] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000
+[22613.226290] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000
+[22613.229637] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[22613.231993] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0
+[22613.234909] Call Trace:
+[22613.235931] seq_read+0x199/0x6d0
+[22613.237259] vfs_read+0xa5/0x1a0
+[22613.239229] ksys_read+0x110/0x160
+[22613.240590] ? kernel_write+0xb0/0xb0
+[22613.242040] do_syscall_64+0x77/0x290
+[22613.243625] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[22613.245450] RIP: 0033:0x7fc2c886ac61
+[22613.246706] Code: fe ff ff 48 8d 3d c7 a0 09 00 48 83 ec 08 e8 46 03 02 00 66 0f 1f 44 00 00 8b 05 ca fb 2c 00 48 63 ff 85 c0 75 13 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 55 53 48 89 d5 48 89
+[22613.253296] RSP: 002b:00007ffebe776d68 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
+[22613.255835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fc2c886ac61
+[22613.258472] RDX: 0000000000020000 RSI: 00007fc2c8cca000 RDI: 0000000000000003
+[22613.260807] RBP: 0000000000020000 R08: ffffffffffffffff R09: 0000000000000000
+[22613.263188] R10: 000000000000038c R11: 0000000000000246 R12: 00007fc2c8cca000
+[22613.265598] R13: 0000000000000003 R14: 00007fc2c8cca00f R15: 0000000000020000
+[22613.268729] Modules linked in: scsi_transport_iscsi af_packet iscsi_ibft iscsi_boot_sysfs vmw_vsock_vmci_transport vsock fuse bnep kvm_intel kvm irqbypass crc32_pclmul crc32c_intel ghash_clmulni_intel snd_ens1371 snd_ac97_codec ac97_bus bcache snd_pcm btusb btrtl btbcm btintel crc64 aesni_intel glue_helper crypto_simd vmw_balloon cryptd bluetooth snd_timer snd_rawmidi snd joydev pcspkr e1000 rfkill vmw_vmci soundcore ecdh_generic ecc gameport i2c_piix4 mptctl ac button hid_generic usbhid sr_mod cdrom ata_generic ehci_pci vmwgfx uhci_hcd drm_kms_helper syscopyarea serio_raw sysfillrect sysimgblt fb_sys_fops ttm ehci_hcd mptspi scsi_transport_spi mptscsih ata_piix mptbase ahci usbcore libahci drm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua
+[22613.292429] CR2: 0000000000000000
+[22613.293563] ---[ end trace a074b26a8508f378 ]---
+[22613.295138] RIP: 0010:sysfs_kf_seq_show+0x117/0x230
+[22613.296769] Code: ff 48 8b 0b 48 8b 44 24 08 48 01 e9 eb a6 31 f6 48 89 cf ba 00 10 00 00 48 89 4c 24 10 e8 b1 e6 e9 ff 4c 89 ff e8 19 07 ea ff <49> 8b 07 48 85 c0 48 89 44 24 08 0f 84 91 00 00 00 49 8b 6d 00 48
+[22613.303553] RSP: 0018:ffff8881d4f8fd78 EFLAGS: 00010246
+[22613.305280] RAX: 0000000000000000 RBX: ffff8881eb99b180 RCX: ffffffff810d9ef6
+[22613.307924] RDX: 0000000000000001 RSI: 0000000000000246 RDI: 0000000000000246
+[22613.310272] RBP: 0000000000001000 R08: fffffbfff072ddcd R09: fffffbfff072ddcd
+[22613.312685] R10: 0000000000000001 R11: fffffbfff072ddcc R12: ffff8881de5c0200
+[22613.315076] R13: ffff8881ed175500 R14: ffff8881eb99b198 R15: 0000000000000000
+[22613.318116] FS: 00007fc2c8d3d500(0000) GS:ffff8881f2a80000(0000) knlGS:0000000000000000
+[22613.320743] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[22613.322628] CR2: 0000000000000000 CR3: 00000001ec89a004 CR4: 00000000003606e0
+
+Here this patch fixes the following problem by explicity set all the 7
+members to 0 in bch_cache_accounting_clear().
+
+Reported-by: Сорокин Артем Сергеевич <a.sorokin@bank-hlynov.ru>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/stats.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/stats.c b/drivers/md/bcache/stats.c
+index ba1c93791d8db..503aafe188dce 100644
+--- a/drivers/md/bcache/stats.c
++++ b/drivers/md/bcache/stats.c
+@@ -109,9 +109,13 @@ int bch_cache_accounting_add_kobjs(struct cache_accounting *acc,
+
+ void bch_cache_accounting_clear(struct cache_accounting *acc)
+ {
+- memset(&acc->total.cache_hits,
+- 0,
+- sizeof(struct cache_stats));
++ acc->total.cache_hits = 0;
++ acc->total.cache_misses = 0;
++ acc->total.cache_bypass_hits = 0;
++ acc->total.cache_bypass_misses = 0;
++ acc->total.cache_readaheads = 0;
++ acc->total.cache_miss_collisions = 0;
++ acc->total.sectors_bypassed = 0;
+ }
+
+ void bch_cache_accounting_destroy(struct cache_accounting *acc)
+--
+2.20.1
+
--- /dev/null
+From 9f2910233910edc283fda3542376a6d9295ab58b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:30 +0800
+Subject: bcache: fix use-after-free in register_bcache()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit ae3cd299919af6eb670d5af0bc9d7ba14086bd8e ]
+
+The patch "bcache: rework error unwinding in register_bcache" introduces
+a use-after-free regression in register_bcache(). Here are current code,
+ 2510 out_free_path:
+ 2511 kfree(path);
+ 2512 out_module_put:
+ 2513 module_put(THIS_MODULE);
+ 2514 out:
+ 2515 pr_info("error %s: %s", path, err);
+ 2516 return ret;
+If some error happens and the above code path is executed, at line 2511
+path is released, but referenced at line 2515. Then KASAN reports a use-
+after-free error message.
+
+This patch changes line 2515 in the following way to fix the problem,
+ 2515 pr_info("error %s: %s", path?path:"", err);
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 86f7e09d31516..485ebc2b2144c 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2472,10 +2472,11 @@ out_free_sb:
+ kfree(sb);
+ out_free_path:
+ kfree(path);
++ path = NULL;
+ out_module_put:
+ module_put(THIS_MODULE);
+ out:
+- pr_info("error %s: %s", path, err);
++ pr_info("error %s: %s", path?path:"", err);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fa8779401a47b6dbfae33520d86e8c16f3a257ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:29 +0800
+Subject: bcache: properly initialize 'path' and 'err' in register_bcache()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 29cda393bcaad160c4bf3676ddd99855adafc72f ]
+
+Patch "bcache: rework error unwinding in register_bcache" from
+Christoph Hellwig changes the local variables 'path' and 'err'
+in undefined initial state. If the code in register_bcache() jumps
+to label 'out:' or 'out_module_put:' by goto, these two variables
+might be reference with undefined value by the following line,
+
+ out_module_put:
+ module_put(THIS_MODULE);
+ out:
+ pr_info("error %s: %s", path, err);
+ return ret;
+
+Therefore this patch initializes these two local variables properly
+in register_bcache() to avoid such issue.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 485ebc2b2144c..658b0f4a01f56 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2373,18 +2373,20 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ const char *buffer, size_t size)
+ {
+ const char *err;
+- char *path;
++ char *path = NULL;
+ struct cache_sb *sb;
+ struct block_device *bdev = NULL;
+ struct page *sb_page;
+ ssize_t ret;
+
+ ret = -EBUSY;
++ err = "failed to reference bcache module";
+ if (!try_module_get(THIS_MODULE))
+ goto out;
+
+ /* For latest state of bcache_is_reboot */
+ smp_mb();
++ err = "bcache is in reboot";
+ if (bcache_is_reboot)
+ goto out_module_put;
+
+--
+2.20.1
+
--- /dev/null
+From 88f0c29df7e3ff3a9f2dbc1e0bfb10dbf0d709ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:28 +0800
+Subject: bcache: rework error unwinding in register_bcache
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 50246693f81fe887f4db78bf7089051d7f1894cc ]
+
+Split the successful and error return path, and use one goto label for each
+resource to unwind. This also fixes some small errors like leaking the
+module reference count in the reboot case (which seems entirely harmless)
+or printing the wrong warning messages for early failures.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 75 +++++++++++++++++++++++----------------
+ 1 file changed, 45 insertions(+), 30 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index b86cf72033401..86f7e09d31516 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2372,29 +2372,33 @@ static bool bch_is_open(struct block_device *bdev)
+ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ const char *buffer, size_t size)
+ {
+- ssize_t ret = -EINVAL;
+- const char *err = "cannot allocate memory";
+- char *path = NULL;
+- struct cache_sb *sb = NULL;
++ const char *err;
++ char *path;
++ struct cache_sb *sb;
+ struct block_device *bdev = NULL;
+- struct page *sb_page = NULL;
++ struct page *sb_page;
++ ssize_t ret;
+
++ ret = -EBUSY;
+ if (!try_module_get(THIS_MODULE))
+- return -EBUSY;
++ goto out;
+
+ /* For latest state of bcache_is_reboot */
+ smp_mb();
+ if (bcache_is_reboot)
+- return -EBUSY;
++ goto out_module_put;
+
++ ret = -ENOMEM;
++ err = "cannot allocate memory";
+ path = kstrndup(buffer, size, GFP_KERNEL);
+ if (!path)
+- goto err;
++ goto out_module_put;
+
+ sb = kmalloc(sizeof(struct cache_sb), GFP_KERNEL);
+ if (!sb)
+- goto err;
++ goto out_free_path;
+
++ ret = -EINVAL;
+ err = "failed to open device";
+ bdev = blkdev_get_by_path(strim(path),
+ FMODE_READ|FMODE_WRITE|FMODE_EXCL,
+@@ -2411,57 +2415,68 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ if (!IS_ERR(bdev))
+ bdput(bdev);
+ if (attr == &ksysfs_register_quiet)
+- goto quiet_out;
++ goto done;
+ }
+- goto err;
++ goto out_free_sb;
+ }
+
+ err = "failed to set blocksize";
+ if (set_blocksize(bdev, 4096))
+- goto err_close;
++ goto out_blkdev_put;
+
+ err = read_super(sb, bdev, &sb_page);
+ if (err)
+- goto err_close;
++ goto out_blkdev_put;
+
+ err = "failed to register device";
+ if (SB_IS_BDEV(sb)) {
+ struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL);
+
+ if (!dc)
+- goto err_close;
++ goto out_put_sb_page;
+
+ mutex_lock(&bch_register_lock);
+ ret = register_bdev(sb, sb_page, bdev, dc);
+ mutex_unlock(&bch_register_lock);
+ /* blkdev_put() will be called in cached_dev_free() */
+- if (ret < 0)
+- goto err;
++ if (ret < 0) {
++ bdev = NULL;
++ goto out_put_sb_page;
++ }
+ } else {
+ struct cache *ca = kzalloc(sizeof(*ca), GFP_KERNEL);
+
+ if (!ca)
+- goto err_close;
++ goto out_put_sb_page;
+
+ /* blkdev_put() will be called in bch_cache_release() */
+- if (register_cache(sb, sb_page, bdev, ca) != 0)
+- goto err;
++ if (register_cache(sb, sb_page, bdev, ca) != 0) {
++ bdev = NULL;
++ goto out_put_sb_page;
++ }
+ }
+-quiet_out:
+- ret = size;
+-out:
+- if (sb_page)
+- put_page(sb_page);
++
++ put_page(sb_page);
++done:
+ kfree(sb);
+ kfree(path);
+ module_put(THIS_MODULE);
+- return ret;
+-
+-err_close:
+- blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+-err:
++ return size;
++
++out_put_sb_page:
++ put_page(sb_page);
++out_blkdev_put:
++ if (bdev)
++ blkdev_put(bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL);
++out_free_sb:
++ kfree(sb);
++out_free_path:
++ kfree(path);
++out_module_put:
++ module_put(THIS_MODULE);
++out:
+ pr_info("error %s: %s", path, err);
+- goto out;
++ return ret;
+ }
+
+
+--
+2.20.1
+
--- /dev/null
+From 2d08329de5db20173359391328b3154500a51066 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 11:40:54 +0100
+Subject: block, bfq: do not plug I/O for bfq_queues with no proc refs
+
+From: Paolo Valente <paolo.valente@linaro.org>
+
+[ Upstream commit f718b093277df582fbf8775548a4f163e664d282 ]
+
+Commit 478de3380c1c ("block, bfq: deschedule empty bfq_queues not
+referred by any process") fixed commit 3726112ec731 ("block, bfq:
+re-schedule empty queues if they deserve I/O plugging") by
+descheduling an empty bfq_queue when it remains with not process
+reference. Yet, this still left a case uncovered: an empty bfq_queue
+with not process reference that remains in service. This happens for
+an in-service sync bfq_queue that is deemed to deserve I/O-dispatch
+plugging when it remains empty. Yet no new requests will arrive for
+such a bfq_queue if no process sends requests to it any longer. Even
+worse, the bfq_queue may happen to be prematurely freed while still in
+service (because there may remain no reference to it any longer).
+
+This commit solves this problem by preventing I/O dispatch from being
+plugged for the in-service bfq_queue, if the latter has no process
+reference (the bfq_queue is then prevented from remaining in service).
+
+Fixes: 3726112ec731 ("block, bfq: re-schedule empty queues if they deserve I/O plugging")
+Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
+Reported-by: Patrick Dung <patdung100@gmail.com>
+Tested-by: Patrick Dung <patdung100@gmail.com>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 0c6214497fcc1..5498d05b873d3 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -3444,6 +3444,10 @@ static void bfq_dispatch_remove(struct request_queue *q, struct request *rq)
+ static bool idling_needed_for_service_guarantees(struct bfq_data *bfqd,
+ struct bfq_queue *bfqq)
+ {
++ /* No point in idling for bfqq if it won't get requests any longer */
++ if (unlikely(!bfqq_process_refs(bfqq)))
++ return false;
++
+ return (bfqq->wr_coeff > 1 &&
+ (bfqd->wr_busy_queues <
+ bfq_tot_busy_queues(bfqd) ||
+@@ -4077,6 +4081,10 @@ static bool idling_boosts_thr_without_issues(struct bfq_data *bfqd,
+ bfqq_sequential_and_IO_bound,
+ idling_boosts_thr;
+
++ /* No point in idling for bfqq if it won't get requests any longer */
++ if (unlikely(!bfqq_process_refs(bfqq)))
++ return false;
++
+ bfqq_sequential_and_IO_bound = !BFQQ_SEEKY(bfqq) &&
+ bfq_bfqq_IO_bound(bfqq) && bfq_bfqq_has_short_ttime(bfqq);
+
+@@ -4170,6 +4178,10 @@ static bool bfq_better_to_idle(struct bfq_queue *bfqq)
+ struct bfq_data *bfqd = bfqq->bfqd;
+ bool idling_boosts_thr_with_no_issue, idling_needed_for_service_guar;
+
++ /* No point in idling for bfqq if it won't get requests any longer */
++ if (unlikely(!bfqq_process_refs(bfqq)))
++ return false;
++
+ if (unlikely(bfqd->strict_guarantees))
+ return true;
+
+--
+2.20.1
+
--- /dev/null
+From e3b1da08ff641d20f20b728f0f82ffc8858728ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 11:35:42 -0800
+Subject: bnxt: Detach page from page pool before sending up the stack
+
+From: Jonathan Lemon <jonathan.lemon@gmail.com>
+
+[ Upstream commit 3071c51783b39d6a676d02a9256c3b3f87804285 ]
+
+When running in XDP mode, pages come from the page pool, and should
+be freed back to the same pool or specifically detached. Currently,
+when the driver re-initializes, the page pool destruction is delayed
+forever since it thinks there are oustanding pages.
+
+Fixes: 322b87ca55f2 ("bnxt_en: add page_pool support")
+Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 41297533b4a86..68618891b0e42 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -942,6 +942,7 @@ static struct sk_buff *bnxt_rx_page_skb(struct bnxt *bp,
+ dma_addr -= bp->rx_dma_offset;
+ dma_unmap_page_attrs(&bp->pdev->dev, dma_addr, PAGE_SIZE, bp->rx_dir,
+ DMA_ATTR_WEAK_ORDERING);
++ page_pool_release_page(rxr->page_pool, page);
+
+ if (unlikely(!payload))
+ payload = eth_get_headlen(bp->dev, data_ptr, len);
+--
+2.20.1
+
--- /dev/null
+From 0b908f796d6b414efbe676d0106d18d88efd951e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 00:01:10 +0000
+Subject: bpf, btf: Always output invariant hit in pahole DWARF to BTF
+ transform
+
+From: Chris Down <chris@chrisdown.name>
+
+[ Upstream commit 2a67a6ccb01f21b854715d86ff6432a18b97adb3 ]
+
+When trying to compile with CONFIG_DEBUG_INFO_BTF enabled, I got this
+error:
+
+ % make -s
+ Failed to generate BTF for vmlinux
+ Try to disable CONFIG_DEBUG_INFO_BTF
+ make[3]: *** [vmlinux] Error 1
+
+Compiling again without -s shows the true error (that pahole is
+missing), but since this is fatal, we should show the error
+unconditionally on stderr as well, not silence it using the `info`
+function. With this patch:
+
+ % make -s
+ BTF: .tmp_vmlinux.btf: pahole (pahole) is not available
+ Failed to generate BTF for vmlinux
+ Try to disable CONFIG_DEBUG_INFO_BTF
+ make[3]: *** [vmlinux] Error 1
+
+Signed-off-by: Chris Down <chris@chrisdown.name>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200122000110.GA310073@chrisdown.name
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/link-vmlinux.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
+index 4363799403561..408b5c0b99b1b 100755
+--- a/scripts/link-vmlinux.sh
++++ b/scripts/link-vmlinux.sh
+@@ -108,13 +108,13 @@ gen_btf()
+ local bin_arch
+
+ if ! [ -x "$(command -v ${PAHOLE})" ]; then
+- info "BTF" "${1}: pahole (${PAHOLE}) is not available"
++ echo >&2 "BTF: ${1}: pahole (${PAHOLE}) is not available"
+ return 1
+ fi
+
+ pahole_ver=$(${PAHOLE} --version | sed -E 's/v([0-9]+)\.([0-9]+)/\1\2/')
+ if [ "${pahole_ver}" -lt "113" ]; then
+- info "BTF" "${1}: pahole version $(${PAHOLE} --version) is too old, need at least v1.13"
++ echo >&2 "BTF: ${1}: pahole version $(${PAHOLE} --version) is too old, need at least v1.13"
+ return 1
+ fi
+
+--
+2.20.1
+
--- /dev/null
+From f984d2448aa9c206b9306cdd44db4cbd3cfe2804 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2020 12:10:02 +0300
+Subject: bpf: map_seq_next should always increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 90435a7891a2259b0f74c5a1bc5600d0d64cba8f ]
+
+If seq_file .next fuction does not change position index,
+read after some lseek can generate an unexpected output.
+
+See also: https://bugzilla.kernel.org/show_bug.cgi?id=206283
+
+v1 -> v2: removed missed increment in end of function
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/eca84fdd-c374-a154-d874-6c7b55fc3bc4@virtuozzo.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index a70f7209cda3f..218c09ff6a273 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -196,6 +196,7 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ void *key = map_iter(m)->key;
+ void *prev_key;
+
++ (*pos)++;
+ if (map_iter(m)->done)
+ return NULL;
+
+@@ -208,8 +209,6 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ map_iter(m)->done = true;
+ return NULL;
+ }
+-
+- ++(*pos);
+ return key;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0c24a95f41be47b474959fcaa5dac58d9c8ac1a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 17:17:42 -0800
+Subject: bpf: Print error message for bpftool cgroup show
+
+From: Hechao Li <hechaol@fb.com>
+
+[ Upstream commit 1162f844030ac1ac7321b5e8f6c9badc7a11428f ]
+
+Currently, when bpftool cgroup show <path> has an error, no error
+message is printed. This is confusing because the user may think the
+result is empty.
+
+Before the change:
+
+$ bpftool cgroup show /sys/fs/cgroup
+ID AttachType AttachFlags Name
+$ echo $?
+255
+
+After the change:
+$ ./bpftool cgroup show /sys/fs/cgroup
+Error: can't query bpf programs attached to /sys/fs/cgroup: Operation
+not permitted
+
+v2: Rename check_query_cgroup_progs to cgroup_has_attached_progs
+
+Signed-off-by: Hechao Li <hechaol@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/20191224011742.3714301-1-hechaol@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/cgroup.c | 56 ++++++++++++++++++++++++++------------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
+index 1ef45e55039e1..2f017caa678dc 100644
+--- a/tools/bpf/bpftool/cgroup.c
++++ b/tools/bpf/bpftool/cgroup.c
+@@ -117,6 +117,25 @@ static int count_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type)
+ return prog_cnt;
+ }
+
++static int cgroup_has_attached_progs(int cgroup_fd)
++{
++ enum bpf_attach_type type;
++ bool no_prog = true;
++
++ for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
++ int count = count_attached_bpf_progs(cgroup_fd, type);
++
++ if (count < 0 && errno != EINVAL)
++ return -1;
++
++ if (count > 0) {
++ no_prog = false;
++ break;
++ }
++ }
++
++ return no_prog ? 0 : 1;
++}
+ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type,
+ int level)
+ {
+@@ -161,6 +180,7 @@ static int show_attached_bpf_progs(int cgroup_fd, enum bpf_attach_type type,
+ static int do_show(int argc, char **argv)
+ {
+ enum bpf_attach_type type;
++ int has_attached_progs;
+ const char *path;
+ int cgroup_fd;
+ int ret = -1;
+@@ -192,6 +212,16 @@ static int do_show(int argc, char **argv)
+ goto exit;
+ }
+
++ has_attached_progs = cgroup_has_attached_progs(cgroup_fd);
++ if (has_attached_progs < 0) {
++ p_err("can't query bpf programs attached to %s: %s",
++ path, strerror(errno));
++ goto exit_cgroup;
++ } else if (!has_attached_progs) {
++ ret = 0;
++ goto exit_cgroup;
++ }
++
+ if (json_output)
+ jsonw_start_array(json_wtr);
+ else
+@@ -212,6 +242,7 @@ static int do_show(int argc, char **argv)
+ if (json_output)
+ jsonw_end_array(json_wtr);
+
++exit_cgroup:
+ close(cgroup_fd);
+ exit:
+ return ret;
+@@ -228,7 +259,7 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
+ int typeflag, struct FTW *ftw)
+ {
+ enum bpf_attach_type type;
+- bool skip = true;
++ int has_attached_progs;
+ int cgroup_fd;
+
+ if (typeflag != FTW_D)
+@@ -240,22 +271,13 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
+ return SHOW_TREE_FN_ERR;
+ }
+
+- for (type = 0; type < __MAX_BPF_ATTACH_TYPE; type++) {
+- int count = count_attached_bpf_progs(cgroup_fd, type);
+-
+- if (count < 0 && errno != EINVAL) {
+- p_err("can't query bpf programs attached to %s: %s",
+- fpath, strerror(errno));
+- close(cgroup_fd);
+- return SHOW_TREE_FN_ERR;
+- }
+- if (count > 0) {
+- skip = false;
+- break;
+- }
+- }
+-
+- if (skip) {
++ has_attached_progs = cgroup_has_attached_progs(cgroup_fd);
++ if (has_attached_progs < 0) {
++ p_err("can't query bpf programs attached to %s: %s",
++ fpath, strerror(errno));
++ close(cgroup_fd);
++ return SHOW_TREE_FN_ERR;
++ } else if (!has_attached_progs) {
+ close(cgroup_fd);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 2cab7d271e39c05e0b9664aee56900090fa17010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 09:04:37 +0800
+Subject: bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 0a29275b6300f39f78a87f2038bbfe5bdbaeca47 ]
+
+A negative value should be returned if map->map_type is invalid
+although that is impossible now, but if we run into such situation
+in future, then xdpbuff could be leaked.
+
+Daniel Borkmann suggested:
+
+-EBADRQC should be returned to stay consistent with generic XDP
+for the tracepoint output and not to be confused with -EOPNOTSUPP
+from other locations like dev_map_enqueue() when ndo_xdp_xmit is
+missing and such.
+
+Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/1578618277-18085-1-git-send-email-lirongqing@baidu.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 1a78d64096bbd..d59dbc88fef5d 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3543,7 +3543,7 @@ static int __bpf_tx_xdp_map(struct net_device *dev_rx, void *fwd,
+ return err;
+ }
+ default:
+- break;
++ return -EBADRQC;
+ }
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From f839dbcea1e2cefa485e0b49ec15b0fc23e9faf5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 12:16:51 +0100
+Subject: bpf, sockhash: Synchronize_rcu before free'ing map
+
+From: Jakub Sitnicki <jakub@cloudflare.com>
+
+[ Upstream commit 0b2dc83906cf1e694e48003eae5df8fa63f76fd9 ]
+
+We need to have a synchronize_rcu before free'ing the sockhash because any
+outstanding psock references will have a pointer to the map and when they
+use it, this could trigger a use after free.
+
+This is a sister fix for sockhash, following commit 2bb90e5cc90e ("bpf:
+sockmap, synchronize_rcu before free'ing map") which addressed sockmap,
+which comes from a manual audit.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200206111652.694507-3-jakub@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index 085cef5857bbf..405397801bb07 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -881,6 +881,9 @@ static void sock_hash_free(struct bpf_map *map)
+ /* wait for psock readers accessing its map link */
+ synchronize_rcu();
+
++ /* wait for psock readers accessing its map link */
++ synchronize_rcu();
++
+ bpf_map_area_free(htab->buckets);
+ kfree(htab);
+ }
+--
+2.20.1
+
--- /dev/null
+From 2b385e9bf4e6ed6eff9e9b140ff701b5a26725d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 13:19:48 -0600
+Subject: brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev()
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 5cc509aa83c6acd2c5cd94f99065c39d2bd0a490 ]
+
+In the implementation of brcmf_p2p_create_p2pdev() the allocated memory
+for p2p_vif is leaked when the mac address is the same as primary
+interface. To fix this, go to error path to release p2p_vif via
+brcmf_free_vif().
+
+Fixes: cb746e47837a ("brcmfmac: check p2pdev mac address uniqueness")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+index 7ba9f6a686459..1f5deea5a288e 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -2092,7 +2092,8 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
+ /* firmware requires unique mac address for p2pdev interface */
+ if (addr && ether_addr_equal(addr, pri_ifp->mac_addr)) {
+ bphy_err(drvr, "discovery vif must be different from primary interface\n");
+- return ERR_PTR(-EINVAL);
++ err = -EINVAL;
++ goto fail;
+ }
+
+ brcmf_p2p_generate_bss_mac(p2p, addr);
+--
+2.20.1
+
--- /dev/null
+From a3fcd20bd131a866e6b9bd9ca6ee882eee8fb31c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 12:58:55 +0300
+Subject: brcmfmac: Fix use after free in brcmf_sdio_readframes()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]
+
+The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
+static checker warning:
+
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
+ error: dereferencing freed memory 'pkt'
+
+It looks like there was supposed to be a continue after we free "pkt".
+
+Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 264ad63232f87..1dea0178832ea 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
+ BRCMF_SDIO_FT_NORMAL)) {
+ rd->len = 0;
+ brcmu_pkt_buf_free_skb(pkt);
++ continue;
+ }
+ bus->sdcnt.rx_readahead_cnt++;
+ if (rd->len != roundup(rd_new.len, 16)) {
+--
+2.20.1
+
--- /dev/null
+From 06ad1f4e22c7255df2f90276056d21b64871d795 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 10:20:33 +0100
+Subject: brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362
+
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+
+[ Upstream commit 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 ]
+
+Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling
+brcmf_bus_started()") changed the initialization order of the brcmfmac
+SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now
+called before the sdiodev->bus_if initialization, it reads the wrong
+chip ID and fails to initialize the GPIO on brcm43362. Thus the chip
+cannot send interrupts and fails to probe:
+
+[ 12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
+[ 12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110
+[ 12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110
+[ 12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed
+
+Initialize the bus interface earlier to ensure that
+brcmf_sdiod_intr_register() properly sets up the OOB interrupt.
+
+BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438
+Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()")
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 1dea0178832ea..a935993a3c514 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4226,6 +4226,12 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ }
+
+ if (err == 0) {
++ /* Assign bus interface call back */
++ sdiod->bus_if->dev = sdiod->dev;
++ sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
++ sdiod->bus_if->chip = bus->ci->chip;
++ sdiod->bus_if->chiprev = bus->ci->chiprev;
++
+ /* Allow full data communication using DPC from now on. */
+ brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
+
+@@ -4242,12 +4248,6 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+
+ sdio_release_host(sdiod->func1);
+
+- /* Assign bus interface call back */
+- sdiod->bus_if->dev = sdiod->dev;
+- sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
+- sdiod->bus_if->chip = bus->ci->chip;
+- sdiod->bus_if->chiprev = bus->ci->chiprev;
+-
+ err = brcmf_alloc(sdiod->dev, sdiod->settings);
+ if (err) {
+ brcmf_err("brcmf_alloc failed\n");
+--
+2.20.1
+
--- /dev/null
+From 90cbb675581dd7134f648087a653e8103c39dbc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Feb 2020 19:30:20 +0800
+Subject: brd: check and limit max_part par
+
+From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+
+[ Upstream commit c8ab422553c81a0eb070329c63725df1cd1425bc ]
+
+In brd_init func, rd_nr num of brd_device are firstly allocated
+and add in brd_devices, then brd_devices are traversed to add each
+brd_device by calling add_disk func. When allocating brd_device,
+the disk->first_minor is set to i * max_part, if rd_nr * max_part
+is larger than MINORMASK, two different brd_device may have the same
+devt, then only one of them can be successfully added.
+when rmmod brd.ko, it will cause oops when calling brd_exit.
+
+Follow those steps:
+ # modprobe brd rd_nr=3 rd_size=102400 max_part=1048576
+ # rmmod brd
+then, the oops will appear.
+
+Oops log:
+[ 726.613722] Call trace:
+[ 726.614175] kernfs_find_ns+0x24/0x130
+[ 726.614852] kernfs_find_and_get_ns+0x44/0x68
+[ 726.615749] sysfs_remove_group+0x38/0xb0
+[ 726.616520] blk_trace_remove_sysfs+0x1c/0x28
+[ 726.617320] blk_unregister_queue+0x98/0x100
+[ 726.618105] del_gendisk+0x144/0x2b8
+[ 726.618759] brd_exit+0x68/0x560 [brd]
+[ 726.619501] __arm64_sys_delete_module+0x19c/0x2a0
+[ 726.620384] el0_svc_common+0x78/0x130
+[ 726.621057] el0_svc_handler+0x38/0x78
+[ 726.621738] el0_svc+0x8/0xc
+[ 726.622259] Code: aa0203f6 aa0103f7 aa1e03e0 d503201f (7940e260)
+
+Here, we add brd_check_and_reset_par func to check and limit max_part par.
+
+--
+V5->V6:
+ - remove useless code
+
+V4->V5:(suggested by Ming Lei)
+ - make sure max_part is not larger than DISK_MAX_PARTS
+
+V3->V4:(suggested by Ming Lei)
+ - remove useless change
+ - add one limit of max_part
+
+V2->V3: (suggested by Ming Lei)
+ - clear .minors when running out of consecutive minor space in brd_alloc
+ - remove limit of rd_nr
+
+V1->V2:
+ - add more checks in brd_check_par_valid as suggested by Ming Lei.
+
+Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reviewed-by: Bob Liu <bob.liu@oracle.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/brd.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index c548a5a6c1a00..79f18cfa7049f 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -470,6 +470,25 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
+ return kobj;
+ }
+
++static inline void brd_check_and_reset_par(void)
++{
++ if (unlikely(!max_part))
++ max_part = 1;
++
++ /*
++ * make sure 'max_part' can be divided exactly by (1U << MINORBITS),
++ * otherwise, it is possiable to get same dev_t when adding partitions.
++ */
++ if ((1U << MINORBITS) % max_part != 0)
++ max_part = 1UL << fls(max_part);
++
++ if (max_part > DISK_MAX_PARTS) {
++ pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
++ DISK_MAX_PARTS, DISK_MAX_PARTS);
++ max_part = DISK_MAX_PARTS;
++ }
++}
++
+ static int __init brd_init(void)
+ {
+ struct brd_device *brd, *next;
+@@ -493,8 +512,7 @@ static int __init brd_init(void)
+ if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
+ return -EIO;
+
+- if (unlikely(!max_part))
+- max_part = 1;
++ brd_check_and_reset_par();
+
+ for (i = 0; i < rd_nr; i++) {
+ brd = brd_alloc(i);
+--
+2.20.1
+
--- /dev/null
+From 836393d1c9b9568ce41a05b91d5e2daf07d52bd2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 12:26:34 +0800
+Subject: btrfs: device stats, log when stats are zeroed
+
+From: Anand Jain <anand.jain@oracle.com>
+
+[ Upstream commit a69976bc69308aa475d0ba3b8b3efd1d013c0460 ]
+
+We had a report indicating that some read errors aren't reported by the
+device stats in the userland. It is important to have the errors
+reported in the device stat as user land scripts might depend on it to
+take the reasonable corrective actions. But to debug these issue we need
+to be really sure that request to reset the device stat did not come
+from the userland itself. So log an info message when device error reset
+happens.
+
+For example:
+ BTRFS info (device sdc): device stats zeroed by btrfs(9223)
+
+Reported-by: philip@philip-seeger.de
+Link: https://www.spinics.net/lists/linux-btrfs/msg96528.html
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Anand Jain <anand.jain@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index f7d9fc1a6fc2f..9ab3ae5df3005 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7561,6 +7561,8 @@ int btrfs_get_dev_stats(struct btrfs_fs_info *fs_info,
+ else
+ btrfs_dev_stat_set(dev, i, 0);
+ }
++ btrfs_info(fs_info, "device stats zeroed by %s (%d)",
++ current->comm, task_pid_nr(current));
+ } else {
+ for (i = 0; i < BTRFS_DEV_STAT_VALUES_MAX; i++)
+ if (stats->nr_items > i)
+--
+2.20.1
+
--- /dev/null
+From e030e96b37fe52680aa446398711d3c28a2e22a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 14:34:52 -0500
+Subject: btrfs: do not do delalloc reservation under page lock
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+[ Upstream commit f4b1363cae43fef7c86c993b7ca7fe7d546b3c68 ]
+
+We ran into a deadlock in production with the fixup worker. The stack
+traces were as follows:
+
+Thread responsible for the writeout, waiting on the page lock
+
+ [<0>] io_schedule+0x12/0x40
+ [<0>] __lock_page+0x109/0x1e0
+ [<0>] extent_write_cache_pages+0x206/0x360
+ [<0>] extent_writepages+0x40/0x60
+ [<0>] do_writepages+0x31/0xb0
+ [<0>] __writeback_single_inode+0x3d/0x350
+ [<0>] writeback_sb_inodes+0x19d/0x3c0
+ [<0>] __writeback_inodes_wb+0x5d/0xb0
+ [<0>] wb_writeback+0x231/0x2c0
+ [<0>] wb_workfn+0x308/0x3c0
+ [<0>] process_one_work+0x1e0/0x390
+ [<0>] worker_thread+0x2b/0x3c0
+ [<0>] kthread+0x113/0x130
+ [<0>] ret_from_fork+0x35/0x40
+ [<0>] 0xffffffffffffffff
+
+Thread of the fixup worker who is holding the page lock
+
+ [<0>] start_delalloc_inodes+0x241/0x2d0
+ [<0>] btrfs_start_delalloc_roots+0x179/0x230
+ [<0>] btrfs_alloc_data_chunk_ondemand+0x11b/0x2e0
+ [<0>] btrfs_check_data_free_space+0x53/0xa0
+ [<0>] btrfs_delalloc_reserve_space+0x20/0x70
+ [<0>] btrfs_writepage_fixup_worker+0x1fc/0x2a0
+ [<0>] normal_work_helper+0x11c/0x360
+ [<0>] process_one_work+0x1e0/0x390
+ [<0>] worker_thread+0x2b/0x3c0
+ [<0>] kthread+0x113/0x130
+ [<0>] ret_from_fork+0x35/0x40
+ [<0>] 0xffffffffffffffff
+
+Thankfully the stars have to align just right to hit this. First you
+have to end up in the fixup worker, which is tricky by itself (my
+reproducer does DIO reads into a MMAP'ed region, so not a common
+operation). Then you have to have less than a page size of free data
+space and 0 unallocated space so you go down the "commit the transaction
+to free up pinned space" path. This was accomplished by a random
+balance that was running on the host. Then you get this deadlock.
+
+I'm still in the process of trying to force the deadlock to happen on
+demand, but I've hit other issues. I can still trigger the fixup worker
+path itself so this patch has been tested in that regard, so the normal
+case is fine.
+
+Fixes: 87826df0ec36 ("btrfs: delalloc for page dirtied out-of-band in fixup worker")
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 76 ++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 60 insertions(+), 16 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 1b4ab02be9243..b83eef445db33 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2168,6 +2168,7 @@ int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end,
+ /* see btrfs_writepage_start_hook for details on why this is required */
+ struct btrfs_writepage_fixup {
+ struct page *page;
++ struct inode *inode;
+ struct btrfs_work work;
+ };
+
+@@ -2182,9 +2183,20 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
+ u64 page_start;
+ u64 page_end;
+ int ret = 0;
++ bool free_delalloc_space = true;
+
+ fixup = container_of(work, struct btrfs_writepage_fixup, work);
+ page = fixup->page;
++ inode = fixup->inode;
++ page_start = page_offset(page);
++ page_end = page_offset(page) + PAGE_SIZE - 1;
++
++ /*
++ * This is similar to page_mkwrite, we need to reserve the space before
++ * we take the page lock.
++ */
++ ret = btrfs_delalloc_reserve_space(inode, &data_reserved, page_start,
++ PAGE_SIZE);
+ again:
+ lock_page(page);
+
+@@ -2193,25 +2205,48 @@ again:
+ * page->mapping may go NULL, but it shouldn't be moved to a different
+ * address space.
+ */
+- if (!page->mapping || !PageDirty(page) || !PageChecked(page))
++ if (!page->mapping || !PageDirty(page) || !PageChecked(page)) {
++ /*
++ * Unfortunately this is a little tricky, either
++ *
++ * 1) We got here and our page had already been dealt with and
++ * we reserved our space, thus ret == 0, so we need to just
++ * drop our space reservation and bail. This can happen the
++ * first time we come into the fixup worker, or could happen
++ * while waiting for the ordered extent.
++ * 2) Our page was already dealt with, but we happened to get an
++ * ENOSPC above from the btrfs_delalloc_reserve_space. In
++ * this case we obviously don't have anything to release, but
++ * because the page was already dealt with we don't want to
++ * mark the page with an error, so make sure we're resetting
++ * ret to 0. This is why we have this check _before_ the ret
++ * check, because we do not want to have a surprise ENOSPC
++ * when the page was already properly dealt with.
++ */
++ if (!ret) {
++ btrfs_delalloc_release_extents(BTRFS_I(inode),
++ PAGE_SIZE);
++ btrfs_delalloc_release_space(inode, data_reserved,
++ page_start, PAGE_SIZE,
++ true);
++ }
++ ret = 0;
+ goto out_page;
++ }
+
+ /*
+- * We keep the PageChecked() bit set until we're done with the
+- * btrfs_start_ordered_extent() dance that we do below. That drops and
+- * retakes the page lock, so we don't want new fixup workers queued for
+- * this page during the churn.
++ * We can't mess with the page state unless it is locked, so now that
++ * it is locked bail if we failed to make our space reservation.
+ */
+- inode = page->mapping->host;
+- page_start = page_offset(page);
+- page_end = page_offset(page) + PAGE_SIZE - 1;
++ if (ret)
++ goto out_page;
+
+ lock_extent_bits(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ &cached_state);
+
+ /* already ordered? We're done */
+ if (PagePrivate2(page))
+- goto out;
++ goto out_reserved;
+
+ ordered = btrfs_lookup_ordered_range(BTRFS_I(inode), page_start,
+ PAGE_SIZE);
+@@ -2224,11 +2259,6 @@ again:
+ goto again;
+ }
+
+- ret = btrfs_delalloc_reserve_space(inode, &data_reserved, page_start,
+- PAGE_SIZE);
+- if (ret)
+- goto out;
+-
+ ret = btrfs_set_extent_delalloc(inode, page_start, page_end, 0,
+ &cached_state);
+ if (ret)
+@@ -2242,12 +2272,12 @@ again:
+ * The page was dirty when we started, nothing should have cleaned it.
+ */
+ BUG_ON(!PageDirty(page));
++ free_delalloc_space = false;
+ out_reserved:
+ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+- if (ret)
++ if (free_delalloc_space)
+ btrfs_delalloc_release_space(inode, data_reserved, page_start,
+ PAGE_SIZE, true);
+-out:
+ unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ &cached_state);
+ out_page:
+@@ -2266,6 +2296,12 @@ out_page:
+ put_page(page);
+ kfree(fixup);
+ extent_changeset_free(data_reserved);
++ /*
++ * As a precaution, do a delayed iput in case it would be the last iput
++ * that could need flushing space. Recursing back to fixup worker would
++ * deadlock.
++ */
++ btrfs_add_delayed_iput(inode);
+ }
+
+ /*
+@@ -2303,10 +2339,18 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end)
+ if (!fixup)
+ return -EAGAIN;
+
++ /*
++ * We are already holding a reference to this inode from
++ * write_cache_pages. We need to hold it because the space reservation
++ * takes place outside of the page lock, and we can't trust
++ * page->mapping outside of the page lock.
++ */
++ ihold(inode);
+ SetPageChecked(page);
+ get_page(page);
+ btrfs_init_work(&fixup->work, btrfs_writepage_fixup_worker, NULL, NULL);
+ fixup->page = page;
++ fixup->inode = inode;
+ btrfs_queue_work(fs_info->fixup_workers, &fixup->work);
+
+ return -EAGAIN;
+--
+2.20.1
+
--- /dev/null
+From 42e3e40d5b286994d48ea6a649666ab8e76a7625 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 14:19:57 +0100
+Subject: btrfs: fix possible NULL-pointer dereference in integrity checks
+
+From: Johannes Thumshirn <jth@kernel.org>
+
+[ Upstream commit 3dbd351df42109902fbcebf27104149226a4fcd9 ]
+
+A user reports a possible NULL-pointer dereference in
+btrfsic_process_superblock(). We are assigning state->fs_info to a local
+fs_info variable and afterwards checking for the presence of state.
+
+While we would BUG_ON() a NULL state anyways, we can also just remove
+the local fs_info copy, as fs_info is only used once as the first
+argument for btrfs_num_copies(). There we can just pass in
+state->fs_info as well.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205003
+Signed-off-by: Johannes Thumshirn <jth@kernel.org>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/check-integrity.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
+index 0b52ab4cb9649..72c70f59fc605 100644
+--- a/fs/btrfs/check-integrity.c
++++ b/fs/btrfs/check-integrity.c
+@@ -629,7 +629,6 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(dev_t dev,
+ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ struct btrfs_fs_devices *fs_devices)
+ {
+- struct btrfs_fs_info *fs_info = state->fs_info;
+ struct btrfs_super_block *selected_super;
+ struct list_head *dev_head = &fs_devices->devices;
+ struct btrfs_device *device;
+@@ -700,7 +699,7 @@ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ break;
+ }
+
+- num_copies = btrfs_num_copies(fs_info, next_bytenr,
++ num_copies = btrfs_num_copies(state->fs_info, next_bytenr,
+ state->metablock_size);
+ if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+ pr_info("num_copies(log_bytenr=%llu) = %d\n",
+--
+2.20.1
+
--- /dev/null
+From bdeeffe9fdf9780d982a5b59bd90d790bd212fb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:11:35 +0200
+Subject: btrfs: Fix split-brain handling when changing FSID to metadata uuid
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+[ Upstream commit 1362089d2ad7e20d16371b39d3c11990d4ec23e4 ]
+
+Current code doesn't correctly handle the situation which arises when
+a file system that has METADATA_UUID_INCOMPAT flag set and has its FSID
+changed to the one in metadata uuid. This causes the incompat flag to
+disappear.
+
+In case of a power failure we could end up in a situation where part of
+the disks in a multi-disk filesystem are correctly reverted to
+METADATA_UUID_INCOMPAT flag unset state, while others have
+METADATA_UUID_INCOMPAT set and CHANGING_FSID_V2_IN_PROGRESS.
+
+This patch corrects the behavior required to handle the case where a
+disk of the second type is scanned first, creating the necessary
+btrfs_fs_devices. Subsequently, when a disk which has already completed
+the transition is scanned it should overwrite the data in
+btrfs_fs_devices.
+
+Reported-by: Su Yue <Damenly_Su@gmx.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 42 ++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 38 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 9ab3ae5df3005..3e64f49c394b8 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -907,6 +907,32 @@ static struct btrfs_fs_devices *find_fsid_changed(
+
+ return NULL;
+ }
++
++static struct btrfs_fs_devices *find_fsid_reverted_metadata(
++ struct btrfs_super_block *disk_super)
++{
++ struct btrfs_fs_devices *fs_devices;
++
++ /*
++ * Handle the case where the scanned device is part of an fs whose last
++ * metadata UUID change reverted it to the original FSID. At the same
++ * time * fs_devices was first created by another constitutent device
++ * which didn't fully observe the operation. This results in an
++ * btrfs_fs_devices created with metadata/fsid different AND
++ * btrfs_fs_devices::fsid_change set AND the metadata_uuid of the
++ * fs_devices equal to the FSID of the disk.
++ */
++ list_for_each_entry(fs_devices, &fs_uuids, fs_list) {
++ if (memcmp(fs_devices->fsid, fs_devices->metadata_uuid,
++ BTRFS_FSID_SIZE) != 0 &&
++ memcmp(fs_devices->metadata_uuid, disk_super->fsid,
++ BTRFS_FSID_SIZE) == 0 &&
++ fs_devices->fsid_change)
++ return fs_devices;
++ }
++
++ return NULL;
++}
+ /*
+ * Add new device to list of registered devices
+ *
+@@ -946,7 +972,9 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ fs_devices = find_fsid(disk_super->fsid,
+ disk_super->metadata_uuid);
+ } else {
+- fs_devices = find_fsid(disk_super->fsid, NULL);
++ fs_devices = find_fsid_reverted_metadata(disk_super);
++ if (!fs_devices)
++ fs_devices = find_fsid(disk_super->fsid, NULL);
+ }
+
+
+@@ -976,12 +1004,18 @@ static noinline struct btrfs_device *device_list_add(const char *path,
+ * a device which had the CHANGING_FSID_V2 flag then replace the
+ * metadata_uuid/fsid values of the fs_devices.
+ */
+- if (has_metadata_uuid && fs_devices->fsid_change &&
++ if (fs_devices->fsid_change &&
+ found_transid > fs_devices->latest_generation) {
+ memcpy(fs_devices->fsid, disk_super->fsid,
+ BTRFS_FSID_SIZE);
+- memcpy(fs_devices->metadata_uuid,
+- disk_super->metadata_uuid, BTRFS_FSID_SIZE);
++
++ if (has_metadata_uuid)
++ memcpy(fs_devices->metadata_uuid,
++ disk_super->metadata_uuid,
++ BTRFS_FSID_SIZE);
++ else
++ memcpy(fs_devices->metadata_uuid,
++ disk_super->fsid, BTRFS_FSID_SIZE);
+
+ fs_devices->fsid_change = false;
+ }
+--
+2.20.1
+
--- /dev/null
+From 36d4fa45fe96dc73387acb7b99859643c792e637 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 11:51:42 -0500
+Subject: Btrfs: keep pages dirty when using btrfs_writepage_fixup_worker
+
+From: Chris Mason <clm@fb.com>
+
+[ Upstream commit 25f3c5021985e885292980d04a1423fd83c967bb ]
+
+For COW, btrfs expects pages dirty pages to have been through a few setup
+steps. This includes reserving space for the new block allocations and marking
+the range in the state tree for delayed allocation.
+
+A few places outside btrfs will dirty pages directly, especially when unmapping
+mmap'd pages. In order for these to properly go through COW, we run them
+through a fixup worker to wait for stable pages, and do the delalloc prep.
+
+87826df0ec36 added a window where the dirty pages were cleaned, but pending
+more action from the fixup worker. We clear_page_dirty_for_io() before
+we call into writepage, so the page is no longer dirty. The commit
+changed it so now we leave the page clean between unlocking it here and
+the fixup worker starting at some point in the future.
+
+During this window, page migration can jump in and relocate the page. Once our
+fixup work actually starts, it finds page->mapping is NULL and we end up
+freeing the page without ever writing it.
+
+This leads to crc errors and other exciting problems, since it screws up the
+whole statemachine for waiting for ordered extents. The fix here is to keep
+the page dirty while we're waiting for the fixup worker to get to work.
+This is accomplished by returning -EAGAIN from btrfs_writepage_cow_fixup
+if we queued the page up for fixup, which will cause the writepage
+function to redirty the page.
+
+Because we now expect the page to be dirty once it gets to the fixup
+worker we must adjust the error cases to call clear_page_dirty_for_io()
+on the page. That is the bulk of the patch, but it is not the fix, the
+fix is the -EAGAIN from btrfs_writepage_cow_fixup. We cannot separate
+these two changes out because the error conditions change with the new
+expectations.
+
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode.c | 61 ++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 44 insertions(+), 17 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 6f0568fb58997..1b4ab02be9243 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2181,17 +2181,27 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
+ struct inode *inode;
+ u64 page_start;
+ u64 page_end;
+- int ret;
++ int ret = 0;
+
+ fixup = container_of(work, struct btrfs_writepage_fixup, work);
+ page = fixup->page;
+ again:
+ lock_page(page);
+- if (!page->mapping || !PageDirty(page) || !PageChecked(page)) {
+- ClearPageChecked(page);
++
++ /*
++ * Before we queued this fixup, we took a reference on the page.
++ * page->mapping may go NULL, but it shouldn't be moved to a different
++ * address space.
++ */
++ if (!page->mapping || !PageDirty(page) || !PageChecked(page))
+ goto out_page;
+- }
+
++ /*
++ * We keep the PageChecked() bit set until we're done with the
++ * btrfs_start_ordered_extent() dance that we do below. That drops and
++ * retakes the page lock, so we don't want new fixup workers queued for
++ * this page during the churn.
++ */
+ inode = page->mapping->host;
+ page_start = page_offset(page);
+ page_end = page_offset(page) + PAGE_SIZE - 1;
+@@ -2216,24 +2226,22 @@ again:
+
+ ret = btrfs_delalloc_reserve_space(inode, &data_reserved, page_start,
+ PAGE_SIZE);
+- if (ret) {
+- mapping_set_error(page->mapping, ret);
+- end_extent_writepage(page, ret, page_start, page_end);
+- ClearPageChecked(page);
++ if (ret)
+ goto out;
+- }
+
+ ret = btrfs_set_extent_delalloc(inode, page_start, page_end, 0,
+ &cached_state);
+- if (ret) {
+- mapping_set_error(page->mapping, ret);
+- end_extent_writepage(page, ret, page_start, page_end);
+- ClearPageChecked(page);
++ if (ret)
+ goto out_reserved;
+- }
+
+- ClearPageChecked(page);
+- set_page_dirty(page);
++ /*
++ * Everything went as planned, we're now the owner of a dirty page with
++ * delayed allocation bits set and space reserved for our COW
++ * destination.
++ *
++ * The page was dirty when we started, nothing should have cleaned it.
++ */
++ BUG_ON(!PageDirty(page));
+ out_reserved:
+ btrfs_delalloc_release_extents(BTRFS_I(inode), PAGE_SIZE);
+ if (ret)
+@@ -2243,6 +2251,17 @@ out:
+ unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
+ &cached_state);
+ out_page:
++ if (ret) {
++ /*
++ * We hit ENOSPC or other errors. Update the mapping and page
++ * to reflect the errors and clean the page.
++ */
++ mapping_set_error(page->mapping, ret);
++ end_extent_writepage(page, ret, page_start, page_end);
++ clear_page_dirty_for_io(page);
++ SetPageError(page);
++ }
++ ClearPageChecked(page);
+ unlock_page(page);
+ put_page(page);
+ kfree(fixup);
+@@ -2270,6 +2289,13 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end)
+ if (TestClearPagePrivate2(page))
+ return 0;
+
++ /*
++ * PageChecked is set below when we create a fixup worker for this page,
++ * don't try to create another one if we're already PageChecked()
++ *
++ * The extent_io writepage code will redirty the page if we send back
++ * EAGAIN.
++ */
+ if (PageChecked(page))
+ return -EAGAIN;
+
+@@ -2282,7 +2308,8 @@ int btrfs_writepage_cow_fixup(struct page *page, u64 start, u64 end)
+ btrfs_init_work(&fixup->work, btrfs_writepage_fixup_worker, NULL, NULL);
+ fixup->page = page;
+ btrfs_queue_work(fs_info->fixup_workers, &fixup->work);
+- return -EBUSY;
++
++ return -EAGAIN;
+ }
+
+ static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
+--
+2.20.1
+
--- /dev/null
+From 4e99dd4c91f7acb99d94738edf77d656ff252c99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 15:29:53 +0100
+Subject: btrfs: safely advance counter when looking up bio csums
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 4babad10198fa73fe73239d02c2e99e3333f5f5c ]
+
+Dan's smatch tool reports
+
+ fs/btrfs/file-item.c:295 btrfs_lookup_bio_sums()
+ warn: should this be 'count == -1'
+
+which points to the while (count--) loop. With count == 0 the check
+itself could decrement it to -1. There's a WARN_ON a few lines below
+that has never been seen in practice though.
+
+It turns out that the value of page_bytes_left matches the count (by
+sectorsize multiples). The loop never reaches the state where count
+would go to -1, because page_bytes_left == 0 is found first and this
+breaks out.
+
+For clarity, use only plain check on count (and only for positive
+value), decrement safely inside the loop. Any other discrepancy after
+the whole bio list processing should be reported by the exising
+WARN_ON_ONCE as well.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file-item.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index c878bc25d0460..f62a179f85bb6 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -274,7 +274,8 @@ found:
+ csum += count * csum_size;
+ nblocks -= count;
+ next:
+- while (count--) {
++ while (count > 0) {
++ count--;
+ disk_bytenr += fs_info->sectorsize;
+ offset += fs_info->sectorsize;
+ page_bytes_left -= fs_info->sectorsize;
+--
+2.20.1
+
--- /dev/null
+From 4f6676e07edee820c963eb5c457af16c219abd46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 20:00:48 +0100
+Subject: btrfs: separate definition of assertion failure handlers
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 68c467cbb2f389b6c933e235bce0d1756fc8cc34 ]
+
+There's a report where objtool detects unreachable instructions, eg.:
+
+ fs/btrfs/ctree.o: warning: objtool: btrfs_search_slot()+0x2d4: unreachable instruction
+
+This seems to be a false positive due to compiler version. The cause is
+in the ASSERT macro implementation that does the conditional check as
+IS_DEFINED(CONFIG_BTRFS_ASSERT) and not an #ifdef.
+
+To avoid that, use the ifdefs directly.
+
+There are still 2 reports that aren't fixed:
+
+ fs/btrfs/extent_io.o: warning: objtool: __set_extent_bit()+0x71f: unreachable instruction
+ fs/btrfs/relocation.o: warning: objtool: find_data_references()+0x4e0: unreachable instruction
+
+Co-developed-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/ctree.h | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 290ca193c6c0f..169075550a5a2 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3107,17 +3107,21 @@ do { \
+ rcu_read_unlock(); \
+ } while (0)
+
+-__cold
+-static inline void assfail(const char *expr, const char *file, int line)
++#ifdef CONFIG_BTRFS_ASSERT
++__cold __noreturn
++static inline void assertfail(const char *expr, const char *file, int line)
+ {
+- if (IS_ENABLED(CONFIG_BTRFS_ASSERT)) {
+- pr_err("assertion failed: %s, in %s:%d\n", expr, file, line);
+- BUG();
+- }
++ pr_err("assertion failed: %s, in %s:%d\n", expr, file, line);
++ BUG();
+ }
+
+-#define ASSERT(expr) \
+- (likely(expr) ? (void)0 : assfail(#expr, __FILE__, __LINE__))
++#define ASSERT(expr) \
++ (likely(expr) ? (void)0 : assertfail(#expr, __FILE__, __LINE__))
++
++#else
++static inline void assertfail(const char *expr, const char* file, int line) { }
++#define ASSERT(expr) (void)(expr)
++#endif
+
+ /*
+ * Use that for functions that are conditionally exported for sanity tests but
+--
+2.20.1
+
--- /dev/null
+From 4b2976db74f9abbf9b1df370302f69f4e7e0c446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 08:57:58 -0800
+Subject: bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 94f6345712b37e4bb23cb265ce4c65b9d177e75a ]
+
+For dra7 dcan and dwc3 instances we need to block clockdomain autoidle.
+Let's do this with CLKDM_NOAUTO quirk flag and enable it for dcan and
+dwc3.
+
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Roger Quadros <rogerq@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 10 ++++++++--
+ include/linux/platform_data/ti-sysc.h | 1 +
+ 2 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index d9846265a5cd9..a0cecb12b6f96 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -479,7 +479,7 @@ static void sysc_clkdm_deny_idle(struct sysc *ddata)
+ {
+ struct ti_sysc_platform_data *pdata;
+
+- if (ddata->legacy_mode)
++ if (ddata->legacy_mode || (ddata->cfg.quirks & SYSC_QUIRK_CLKDM_NOAUTO))
+ return;
+
+ pdata = dev_get_platdata(ddata->dev);
+@@ -491,7 +491,7 @@ static void sysc_clkdm_allow_idle(struct sysc *ddata)
+ {
+ struct ti_sysc_platform_data *pdata;
+
+- if (ddata->legacy_mode)
++ if (ddata->legacy_mode || (ddata->cfg.quirks & SYSC_QUIRK_CLKDM_NOAUTO))
+ return;
+
+ pdata = dev_get_platdata(ddata->dev);
+@@ -1251,6 +1251,12 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = {
+ /* Quirks that need to be set based on detected module */
+ SYSC_QUIRK("aess", 0, 0, 0x10, -1, 0x40000000, 0xffffffff,
+ SYSC_MODULE_QUIRK_AESS),
++ SYSC_QUIRK("dcan", 0x48480000, 0x20, -1, -1, 0xa3170504, 0xffffffff,
++ SYSC_QUIRK_CLKDM_NOAUTO),
++ SYSC_QUIRK("dwc3", 0x48880000, 0, 0x10, -1, 0x500a0200, 0xffffffff,
++ SYSC_QUIRK_CLKDM_NOAUTO),
++ SYSC_QUIRK("dwc3", 0x488c0000, 0, 0x10, -1, 0x500a0200, 0xffffffff,
++ SYSC_QUIRK_CLKDM_NOAUTO),
+ SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x00000006, 0xffffffff,
+ SYSC_MODULE_QUIRK_HDQ1W),
+ SYSC_QUIRK("hdq1w", 0, 0, 0x14, 0x18, 0x0000000a, 0xffffffff,
+diff --git a/include/linux/platform_data/ti-sysc.h b/include/linux/platform_data/ti-sysc.h
+index 8cfe570fdece6..2cbde6542849d 100644
+--- a/include/linux/platform_data/ti-sysc.h
++++ b/include/linux/platform_data/ti-sysc.h
+@@ -49,6 +49,7 @@ struct sysc_regbits {
+ s8 emufree_shift;
+ };
+
++#define SYSC_QUIRK_CLKDM_NOAUTO BIT(21)
+ #define SYSC_QUIRK_FORCE_MSTANDBY BIT(20)
+ #define SYSC_MODULE_QUIRK_AESS BIT(19)
+ #define SYSC_MODULE_QUIRK_SGX BIT(18)
+--
+2.20.1
+
--- /dev/null
+From 1109f301181b9dc70ca9e48b7081b6318e3fe8cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 20:29:40 -0500
+Subject: ceph: check availability of mds cluster on mount after wait timeout
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit 97820058fb2831a4b203981fa2566ceaaa396103 ]
+
+If all the MDS daemons are down for some reason, then the first mount
+attempt will fail with EIO after the mount request times out. A mount
+attempt will also fail with EIO if all of the MDS's are laggy.
+
+This patch changes the code to return -EHOSTUNREACH in these situations
+and adds a pr_info error message to help the admin determine the cause.
+
+URL: https://tracker.ceph.com/issues/4386
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 3 +--
+ fs/ceph/super.c | 5 +++++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index ee02a742fff57..8c1f04c3a684c 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -2552,8 +2552,7 @@ static void __do_request(struct ceph_mds_client *mdsc,
+ if (!(mdsc->fsc->mount_options->flags &
+ CEPH_MOUNT_OPT_MOUNTWAIT) &&
+ !ceph_mdsmap_is_cluster_available(mdsc->mdsmap)) {
+- err = -ENOENT;
+- pr_info("probably no mds server is up\n");
++ err = -EHOSTUNREACH;
+ goto finish;
+ }
+ }
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index b47f43fc2d688..62fc7d46032e8 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -1137,6 +1137,11 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
+ return res;
+
+ out_splat:
++ if (!ceph_mdsmap_is_cluster_available(fsc->mdsc->mdsmap)) {
++ pr_info("No mds server is up or the cluster is laggy\n");
++ err = -EHOSTUNREACH;
++ }
++
+ ceph_mdsc_close_sessions(fsc->mdsc);
+ deactivate_locked_super(sb);
+ goto out_final;
+--
+2.20.1
+
--- /dev/null
+From b042e8934c4f355002b0955aab0d488348f3e16d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 20:26:13 -0600
+Subject: char: hpet: Fix out-of-bounds read bug
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 98c49f1746ac44ccc164e914b9a44183fad09f51 ]
+
+Currently, there is an out-of-bounds read on array hpetp->hp_dev
+in the following for loop:
+
+870 for (i = 0; i < hdp->hd_nirqs; i++)
+871 hpetp->hp_dev[i].hd_hdwirq = hdp->hd_irq[i];
+
+This is due to the recent change from one-element array to
+flexible-array member in struct hpets:
+
+104 struct hpets {
+ ...
+113 struct hpet_dev hp_dev[];
+114 };
+
+This change affected the total size of the dynamic memory
+allocation, decreasing it by one time the size of struct hpet_dev.
+
+Fix this by adjusting the allocation size when calling
+struct_size().
+
+Fixes: 987f028b8637c ("char: hpet: Use flexible-array member")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Acked-by: Eric Biggers <ebiggers@kernel.org>
+Link: https://lore.kernel.org/r/20200129022613.GA24281@embeddedor.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/hpet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index 9ac6671bb5141..f69609b47fef8 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -855,7 +855,7 @@ int hpet_alloc(struct hpet_data *hdp)
+ return 0;
+ }
+
+- hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs - 1),
++ hpetp = kzalloc(struct_size(hpetp, hp_dev, hdp->hd_nirqs),
+ GFP_KERNEL);
+
+ if (!hpetp)
+--
+2.20.1
+
--- /dev/null
+From 77174d88f9762aa5781da828cb7be4d2954778de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 16:16:25 -0500
+Subject: char/random: silence a lockdep splat with printk()
+
+From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+
+[ Upstream commit 1b710b1b10eff9d46666064ea25f079f70bc67a8 ]
+
+Sergey didn't like the locking order,
+
+uart_port->lock -> tty_port->lock
+
+uart_write (uart_port->lock)
+ __uart_start
+ pl011_start_tx
+ pl011_tx_chars
+ uart_write_wakeup
+ tty_port_tty_wakeup
+ tty_port_default
+ tty_port_tty_get (tty_port->lock)
+
+but those code is so old, and I have no clue how to de-couple it after
+checking other locks in the splat. There is an onging effort to make all
+printk() as deferred, so until that happens, workaround it for now as a
+short-term fix.
+
+LTP: starting iogen01 (export LTPROOT; rwtest -N iogen01 -i 120s -s
+read,write -Da -Dv -n 2 500b:$TMPDIR/doio.f1.$$
+1000b:$TMPDIR/doio.f2.$$)
+WARNING: possible circular locking dependency detected
+------------------------------------------------------
+doio/49441 is trying to acquire lock:
+ffff008b7cff7290 (&(&zone->lock)->rlock){..-.}, at: rmqueue+0x138/0x2050
+
+but task is already holding lock:
+60ff000822352818 (&pool->lock/1){-.-.}, at: start_flush_work+0xd8/0x3f0
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #4 (&pool->lock/1){-.-.}:
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ __queue_work+0x4b4/0xa10
+ queue_work_on+0xac/0x11c
+ tty_schedule_flip+0x84/0xbc
+ tty_flip_buffer_push+0x1c/0x28
+ pty_write+0x98/0xd0
+ n_tty_write+0x450/0x60c
+ tty_write+0x338/0x474
+ __vfs_write+0x88/0x214
+ vfs_write+0x12c/0x1a4
+ redirected_tty_write+0x90/0xdc
+ do_loop_readv_writev+0x140/0x180
+ do_iter_write+0xe0/0x10c
+ vfs_writev+0x134/0x1cc
+ do_writev+0xbc/0x130
+ __arm64_sys_writev+0x58/0x8c
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+ -> #3 (&(&port->lock)->rlock){-.-.}:
+ lock_acquire+0x320/0x360
+ _raw_spin_lock_irqsave+0x7c/0x9c
+ tty_port_tty_get+0x24/0x60
+ tty_port_default_wakeup+0x1c/0x3c
+ tty_port_tty_wakeup+0x34/0x40
+ uart_write_wakeup+0x28/0x44
+ pl011_tx_chars+0x1b8/0x270
+ pl011_start_tx+0x24/0x70
+ __uart_start+0x5c/0x68
+ uart_write+0x164/0x1c8
+ do_output_char+0x33c/0x348
+ n_tty_write+0x4bc/0x60c
+ tty_write+0x338/0x474
+ redirected_tty_write+0xc0/0xdc
+ do_loop_readv_writev+0x140/0x180
+ do_iter_write+0xe0/0x10c
+ vfs_writev+0x134/0x1cc
+ do_writev+0xbc/0x130
+ __arm64_sys_writev+0x58/0x8c
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+ -> #2 (&port_lock_key){-.-.}:
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ pl011_console_write+0xec/0x2cc
+ console_unlock+0x794/0x96c
+ vprintk_emit+0x260/0x31c
+ vprintk_default+0x54/0x7c
+ vprintk_func+0x218/0x254
+ printk+0x7c/0xa4
+ register_console+0x734/0x7b0
+ uart_add_one_port+0x734/0x834
+ pl011_register_port+0x6c/0xac
+ sbsa_uart_probe+0x234/0x2ec
+ platform_drv_probe+0xd4/0x124
+ really_probe+0x250/0x71c
+ driver_probe_device+0xb4/0x200
+ __device_attach_driver+0xd8/0x188
+ bus_for_each_drv+0xbc/0x110
+ __device_attach+0x120/0x220
+ device_initial_probe+0x20/0x2c
+ bus_probe_device+0x54/0x100
+ device_add+0xae8/0xc2c
+ platform_device_add+0x278/0x3b8
+ platform_device_register_full+0x238/0x2ac
+ acpi_create_platform_device+0x2dc/0x3a8
+ acpi_bus_attach+0x390/0x3cc
+ acpi_bus_attach+0x108/0x3cc
+ acpi_bus_attach+0x108/0x3cc
+ acpi_bus_attach+0x108/0x3cc
+ acpi_bus_scan+0x7c/0xb0
+ acpi_scan_init+0xe4/0x304
+ acpi_init+0x100/0x114
+ do_one_initcall+0x348/0x6a0
+ do_initcall_level+0x190/0x1fc
+ do_basic_setup+0x34/0x4c
+ kernel_init_freeable+0x19c/0x260
+ kernel_init+0x18/0x338
+ ret_from_fork+0x10/0x18
+
+ -> #1 (console_owner){-...}:
+ lock_acquire+0x320/0x360
+ console_lock_spinning_enable+0x6c/0x7c
+ console_unlock+0x4f8/0x96c
+ vprintk_emit+0x260/0x31c
+ vprintk_default+0x54/0x7c
+ vprintk_func+0x218/0x254
+ printk+0x7c/0xa4
+ get_random_u64+0x1c4/0x1dc
+ shuffle_pick_tail+0x40/0xac
+ __free_one_page+0x424/0x710
+ free_one_page+0x70/0x120
+ __free_pages_ok+0x61c/0xa94
+ __free_pages_core+0x1bc/0x294
+ memblock_free_pages+0x38/0x48
+ __free_pages_memory+0xcc/0xfc
+ __free_memory_core+0x70/0x78
+ free_low_memory_core_early+0x148/0x18c
+ memblock_free_all+0x18/0x54
+ mem_init+0xb4/0x17c
+ mm_init+0x14/0x38
+ start_kernel+0x19c/0x530
+
+ -> #0 (&(&zone->lock)->rlock){..-.}:
+ validate_chain+0xf6c/0x2e2c
+ __lock_acquire+0x868/0xc2c
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ rmqueue+0x138/0x2050
+ get_page_from_freelist+0x474/0x688
+ __alloc_pages_nodemask+0x3b4/0x18dc
+ alloc_pages_current+0xd0/0xe0
+ alloc_slab_page+0x2b4/0x5e0
+ new_slab+0xc8/0x6bc
+ ___slab_alloc+0x3b8/0x640
+ kmem_cache_alloc+0x4b4/0x588
+ __debug_object_init+0x778/0x8b4
+ debug_object_init_on_stack+0x40/0x50
+ start_flush_work+0x16c/0x3f0
+ __flush_work+0xb8/0x124
+ flush_work+0x20/0x30
+ xlog_cil_force_lsn+0x88/0x204 [xfs]
+ xfs_log_force_lsn+0x128/0x1b8 [xfs]
+ xfs_file_fsync+0x3c4/0x488 [xfs]
+ vfs_fsync_range+0xb0/0xd0
+ generic_write_sync+0x80/0xa0 [xfs]
+ xfs_file_buffered_aio_write+0x66c/0x6e4 [xfs]
+ xfs_file_write_iter+0x1a0/0x218 [xfs]
+ __vfs_write+0x1cc/0x214
+ vfs_write+0x12c/0x1a4
+ ksys_write+0xb0/0x120
+ __arm64_sys_write+0x54/0x88
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &(&zone->lock)->rlock --> &(&port->lock)->rlock --> &pool->lock/1
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&pool->lock/1);
+ lock(&(&port->lock)->rlock);
+ lock(&pool->lock/1);
+ lock(&(&zone->lock)->rlock);
+
+ *** DEADLOCK ***
+
+4 locks held by doio/49441:
+ #0: a0ff00886fc27408 (sb_writers#8){.+.+}, at: vfs_write+0x118/0x1a4
+ #1: 8fff00080810dfe0 (&xfs_nondir_ilock_class){++++}, at:
+xfs_ilock+0x2a8/0x300 [xfs]
+ #2: ffff9000129f2390 (rcu_read_lock){....}, at:
+rcu_lock_acquire+0x8/0x38
+ #3: 60ff000822352818 (&pool->lock/1){-.-.}, at:
+start_flush_work+0xd8/0x3f0
+
+ stack backtrace:
+CPU: 48 PID: 49441 Comm: doio Tainted: G W
+Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS
+L50_5.13_1.11 06/18/2019
+Call trace:
+ dump_backtrace+0x0/0x248
+ show_stack+0x20/0x2c
+ dump_stack+0xe8/0x150
+ print_circular_bug+0x368/0x380
+ check_noncircular+0x28c/0x294
+ validate_chain+0xf6c/0x2e2c
+ __lock_acquire+0x868/0xc2c
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ rmqueue+0x138/0x2050
+ get_page_from_freelist+0x474/0x688
+ __alloc_pages_nodemask+0x3b4/0x18dc
+ alloc_pages_current+0xd0/0xe0
+ alloc_slab_page+0x2b4/0x5e0
+ new_slab+0xc8/0x6bc
+ ___slab_alloc+0x3b8/0x640
+ kmem_cache_alloc+0x4b4/0x588
+ __debug_object_init+0x778/0x8b4
+ debug_object_init_on_stack+0x40/0x50
+ start_flush_work+0x16c/0x3f0
+ __flush_work+0xb8/0x124
+ flush_work+0x20/0x30
+ xlog_cil_force_lsn+0x88/0x204 [xfs]
+ xfs_log_force_lsn+0x128/0x1b8 [xfs]
+ xfs_file_fsync+0x3c4/0x488 [xfs]
+ vfs_fsync_range+0xb0/0xd0
+ generic_write_sync+0x80/0xa0 [xfs]
+ xfs_file_buffered_aio_write+0x66c/0x6e4 [xfs]
+ xfs_file_write_iter+0x1a0/0x218 [xfs]
+ __vfs_write+0x1cc/0x214
+ vfs_write+0x12c/0x1a4
+ ksys_write+0xb0/0x120
+ __arm64_sys_write+0x54/0x88
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Signed-off-by: Qian Cai <cai@lca.pw>
+Link: https://lore.kernel.org/r/1573679785-21068-1-git-send-email-cai@lca.pw
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/random.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 01b8868b9bed2..a385fc1da1cbf 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1687,8 +1687,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
+ print_once = true;
+ #endif
+ if (__ratelimit(&unseeded_warning))
+- pr_notice("random: %s called from %pS with crng_init=%d\n",
+- func_name, caller, crng_init);
++ printk_deferred(KERN_NOTICE "random: %s called from %pS "
++ "with crng_init=%d\n", func_name, caller,
++ crng_init);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 1785639aacdb1caed99f3c3abf6e37f1e61b8650 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 10:03:19 -0300
+Subject: cifs: Fix mount options set in automount
+
+From: Paulo Alcantara (SUSE) <pc@cjr.nz>
+
+[ Upstream commit 5739375ee4230980166807d347cc21c305532bbc ]
+
+Starting from 4a367dc04435, we must set the mount options based on the
+DFS full path rather than the resolved target, that is, cifs_mount()
+will be responsible for resolving the DFS link (cached) as well as
+performing failover to any other targets in the referral.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Reported-by: Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
+Fixes: 4a367dc04435 ("cifs: Add support for failover in cifs_mount()")
+Link: https://lore.kernel.org/linux-cifs/39643d7d-2abb-14d3-ced6-c394fab9a777@prodrive-technologies.com
+Tested-by: Martijn de Gouw <martijn.de.gouw@prodrive-technologies.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifs_dfs_ref.c | 97 +++++++++++++++++++-----------------------
+ 1 file changed, 43 insertions(+), 54 deletions(-)
+
+diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
+index 41957b82d7960..606f26d862dc1 100644
+--- a/fs/cifs/cifs_dfs_ref.c
++++ b/fs/cifs/cifs_dfs_ref.c
+@@ -120,17 +120,17 @@ cifs_build_devname(char *nodename, const char *prepath)
+
+
+ /**
+- * cifs_compose_mount_options - creates mount options for refferral
++ * cifs_compose_mount_options - creates mount options for referral
+ * @sb_mountdata: parent/root DFS mount options (template)
+ * @fullpath: full path in UNC format
+- * @ref: server's referral
++ * @ref: optional server's referral
+ * @devname: optional pointer for saving device name
+ *
+ * creates mount options for submount based on template options sb_mountdata
+ * and replacing unc,ip,prefixpath options with ones we've got form ref_unc.
+ *
+ * Returns: pointer to new mount options or ERR_PTR.
+- * Caller is responcible for freeing retunrned value if it is not error.
++ * Caller is responsible for freeing returned value if it is not error.
+ */
+ char *cifs_compose_mount_options(const char *sb_mountdata,
+ const char *fullpath,
+@@ -150,18 +150,27 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
+ if (sb_mountdata == NULL)
+ return ERR_PTR(-EINVAL);
+
+- if (strlen(fullpath) - ref->path_consumed) {
+- prepath = fullpath + ref->path_consumed;
+- /* skip initial delimiter */
+- if (*prepath == '/' || *prepath == '\\')
+- prepath++;
+- }
++ if (ref) {
++ if (strlen(fullpath) - ref->path_consumed) {
++ prepath = fullpath + ref->path_consumed;
++ /* skip initial delimiter */
++ if (*prepath == '/' || *prepath == '\\')
++ prepath++;
++ }
+
+- name = cifs_build_devname(ref->node_name, prepath);
+- if (IS_ERR(name)) {
+- rc = PTR_ERR(name);
+- name = NULL;
+- goto compose_mount_options_err;
++ name = cifs_build_devname(ref->node_name, prepath);
++ if (IS_ERR(name)) {
++ rc = PTR_ERR(name);
++ name = NULL;
++ goto compose_mount_options_err;
++ }
++ } else {
++ name = cifs_build_devname((char *)fullpath, NULL);
++ if (IS_ERR(name)) {
++ rc = PTR_ERR(name);
++ name = NULL;
++ goto compose_mount_options_err;
++ }
+ }
+
+ rc = dns_resolve_server_name_to_ip(name, &srvIP);
+@@ -225,6 +234,8 @@ char *cifs_compose_mount_options(const char *sb_mountdata,
+
+ if (devname)
+ *devname = name;
++ else
++ kfree(name);
+
+ /*cifs_dbg(FYI, "%s: parent mountdata: %s\n", __func__, sb_mountdata);*/
+ /*cifs_dbg(FYI, "%s: submount mountdata: %s\n", __func__, mountdata );*/
+@@ -241,23 +252,23 @@ compose_mount_options_err:
+ }
+
+ /**
+- * cifs_dfs_do_refmount - mounts specified path using provided refferal
++ * cifs_dfs_do_mount - mounts specified path using DFS full path
++ *
++ * Always pass down @fullpath to smb3_do_mount() so we can use the root server
++ * to perform failover in case we failed to connect to the first target in the
++ * referral.
++ *
+ * @cifs_sb: parent/root superblock
+ * @fullpath: full path in UNC format
+- * @ref: server's referral
+ */
+-static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
+- struct cifs_sb_info *cifs_sb,
+- const char *fullpath, const struct dfs_info3_param *ref)
++static struct vfsmount *cifs_dfs_do_mount(struct dentry *mntpt,
++ struct cifs_sb_info *cifs_sb,
++ const char *fullpath)
+ {
+ struct vfsmount *mnt;
+ char *mountdata;
+ char *devname;
+
+- /*
+- * Always pass down the DFS full path to smb3_do_mount() so we
+- * can use it later for failover.
+- */
+ devname = kstrndup(fullpath, strlen(fullpath), GFP_KERNEL);
+ if (!devname)
+ return ERR_PTR(-ENOMEM);
+@@ -266,7 +277,7 @@ static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
+
+ /* strip first '\' from fullpath */
+ mountdata = cifs_compose_mount_options(cifs_sb->mountdata,
+- fullpath + 1, ref, NULL);
++ fullpath + 1, NULL, NULL);
+ if (IS_ERR(mountdata)) {
+ kfree(devname);
+ return (struct vfsmount *)mountdata;
+@@ -278,28 +289,16 @@ static struct vfsmount *cifs_dfs_do_refmount(struct dentry *mntpt,
+ return mnt;
+ }
+
+-static void dump_referral(const struct dfs_info3_param *ref)
+-{
+- cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name);
+- cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name);
+- cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n",
+- ref->flags, ref->server_type);
+- cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n",
+- ref->ref_flag, ref->path_consumed);
+-}
+-
+ /*
+ * Create a vfsmount that we can automount
+ */
+ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ {
+- struct dfs_info3_param referral = {0};
+ struct cifs_sb_info *cifs_sb;
+ struct cifs_ses *ses;
+ struct cifs_tcon *tcon;
+ char *full_path, *root_path;
+ unsigned int xid;
+- int len;
+ int rc;
+ struct vfsmount *mnt;
+
+@@ -357,7 +356,7 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ if (!rc) {
+ rc = dfs_cache_find(xid, ses, cifs_sb->local_nls,
+ cifs_remap(cifs_sb), full_path + 1,
+- &referral, NULL);
++ NULL, NULL);
+ }
+
+ free_xid(xid);
+@@ -366,26 +365,16 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ mnt = ERR_PTR(rc);
+ goto free_root_path;
+ }
+-
+- dump_referral(&referral);
+-
+- len = strlen(referral.node_name);
+- if (len < 2) {
+- cifs_dbg(VFS, "%s: Net Address path too short: %s\n",
+- __func__, referral.node_name);
+- mnt = ERR_PTR(-EINVAL);
+- goto free_dfs_ref;
+- }
+ /*
+- * cifs_mount() will retry every available node server in case
+- * of failures.
++ * OK - we were able to get and cache a referral for @full_path.
++ *
++ * Now, pass it down to cifs_mount() and it will retry every available
++ * node server in case of failures - no need to do it here.
+ */
+- mnt = cifs_dfs_do_refmount(mntpt, cifs_sb, full_path, &referral);
+- cifs_dbg(FYI, "%s: cifs_dfs_do_refmount:%s , mnt:%p\n", __func__,
+- referral.node_name, mnt);
++ mnt = cifs_dfs_do_mount(mntpt, cifs_sb, full_path);
++ cifs_dbg(FYI, "%s: cifs_dfs_do_mount:%s , mnt:%p\n", __func__,
++ full_path + 1, mnt);
+
+-free_dfs_ref:
+- free_dfs_info_param(&referral);
+ free_root_path:
+ kfree(root_path);
+ free_full_path:
+--
+2.20.1
+
--- /dev/null
+From d39d4e8461cdb6bad2ced87cc1acb5b4c2fca0e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 11:07:56 +1000
+Subject: cifs: fix NULL dereference in match_prepath
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+[ Upstream commit fe1292686333d1dadaf84091f585ee903b9ddb84 ]
+
+RHBZ: 1760879
+
+Fix an oops in match_prepath() by making sure that the prepath string is not
+NULL before we pass it into strcmp().
+
+This is similar to other checks we make for example in cifs_root_iget()
+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 02451d085ddd0..5d3c867bdc808 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3652,8 +3652,10 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+ {
+ struct cifs_sb_info *old = CIFS_SB(sb);
+ struct cifs_sb_info *new = mnt_data->cifs_sb;
+- bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
+- bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
++ bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++ old->prepath;
++ bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++ new->prepath;
+
+ if (old_set && new_set && !strcmp(new->prepath, old->prepath))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From 57204d0994f2076bbbe8c7d6a2b7ddeba0aa6072 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 15:58:00 -0600
+Subject: cifs: fix unitialized variable poential problem with network I/O
+ cache lock patch
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 463a7b457c02250a84faa1d23c52da9e3364aed2 ]
+
+static analysis with Coverity detected an issue with the following
+commit:
+
+ Author: Paulo Alcantara (SUSE) <pc@cjr.nz>
+ Date: Wed Dec 4 17:38:03 2019 -0300
+
+ cifs: Avoid doing network I/O while holding cache lock
+
+Addresses-Coverity: ("Uninitialized pointer read")
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/dfs_cache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c
+index 2faa05860a483..cf6cec59696c2 100644
+--- a/fs/cifs/dfs_cache.c
++++ b/fs/cifs/dfs_cache.c
+@@ -1319,7 +1319,7 @@ static struct cifs_ses *find_root_ses(struct dfs_cache_vol_info *vi,
+ char *mdata = NULL, *devname = NULL;
+ struct TCP_Server_Info *server;
+ struct cifs_ses *ses;
+- struct smb_vol vol;
++ struct smb_vol vol = {NULL};
+
+ rpath = get_dfs_root(path);
+ if (IS_ERR(rpath))
+--
+2.20.1
+
--- /dev/null
+From cf39991323f9413be13d8a2baf6b92859503d54d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 16:52:11 -0600
+Subject: cifs: log warning message (once) if out of disk space
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit d6fd41905ec577851734623fb905b1763801f5ef ]
+
+We ran into a confusing problem where an application wasn't checking
+return code on close and so user didn't realize that the application
+ran out of disk space. log a warning message (once) in these
+cases. For example:
+
+ [ 8407.391909] Out of space writing to \\oleg-server\small-share
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reported-by: Oleg Kravtsov <oleg@tuxera.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 06d932ed097e5..c6fc6582ee7bc 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3917,6 +3917,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
+ wdata->cfile->fid.persistent_fid,
+ tcon->tid, tcon->ses->Suid, wdata->offset,
+ wdata->bytes, wdata->result);
++ if (wdata->result == -ENOSPC)
++ printk_once(KERN_WARNING "Out of space writing to %s\n",
++ tcon->treeName);
+ } else
+ trace_smb3_write_done(0 /* no xid */,
+ wdata->cfile->fid.persistent_fid,
+--
+2.20.1
+
--- /dev/null
+From a02ed140239d97f0c02331da493c0f4be63f6a7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 14:39:52 +0200
+Subject: clk: actually call the clock init before any other callback of the
+ clock
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit f6fa75ca912be6021335de63a32aa4d295f3c524 ]
+
+ __clk_init_parent() will call the .get_parent() callback of the clock
+ so .init() must run before.
+
+Fixes: 541debae0adf ("clk: call the clock init() callback before any other ops callback")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lkml.kernel.org/r/20190924123954.31561-2-jbrunet@baylibre.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 67f592fa083ab..b0344a1a03704 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3320,6 +3320,21 @@ static int __clk_core_init(struct clk_core *core)
+ goto out;
+ }
+
++ /*
++ * optional platform-specific magic
++ *
++ * The .init callback is not used by any of the basic clock types, but
++ * exists for weird hardware that must perform initialization magic.
++ * Please consider other ways of solving initialization problems before
++ * using this callback, as its use is discouraged.
++ *
++ * If it exist, this callback should called before any other callback of
++ * the clock
++ */
++ if (core->ops->init)
++ core->ops->init(core->hw);
++
++
+ core->parent = __clk_init_parent(core);
+
+ /*
+@@ -3344,17 +3359,6 @@ static int __clk_core_init(struct clk_core *core)
+ core->orphan = true;
+ }
+
+- /*
+- * optional platform-specific magic
+- *
+- * The .init callback is not used by any of the basic clock types, but
+- * exists for weird hardware that must perform initialization magic.
+- * Please consider other ways of solving initialization problems before
+- * using this callback, as its use is discouraged.
+- */
+- if (core->ops->init)
+- core->ops->init(core->hw);
+-
+ /*
+ * Set clk's accuracy. The preferred method is to use
+ * .recalc_accuracy. For simple clocks and lazy developers the default
+--
+2.20.1
+
--- /dev/null
+From 83bcb571678c0088e0af683b2ca9b12777d1d24c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 11:25:19 +0000
+Subject: clk: at91: sam9x60: fix programmable clock prescaler
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 66d9f5214c9ba1c151478f99520b6817302d50dc ]
+
+The prescaler works as parent rate divided by (PRES + 1) (is_pres_direct == 1)
+It does not work in the way of parent rate shifted to the right by (PRES + 1),
+which means division by 2^(PRES + 1) (is_pres_direct == 0)
+Thus is_pres_direct must be enabled for this SoC, to make the right computation.
+This field was added in
+commit 45b06682113b ("clk: at91: fix programmable clock for sama5d2")
+SAM9X60 has the same field as SAMA5D2 in the PCK
+
+Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Link: https://lkml.kernel.org/r/1575977088-16781-1-git-send-email-eugen.hristev@microchip.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sam9x60.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
+index 86238d5ecb4da..77398aefeb6db 100644
+--- a/drivers/clk/at91/sam9x60.c
++++ b/drivers/clk/at91/sam9x60.c
+@@ -47,6 +47,7 @@ static const struct clk_programmable_layout sam9x60_programmable_layout = {
+ .pres_shift = 8,
+ .css_mask = 0x1f,
+ .have_slck_mck = 0,
++ .is_pres_direct = 1,
+ };
+
+ static const struct clk_pcr_layout sam9x60_pcr_layout = {
+--
+2.20.1
+
--- /dev/null
+From c1fa686c56abd0ad25aafb95555944996a40968f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:25:40 +0200
+Subject: clk: imx: Add correct failure handling for clk based helpers
+
+From: Abel Vesa <abel.vesa@nxp.com>
+
+[ Upstream commit f60f1c62c3188fcca945581e35e3440ee3fdcc95 ]
+
+If the clk_hw based API returns an error, trying to return the clk from
+hw will end up in a NULL pointer dereference. So adding the to_clk
+checker and using it inside every clk based macro helper we handle that
+case correctly.
+
+This to_clk is also temporary and will go away along with the clk based
+macro helpers once there is no user that need them anymore.
+
+Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk.h | 37 ++++++++++++++++++++++---------------
+ 1 file changed, 22 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/clk/imx/clk.h b/drivers/clk/imx/clk.h
+index f7a389a50401a..6fe64ff8ffa12 100644
+--- a/drivers/clk/imx/clk.h
++++ b/drivers/clk/imx/clk.h
+@@ -51,48 +51,48 @@ struct imx_pll14xx_clk {
+ };
+
+ #define imx_clk_cpu(name, parent_name, div, mux, pll, step) \
+- imx_clk_hw_cpu(name, parent_name, div, mux, pll, step)->clk
++ to_clk(imx_clk_hw_cpu(name, parent_name, div, mux, pll, step))
+
+ #define clk_register_gate2(dev, name, parent_name, flags, reg, bit_idx, \
+ cgr_val, clk_gate_flags, lock, share_count) \
+- clk_hw_register_gate2(dev, name, parent_name, flags, reg, bit_idx, \
+- cgr_val, clk_gate_flags, lock, share_count)->clk
++ to_clk(clk_hw_register_gate2(dev, name, parent_name, flags, reg, bit_idx, \
++ cgr_val, clk_gate_flags, lock, share_count))
+
+ #define imx_clk_pllv3(type, name, parent_name, base, div_mask) \
+- imx_clk_hw_pllv3(type, name, parent_name, base, div_mask)->clk
++ to_clk(imx_clk_hw_pllv3(type, name, parent_name, base, div_mask))
+
+ #define imx_clk_pfd(name, parent_name, reg, idx) \
+- imx_clk_hw_pfd(name, parent_name, reg, idx)->clk
++ to_clk(imx_clk_hw_pfd(name, parent_name, reg, idx))
+
+ #define imx_clk_gate_exclusive(name, parent, reg, shift, exclusive_mask) \
+- imx_clk_hw_gate_exclusive(name, parent, reg, shift, exclusive_mask)->clk
++ to_clk(imx_clk_hw_gate_exclusive(name, parent, reg, shift, exclusive_mask))
+
+ #define imx_clk_fixed_factor(name, parent, mult, div) \
+- imx_clk_hw_fixed_factor(name, parent, mult, div)->clk
++ to_clk(imx_clk_hw_fixed_factor(name, parent, mult, div))
+
+ #define imx_clk_divider2(name, parent, reg, shift, width) \
+- imx_clk_hw_divider2(name, parent, reg, shift, width)->clk
++ to_clk(imx_clk_hw_divider2(name, parent, reg, shift, width))
+
+ #define imx_clk_gate_dis(name, parent, reg, shift) \
+- imx_clk_hw_gate_dis(name, parent, reg, shift)->clk
++ to_clk(imx_clk_hw_gate_dis(name, parent, reg, shift))
+
+ #define imx_clk_gate2(name, parent, reg, shift) \
+- imx_clk_hw_gate2(name, parent, reg, shift)->clk
++ to_clk(imx_clk_hw_gate2(name, parent, reg, shift))
+
+ #define imx_clk_gate2_flags(name, parent, reg, shift, flags) \
+- imx_clk_hw_gate2_flags(name, parent, reg, shift, flags)->clk
++ to_clk(imx_clk_hw_gate2_flags(name, parent, reg, shift, flags))
+
+ #define imx_clk_gate2_shared2(name, parent, reg, shift, share_count) \
+- imx_clk_hw_gate2_shared2(name, parent, reg, shift, share_count)->clk
++ to_clk(imx_clk_hw_gate2_shared2(name, parent, reg, shift, share_count))
+
+ #define imx_clk_gate3(name, parent, reg, shift) \
+- imx_clk_hw_gate3(name, parent, reg, shift)->clk
++ to_clk(imx_clk_hw_gate3(name, parent, reg, shift))
+
+ #define imx_clk_gate4(name, parent, reg, shift) \
+- imx_clk_hw_gate4(name, parent, reg, shift)->clk
++ to_clk(imx_clk_hw_gate4(name, parent, reg, shift))
+
+ #define imx_clk_mux(name, reg, shift, width, parents, num_parents) \
+- imx_clk_hw_mux(name, reg, shift, width, parents, num_parents)->clk
++ to_clk(imx_clk_hw_mux(name, reg, shift, width, parents, num_parents))
+
+ struct clk *imx_clk_pll14xx(const char *name, const char *parent_name,
+ void __iomem *base, const struct imx_pll14xx_clk *pll_clk);
+@@ -195,6 +195,13 @@ struct clk_hw *imx_clk_hw_fixup_mux(const char *name, void __iomem *reg,
+ u8 shift, u8 width, const char * const *parents,
+ int num_parents, void (*fixup)(u32 *val));
+
++static inline struct clk *to_clk(struct clk_hw *hw)
++{
++ if (IS_ERR_OR_NULL(hw))
++ return ERR_CAST(hw);
++ return hw->clk;
++}
++
+ static inline struct clk *imx_clk_fixed(const char *name, int rate)
+ {
+ return clk_register_fixed_rate(NULL, name, NULL, 0, rate);
+--
+2.20.1
+
--- /dev/null
+From 966ff839e126f04d724a03932ca0eeb7ad7fc6d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 20:12:23 +0100
+Subject: clk: meson: meson8b: make the CCF use the glitch-free mali mux
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 8daeaea99caabe24a0929fac17977ebfb882fa86 ]
+
+The "mali_0" or "mali_1" clock trees should not be updated while the
+clock is running. Enforce this by setting CLK_SET_RATE_GATE on the
+"mali_0" and "mali_1" gates. This makes the CCF switch to the "mali_1"
+tree when "mali_0" is currently active and vice versa, which is exactly
+what the vendor driver does when updating the frequency of the mali
+clock.
+
+This fixes a potential hang when changing the GPU frequency at runtime.
+
+Fixes: 74e1f2521f16ff ("clk: meson: meson8b: add the GPU clock tree")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/meson8b.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 67e6691e080c1..8856ce476ccfa 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -1764,8 +1764,11 @@ static struct clk_regmap meson8b_hdmi_sys = {
+
+ /*
+ * The MALI IP is clocked by two identical clocks (mali_0 and mali_1)
+- * muxed by a glitch-free switch on Meson8b and Meson8m2. Meson8 only
+- * has mali_0 and no glitch-free mux.
++ * muxed by a glitch-free switch on Meson8b and Meson8m2. The CCF can
++ * actually manage this glitch-free mux because it does top-to-bottom
++ * updates the each clock tree and switches to the "inactive" one when
++ * CLK_SET_RATE_GATE is set.
++ * Meson8 only has mali_0 and no glitch-free mux.
+ */
+ static const struct clk_hw *meson8b_mali_0_1_parent_hws[] = {
+ &meson8b_xtal.hw,
+@@ -1830,7 +1833,7 @@ static struct clk_regmap meson8b_mali_0 = {
+ &meson8b_mali_0_div.hw
+ },
+ .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
++ .flags = CLK_SET_RATE_GATE | CLK_SET_RATE_PARENT,
+ },
+ };
+
+@@ -1885,7 +1888,7 @@ static struct clk_regmap meson8b_mali_1 = {
+ &meson8b_mali_1_div.hw
+ },
+ .num_parents = 1,
+- .flags = CLK_SET_RATE_PARENT,
++ .flags = CLK_SET_RATE_GATE | CLK_SET_RATE_PARENT,
+ },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 144145197387ee31bb68e98fb843f15dbef88a2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 12:47:05 +0100
+Subject: clk: meson: pll: Fix by 0 division in __pll_params_to_rate()
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+[ Upstream commit d8488a41800d9f5c80bc0d17b9cc2c91b4841464 ]
+
+Some meson pll registers can be initialized with 0 as N value, introducing
+the following division by 0 when computing rate :
+
+ UBSAN: Undefined behaviour in drivers/clk/meson/clk-pll.c:75:9
+ division by zero
+ CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc3-608075-g86c9af8630e1-dirty #400
+ Call trace:
+ dump_backtrace+0x0/0x1c0
+ show_stack+0x14/0x20
+ dump_stack+0xc4/0x100
+ ubsan_epilogue+0x14/0x68
+ __ubsan_handle_divrem_overflow+0x98/0xb8
+ __pll_params_to_rate+0xdc/0x140
+ meson_clk_pll_recalc_rate+0x278/0x3a0
+ __clk_register+0x7c8/0xbb0
+ devm_clk_hw_register+0x54/0xc0
+ meson_eeclkc_probe+0xf4/0x1a0
+ platform_drv_probe+0x54/0xd8
+ really_probe+0x16c/0x438
+ driver_probe_device+0xb0/0xf0
+ device_driver_attach+0x94/0xa0
+ __driver_attach+0x70/0x108
+ bus_for_each_dev+0xd8/0x128
+ driver_attach+0x30/0x40
+ bus_add_driver+0x1b0/0x2d8
+ driver_register+0xbc/0x1d0
+ __platform_driver_register+0x78/0x88
+ axg_driver_init+0x18/0x20
+ do_one_initcall+0xc8/0x24c
+ kernel_init_freeable+0x2b0/0x344
+ kernel_init+0x10/0x128
+ ret_from_fork+0x10/0x18
+
+This checks if N is null before doing the division.
+
+Fixes: 7a29a869434e ("clk: meson: Add support for Meson clock controller")
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+[jbrunet@baylibre.com: update the comment in above the fix]
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/clk-pll.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/clk/meson/clk-pll.c b/drivers/clk/meson/clk-pll.c
+index ddb1e56347395..3a5853ca98c6c 100644
+--- a/drivers/clk/meson/clk-pll.c
++++ b/drivers/clk/meson/clk-pll.c
+@@ -77,6 +77,15 @@ static unsigned long meson_clk_pll_recalc_rate(struct clk_hw *hw,
+ unsigned int m, n, frac;
+
+ n = meson_parm_read(clk->map, &pll->n);
++
++ /*
++ * On some HW, N is set to zero on init. This value is invalid as
++ * it would result in a division by zero. The rate can't be
++ * calculated in this case
++ */
++ if (n == 0)
++ return 0;
++
+ m = meson_parm_read(clk->map, &pll->m);
+
+ frac = MESON_PARM_APPLICABLE(&pll->frac) ?
+--
+2.20.1
+
--- /dev/null
+From d92f08243a620593b7f370b6434e41d1db269902 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 11:33:29 -0800
+Subject: clk: qcom: Don't overwrite 'cfg' in clk_rcg2_dfs_populate_freq()
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 21e157c62eeded8b1558a991b4820b761d48a730 ]
+
+The DFS frequency table logic overwrites 'cfg' while detecting the
+parent clk and then later on in clk_rcg2_dfs_populate_freq() we use that
+same variable to figure out the mode of the clk, either MND or not. Add
+a new variable to hold the parent clk bit so that 'cfg' is left
+untouched for use later.
+
+This fixes problems in detecting the supported frequencies for any clks
+in DFS mode.
+
+Fixes: cc4f6944d0e3 ("clk: qcom: Add support for RCG to register for DFS")
+Reported-by: Rajendra Nayak <rnayak@codeaurora.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20200128193329.45635-1-sboyd@kernel.org
+Tested-by: Rajendra Nayak <rnayak@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 5a89ed88cc27a..5174222cbfab2 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -952,7 +952,7 @@ static void clk_rcg2_dfs_populate_freq(struct clk_hw *hw, unsigned int l,
+ struct clk_rcg2 *rcg = to_clk_rcg2(hw);
+ struct clk_hw *p;
+ unsigned long prate = 0;
+- u32 val, mask, cfg, mode;
++ u32 val, mask, cfg, mode, src;
+ int i, num_parents;
+
+ regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + SE_PERF_DFSR(l), &cfg);
+@@ -962,12 +962,12 @@ static void clk_rcg2_dfs_populate_freq(struct clk_hw *hw, unsigned int l,
+ if (cfg & mask)
+ f->pre_div = cfg & mask;
+
+- cfg &= CFG_SRC_SEL_MASK;
+- cfg >>= CFG_SRC_SEL_SHIFT;
++ src = cfg & CFG_SRC_SEL_MASK;
++ src >>= CFG_SRC_SEL_SHIFT;
+
+ num_parents = clk_hw_get_num_parents(hw);
+ for (i = 0; i < num_parents; i++) {
+- if (cfg == rcg->parent_map[i].cfg) {
++ if (src == rcg->parent_map[i].cfg) {
+ f->src = rcg->parent_map[i].src;
+ p = clk_hw_get_parent_by_index(&rcg->clkr.hw, i);
+ prate = clk_hw_get_rate(p);
+--
+2.20.1
+
--- /dev/null
+From 7155eeb90d5df3ca8d7fe5df273a9a9409b86c64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 10:31:34 -0800
+Subject: clk: qcom: rcg2: Don't crash if our parent can't be found; return an
+ error
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 908b050114d8fefdddc57ec9fbc213c3690e7f5f ]
+
+When I got my clock parenting slightly wrong I ended up with a crash
+that looked like this:
+
+ Unable to handle kernel NULL pointer dereference at virtual
+ address 0000000000000000
+ ...
+ pc : clk_hw_get_rate+0x14/0x44
+ ...
+ Call trace:
+ clk_hw_get_rate+0x14/0x44
+ _freq_tbl_determine_rate+0x94/0xfc
+ clk_rcg2_determine_rate+0x2c/0x38
+ clk_core_determine_round_nolock+0x4c/0x88
+ clk_core_round_rate_nolock+0x6c/0xa8
+ clk_core_round_rate_nolock+0x9c/0xa8
+ clk_core_set_rate_nolock+0x70/0x180
+ clk_set_rate+0x3c/0x6c
+ of_clk_set_defaults+0x254/0x360
+ platform_drv_probe+0x28/0xb0
+ really_probe+0x120/0x2dc
+ driver_probe_device+0x64/0xfc
+ device_driver_attach+0x4c/0x6c
+ __driver_attach+0xac/0xc0
+ bus_for_each_dev+0x84/0xcc
+ driver_attach+0x2c/0x38
+ bus_add_driver+0xfc/0x1d0
+ driver_register+0x64/0xf8
+ __platform_driver_register+0x4c/0x58
+ msm_drm_register+0x5c/0x60
+ ...
+
+It turned out that clk_hw_get_parent_by_index() was returning NULL and
+we weren't checking. Let's check it so that we don't crash.
+
+Fixes: ac269395cdd8 ("clk: qcom: Convert to clk_hw based provider APIs")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Link: https://lkml.kernel.org/r/20200203103049.v4.1.I7487325fe8e701a68a07d3be8a6a4b571eca9cfa@changeid
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 5174222cbfab2..a88101480e337 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -217,6 +217,9 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,
+
+ clk_flags = clk_hw_get_flags(hw);
+ p = clk_hw_get_parent_by_index(hw, index);
++ if (!p)
++ return -EINVAL;
++
+ if (clk_flags & CLK_SET_RATE_PARENT) {
+ rate = f->freq;
+ if (f->pre_div) {
+--
+2.20.1
+
--- /dev/null
+From 319400b0f0a3fa66d38001d8c5e67ac76b2a7445 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 08:54:09 -0800
+Subject: clk: qcom: smd: Add missing bimc clock
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 87ec9adcca71801a44ddb311185b17df09839ab5 ]
+
+It turns out booting the modem is dependent on a bimc vote from Linux on
+msm8998. To make the modem happy, add the bimc clock to rely on the
+default vote from rpmcc. Once we have interconnect support, bimc should
+be controlled properly.
+
+Fixes: 6131dc81211c ("clk: qcom: smd: Add support for MSM8998 rpm clocks")
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Link: https://lkml.kernel.org/r/20191217165409.4919-1-jeffrey.l.hugo@gmail.com
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-smd-rpm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/clk-smd-rpm.c b/drivers/clk/qcom/clk-smd-rpm.c
+index 930fa4a4c52a8..e5c3db11bf26c 100644
+--- a/drivers/clk/qcom/clk-smd-rpm.c
++++ b/drivers/clk/qcom/clk-smd-rpm.c
+@@ -648,6 +648,7 @@ static const struct rpm_smd_clk_desc rpm_clk_qcs404 = {
+ };
+
+ /* msm8998 */
++DEFINE_CLK_SMD_RPM(msm8998, bimc_clk, bimc_a_clk, QCOM_SMD_RPM_MEM_CLK, 0);
+ DEFINE_CLK_SMD_RPM(msm8998, pcnoc_clk, pcnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 0);
+ DEFINE_CLK_SMD_RPM(msm8998, snoc_clk, snoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 1);
+ DEFINE_CLK_SMD_RPM(msm8998, cnoc_clk, cnoc_a_clk, QCOM_SMD_RPM_BUS_CLK, 2);
+@@ -671,6 +672,8 @@ DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk2_pin, rf_clk2_a_pin, 5);
+ DEFINE_CLK_SMD_RPM_XO_BUFFER(msm8998, rf_clk3, rf_clk3_a, 6);
+ DEFINE_CLK_SMD_RPM_XO_BUFFER_PINCTRL(msm8998, rf_clk3_pin, rf_clk3_a_pin, 6);
+ static struct clk_smd_rpm *msm8998_clks[] = {
++ [RPM_SMD_BIMC_CLK] = &msm8998_bimc_clk,
++ [RPM_SMD_BIMC_A_CLK] = &msm8998_bimc_a_clk,
+ [RPM_SMD_PCNOC_CLK] = &msm8998_pcnoc_clk,
+ [RPM_SMD_PCNOC_A_CLK] = &msm8998_pcnoc_a_clk,
+ [RPM_SMD_SNOC_CLK] = &msm8998_snoc_clk,
+--
+2.20.1
+
--- /dev/null
+From 2b7dd0cf58ebc05adc3a314f6bb6bdc62aa753b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 21:09:21 +0300
+Subject: clk: renesas: rcar-gen3: Allow changing the RPC[D2] clocks
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+[ Upstream commit 0d67c0340a60829c5c1b7d09629d23bbd67696f3 ]
+
+I was unable to get clk_set_rate() setting a lower RPC-IF clock frequency
+and that issue boiled down to me not passing CLK_SET_RATE_PARENT flag to
+clk_register_composite() when registering the RPC[D2] clocks...
+
+Fixes: db4a0073cc82 ("clk: renesas: rcar-gen3: Add RPC clocks")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Link: https://lore.kernel.org/r/be27a344-d8bf-9e0c-8950-2d1b48498496@cogentembedded.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rcar-gen3-cpg.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/rcar-gen3-cpg.c b/drivers/clk/renesas/rcar-gen3-cpg.c
+index d25c8ba00a656..532626946b8d2 100644
+--- a/drivers/clk/renesas/rcar-gen3-cpg.c
++++ b/drivers/clk/renesas/rcar-gen3-cpg.c
+@@ -464,7 +464,8 @@ static struct clk * __init cpg_rpc_clk_register(const char *name,
+
+ clk = clk_register_composite(NULL, name, &parent_name, 1, NULL, NULL,
+ &rpc->div.hw, &clk_divider_ops,
+- &rpc->gate.hw, &clk_gate_ops, 0);
++ &rpc->gate.hw, &clk_gate_ops,
++ CLK_SET_RATE_PARENT);
+ if (IS_ERR(clk)) {
+ kfree(rpc);
+ return clk;
+@@ -500,7 +501,8 @@ static struct clk * __init cpg_rpcd2_clk_register(const char *name,
+
+ clk = clk_register_composite(NULL, name, &parent_name, 1, NULL, NULL,
+ &rpcd2->fixed.hw, &clk_fixed_factor_ops,
+- &rpcd2->gate.hw, &clk_gate_ops, 0);
++ &rpcd2->gate.hw, &clk_gate_ops,
++ CLK_SET_RATE_PARENT);
+ if (IS_ERR(clk))
+ kfree(rpcd2);
+
+--
+2.20.1
+
--- /dev/null
+From 603e71669ee279a1c0e304f15d4bf1879face1f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 22:35:03 -0800
+Subject: clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit ec97faff743b398e21f74a54c81333f3390093aa ]
+
+The A64 PLL_CPU clock has the same instability if some factor changed
+without the PLL gated like other SoCs with sun6i-style CCU, e.g. A33,
+H3.
+
+Add the mux and pll notifiers for A64 CPU clock to workaround the
+problem.
+
+Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 28 ++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 49bd7a4c015c4..5f66bf8797723 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -921,11 +921,26 @@ static const struct sunxi_ccu_desc sun50i_a64_ccu_desc = {
+ .num_resets = ARRAY_SIZE(sun50i_a64_ccu_resets),
+ };
+
++static struct ccu_pll_nb sun50i_a64_pll_cpu_nb = {
++ .common = &pll_cpux_clk.common,
++ /* copy from pll_cpux_clk */
++ .enable = BIT(31),
++ .lock = BIT(28),
++};
++
++static struct ccu_mux_nb sun50i_a64_cpu_nb = {
++ .common = &cpux_clk.common,
++ .cm = &cpux_clk.mux,
++ .delay_us = 1, /* > 8 clock cycles at 24 MHz */
++ .bypass_index = 1, /* index of 24 MHz oscillator */
++};
++
+ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+ {
+ struct resource *res;
+ void __iomem *reg;
+ u32 val;
++ int ret;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ reg = devm_ioremap_resource(&pdev->dev, res);
+@@ -939,7 +954,18 @@ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+
+ writel(0x515, reg + SUN50I_A64_PLL_MIPI_REG);
+
+- return sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++ ret = sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++ if (ret)
++ return ret;
++
++ /* Gate then ungate PLL CPU after any rate changes */
++ ccu_pll_notifier_register(&sun50i_a64_pll_cpu_nb);
++
++ /* Reparent CPU during PLL CPU rate changes */
++ ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
++ &sun50i_a64_cpu_nb);
++
++ return 0;
+ }
+
+ static const struct of_device_id sun50i_a64_ccu_ids[] = {
+--
+2.20.1
+
--- /dev/null
+From 189db07aff58228474c12a6b31495cf250d6e482 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Dec 2019 13:00:04 +0200
+Subject: clk: ti: dra7: fix parent for gmac_clkctrl
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 69e300283796dae7e8c2e6acdabcd31336c0c93e ]
+
+The parent clk for gmac clk ctrl has to be gmac_main_clk (125MHz) instead
+of dpll_gmac_ck (1GHz). This is caused incorrect CPSW MDIO operation.
+Hence, fix it.
+
+Fixes: dffa9051d546 ('clk: ti: dra7: add new clkctrl data')
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-7xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
+index 9dd6185a4b4e2..66e4b2b9ec600 100644
+--- a/drivers/clk/ti/clk-7xx.c
++++ b/drivers/clk/ti/clk-7xx.c
+@@ -405,7 +405,7 @@ static const struct omap_clkctrl_bit_data dra7_gmac_bit_data[] __initconst = {
+ };
+
+ static const struct omap_clkctrl_reg_data dra7_gmac_clkctrl_regs[] __initconst = {
+- { DRA7_GMAC_GMAC_CLKCTRL, dra7_gmac_bit_data, CLKF_SW_SUP, "dpll_gmac_ck" },
++ { DRA7_GMAC_GMAC_CLKCTRL, dra7_gmac_bit_data, CLKF_SW_SUP, "gmac_main_clk" },
+ { 0 },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 212eb9dee06d1d44f60b386eddc2e4d0c0c8cb2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2019 10:42:05 +0900
+Subject: clk: uniphier: Add SCSSI clock gate for each channel
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 1ec09a2ec67a0baa46a3ccac041dbcdbc6db2cb9 ]
+
+SCSSI has clock gates for each channel in the SoCs newer than Pro4,
+so this adds missing clock gates for channel 1, 2 and 3. And more, this
+moves MCSSI clock ID after SCSSI.
+
+Fixes: ff388ee36516 ("clk: uniphier: add clock frequency support for SPI")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Link: https://lkml.kernel.org/r/1577410925-22021-1-git-send-email-hayashi.kunihiko@socionext.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/uniphier/clk-uniphier-peri.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/uniphier/clk-uniphier-peri.c b/drivers/clk/uniphier/clk-uniphier-peri.c
+index 9caa52944b1c5..3e32db9dad815 100644
+--- a/drivers/clk/uniphier/clk-uniphier-peri.c
++++ b/drivers/clk/uniphier/clk-uniphier-peri.c
+@@ -18,8 +18,8 @@
+ #define UNIPHIER_PERI_CLK_FI2C(idx, ch) \
+ UNIPHIER_CLK_GATE("i2c" #ch, (idx), "i2c", 0x24, 24 + (ch))
+
+-#define UNIPHIER_PERI_CLK_SCSSI(idx) \
+- UNIPHIER_CLK_GATE("scssi", (idx), "spi", 0x20, 17)
++#define UNIPHIER_PERI_CLK_SCSSI(idx, ch) \
++ UNIPHIER_CLK_GATE("scssi" #ch, (idx), "spi", 0x20, 17 + (ch))
+
+ #define UNIPHIER_PERI_CLK_MCSSI(idx) \
+ UNIPHIER_CLK_GATE("mcssi", (idx), "spi", 0x24, 14)
+@@ -35,7 +35,7 @@ const struct uniphier_clk_data uniphier_ld4_peri_clk_data[] = {
+ UNIPHIER_PERI_CLK_I2C(6, 2),
+ UNIPHIER_PERI_CLK_I2C(7, 3),
+ UNIPHIER_PERI_CLK_I2C(8, 4),
+- UNIPHIER_PERI_CLK_SCSSI(11),
++ UNIPHIER_PERI_CLK_SCSSI(11, 0),
+ { /* sentinel */ }
+ };
+
+@@ -51,7 +51,10 @@ const struct uniphier_clk_data uniphier_pro4_peri_clk_data[] = {
+ UNIPHIER_PERI_CLK_FI2C(8, 4),
+ UNIPHIER_PERI_CLK_FI2C(9, 5),
+ UNIPHIER_PERI_CLK_FI2C(10, 6),
+- UNIPHIER_PERI_CLK_SCSSI(11),
+- UNIPHIER_PERI_CLK_MCSSI(12),
++ UNIPHIER_PERI_CLK_SCSSI(11, 0),
++ UNIPHIER_PERI_CLK_SCSSI(12, 1),
++ UNIPHIER_PERI_CLK_SCSSI(13, 2),
++ UNIPHIER_PERI_CLK_SCSSI(14, 3),
++ UNIPHIER_PERI_CLK_MCSSI(15),
+ { /* sentinel */ }
+ };
+--
+2.20.1
+
--- /dev/null
+From aa1aee0ffe7103a65f11866408bff2470c07ceb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 10:29:35 -0800
+Subject: clk: Use parent node pointer during registration if necessary
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 9011f92622e5ef2d075f45e5fa818776d4feb8c0 ]
+
+Sometimes clk drivers are attached to devices which are children of a
+parent device that is connected to a node in DT. This happens when
+devices are MFD-ish and the parent device driver mostly registers child
+devices to match against drivers placed in their respective subsystem
+directories like drivers/clk, drivers/regulator, etc. When the clk
+driver calls clk_register() with a device pointer, that struct device
+pointer won't have a device_node associated with it because it was
+created purely in software as a way to partition logic to a subsystem.
+
+This causes problems for the way we find parent clks for the clks
+registered by these child devices because we look at the registering
+device's device_node pointer to lookup 'clocks' and 'clock-names'
+properties. Let's use the parent device's device_node pointer if the
+registering device doesn't have a device_node but the parent does. This
+simplifies clk registration code by avoiding the need to assign some
+device_node to the device registering the clk.
+
+Cc: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reported-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Link: https://lkml.kernel.org/r/20191230190455.141339-1-sboyd@kernel.org
+[sboyd@kernel.org: Fixup kernel-doc notation]
+Reviewed-by: Niklas Cassel <nks@flawful.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 27 +++++++++++++++++++++++++--
+ 1 file changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index b0344a1a03704..62d0fc486d3a2 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3718,6 +3718,28 @@ fail_out:
+ return ERR_PTR(ret);
+ }
+
++/**
++ * dev_or_parent_of_node() - Get device node of @dev or @dev's parent
++ * @dev: Device to get device node of
++ *
++ * Return: device node pointer of @dev, or the device node pointer of
++ * @dev->parent if dev doesn't have a device node, or NULL if neither
++ * @dev or @dev->parent have a device node.
++ */
++static struct device_node *dev_or_parent_of_node(struct device *dev)
++{
++ struct device_node *np;
++
++ if (!dev)
++ return NULL;
++
++ np = dev_of_node(dev);
++ if (!np)
++ np = dev_of_node(dev->parent);
++
++ return np;
++}
++
+ /**
+ * clk_register - allocate a new clock, register it and return an opaque cookie
+ * @dev: device that is registering this clock
+@@ -3733,7 +3755,7 @@ fail_out:
+ */
+ struct clk *clk_register(struct device *dev, struct clk_hw *hw)
+ {
+- return __clk_register(dev, dev_of_node(dev), hw);
++ return __clk_register(dev, dev_or_parent_of_node(dev), hw);
+ }
+ EXPORT_SYMBOL_GPL(clk_register);
+
+@@ -3749,7 +3771,8 @@ EXPORT_SYMBOL_GPL(clk_register);
+ */
+ int clk_hw_register(struct device *dev, struct clk_hw *hw)
+ {
+- return PTR_ERR_OR_ZERO(__clk_register(dev, dev_of_node(dev), hw));
++ return PTR_ERR_OR_ZERO(__clk_register(dev, dev_or_parent_of_node(dev),
++ hw));
+ }
+ EXPORT_SYMBOL_GPL(clk_hw_register);
+
+--
+2.20.1
+
--- /dev/null
+From a225e8e88fa7b52ed0c866be77e5345deb5cfd87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 18:16:41 +0100
+Subject: clocksource: davinci: only enable clockevents once tim34 is
+ initialized
+
+From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+
+[ Upstream commit cea931c25104e6bddc42eb067f58193f355dbdd7 ]
+
+The DM365 platform has a strange quirk (only present when using ancient
+u-boot - mainline u-boot v2013.01 and later works fine) where if we
+enable the second half of the timer in periodic mode before we do its
+initialization - the time won't start flowing and we can't boot.
+
+When using more recent u-boot, we can enable the timer, then reinitialize
+it and all works fine.
+
+To work around this issue only enable clockevents once tim34 is
+initialized i.e. move clockevents_config_and_register() below tim34
+initialization.
+
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-davinci.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/clocksource/timer-davinci.c b/drivers/clocksource/timer-davinci.c
+index 62745c9620498..e421946a91c5a 100644
+--- a/drivers/clocksource/timer-davinci.c
++++ b/drivers/clocksource/timer-davinci.c
+@@ -302,10 +302,6 @@ int __init davinci_timer_register(struct clk *clk,
+ return rv;
+ }
+
+- clockevents_config_and_register(&clockevent->dev, tick_rate,
+- DAVINCI_TIMER_MIN_DELTA,
+- DAVINCI_TIMER_MAX_DELTA);
+-
+ davinci_clocksource.dev.rating = 300;
+ davinci_clocksource.dev.read = davinci_clocksource_read;
+ davinci_clocksource.dev.mask =
+@@ -323,6 +319,10 @@ int __init davinci_timer_register(struct clk *clk,
+ davinci_clocksource_init_tim34(base);
+ }
+
++ clockevents_config_and_register(&clockevent->dev, tick_rate,
++ DAVINCI_TIMER_MIN_DELTA,
++ DAVINCI_TIMER_MAX_DELTA);
++
+ rv = clocksource_register_hz(&davinci_clocksource.dev, tick_rate);
+ if (rv) {
+ pr_err("Unable to register clocksource");
+--
+2.20.1
+
--- /dev/null
+From 5b64ef99866833ee640aaaff0db29ceafdcc5adb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 21:32:46 +0000
+Subject: clocksource/drivers/bcm2835_timer: Fix memory leak of timer
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 2052d032c06761330bca4944bb7858b00960e868 ]
+
+Currently when setup_irq fails the error exit path will leak the
+recently allocated timer structure. Originally the code would
+throw a panic but a later commit changed the behaviour to return
+via the err_iounmap path and hence we now have a memory leak. Fix
+this by adding a err_timer_free error path that kfree's timer.
+
+Addresses-Coverity: ("Resource Leak")
+Fixes: 524a7f08983d ("clocksource/drivers/bcm2835_timer: Convert init function to return error")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20191219213246.34437-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/bcm2835_timer.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/bcm2835_timer.c b/drivers/clocksource/bcm2835_timer.c
+index 2b196cbfadb62..b235f446ee50f 100644
+--- a/drivers/clocksource/bcm2835_timer.c
++++ b/drivers/clocksource/bcm2835_timer.c
+@@ -121,7 +121,7 @@ static int __init bcm2835_timer_init(struct device_node *node)
+ ret = setup_irq(irq, &timer->act);
+ if (ret) {
+ pr_err("Can't set up timer IRQ\n");
+- goto err_iounmap;
++ goto err_timer_free;
+ }
+
+ clockevents_config_and_register(&timer->evt, freq, 0xf, 0xffffffff);
+@@ -130,6 +130,9 @@ static int __init bcm2835_timer_init(struct device_node *node)
+
+ return 0;
+
++err_timer_free:
++ kfree(timer);
++
+ err_iounmap:
+ iounmap(base);
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From bf3c7b0cf13897ede4752354bfa40cd281684f93 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:04:41 +0300
+Subject: cmd64x: potential buffer overflow in cmd64x_program_timings()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 117fcc3053606d8db5cef8821dca15022ae578bb ]
+
+The "drive->dn" value is a u8 and it is controlled by root only, but
+it could be out of bounds here so let's check.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/cmd64x.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
+index a1898e11b04e6..943bf944bf722 100644
+--- a/drivers/ide/cmd64x.c
++++ b/drivers/ide/cmd64x.c
+@@ -66,6 +66,9 @@ static void cmd64x_program_timings(ide_drive_t *drive, u8 mode)
+ struct ide_timing t;
+ u8 arttim = 0;
+
++ if (drive->dn >= ARRAY_SIZE(drwtim_regs))
++ return;
++
+ ide_timing_compute(drive, mode, &t, T, 0);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 40b6c6e8f7f7911cbfc176059b12ec700be95cfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 09:34:54 +0100
+Subject: cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 45178ac0cea853fe0e405bf11e101bdebea57b15 ]
+
+Paul reported a very sporadic, rcutorture induced, workqueue failure.
+When the planets align, the workqueue rescuer's self-migrate fails and
+then triggers a WARN for running a work on the wrong CPU.
+
+Tejun then figured that set_cpus_allowed_ptr()'s stop_one_cpu() call
+could be ignored! When stopper->enabled is false, stop_machine will
+insta complete the work, without actually doing the work. Worse, it
+will not WARN about this (we really should fix this).
+
+It turns out there is a small window where a freshly online'ed CPU is
+marked 'online' but doesn't yet have the stopper task running:
+
+ BP AP
+
+ bringup_cpu()
+ __cpu_up(cpu, idle) --> start_secondary()
+ ...
+ cpu_startup_entry()
+ bringup_wait_for_ap()
+ wait_for_ap_thread() <-- cpuhp_online_idle()
+ while (1)
+ do_idle()
+
+ ... available to run kthreads ...
+
+ stop_machine_unpark()
+ stopper->enable = true;
+
+Close this by moving the stop_machine_unpark() into
+cpuhp_online_idle(), such that the stopper thread is ready before we
+start the idle loop and schedule.
+
+Reported-by: "Paul E. McKenney" <paulmck@kernel.org>
+Debugged-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: "Paul E. McKenney" <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cpu.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 116825437cd61..406828fb30388 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -525,8 +525,7 @@ static int bringup_wait_for_ap(unsigned int cpu)
+ if (WARN_ON_ONCE((!cpu_online(cpu))))
+ return -ECANCELED;
+
+- /* Unpark the stopper thread and the hotplug thread of the target cpu */
+- stop_machine_unpark(cpu);
++ /* Unpark the hotplug thread of the target cpu */
+ kthread_unpark(st->thread);
+
+ /*
+@@ -1089,8 +1088,8 @@ void notify_cpu_starting(unsigned int cpu)
+
+ /*
+ * Called from the idle task. Wake up the controlling task which brings the
+- * stopper and the hotplug thread of the upcoming CPU up and then delegates
+- * the rest of the online bringup to the hotplug thread.
++ * hotplug thread of the upcoming CPU up and then delegates the rest of the
++ * online bringup to the hotplug thread.
+ */
+ void cpuhp_online_idle(enum cpuhp_state state)
+ {
+@@ -1100,6 +1099,12 @@ void cpuhp_online_idle(enum cpuhp_state state)
+ if (state != CPUHP_AP_ONLINE_IDLE)
+ return;
+
++ /*
++ * Unpart the stopper thread before we start the idle loop (and start
++ * scheduling); this ensures the stopper task is always available.
++ */
++ stop_machine_unpark(smp_processor_id());
++
+ st->state = CPUHP_AP_ONLINE_IDLE;
+ complete_ap_thread(st, true);
+ }
+--
+2.20.1
+
--- /dev/null
+From 34ed331278e4b16c9211770d1bfe0a304d88c5f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 16:21:48 +0530
+Subject: crypto: chtls - Fixed memory leak
+
+From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+
+[ Upstream commit 93e23eb2ed6c11b4f483c8111ac155ec2b1f3042 ]
+
+Freed work request skbs when connection terminates.
+enqueue_wr()/ dequeue_wr() is shared between softirq
+and application contexts, should be protected by socket
+lock. Moved dequeue_wr() to appropriate file.
+
+Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 27 +++++++++++++------------
+ drivers/crypto/chelsio/chtls/chtls_cm.h | 21 +++++++++++++++++++
+ drivers/crypto/chelsio/chtls/chtls_hw.c | 3 +++
+ 3 files changed, 38 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index aca75237bbcf8..dffa2aa855fdd 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -727,6 +727,14 @@ static int chtls_close_listsrv_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+ return 0;
+ }
+
++static void chtls_purge_wr_queue(struct sock *sk)
++{
++ struct sk_buff *skb;
++
++ while ((skb = dequeue_wr(sk)) != NULL)
++ kfree_skb(skb);
++}
++
+ static void chtls_release_resources(struct sock *sk)
+ {
+ struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+@@ -741,6 +749,11 @@ static void chtls_release_resources(struct sock *sk)
+ kfree_skb(csk->txdata_skb_cache);
+ csk->txdata_skb_cache = NULL;
+
++ if (csk->wr_credits != csk->wr_max_credits) {
++ chtls_purge_wr_queue(sk);
++ chtls_reset_wr_list(csk);
++ }
++
+ if (csk->l2t_entry) {
+ cxgb4_l2t_release(csk->l2t_entry);
+ csk->l2t_entry = NULL;
+@@ -1735,6 +1748,7 @@ static void chtls_peer_close(struct sock *sk, struct sk_buff *skb)
+ else
+ sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+ }
++ kfree_skb(skb);
+ }
+
+ static void chtls_close_con_rpl(struct sock *sk, struct sk_buff *skb)
+@@ -2062,19 +2076,6 @@ rel_skb:
+ return 0;
+ }
+
+-static struct sk_buff *dequeue_wr(struct sock *sk)
+-{
+- struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+- struct sk_buff *skb = csk->wr_skb_head;
+-
+- if (likely(skb)) {
+- /* Don't bother clearing the tail */
+- csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
+- WR_SKB_CB(skb)->next_wr = NULL;
+- }
+- return skb;
+-}
+-
+ static void chtls_rx_ack(struct sock *sk, struct sk_buff *skb)
+ {
+ struct cpl_fw4_ack *hdr = cplhdr(skb) + RSS_HDR;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.h b/drivers/crypto/chelsio/chtls/chtls_cm.h
+index 129d7ac649a93..3fac0c74a41fa 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.h
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.h
+@@ -185,6 +185,12 @@ static inline void chtls_kfree_skb(struct sock *sk, struct sk_buff *skb)
+ kfree_skb(skb);
+ }
+
++static inline void chtls_reset_wr_list(struct chtls_sock *csk)
++{
++ csk->wr_skb_head = NULL;
++ csk->wr_skb_tail = NULL;
++}
++
+ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ {
+ WR_SKB_CB(skb)->next_wr = NULL;
+@@ -197,4 +203,19 @@ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ WR_SKB_CB(csk->wr_skb_tail)->next_wr = skb;
+ csk->wr_skb_tail = skb;
+ }
++
++static inline struct sk_buff *dequeue_wr(struct sock *sk)
++{
++ struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
++ struct sk_buff *skb = NULL;
++
++ skb = csk->wr_skb_head;
++
++ if (likely(skb)) {
++ /* Don't bother clearing the tail */
++ csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
++ WR_SKB_CB(skb)->next_wr = NULL;
++ }
++ return skb;
++}
+ #endif
+diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c
+index 2a34035d3cfbc..a217fe72602d4 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_hw.c
++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c
+@@ -350,6 +350,7 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ kwr->sc_imm.cmd_more = cpu_to_be32(ULPTX_CMD_V(ULP_TX_SC_IMM));
+ kwr->sc_imm.len = cpu_to_be32(klen);
+
++ lock_sock(sk);
+ /* key info */
+ kctx = (struct _key_ctx *)(kwr + 1);
+ ret = chtls_key_info(csk, kctx, keylen, optname);
+@@ -388,8 +389,10 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ csk->tlshws.txkey = keyid;
+ }
+
++ release_sock(sk);
+ return ret;
+ out_notcb:
++ release_sock(sk);
+ free_tls_keyid(sk);
+ out_nokey:
+ kfree_skb(skb);
+--
+2.20.1
+
--- /dev/null
+From 48e3eef096f6ff65fb0e00272c8e96d23a86466c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 17:58:58 +0100
+Subject: crypto: essiv - fix AEAD capitalization and preposition use in help
+ text
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit ab3d436bf3e9d05f58ceaa85ff7475bfcd6e45af ]
+
+"AEAD" is capitalized everywhere else.
+Use "an" when followed by a written or spoken vowel.
+
+Fixes: be1eb7f78aa8fbe3 ("crypto: essiv - create wrapper template for ESSIV generation")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/crypto/Kconfig b/crypto/Kconfig
+index 29472fb795f34..b2cc0ad3792ad 100644
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -500,10 +500,10 @@ config CRYPTO_ESSIV
+ encryption.
+
+ This driver implements a crypto API template that can be
+- instantiated either as a skcipher or as a aead (depending on the
++ instantiated either as an skcipher or as an AEAD (depending on the
+ type of the first template argument), and which defers encryption
+ and decryption requests to the encapsulated cipher after applying
+- ESSIV to the input IV. Note that in the aead case, it is assumed
++ ESSIV to the input IV. Note that in the AEAD case, it is assumed
+ that the keys are presented in the same format used by the authenc
+ template, and that the IV appears at the end of the authenticated
+ associated data (AAD) region (which is how dm-crypt uses it.)
+--
+2.20.1
+
--- /dev/null
+From aeaa12f9addd281ec8429dd2e39d7613896b50e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:27:39 -0800
+Subject: crypto: inside-secure - add unspecified HAS_IOMEM dependency
+
+From: Brendan Higgins <brendanhiggins@google.com>
+
+[ Upstream commit 6dc0e310623fdcb27a1486eb436f0118c45e95a5 ]
+
+Currently CONFIG_CRYPTO_DEV_SAFEXCEL=y implicitly depends on
+CONFIG_HAS_IOMEM=y; consequently, on architectures without IOMEM we get
+the following build error:
+
+ld: drivers/crypto/inside-secure/safexcel.o: in function `safexcel_probe':
+drivers/crypto/inside-secure/safexcel.c:1692: undefined reference to `devm_platform_ioremap_resource'
+
+Fix the build error by adding the unspecified dependency.
+
+Reported-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
+index 7316312935c88..06b2b3fa5206e 100644
+--- a/drivers/crypto/Kconfig
++++ b/drivers/crypto/Kconfig
+@@ -739,7 +739,7 @@ source "drivers/crypto/stm32/Kconfig"
+
+ config CRYPTO_DEV_SAFEXCEL
+ tristate "Inside Secure's SafeXcel cryptographic engine driver"
+- depends on OF || PCI || COMPILE_TEST
++ depends on (OF || PCI || COMPILE_TEST) && HAS_IOMEM
+ select CRYPTO_LIB_AES
+ select CRYPTO_AUTHENC
+ select CRYPTO_BLKCIPHER
+--
+2.20.1
+
--- /dev/null
+From 647420abc8f50c754093a9d3f00017203ea75076 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 19:55:29 +0100
+Subject: debugobjects: Fix various data races
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 35fd7a637c42bb54ba4608f4d40ae6e55fc88781 ]
+
+The counters obj_pool_free, and obj_nr_tofree, and the flag obj_freeing are
+read locklessly outside the pool_lock critical sections. If read with plain
+accesses, this would result in data races.
+
+This is addressed as follows:
+
+ * reads outside critical sections become READ_ONCE()s (pairing with
+ WRITE_ONCE()s added);
+
+ * writes become WRITE_ONCE()s (pairing with READ_ONCE()s added); since
+ writes happen inside critical sections, only the write and not the read
+ of RMWs needs to be atomic, thus WRITE_ONCE(var, var +/- X) is
+ sufficient.
+
+The data races were reported by KCSAN:
+
+ BUG: KCSAN: data-race in __free_object / fill_pool
+
+ write to 0xffffffff8beb04f8 of 4 bytes by interrupt on cpu 1:
+ __free_object+0x1ee/0x8e0 lib/debugobjects.c:404
+ __debug_check_no_obj_freed+0x199/0x330 lib/debugobjects.c:969
+ debug_check_no_obj_freed+0x3c/0x44 lib/debugobjects.c:994
+ slab_free_hook mm/slub.c:1422 [inline]
+
+ read to 0xffffffff8beb04f8 of 4 bytes by task 1 on cpu 2:
+ fill_pool+0x3d/0x520 lib/debugobjects.c:135
+ __debug_object_init+0x3c/0x810 lib/debugobjects.c:536
+ debug_object_init lib/debugobjects.c:591 [inline]
+ debug_object_activate+0x228/0x320 lib/debugobjects.c:677
+ debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
+
+ BUG: KCSAN: data-race in __debug_object_init / fill_pool
+
+ read to 0xffffffff8beb04f8 of 4 bytes by task 10 on cpu 6:
+ fill_pool+0x3d/0x520 lib/debugobjects.c:135
+ __debug_object_init+0x3c/0x810 lib/debugobjects.c:536
+ debug_object_init_on_stack+0x39/0x50 lib/debugobjects.c:606
+ init_timer_on_stack_key kernel/time/timer.c:742 [inline]
+
+ write to 0xffffffff8beb04f8 of 4 bytes by task 1 on cpu 3:
+ alloc_object lib/debugobjects.c:258 [inline]
+ __debug_object_init+0x717/0x810 lib/debugobjects.c:544
+ debug_object_init lib/debugobjects.c:591 [inline]
+ debug_object_activate+0x228/0x320 lib/debugobjects.c:677
+ debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline]
+
+ BUG: KCSAN: data-race in free_obj_work / free_object
+
+ read to 0xffffffff9140c190 of 4 bytes by task 10 on cpu 6:
+ free_object+0x4b/0xd0 lib/debugobjects.c:426
+ debug_object_free+0x190/0x210 lib/debugobjects.c:824
+ destroy_timer_on_stack kernel/time/timer.c:749 [inline]
+
+ write to 0xffffffff9140c190 of 4 bytes by task 93 on cpu 1:
+ free_obj_work+0x24f/0x480 lib/debugobjects.c:313
+ process_one_work+0x454/0x8d0 kernel/workqueue.c:2264
+ worker_thread+0x9a/0x780 kernel/workqueue.c:2410
+
+Reported-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Marco Elver <elver@google.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20200116185529.11026-1-elver@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/debugobjects.c | 46 +++++++++++++++++++++++++---------------------
+ 1 file changed, 25 insertions(+), 21 deletions(-)
+
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 61261195f5b60..48054dbf1b51f 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -132,14 +132,18 @@ static void fill_pool(void)
+ struct debug_obj *obj;
+ unsigned long flags;
+
+- if (likely(obj_pool_free >= debug_objects_pool_min_level))
++ if (likely(READ_ONCE(obj_pool_free) >= debug_objects_pool_min_level))
+ return;
+
+ /*
+ * Reuse objs from the global free list; they will be reinitialized
+ * when allocating.
++ *
++ * Both obj_nr_tofree and obj_pool_free are checked locklessly; the
++ * READ_ONCE()s pair with the WRITE_ONCE()s in pool_lock critical
++ * sections.
+ */
+- while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) {
++ while (READ_ONCE(obj_nr_tofree) && (READ_ONCE(obj_pool_free) < obj_pool_min_free)) {
+ raw_spin_lock_irqsave(&pool_lock, flags);
+ /*
+ * Recheck with the lock held as the worker thread might have
+@@ -148,9 +152,9 @@ static void fill_pool(void)
+ while (obj_nr_tofree && (obj_pool_free < obj_pool_min_free)) {
+ obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
+ hlist_del(&obj->node);
+- obj_nr_tofree--;
++ WRITE_ONCE(obj_nr_tofree, obj_nr_tofree - 1);
+ hlist_add_head(&obj->node, &obj_pool);
+- obj_pool_free++;
++ WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
+ }
+ raw_spin_unlock_irqrestore(&pool_lock, flags);
+ }
+@@ -158,7 +162,7 @@ static void fill_pool(void)
+ if (unlikely(!obj_cache))
+ return;
+
+- while (obj_pool_free < debug_objects_pool_min_level) {
++ while (READ_ONCE(obj_pool_free) < debug_objects_pool_min_level) {
+ struct debug_obj *new[ODEBUG_BATCH_SIZE];
+ int cnt;
+
+@@ -174,7 +178,7 @@ static void fill_pool(void)
+ while (cnt) {
+ hlist_add_head(&new[--cnt]->node, &obj_pool);
+ debug_objects_allocated++;
+- obj_pool_free++;
++ WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
+ }
+ raw_spin_unlock_irqrestore(&pool_lock, flags);
+ }
+@@ -236,7 +240,7 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ obj = __alloc_object(&obj_pool);
+ if (obj) {
+ obj_pool_used++;
+- obj_pool_free--;
++ WRITE_ONCE(obj_pool_free, obj_pool_free - 1);
+
+ /*
+ * Looking ahead, allocate one batch of debug objects and
+@@ -255,7 +259,7 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
+ &percpu_pool->free_objs);
+ percpu_pool->obj_free++;
+ obj_pool_used++;
+- obj_pool_free--;
++ WRITE_ONCE(obj_pool_free, obj_pool_free - 1);
+ }
+ }
+
+@@ -309,8 +313,8 @@ static void free_obj_work(struct work_struct *work)
+ obj = hlist_entry(obj_to_free.first, typeof(*obj), node);
+ hlist_del(&obj->node);
+ hlist_add_head(&obj->node, &obj_pool);
+- obj_pool_free++;
+- obj_nr_tofree--;
++ WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
++ WRITE_ONCE(obj_nr_tofree, obj_nr_tofree - 1);
+ }
+ raw_spin_unlock_irqrestore(&pool_lock, flags);
+ return;
+@@ -324,7 +328,7 @@ free_objs:
+ if (obj_nr_tofree) {
+ hlist_move_list(&obj_to_free, &tofree);
+ debug_objects_freed += obj_nr_tofree;
+- obj_nr_tofree = 0;
++ WRITE_ONCE(obj_nr_tofree, 0);
+ }
+ raw_spin_unlock_irqrestore(&pool_lock, flags);
+
+@@ -375,10 +379,10 @@ free_to_obj_pool:
+ obj_pool_used--;
+
+ if (work) {
+- obj_nr_tofree++;
++ WRITE_ONCE(obj_nr_tofree, obj_nr_tofree + 1);
+ hlist_add_head(&obj->node, &obj_to_free);
+ if (lookahead_count) {
+- obj_nr_tofree += lookahead_count;
++ WRITE_ONCE(obj_nr_tofree, obj_nr_tofree + lookahead_count);
+ obj_pool_used -= lookahead_count;
+ while (lookahead_count) {
+ hlist_add_head(&objs[--lookahead_count]->node,
+@@ -396,15 +400,15 @@ free_to_obj_pool:
+ for (i = 0; i < ODEBUG_BATCH_SIZE; i++) {
+ obj = __alloc_object(&obj_pool);
+ hlist_add_head(&obj->node, &obj_to_free);
+- obj_pool_free--;
+- obj_nr_tofree++;
++ WRITE_ONCE(obj_pool_free, obj_pool_free - 1);
++ WRITE_ONCE(obj_nr_tofree, obj_nr_tofree + 1);
+ }
+ }
+ } else {
+- obj_pool_free++;
++ WRITE_ONCE(obj_pool_free, obj_pool_free + 1);
+ hlist_add_head(&obj->node, &obj_pool);
+ if (lookahead_count) {
+- obj_pool_free += lookahead_count;
++ WRITE_ONCE(obj_pool_free, obj_pool_free + lookahead_count);
+ obj_pool_used -= lookahead_count;
+ while (lookahead_count) {
+ hlist_add_head(&objs[--lookahead_count]->node,
+@@ -423,7 +427,7 @@ free_to_obj_pool:
+ static void free_object(struct debug_obj *obj)
+ {
+ __free_object(obj);
+- if (!obj_freeing && obj_nr_tofree) {
++ if (!READ_ONCE(obj_freeing) && READ_ONCE(obj_nr_tofree)) {
+ WRITE_ONCE(obj_freeing, true);
+ schedule_delayed_work(&debug_obj_work, ODEBUG_FREE_WORK_DELAY);
+ }
+@@ -982,7 +986,7 @@ repeat:
+ debug_objects_maxchecked = objs_checked;
+
+ /* Schedule work to actually kmem_cache_free() objects */
+- if (!obj_freeing && obj_nr_tofree) {
++ if (!READ_ONCE(obj_freeing) && READ_ONCE(obj_nr_tofree)) {
+ WRITE_ONCE(obj_freeing, true);
+ schedule_delayed_work(&debug_obj_work, ODEBUG_FREE_WORK_DELAY);
+ }
+@@ -1008,12 +1012,12 @@ static int debug_stats_show(struct seq_file *m, void *v)
+ seq_printf(m, "max_checked :%d\n", debug_objects_maxchecked);
+ seq_printf(m, "warnings :%d\n", debug_objects_warnings);
+ seq_printf(m, "fixups :%d\n", debug_objects_fixups);
+- seq_printf(m, "pool_free :%d\n", obj_pool_free + obj_percpu_free);
++ seq_printf(m, "pool_free :%d\n", READ_ONCE(obj_pool_free) + obj_percpu_free);
+ seq_printf(m, "pool_pcp_free :%d\n", obj_percpu_free);
+ seq_printf(m, "pool_min_free :%d\n", obj_pool_min_free);
+ seq_printf(m, "pool_used :%d\n", obj_pool_used - obj_percpu_free);
+ seq_printf(m, "pool_max_used :%d\n", obj_pool_max_used);
+- seq_printf(m, "on_free_list :%d\n", obj_nr_tofree);
++ seq_printf(m, "on_free_list :%d\n", READ_ONCE(obj_nr_tofree));
+ seq_printf(m, "objs_allocated:%d\n", debug_objects_allocated);
+ seq_printf(m, "objs_freed :%d\n", debug_objects_freed);
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 3aeffe38355b479133bbdad77be57131f419f5b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 15:04:37 -0500
+Subject: dm thin: don't allow changing data device during thin-pool reload
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+[ Upstream commit 873937e75f9a8ea231a502c3d29d9cb6ad91b3ef ]
+
+The existing code allows changing the data device when the thin-pool
+target is reloaded.
+
+This capability is not required and only complicates device lifetime
+guarantees. This can cause crashes like the one reported here:
+ https://bugzilla.redhat.com/show_bug.cgi?id=1788596
+where the kernel tries to issue a flush bio located in a structure that
+was already freed.
+
+Take the first step to simplifying the thin-pool's data device lifetime
+by disallowing changing it. Like the thin-pool's metadata device, the
+data device is now set in pool_create() and it cannot be changed for a
+given thin-pool.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-thin.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 69201bdf7f4c6..1b2c98b43519f 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -231,6 +231,7 @@ struct pool {
+ struct dm_target *ti; /* Only set if a pool target is bound */
+
+ struct mapped_device *pool_md;
++ struct block_device *data_dev;
+ struct block_device *md_dev;
+ struct dm_pool_metadata *pmd;
+
+@@ -2945,6 +2946,7 @@ static struct kmem_cache *_new_mapping_cache;
+
+ static struct pool *pool_create(struct mapped_device *pool_md,
+ struct block_device *metadata_dev,
++ struct block_device *data_dev,
+ unsigned long block_size,
+ int read_only, char **error)
+ {
+@@ -3052,6 +3054,7 @@ static struct pool *pool_create(struct mapped_device *pool_md,
+ pool->last_commit_jiffies = jiffies;
+ pool->pool_md = pool_md;
+ pool->md_dev = metadata_dev;
++ pool->data_dev = data_dev;
+ __pool_table_insert(pool);
+
+ return pool;
+@@ -3093,6 +3096,7 @@ static void __pool_dec(struct pool *pool)
+
+ static struct pool *__pool_find(struct mapped_device *pool_md,
+ struct block_device *metadata_dev,
++ struct block_device *data_dev,
+ unsigned long block_size, int read_only,
+ char **error, int *created)
+ {
+@@ -3103,19 +3107,23 @@ static struct pool *__pool_find(struct mapped_device *pool_md,
+ *error = "metadata device already in use by a pool";
+ return ERR_PTR(-EBUSY);
+ }
++ if (pool->data_dev != data_dev) {
++ *error = "data device already in use by a pool";
++ return ERR_PTR(-EBUSY);
++ }
+ __pool_inc(pool);
+
+ } else {
+ pool = __pool_table_lookup(pool_md);
+ if (pool) {
+- if (pool->md_dev != metadata_dev) {
++ if (pool->md_dev != metadata_dev || pool->data_dev != data_dev) {
+ *error = "different pool cannot replace a pool";
+ return ERR_PTR(-EINVAL);
+ }
+ __pool_inc(pool);
+
+ } else {
+- pool = pool_create(pool_md, metadata_dev, block_size, read_only, error);
++ pool = pool_create(pool_md, metadata_dev, data_dev, block_size, read_only, error);
+ *created = 1;
+ }
+ }
+@@ -3368,7 +3376,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ goto out;
+ }
+
+- pool = __pool_find(dm_table_get_md(ti->table), metadata_dev->bdev,
++ pool = __pool_find(dm_table_get_md(ti->table), metadata_dev->bdev, data_dev->bdev,
+ block_size, pf.mode == PM_READ_ONLY, &ti->error, &pool_created);
+ if (IS_ERR(pool)) {
+ r = PTR_ERR(pool);
+@@ -4114,7 +4122,7 @@ static struct target_type pool_target = {
+ .name = "thin-pool",
+ .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
+ DM_TARGET_IMMUTABLE,
+- .version = {1, 21, 0},
++ .version = {1, 22, 0},
+ .module = THIS_MODULE,
+ .ctr = pool_ctr,
+ .dtr = pool_dtr,
+@@ -4493,7 +4501,7 @@ static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
+
+ static struct target_type thin_target = {
+ .name = "thin",
+- .version = {1, 21, 0},
++ .version = {1, 22, 0},
+ .module = THIS_MODULE,
+ .ctr = thin_ctr,
+ .dtr = thin_dtr,
+--
+2.20.1
+
--- /dev/null
+From 8b8c28d0f30ade6cb70e7f7d469775fa6224b094 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 20:58:43 +0800
+Subject: dmaengine: fsl-qdma: fix duplicated argument to &&
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 4b048178854da11656596d36a107577d66fd1e08 ]
+
+There is duplicated argument to && in function fsl_qdma_free_chan_resources,
+which looks like a typo, pointer fsl_queue->desc_pool also needs NULL check,
+fix it.
+Detected with coccinelle.
+
+Fixes: b092529e0aa0 ("dmaengine: fsl-qdma: Add qDMA controller driver for Layerscape SoCs")
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Reviewed-by: Peng Ma <peng.ma@nxp.com>
+Tested-by: Peng Ma <peng.ma@nxp.com>
+Link: https://lore.kernel.org/r/20200120125843.34398-1-chenzhou10@huawei.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsl-qdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c
+index 89792083d62c5..95cc0256b3878 100644
+--- a/drivers/dma/fsl-qdma.c
++++ b/drivers/dma/fsl-qdma.c
+@@ -304,7 +304,7 @@ static void fsl_qdma_free_chan_resources(struct dma_chan *chan)
+
+ vchan_dma_desc_free_list(&fsl_chan->vchan, &head);
+
+- if (!fsl_queue->comp_pool && !fsl_queue->comp_pool)
++ if (!fsl_queue->comp_pool && !fsl_queue->desc_pool)
+ return;
+
+ list_for_each_entry_safe(comp_temp, _comp_temp,
+--
+2.20.1
+
--- /dev/null
+From 497864b2415658f4e251244a3a4d3c7ca183928b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:53:28 +0100
+Subject: dmaengine: imx-sdma: Fix memory leak
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 02939cd167095f16328a1bd5cab5a90b550606df ]
+
+The current descriptor is not on any list of the virtual DMA channel.
+Once sdma_terminate_all() is called when a descriptor is currently
+in flight then this one is forgotten to be freed. We have to call
+vchan_terminate_vdesc() on this descriptor to re-add it to the lists.
+Now that we also free the currently running descriptor we can (and
+actually have to) remove the current descriptor from its list also
+for the cyclic case.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Robin Gong <yibin.gong@nxp.com>
+Tested-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://lore.kernel.org/r/20191216105328.15198-10-s.hauer@pengutronix.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-sdma.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index c27e206a764c3..66f1b2ac5cde4 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -760,12 +760,8 @@ static void sdma_start_desc(struct sdma_channel *sdmac)
+ return;
+ }
+ sdmac->desc = desc = to_sdma_desc(&vd->tx);
+- /*
+- * Do not delete the node in desc_issued list in cyclic mode, otherwise
+- * the desc allocated will never be freed in vchan_dma_desc_free_list
+- */
+- if (!(sdmac->flags & IMX_DMA_SG_LOOP))
+- list_del(&vd->node);
++
++ list_del(&vd->node);
+
+ sdma->channel_control[channel].base_bd_ptr = desc->bd_phys;
+ sdma->channel_control[channel].current_bd_ptr = desc->bd_phys;
+@@ -1071,7 +1067,6 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+
+ spin_lock_irqsave(&sdmac->vc.lock, flags);
+ vchan_get_all_descriptors(&sdmac->vc, &head);
+- sdmac->desc = NULL;
+ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+ vchan_dma_desc_free_list(&sdmac->vc, &head);
+ sdmac->context_loaded = false;
+@@ -1080,11 +1075,19 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+ static int sdma_disable_channel_async(struct dma_chan *chan)
+ {
+ struct sdma_channel *sdmac = to_sdma_chan(chan);
++ unsigned long flags;
++
++ spin_lock_irqsave(&sdmac->vc.lock, flags);
+
+ sdma_disable_channel(chan);
+
+- if (sdmac->desc)
++ if (sdmac->desc) {
++ vchan_terminate_vdesc(&sdmac->desc->vd);
++ sdmac->desc = NULL;
+ schedule_work(&sdmac->terminate_worker);
++ }
++
++ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 298f15763fb5ca64e67f2219c5640e4110854e2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 12:01:16 -0700
+Subject: dmaengine: Store module owner in dma_device struct
+
+From: Logan Gunthorpe <logang@deltatee.com>
+
+[ Upstream commit dae7a589c18a4d979d5f14b09374e871b995ceb1 ]
+
+dma_chan_to_owner() dereferences the driver from the struct device to
+obtain the owner and call module_[get|put](). However, if the backing
+device is unbound before the dma_device is unregistered, the driver
+will be cleared and this will cause a NULL pointer dereference.
+
+Instead, store a pointer to the owner module in the dma_device struct
+so the module reference can be properly put when the channel is put, even
+if the backing device was destroyed first.
+
+This change helps to support a safer unbind of DMA engines.
+If the dma_device is unregistered in the driver's remove function,
+there's no guarantee that there are no existing clients and a users
+action may trigger the WARN_ONCE in dma_async_device_unregister()
+which is unlikely to leave the system in a consistent state.
+Instead, a better approach is to allow the backing driver to go away
+and fail any subsequent requests to it.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://lore.kernel.org/r/20191216190120.21374-2-logang@deltatee.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dmaengine.c | 4 +++-
+ include/linux/dmaengine.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index 03ac4b96117cd..4b604086b1b3a 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -179,7 +179,7 @@ __dma_device_satisfies_mask(struct dma_device *device,
+
+ static struct module *dma_chan_to_owner(struct dma_chan *chan)
+ {
+- return chan->device->dev->driver->owner;
++ return chan->device->owner;
+ }
+
+ /**
+@@ -919,6 +919,8 @@ int dma_async_device_register(struct dma_device *device)
+ return -EIO;
+ }
+
++ device->owner = device->dev->driver->owner;
++
+ if (dma_has_cap(DMA_MEMCPY, device->cap_mask) && !device->device_prep_dma_memcpy) {
+ dev_err(device->dev,
+ "Device claims capability %s, but op is not defined\n",
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index dad4a68fa0094..8013562751a50 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -674,6 +674,7 @@ struct dma_filter {
+ * @fill_align: alignment shift for memset operations
+ * @dev_id: unique device ID
+ * @dev: struct device reference for dma mapping api
++ * @owner: owner module (automatically set based on the provided dev)
+ * @src_addr_widths: bit mask of src addr widths the device supports
+ * Width is specified in bytes, e.g. for a device supporting
+ * a width of 4 the mask should have BIT(4) set.
+@@ -737,6 +738,7 @@ struct dma_device {
+
+ int dev_id;
+ struct device *dev;
++ struct module *owner;
+
+ u32 src_addr_widths;
+ u32 dst_addr_widths;
+--
+2.20.1
+
--- /dev/null
+From a0f26a1b630977a7b549aa5ec0dc652a13b54823 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 17:57:58 +0000
+Subject: driver core: platform: fix u32 greater or equal to zero comparison
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 0707cfa5c3ef58effb143db9db6d6e20503f9dec ]
+
+Currently the check that a u32 variable i is >= 0 is always true because
+the unsigned variable will never be negative, causing the loop to run
+forever. Fix this by changing the pre-decrement check to a zero check on
+i followed by a decrement of i.
+
+Addresses-Coverity: ("Unsigned compared against 0")
+Fixes: 39cc539f90d0 ("driver core: platform: Prevent resouce overflow from causing infinite loops")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/20200116175758.88396-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index ee99b15581290..60386a32208ff 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -543,7 +543,7 @@ int platform_device_add(struct platform_device *pdev)
+ pdev->id = PLATFORM_DEVID_AUTO;
+ }
+
+- while (--i >= 0) {
++ while (i--) {
+ struct resource *r = &pdev->resource[i];
+ if (r->parent)
+ release_resource(r);
+--
+2.20.1
+
--- /dev/null
+From b1582344d92f86bda25213e0187a2b7844f8832a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 17:41:37 -0500
+Subject: driver core: platform: Prevent resouce overflow from causing infinite
+ loops
+
+From: Simon Schwartz <kern.simon@theschwartz.xyz>
+
+[ Upstream commit 39cc539f90d035a293240c9443af50be55ee81b8 ]
+
+num_resources in the platform_device struct is declared as a u32. The
+for loops that iterate over num_resources use an int as the counter,
+which can cause infinite loops on architectures with smaller ints.
+Change the loop counters to u32.
+
+Signed-off-by: Simon Schwartz <kern.simon@theschwartz.xyz>
+Link: https://lore.kernel.org/r/2201ce63a2a171ffd2ed14e867875316efcf71db.camel@theschwartz.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 3c0cd20925b71..ee99b15581290 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -27,6 +27,7 @@
+ #include <linux/limits.h>
+ #include <linux/property.h>
+ #include <linux/kmemleak.h>
++#include <linux/types.h>
+
+ #include "base.h"
+ #include "power/power.h"
+@@ -48,7 +49,7 @@ EXPORT_SYMBOL_GPL(platform_bus);
+ struct resource *platform_get_resource(struct platform_device *dev,
+ unsigned int type, unsigned int num)
+ {
+- int i;
++ u32 i;
+
+ for (i = 0; i < dev->num_resources; i++) {
+ struct resource *r = &dev->resource[i];
+@@ -226,7 +227,7 @@ struct resource *platform_get_resource_byname(struct platform_device *dev,
+ unsigned int type,
+ const char *name)
+ {
+- int i;
++ u32 i;
+
+ for (i = 0; i < dev->num_resources; i++) {
+ struct resource *r = &dev->resource[i];
+@@ -473,7 +474,8 @@ EXPORT_SYMBOL_GPL(platform_device_add_properties);
+ */
+ int platform_device_add(struct platform_device *pdev)
+ {
+- int i, ret;
++ u32 i;
++ int ret;
+
+ if (!pdev)
+ return -EINVAL;
+@@ -562,7 +564,7 @@ EXPORT_SYMBOL_GPL(platform_device_add);
+ */
+ void platform_device_del(struct platform_device *pdev)
+ {
+- int i;
++ u32 i;
+
+ if (!IS_ERR_OR_NULL(pdev)) {
+ device_del(&pdev->dev);
+--
+2.20.1
+
--- /dev/null
+From bc243376fc3b191216d60651ddefe105844b677f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 14:22:19 +0100
+Subject: driver core: Print device when resources present in really_probe()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7c35e699c88bd60734277b26962783c60e04b494 ]
+
+If a device already has devres items attached before probing, a warning
+backtrace is printed. However, this backtrace does not reveal the
+offending device, leaving the user uninformed. Furthermore, using
+WARN_ON() causes systems with panic-on-warn to reboot.
+
+Fix this by replacing the WARN_ON() by a dev_crit() message.
+Abort probing the device, to prevent doing more damage to the device's
+resources.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191206132219.28908-1-geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/dd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index d811e60610d33..b25bcab2a26bd 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -516,7 +516,10 @@ static int really_probe(struct device *dev, struct device_driver *drv)
+ atomic_inc(&probe_count);
+ pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
+ drv->bus->name, __func__, drv->name, dev_name(dev));
+- WARN_ON(!list_empty(&dev->devres_head));
++ if (!list_empty(&dev->devres_head)) {
++ dev_crit(dev, "Resources present before probing\n");
++ return -EBUSY;
++ }
+
+ re_probe:
+ dev->driver = drv;
+--
+2.20.1
+
--- /dev/null
+From c658675f5dcbfa9f806dedeadb9ec24ec9a3bf43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:15:25 -0800
+Subject: drivers/block/zram/zram_drv.c: fix error return codes not being
+ returned in writeback_store
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 3b82a051c10143639a378dcd12019f2353cc9054 ]
+
+Currently when an error code -EIO or -ENOSPC in the for-loop of
+writeback_store the error code is being overwritten by a ret = len
+assignment at the end of the function and the error codes are being
+lost. Fix this by assigning ret = len at the start of the function and
+remove the assignment from the end, hence allowing ret to be preserved
+when error codes are assigned to it.
+
+Addresses Coverity ("Unused value")
+
+Link: http://lkml.kernel.org/r/20191128122958.178290-1-colin.king@canonical.com
+Fixes: a939888ec38b ("zram: support idle/huge page writeback")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Minchan Kim <minchan@kernel.org>
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/zram/zram_drv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 4285e75e52c34..1bf4a908a0bd9 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -626,7 +626,7 @@ static ssize_t writeback_store(struct device *dev,
+ struct bio bio;
+ struct bio_vec bio_vec;
+ struct page *page;
+- ssize_t ret;
++ ssize_t ret = len;
+ int mode;
+ unsigned long blk_idx = 0;
+
+@@ -762,7 +762,6 @@ next:
+
+ if (blk_idx)
+ free_block_bdev(zram, blk_idx);
+- ret = len;
+ __free_page(page);
+ release_init_lock:
+ up_read(&zram->init_lock);
+--
+2.20.1
+
--- /dev/null
+From c07bbd4e4e473cce42ac93cbd01001cc61b57e49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 15:12:30 -0500
+Subject: drm/amd/display: Clear state after exiting fixed active VRR state
+
+From: Amanda Liu <amanda.liu@amd.com>
+
+[ Upstream commit 6f8f76444baf405bacb0591d97549a71a9aaa1ac ]
+
+[why]
+Upon exiting a fixed active VRR state, the state isn't cleared. This
+leads to the variable VRR range to be calculated incorrectly.
+
+[how]
+Set fixed active state to false when updating vrr params
+
+Signed-off-by: Amanda Liu <amanda.liu@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/modules/freesync/freesync.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+index 0978c698f0f85..7d67cb2c61f04 100644
+--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
++++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+@@ -803,6 +803,7 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ 2 * in_out_vrr->min_refresh_in_uhz)
+ in_out_vrr->btr.btr_enabled = false;
+
++ in_out_vrr->fixed.fixed_active = false;
+ in_out_vrr->btr.btr_active = false;
+ in_out_vrr->btr.inserted_duration_in_us = 0;
+ in_out_vrr->btr.frames_to_insert = 0;
+@@ -822,6 +823,7 @@ void mod_freesync_build_vrr_params(struct mod_freesync *mod_freesync,
+ in_out_vrr->adjust.v_total_max = stream->timing.v_total;
+ } else if (in_out_vrr->state == VRR_STATE_ACTIVE_VARIABLE &&
+ refresh_range >= MIN_REFRESH_RANGE_IN_US) {
++
+ in_out_vrr->adjust.v_total_min =
+ calc_v_total_from_refresh(stream,
+ in_out_vrr->max_refresh_in_uhz);
+--
+2.20.1
+
--- /dev/null
+From c4406400013dfac52eae146782a2770a3e149c29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 14:22:15 +0200
+Subject: drm/amd/display: do not allocate display_mode_lib unnecessarily
+
+From: Dor Askayo <dor.askayo@gmail.com>
+
+[ Upstream commit bb67bfd2e7101bf2ac5327b0b7a847cd9fb9723f ]
+
+This allocation isn't required and can fail when resuming from suspend.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/1009
+Signed-off-by: Dor Askayo <dor.askayo@gmail.com>
+Reviewed-by: Leo Li <sunpeng.li@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
+index 4b8819c27fcda..4704aac336c29 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
+@@ -2267,12 +2267,7 @@ void dc_set_power_state(
+ enum dc_acpi_cm_power_state power_state)
+ {
+ struct kref refcount;
+- struct display_mode_lib *dml = kzalloc(sizeof(struct display_mode_lib),
+- GFP_KERNEL);
+-
+- ASSERT(dml);
+- if (!dml)
+- return;
++ struct display_mode_lib *dml;
+
+ switch (power_state) {
+ case DC_ACPI_CM_POWER_STATE_D0:
+@@ -2294,6 +2289,12 @@ void dc_set_power_state(
+ * clean state, and dc hw programming optimizations will not
+ * cause any trouble.
+ */
++ dml = kzalloc(sizeof(struct display_mode_lib),
++ GFP_KERNEL);
++
++ ASSERT(dml);
++ if (!dml)
++ return;
+
+ /* Preserve refcount */
+ refcount = dc->current_state->refcount;
+@@ -2307,10 +2308,10 @@ void dc_set_power_state(
+ dc->current_state->refcount = refcount;
+ dc->current_state->bw_ctx.dml = *dml;
+
++ kfree(dml);
++
+ break;
+ }
+-
+- kfree(dml);
+ }
+
+ void dc_resume(struct dc *dc)
+--
+2.20.1
+
--- /dev/null
+From a4c46730792f9bfb538c9d9334d1370aa74cef6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 14:40:56 -0500
+Subject: drm/amd/display: fixup DML dependencies
+
+From: Jun Lei <Jun.Lei@amd.com>
+
+[ Upstream commit 34ad0230062c39cdcba564d16d122c0fb467a7d6 ]
+
+[why]
+Need to fix DML portability issues to enable SW unit testing around DML
+
+[how]
+Move calcs into dc include folder since multiple components reference it
+Remove relative paths to external dependencies
+
+Signed-off-by: Jun Lei <Jun.Lei@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c | 2 +-
+ drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 2 +-
+ drivers/gpu/drm/amd/display/dc/{calcs => inc}/dcn_calc_math.h | 0
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+ rename drivers/gpu/drm/amd/display/dc/{calcs => inc}/dcn_calc_math.h (100%)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+index b953b02a15121..723af0b2dda04 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+@@ -24,7 +24,7 @@
+ */
+
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+
+ #include "dml_inline_defs.h"
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+index eca140da13d82..ded71ea82413d 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+@@ -27,7 +27,7 @@
+ #define __DML_INLINE_DEFS_H__
+
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+ #include "dml_logger.h"
+
+ static inline double dml_min(double a, double b)
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h b/drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+similarity index 100%
+rename from drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h
+rename to drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+--
+2.20.1
+
--- /dev/null
+From 0d5ffc9bca94383f0b0274983d8273bfa68f01be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 15:18:31 -0500
+Subject: drm/amd/display: Map ODM memory correctly when doing ODM combine
+
+From: Nikola Cornij <nikola.cornij@amd.com>
+
+[ Upstream commit ec5b356c58941bb8930858155d9ce14ceb3d30a0 ]
+
+[why]
+Up to 4 ODM memory pieces are required per ODM combine and cannot
+overlap, i.e. each ODM "session" has to use its own memory pieces.
+The ODM-memory mapping is currently broken for generic case.
+
+The maximum number of memory pieces is ASIC-dependent, but it's always
+big enough to satisfy maximum number of ODM combines. Memory pieces
+are mapped as a bit-map, i.e. one memory piece corresponds to one bit.
+The OPTC doing ODM needs to select memory pieces by setting the
+corresponding bits, making sure there's no overlap with other OPTC
+instances that might be doing ODM.
+
+The current mapping works only for OPTC instance indexes smaller than
+3. For instance indexes 3 and up it practically maps no ODM memory,
+causing black, gray or white screen in display configs that include
+ODM on OPTC instance 3 or up.
+
+[how]
+Statically map two unique ODM memory pieces for each OPTC instance
+and piece them together when programming ODM combine mode.
+
+Signed-off-by: Nikola Cornij <nikola.cornij@amd.com>
+Reviewed-by: Jun Lei <Jun.Lei@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/dcn20/dcn20_optc.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
+index dda90995ba933..8d5cfd5357c75 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c
+@@ -233,12 +233,13 @@ void optc2_set_odm_combine(struct timing_generator *optc, int *opp_id, int opp_c
+ struct dc_crtc_timing *timing)
+ {
+ struct optc *optc1 = DCN10TG_FROM_TG(optc);
+- /* 2 pieces of memory required for up to 5120 displays, 4 for up to 8192 */
+ int mpcc_hactive = (timing->h_addressable + timing->h_border_left + timing->h_border_right)
+ / opp_cnt;
+- int memory_mask = mpcc_hactive <= 2560 ? 0x3 : 0xf;
++ uint32_t memory_mask;
+ uint32_t data_fmt = 0;
+
++ ASSERT(opp_cnt == 2);
++
+ /* TODO: In pseudocode but does not affect maximus, delete comment if we dont need on asic
+ * REG_SET(OTG_GLOBAL_CONTROL2, 0, GLOBAL_UPDATE_LOCK_EN, 1);
+ * Program OTG register MASTER_UPDATE_LOCK_DB_X/Y to the position before DP frame start
+@@ -246,9 +247,17 @@ void optc2_set_odm_combine(struct timing_generator *optc, int *opp_id, int opp_c
+ * MASTER_UPDATE_LOCK_DB_X, 160,
+ * MASTER_UPDATE_LOCK_DB_Y, 240);
+ */
++
++ /* 2 pieces of memory required for up to 5120 displays, 4 for up to 8192,
++ * however, for ODM combine we can simplify by always using 4.
++ * To make sure there's no overlap, each instance "reserves" 2 memories and
++ * they are uniquely combined here.
++ */
++ memory_mask = 0x3 << (opp_id[0] * 2) | 0x3 << (opp_id[1] * 2);
++
+ if (REG(OPTC_MEMORY_CONFIG))
+ REG_SET(OPTC_MEMORY_CONFIG, 0,
+- OPTC_MEM_SEL, memory_mask << (optc->inst * 4));
++ OPTC_MEM_SEL, memory_mask);
+
+ if (timing->pixel_encoding == PIXEL_ENCODING_YCBCR422)
+ data_fmt = 1;
+@@ -257,7 +266,6 @@ void optc2_set_odm_combine(struct timing_generator *optc, int *opp_id, int opp_c
+
+ REG_UPDATE(OPTC_DATA_FORMAT_CONTROL, OPTC_DATA_FORMAT, data_fmt);
+
+- ASSERT(opp_cnt == 2);
+ REG_SET_3(OPTC_DATA_SOURCE_SELECT, 0,
+ OPTC_NUM_OF_INPUT_SEGMENT, 1,
+ OPTC_SEG0_SRC_SEL, opp_id[0],
+--
+2.20.1
+
--- /dev/null
+From 634231fcc32795eba1a7a48f06e46c3016b934f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 16:12:45 -0500
+Subject: drm/amd/display: Retrain dongles when SINK_COUNT becomes non-zero
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit 3eb6d7aca53d81ce888624f09cd44dc0302161e8 ]
+
+[WHY]
+Two years ago the patch referenced by the Fixes tag stopped running
+dp_verify_link_cap_with_retries during DP detection when the reason
+for the detection was a short-pulse interrupt. This effectively meant
+that we were no longer doing the verify_link_cap training on active
+dongles when their SINK_COUNT changed from 0 to 1.
+
+A year ago this was partly remedied with:
+commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle")
+
+This made sure that we trained the dongle on initial hotplug (without
+connected downstream devices).
+
+This is all fine and dandy if it weren't for the fact that there are
+some dongles on the market that don't like link training when SINK_COUNT
+is 0 These dongles will in fact indicate a SINK_COUNT of 0 immediately
+after hotplug, even when a downstream device is connected, and then
+trigger a shortpulse interrupt indicating a SINK_COUNT change to 1.
+
+In order to play nicely we will need our policy to not link train an
+active DP dongle when SINK_COUNT is 0 but ensure we train it when the
+SINK_COUNT changes to 1.
+
+[HOW]
+Call dp_verify_link_cap_with_retries on detection even when the detection
+is triggered from a short pulse interrupt.
+
+With this change we can also revert this commit which we'll do in a separate
+follow-up change:
+commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle")
+
+Fixes: 0301ccbaf67d ("drm/amd/display: DP Compliance 400.1.1 failure")
+Suggested-by: Louis Li <Ching-shih.Li@amd.com>
+Tested-by: Louis Li <Ching-shih.Li@amd.com>
+Cc: Wenjing Liu <Wenjing.Liu@amd.com>
+Cc: Hersen Wu <hersenxs.wu@amd.com>
+Cc: Eric Yang <Eric.Yang2@amd.com>
+Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index c0f1c62c59b42..3aedc724241ef 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -948,8 +948,7 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
+ same_edid = is_same_edid(&prev_sink->dc_edid, &sink->dc_edid);
+
+ if (link->connector_signal == SIGNAL_TYPE_DISPLAY_PORT &&
+- sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX &&
+- reason != DETECT_REASON_HPDRX) {
++ sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX) {
+ /*
+ * TODO debug why Dell 2413 doesn't like
+ * two link trainings
+--
+2.20.1
+
--- /dev/null
+From cf73c4a955b74904fbe32903b99e750e2d8726a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 14:39:45 -0500
+Subject: drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c
+ (v2)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c37243579d6c881c575dcfb54cf31c9ded88f946 ]
+
+We might get different numbers of clocks from powerplay depending
+on what the OEM has populated.
+
+v2: add assert for at least one level
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/calcs/dcn_calcs.c | 34 +++++++++++++------
+ 1 file changed, 23 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+index 9b2cb57bf2bad..c9a241fe46cf4 100644
+--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+@@ -1438,6 +1438,7 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ struct dc_context *ctx = dc->ctx;
+ struct dm_pp_clock_levels_with_voltage fclks = {0}, dcfclks = {0};
+ bool res;
++ unsigned vmin0p65_idx, vmid0p72_idx, vnom0p8_idx, vmax0p9_idx;
+
+ /* TODO: This is not the proper way to obtain fabric_and_dram_bandwidth, should be min(fclk, memclk) */
+ res = dm_pp_get_clock_levels_by_type_with_voltage(
+@@ -1449,17 +1450,28 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ res = verify_clock_values(&fclks);
+
+ if (res) {
+- ASSERT(fclks.num_levels >= 3);
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[0].clocks_in_khz / 1000.0) / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - (fclks.num_levels > 2 ? 3 : 2)].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - 2].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - 1].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
++ ASSERT(fclks.num_levels);
++
++ vmin0p65_idx = 0;
++ vmid0p72_idx = fclks.num_levels -
++ (fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1));
++ vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1);
++ vmax0p9_idx = fclks.num_levels - 1;
++
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =
++ 32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vmid0p72_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vnom0p8_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vmax0p9_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
+ } else
+ BREAK_TO_DEBUGGER();
+
+--
+2.20.1
+
--- /dev/null
+From f042d772b649878443a2349e9ceba9068e34a8f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Nov 2019 12:23:36 -0700
+Subject: drm/amdgpu: Ensure ret is always initialized when using
+ SOC15_WAIT_ON_RREG
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit a63141e31764f8daf3f29e8e2d450dcf9199d1c8 ]
+
+Commit b0f3cd3191cd ("drm/amdgpu: remove unnecessary JPEG2.0 code from
+VCN2.0") introduced a new clang warning in the vcn_v2_0_stop function:
+
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1082:2: warning: variable 'r'
+is used uninitialized whenever 'while' loop exits because its condition
+is false [-Wsometimes-uninitialized]
+ SOC15_WAIT_ON_RREG(VCN, 0, mmUVD_STATUS, UVD_STATUS__IDLE, 0x7, r);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+../drivers/gpu/drm/amd/amdgpu/../amdgpu/soc15_common.h:55:10: note:
+expanded from macro 'SOC15_WAIT_ON_RREG'
+ while ((tmp_ & (mask)) != (expected_value)) { \
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1083:6: note: uninitialized use
+occurs here
+ if (r)
+ ^
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1082:2: note: remove the
+condition if it is always true
+ SOC15_WAIT_ON_RREG(VCN, 0, mmUVD_STATUS, UVD_STATUS__IDLE, 0x7, r);
+ ^
+../drivers/gpu/drm/amd/amdgpu/../amdgpu/soc15_common.h:55:10: note:
+expanded from macro 'SOC15_WAIT_ON_RREG'
+ while ((tmp_ & (mask)) != (expected_value)) { \
+ ^
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1072:7: note: initialize the
+variable 'r' to silence this warning
+ int r;
+ ^
+ = 0
+1 warning generated.
+
+To prevent warnings like this from happening in the future, make the
+SOC15_WAIT_ON_RREG macro initialize its ret variable before the while
+loop that can time out. This macro's return value is always checked so
+it should set ret in both the success and fail path.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/776
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15_common.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15_common.h b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+index 839f186e1182a..19e870c798967 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15_common.h
++++ b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+@@ -52,6 +52,7 @@
+ uint32_t old_ = 0; \
+ uint32_t tmp_ = RREG32(adev->reg_offset[ip##_HWIP][inst][reg##_BASE_IDX] + reg); \
+ uint32_t loop = adev->usec_timeout; \
++ ret = 0; \
+ while ((tmp_ & (mask)) != (expected_value)) { \
+ if (old_ != tmp_) { \
+ loop = adev->usec_timeout; \
+--
+2.20.1
+
--- /dev/null
+From be85a3c64e4701752195c773b6c0a2b90bc274f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:16:44 +0800
+Subject: drm/amdgpu: fix KIQ ring test fail in TDR of SRIOV
+
+From: Monk Liu <Monk.Liu@amd.com>
+
+[ Upstream commit 5a7489a7e189ee2be889485f90c8cf24ea4b9a40 ]
+
+issues:
+MEC is ruined by the amdkfd_pre_reset after VF FLR done
+
+fix:
+amdkfd_pre_reset() would ruin MEC after hypervisor finished the VF FLR,
+the correct sequence is do amdkfd_pre_reset before VF FLR but there is
+a limitation to block this sequence:
+if we do pre_reset() before VF FLR, it would go KIQ way to do register
+access and stuck there, because KIQ probably won't work by that time
+(e.g. you already made GFX hang)
+
+so the best way right now is to simply remove it.
+
+Signed-off-by: Monk Liu <Monk.Liu@amd.com>
+Reviewed-by: Emily Deng <Emily.Deng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 7a6c837c0a85f..13694d5eba474 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -3466,8 +3466,6 @@ static int amdgpu_device_reset_sriov(struct amdgpu_device *adev,
+ if (r)
+ return r;
+
+- amdgpu_amdkfd_pre_reset(adev);
+-
+ /* Resume IP prior to SMC */
+ r = amdgpu_device_ip_reinit_early_sriov(adev);
+ if (r)
+--
+2.20.1
+
--- /dev/null
+From efd5ad1d991e7be69f2cb938de2b943d0dc55bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:27:20 +0800
+Subject: drm/amdgpu: remove 4 set but not used variable in
+ amdgpu_atombios_get_connector_info_from_object_table
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit bae028e3e521e8cb8caf2cc16a455ce4c55f2332 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c: In function
+'amdgpu_atombios_get_connector_info_from_object_table':
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:376:26: warning: variable
+'grph_obj_num' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:376:13: warning: variable
+'grph_obj_id' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:341:37: warning: variable
+'con_obj_type' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:341:24: warning: variable
+'con_obj_num' set but not used [-Wunused-but-set-variable]
+
+They are never used, so can be removed.
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+index 1c9d40f97a9b2..f2f40f05fa5c7 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -338,17 +338,9 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ path_size += le16_to_cpu(path->usSize);
+
+ if (device_support & le16_to_cpu(path->usDeviceTag)) {
+- uint8_t con_obj_id, con_obj_num, con_obj_type;
+-
+- con_obj_id =
++ uint8_t con_obj_id =
+ (le16_to_cpu(path->usConnObjectId) & OBJECT_ID_MASK)
+ >> OBJECT_ID_SHIFT;
+- con_obj_num =
+- (le16_to_cpu(path->usConnObjectId) & ENUM_ID_MASK)
+- >> ENUM_ID_SHIFT;
+- con_obj_type =
+- (le16_to_cpu(path->usConnObjectId) &
+- OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+
+ /* Skip TV/CV support */
+ if ((le16_to_cpu(path->usDeviceTag) ==
+@@ -373,14 +365,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ router.ddc_valid = false;
+ router.cd_valid = false;
+ for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) {
+- uint8_t grph_obj_id, grph_obj_num, grph_obj_type;
+-
+- grph_obj_id =
+- (le16_to_cpu(path->usGraphicObjIds[j]) &
+- OBJECT_ID_MASK) >> OBJECT_ID_SHIFT;
+- grph_obj_num =
+- (le16_to_cpu(path->usGraphicObjIds[j]) &
+- ENUM_ID_MASK) >> ENUM_ID_SHIFT;
++ uint8_t grph_obj_type=
+ grph_obj_type =
+ (le16_to_cpu(path->usGraphicObjIds[j]) &
+ OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+--
+2.20.1
+
--- /dev/null
+From 2b5b6939b53493b0fd5e78a5030813cef1a27fec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 13:19:51 -0500
+Subject: drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 4d0a72b66065dd7e274bad6aa450196d42fd8f84 ]
+
+Only send non-0 clocks to DC for validation. This mirrors
+what the windows driver does.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index 1115761982a78..627a42e8fd318 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -1026,12 +1026,15 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
+
+ clocks->num_levels = 0;
+ for (i = 0; i < pclk_vol_table->count; i++) {
+- clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
+- clocks->data[i].latency_in_us = latency_required ?
+- smu10_get_mem_latency(hwmgr,
+- pclk_vol_table->entries[i].clk) :
+- 0;
+- clocks->num_levels++;
++ if (pclk_vol_table->entries[i].clk) {
++ clocks->data[clocks->num_levels].clocks_in_khz =
++ pclk_vol_table->entries[i].clk * 10;
++ clocks->data[clocks->num_levels].latency_in_us = latency_required ?
++ smu10_get_mem_latency(hwmgr,
++ pclk_vol_table->entries[i].clk) :
++ 0;
++ clocks->num_levels++;
++ }
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 050e214feea7448b9f06577bec5668144c1adc77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 12:42:57 -0500
+Subject: drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1064ad4aeef94f51ca230ac639a9e996fb7867a0 ]
+
+Cull out 0 clocks to avoid a warning in DC.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index 627a42e8fd318..fed3fc4bb57a9 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -1080,9 +1080,11 @@ static int smu10_get_clock_by_type_with_voltage(struct pp_hwmgr *hwmgr,
+
+ clocks->num_levels = 0;
+ for (i = 0; i < pclk_vol_table->count; i++) {
+- clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
+- clocks->data[i].voltage_in_mv = pclk_vol_table->entries[i].vol;
+- clocks->num_levels++;
++ if (pclk_vol_table->entries[i].clk) {
++ clocks->data[clocks->num_levels].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
++ clocks->data[clocks->num_levels].voltage_in_mv = pclk_vol_table->entries[i].vol;
++ clocks->num_levels++;
++ }
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From bb474cc33bc504f80d59cf928898d3c3f1cc6c9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 13:44:29 +0800
+Subject: drm/amdgpu/sriov: workaround on rev_id for Navi12 under sriov
+
+From: Tiecheng Zhou <Tiecheng.Zhou@amd.com>
+
+[ Upstream commit df5e984c8bd414561c320d6cbbb66d53abf4c7e2 ]
+
+guest vm gets 0xffffffff when reading RCC_DEV0_EPF0_STRAP0,
+as a consequence, the rev_id and external_rev_id are wrong.
+
+workaround it by hardcoding the rev_id to 0, which is the default value.
+
+v2. add comment in the code
+
+Signed-off-by: Tiecheng Zhou <Tiecheng.Zhou@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/nv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
+index de9b995b65b1a..2d780820ba00e 100644
+--- a/drivers/gpu/drm/amd/amdgpu/nv.c
++++ b/drivers/gpu/drm/amd/amdgpu/nv.c
+@@ -660,6 +660,12 @@ static int nv_common_early_init(void *handle)
+ adev->pg_flags = AMD_PG_SUPPORT_VCN |
+ AMD_PG_SUPPORT_VCN_DPG |
+ AMD_PG_SUPPORT_ATHUB;
++ /* guest vm gets 0xffffffff when reading RCC_DEV0_EPF0_STRAP0,
++ * as a consequence, the rev_id and external_rev_id are wrong.
++ * workaround it by hardcoding rev_id to 0 (default value).
++ */
++ if (amdgpu_sriov_vf(adev))
++ adev->rev_id = 0;
+ adev->external_rev_id = adev->rev_id + 0xa;
+ break;
+ default:
+--
+2.20.1
+
--- /dev/null
+From fb20ff66745b7f53ce13b0942228875989ab2e0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 19:55:47 -0500
+Subject: drm/amdkfd: Fix a bug in SDMA RLC queue counting under HWS mode
+
+From: Yong Zhao <Yong.Zhao@amd.com>
+
+[ Upstream commit f38abc15d157b7b31fa7f651dc8bf92858c963f8 ]
+
+The sdma_queue_count increment should be done before
+execute_queues_cpsch(), which calls pm_calc_rlib_size() where
+sdma_queue_count is used to calculate whether over_subscription is
+triggered.
+
+With the previous code, when a SDMA queue is created,
+compute_queue_count in pm_calc_rlib_size() is one more than the
+actual compute queue number, because the queue_count has been
+incremented while sdma_queue_count has not. This patch fixes that.
+
+Signed-off-by: Yong Zhao <Yong.Zhao@amd.com>
+Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index f335f73919d15..a2ed9c257cb0d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -1181,16 +1181,18 @@ static int create_queue_cpsch(struct device_queue_manager *dqm, struct queue *q,
+
+ list_add(&q->list, &qpd->queues_list);
+ qpd->queue_count++;
++
++ if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
++ dqm->sdma_queue_count++;
++ else if (q->properties.type == KFD_QUEUE_TYPE_SDMA_XGMI)
++ dqm->xgmi_sdma_queue_count++;
++
+ if (q->properties.is_active) {
+ dqm->queue_count++;
+ retval = execute_queues_cpsch(dqm,
+ KFD_UNMAP_QUEUES_FILTER_DYNAMIC_QUEUES, 0);
+ }
+
+- if (q->properties.type == KFD_QUEUE_TYPE_SDMA)
+- dqm->sdma_queue_count++;
+- else if (q->properties.type == KFD_QUEUE_TYPE_SDMA_XGMI)
+- dqm->xgmi_sdma_queue_count++;
+ /*
+ * Unconditionally increment this counter, regardless of the queue's
+ * type or whether the queue is active.
+--
+2.20.1
+
--- /dev/null
+From 8e58bb0cf19ef00f0f237785c1a82ae727bd8ceb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 22:36:55 -0500
+Subject: drm/amdkfd: Fix permissions of hang_hws
+
+From: Felix Kuehling <Felix.Kuehling@amd.com>
+
+[ Upstream commit 2bdac179e217a0c0b548a8c60524977586621b19 ]
+
+Reading from /sys/kernel/debug/kfd/hang_hws would cause a kernel
+oops because we didn't implement a read callback. Set the permission
+to write-only to prevent that.
+
+Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
+Reviewed-by: shaoyunl <shaoyun.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c b/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c
+index 15c523027285c..511712c2e382d 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_debugfs.c
+@@ -93,7 +93,7 @@ void kfd_debugfs_init(void)
+ kfd_debugfs_hqds_by_device, &kfd_debugfs_fops);
+ debugfs_create_file("rls", S_IFREG | 0444, debugfs_root,
+ kfd_debugfs_rls_by_device, &kfd_debugfs_fops);
+- debugfs_create_file("hang_hws", S_IFREG | 0644, debugfs_root,
++ debugfs_create_file("hang_hws", S_IFREG | 0200, debugfs_root,
+ NULL, &kfd_debugfs_hang_hws_fops);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 61913166a612c878673fcb8727b8c5ee05d03778 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 13:24:33 -0800
+Subject: drm/fbdev: Fallback to non tiled mode if all tiles not present
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Manasi Navare <manasi.d.navare@intel.com>
+
+[ Upstream commit f25c7a006cd1c07254780e3406e45cee4842b933 ]
+
+In case of tiled displays, if we hotplug just one connector,
+fbcon currently just selects the preferred mode and if it is
+tiled mode then that becomes a problem if rest of the tiles are
+not present.
+So in the fbdev driver on hotplug when we probe the client modeset,
+if we dont find all the connectors for all tiles, then on a connector
+with one tile, just fallback to the first available non tiled mode
+to display over a single connector.
+On the hotplug of the consecutive tiled connectors, if the tiled mode
+no longer exists because of fbcon size limitation, then return
+no modes for consecutive tiles but retain the non tiled mode
+on the 0th tile.
+Use the same logic in case of connected boot case as well.
+This has been tested with Dell UP328K tiled monitor.
+
+v2:
+* Set the modes on consecutive hotplugged tiles to no mode
+if tiled mode is pruned (Dave)
+v1:
+* Just handle the 1st connector hotplug case
+* v1 Reviewed-by: Dave Airlie <airlied@redhat.com>
+
+Suggested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Suggested-by: Dave Airlie <airlied@redhat.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Manasi Navare <manasi.d.navare@intel.com>
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191113222952.9231-1-manasi.d.navare@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_client_modeset.c | 72 ++++++++++++++++++++++++++++
+ 1 file changed, 72 insertions(+)
+
+diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
+index c8922b7cac091..12e748b202d6f 100644
+--- a/drivers/gpu/drm/drm_client_modeset.c
++++ b/drivers/gpu/drm/drm_client_modeset.c
+@@ -114,6 +114,33 @@ drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc)
+ return NULL;
+ }
+
++static struct drm_display_mode *
++drm_connector_get_tiled_mode(struct drm_connector *connector)
++{
++ struct drm_display_mode *mode;
++
++ list_for_each_entry(mode, &connector->modes, head) {
++ if (mode->hdisplay == connector->tile_h_size &&
++ mode->vdisplay == connector->tile_v_size)
++ return mode;
++ }
++ return NULL;
++}
++
++static struct drm_display_mode *
++drm_connector_fallback_non_tiled_mode(struct drm_connector *connector)
++{
++ struct drm_display_mode *mode;
++
++ list_for_each_entry(mode, &connector->modes, head) {
++ if (mode->hdisplay == connector->tile_h_size &&
++ mode->vdisplay == connector->tile_v_size)
++ continue;
++ return mode;
++ }
++ return NULL;
++}
++
+ static struct drm_display_mode *
+ drm_connector_has_preferred_mode(struct drm_connector *connector, int width, int height)
+ {
+@@ -348,8 +375,15 @@ static bool drm_client_target_preferred(struct drm_connector **connectors,
+ struct drm_connector *connector;
+ u64 conn_configured = 0;
+ int tile_pass = 0;
++ int num_tiled_conns = 0;
+ int i;
+
++ for (i = 0; i < connector_count; i++) {
++ if (connectors[i]->has_tile &&
++ connectors[i]->status == connector_status_connected)
++ num_tiled_conns++;
++ }
++
+ retry:
+ for (i = 0; i < connector_count; i++) {
+ connector = connectors[i];
+@@ -399,6 +433,28 @@ retry:
+ list_for_each_entry(modes[i], &connector->modes, head)
+ break;
+ }
++ /*
++ * In case of tiled mode if all tiles not present fallback to
++ * first available non tiled mode.
++ * After all tiles are present, try to find the tiled mode
++ * for all and if tiled mode not present due to fbcon size
++ * limitations, use first non tiled mode only for
++ * tile 0,0 and set to no mode for all other tiles.
++ */
++ if (connector->has_tile) {
++ if (num_tiled_conns <
++ connector->num_h_tile * connector->num_v_tile ||
++ (connector->tile_h_loc == 0 &&
++ connector->tile_v_loc == 0 &&
++ !drm_connector_get_tiled_mode(connector))) {
++ DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
++ connector->base.id);
++ modes[i] = drm_connector_fallback_non_tiled_mode(connector);
++ } else {
++ modes[i] = drm_connector_get_tiled_mode(connector);
++ }
++ }
++
+ DRM_DEBUG_KMS("found mode %s\n", modes[i] ? modes[i]->name :
+ "none");
+ conn_configured |= BIT_ULL(i);
+@@ -516,6 +572,7 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ bool fallback = true, ret = true;
+ int num_connectors_enabled = 0;
+ int num_connectors_detected = 0;
++ int num_tiled_conns = 0;
+ struct drm_modeset_acquire_ctx ctx;
+
+ if (!drm_drv_uses_atomic_modeset(dev))
+@@ -533,6 +590,11 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ memcpy(save_enabled, enabled, count);
+ mask = GENMASK(count - 1, 0);
+ conn_configured = 0;
++ for (i = 0; i < count; i++) {
++ if (connectors[i]->has_tile &&
++ connectors[i]->status == connector_status_connected)
++ num_tiled_conns++;
++ }
+ retry:
+ conn_seq = conn_configured;
+ for (i = 0; i < count; i++) {
+@@ -632,6 +694,16 @@ retry:
+ connector->name);
+ modes[i] = &connector->state->crtc->mode;
+ }
++ /*
++ * In case of tiled modes, if all tiles are not present
++ * then fallback to a non tiled mode.
++ */
++ if (connector->has_tile &&
++ num_tiled_conns < connector->num_h_tile * connector->num_v_tile) {
++ DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
++ connector->base.id);
++ modes[i] = drm_connector_fallback_non_tiled_mode(connector);
++ }
+ crtcs[i] = new_crtc;
+
+ DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n",
+--
+2.20.1
+
--- /dev/null
+From 4a2b0d9c5f16cb4606d9e1b6342f7475a65e5cf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 16:30:48 +0100
+Subject: drm/gma500: Fixup fbdev stolen size usage evaluation
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit fd1a5e521c3c083bb43ea731aae0f8b95f12b9bd ]
+
+psbfb_probe performs an evaluation of the required size from the stolen
+GTT memory, but gets it wrong in two distinct ways:
+- The resulting size must be page-size-aligned;
+- The size to allocate is derived from the surface dimensions, not the fb
+ dimensions.
+
+When two connectors are connected with different modes, the smallest will
+be stored in the fb dimensions, but the size that needs to be allocated must
+match the largest (surface) dimensions. This is what is used in the actual
+allocation code.
+
+Fix this by correcting the evaluation to conform to the two points above.
+It allows correctly switching to 16bpp when one connector is e.g. 1920x1080
+and the other is 1024x768.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191107153048.843881-1-paul.kocialkowski@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/framebuffer.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
+index 218f3bb15276e..90237abee0885 100644
+--- a/drivers/gpu/drm/gma500/framebuffer.c
++++ b/drivers/gpu/drm/gma500/framebuffer.c
+@@ -462,6 +462,7 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ container_of(helper, struct psb_fbdev, psb_fb_helper);
+ struct drm_device *dev = psb_fbdev->psb_fb_helper.dev;
+ struct drm_psb_private *dev_priv = dev->dev_private;
++ unsigned int fb_size;
+ int bytespp;
+
+ bytespp = sizes->surface_bpp / 8;
+@@ -471,8 +472,11 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ /* If the mode will not fit in 32bit then switch to 16bit to get
+ a console on full resolution. The X mode setting server will
+ allocate its own 32bit GEM framebuffer */
+- if (ALIGN(sizes->fb_width * bytespp, 64) * sizes->fb_height >
+- dev_priv->vram_stolen_size) {
++ fb_size = ALIGN(sizes->surface_width * bytespp, 64) *
++ sizes->surface_height;
++ fb_size = ALIGN(fb_size, PAGE_SIZE);
++
++ if (fb_size > dev_priv->vram_stolen_size) {
+ sizes->surface_bpp = 16;
+ sizes->surface_depth = 16;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1c4ae96510a26ebe65143a56e66442dd6e1dd842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 15:28:51 +0800
+Subject: drm/mediatek: Add gamma property according to hardware capability
+
+From: Yongqiang Niu <yongqiang.niu@mediatek.com>
+
+[ Upstream commit 4cebc1de506fa753301266a5a23bb21bca52ad3a ]
+
+If there is no gamma function in the crtc
+display path, don't add gamma property
+for crtc
+
+Fixes: 2f3f4dda747c ("drm/mediatek: Add gamma correction.")
+Signed-off-by: Yongqiang Niu <yongqiang.niu@mediatek.com>
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 0b3d284d19569..e6c049f4f08bb 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -537,6 +537,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ int pipe = priv->num_pipes;
+ int ret;
+ int i;
++ uint gamma_lut_size = 0;
+
+ if (!path)
+ return 0;
+@@ -587,6 +588,9 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ }
+
+ mtk_crtc->ddp_comp[i] = comp;
++
++ if (comp->funcs && comp->funcs->gamma_set)
++ gamma_lut_size = MTK_LUT_SIZE;
+ }
+
+ mtk_crtc->layer_nr = mtk_ddp_comp_layer_nr(mtk_crtc->ddp_comp[0]);
+@@ -609,8 +613,10 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ NULL, pipe);
+ if (ret < 0)
+ return ret;
+- drm_mode_crtc_set_gamma_size(&mtk_crtc->base, MTK_LUT_SIZE);
+- drm_crtc_enable_color_mgmt(&mtk_crtc->base, 0, false, MTK_LUT_SIZE);
++
++ if (gamma_lut_size)
++ drm_mode_crtc_set_gamma_size(&mtk_crtc->base, gamma_lut_size);
++ drm_crtc_enable_color_mgmt(&mtk_crtc->base, 0, false, gamma_lut_size);
+ priv->num_pipes++;
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 905e8ef050f36495f529a719e35d52ae61386c8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 13:05:21 +0800
+Subject: drm/mediatek: handle events when enabling/disabling crtc
+
+From: Bibby Hsieh <bibby.hsieh@mediatek.com>
+
+[ Upstream commit 411f5c1eacfebb1f6e40b653d29447cdfe7282aa ]
+
+The driver currently handles vblank events only when updating planes on
+an already enabled CRTC. The atomic update API however allows requesting
+an event when enabling or disabling a CRTC. This currently leads to
+event objects being leaked in the kernel and to events not being sent
+out. Fix it.
+
+Signed-off-by: Bibby Hsieh <bibby.hsieh@mediatek.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 34a7317557912..0b3d284d19569 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -298,6 +298,7 @@ err_pm_runtime_put:
+ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ {
+ struct drm_device *drm = mtk_crtc->base.dev;
++ struct drm_crtc *crtc = &mtk_crtc->base;
+ int i;
+
+ DRM_DEBUG_DRIVER("%s\n", __func__);
+@@ -319,6 +320,13 @@ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ mtk_disp_mutex_unprepare(mtk_crtc->mutex);
+
+ pm_runtime_put(drm->dev);
++
++ if (crtc->state->event && !crtc->state->active) {
++ spin_lock_irq(&crtc->dev->event_lock);
++ drm_crtc_send_vblank_event(crtc, crtc->state->event);
++ crtc->state->event = NULL;
++ spin_unlock_irq(&crtc->dev->event_lock);
++ }
+ }
+
+ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
+--
+2.20.1
+
--- /dev/null
+From 3352364bdf558c825f97ff96743d53c44385b50d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 14:06:04 +0100
+Subject: drm/mipi_dbi: Fix off-by-one bugs in mipi_dbi_blank()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2ce18249af5a28031b3f909cfafccc88ea966c9d ]
+
+When configuring the frame memory window, the last column and row
+numbers are written to the column resp. page address registers. These
+numbers are thus one less than the actual window width resp. height.
+
+While this is handled correctly in mipi_dbi_fb_dirty() since commit
+03ceb1c8dfd1e293 ("drm/tinydrm: Fix setting of the column/page end
+addresses."), it is not in mipi_dbi_blank(). The latter still forgets
+to subtract one when calculating the most significant bytes of the
+column and row numbers, thus programming wrong values when the display
+width or height is a multiple of 256.
+
+Fixes: 02dd95fe31693626 ("drm/tinydrm: Add MIPI DBI support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191230130604.31006-1-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_mipi_dbi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c
+index f8154316a3b0d..a05e64e3d80bb 100644
+--- a/drivers/gpu/drm/drm_mipi_dbi.c
++++ b/drivers/gpu/drm/drm_mipi_dbi.c
+@@ -367,9 +367,9 @@ static void mipi_dbi_blank(struct mipi_dbi_dev *dbidev)
+ memset(dbidev->tx_buf, 0, len);
+
+ mipi_dbi_command(dbi, MIPI_DCS_SET_COLUMN_ADDRESS, 0, 0,
+- (width >> 8) & 0xFF, (width - 1) & 0xFF);
++ ((width - 1) >> 8) & 0xFF, (width - 1) & 0xFF);
+ mipi_dbi_command(dbi, MIPI_DCS_SET_PAGE_ADDRESS, 0, 0,
+- (height >> 8) & 0xFF, (height - 1) & 0xFF);
++ ((height - 1) >> 8) & 0xFF, (height - 1) & 0xFF);
+ mipi_dbi_command_buf(dbi, MIPI_DCS_WRITE_MEMORY_START,
+ (u8 *)dbidev->tx_buf, len);
+
+--
+2.20.1
+
--- /dev/null
+From 723304076c83fd1b8130a4546bcb737fa5063494 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Nov 2019 14:23:38 -0800
+Subject: drm/msm/adreno: fix zap vs no-zap handling
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit 15ab987c423df561e0949d77fb5043921ae59956 ]
+
+We can have two cases, when it comes to "zap" fw. Either the fw
+requires zap fw to take the GPU out of secure mode at boot, or it does
+not and we can write RBBM_SECVID_TRUST_CNTL directly. Previously we
+decided based on whether zap fw load succeeded, but this is not a great
+plan because:
+
+1) we could have zap fw in the filesystem on a device where it is not
+ required
+2) we could have the inverse case
+
+Instead, shift to deciding based on whether we have a 'zap-shader' node
+in dt. In practice, there is only one device (currently) with upstream
+dt that does not use zap (cheza), and it already has a /delete-node/ for
+the zap-shader node.
+
+Fixes: abccb9fe3267 ("drm/msm/a6xx: Add zap shader load")
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 11 +++++++++--
+ drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 11 +++++++++--
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+index e9c55d1d6c044..99cd6e62a9715 100644
+--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+@@ -726,11 +726,18 @@ static int a5xx_hw_init(struct msm_gpu *gpu)
+ gpu->funcs->flush(gpu, gpu->rb[0]);
+ if (!a5xx_idle(gpu, gpu->rb[0]))
+ return -EINVAL;
+- } else {
+- /* Print a warning so if we die, we know why */
++ } else if (ret == -ENODEV) {
++ /*
++ * This device does not use zap shader (but print a warning
++ * just in case someone got their dt wrong.. hopefully they
++ * have a debug UART to realize the error of their ways...
++ * if you mess this up you are about to crash horribly)
++ */
+ dev_warn_once(gpu->dev->dev,
+ "Zap shader not enabled - using SECVID_TRUST_CNTL instead\n");
+ gpu_write(gpu, REG_A5XX_RBBM_SECVID_TRUST_CNTL, 0x0);
++ } else {
++ return ret;
+ }
+
+ /* Last step - yield the ringbuffer */
+diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+index dc8ec2c94301b..686c34d706b0d 100644
+--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+@@ -537,12 +537,19 @@ static int a6xx_hw_init(struct msm_gpu *gpu)
+ a6xx_flush(gpu, gpu->rb[0]);
+ if (!a6xx_idle(gpu, gpu->rb[0]))
+ return -EINVAL;
+- } else {
+- /* Print a warning so if we die, we know why */
++ } else if (ret == -ENODEV) {
++ /*
++ * This device does not use zap shader (but print a warning
++ * just in case someone got their dt wrong.. hopefully they
++ * have a debug UART to realize the error of their ways...
++ * if you mess this up you are about to crash horribly)
++ */
+ dev_warn_once(gpu->dev->dev,
+ "Zap shader not enabled - using SECVID_TRUST_CNTL instead\n");
+ gpu_write(gpu, REG_A6XX_RBBM_SECVID_TRUST_CNTL, 0x0);
+ ret = 0;
++ } else {
++ return ret;
+ }
+
+ out:
+--
+2.20.1
+
--- /dev/null
+From 67616c61ffe4d66a4d2c91b83002f5963a500c0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 14:39:26 +1000
+Subject: drm/nouveau/disp/nv50-: prevent oops when no channel method map
+ provided
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 0e6176c6d286316e9431b4f695940cfac4ffe6c2 ]
+
+The implementations for most channel types contains a map of methods to
+priv registers in order to provide debugging info when a disp exception
+has been raised.
+
+This info is missing from the implementation of PIO channels as they're
+rather simplistic already, however, if an exception is raised by one of
+them, we'd end up triggering a NULL-pointer deref. Not ideal...
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206299
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+index bcf32d92ee5a9..50e3539f33d22 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+@@ -74,6 +74,8 @@ nv50_disp_chan_mthd(struct nv50_disp_chan *chan, int debug)
+
+ if (debug > subdev->debug)
+ return;
++ if (!mthd)
++ return;
+
+ for (i = 0; (list = mthd->data[i].mthd) != NULL; i++) {
+ u32 base = chan->head * mthd->addr;
+--
+2.20.1
+
--- /dev/null
+From fe704c4337420202808f6e2df0cd97eb4c9319f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 15:28:37 +0800
+Subject: drm/nouveau/drm/ttm: Remove set but not used variable 'mem'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2e4534a22794746b11a794b2229b8d58797eccce ]
+
+drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_vram_manager_new:
+drivers/gpu/drm/nouveau/nouveau_ttm.c:66:22: warning: variable mem set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_gart_manager_new:
+drivers/gpu/drm/nouveau/nouveau_ttm.c:106:22: warning: variable mem set but not used [-Wunused-but-set-variable]
+
+They are not used any more, so remove it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_ttm.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+index f0daf958e03a2..621d28f094bc7 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+@@ -63,14 +63,12 @@ nouveau_vram_manager_new(struct ttm_mem_type_manager *man,
+ {
+ struct nouveau_bo *nvbo = nouveau_bo(bo);
+ struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+- struct nouveau_mem *mem;
+ int ret;
+
+ if (drm->client.device.info.ram_size == 0)
+ return -ENOMEM;
+
+ ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+- mem = nouveau_mem(reg);
+ if (ret)
+ return ret;
+
+@@ -103,11 +101,9 @@ nouveau_gart_manager_new(struct ttm_mem_type_manager *man,
+ {
+ struct nouveau_bo *nvbo = nouveau_bo(bo);
+ struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+- struct nouveau_mem *mem;
+ int ret;
+
+ ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+- mem = nouveau_mem(reg);
+ if (ret)
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From b414d372d61946958f6fafc326244769415b09da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 06:34:21 +1000
+Subject: drm/nouveau/fault/gv100-: fix memory leak on module unload
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 633cc9beeb6f9b5fa2f17a2a9d0e2790cb6c3de7 ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+index ca251560d3e09..bb4a4266897c3 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+@@ -146,6 +146,7 @@ nvkm_fault_dtor(struct nvkm_subdev *subdev)
+ struct nvkm_fault *fault = nvkm_fault(subdev);
+ int i;
+
++ nvkm_notify_fini(&fault->nrpfb);
+ nvkm_event_fini(&fault->event);
+
+ for (i = 0; i < fault->buffer_nr; i++) {
+--
+2.20.1
+
--- /dev/null
+From 2cf1101f72ea9e760e7efe5ee3110db2a9227b3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:32:01 +0800
+Subject: drm/nouveau: Fix copy-paste error in
+ nouveau_fence_wait_uevent_handler
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 1eb013473bff5f95b6fe1ca4dd7deda47257b9c2 ]
+
+Like other cases, it should use rcu protected 'chan' rather
+than 'fence->channel' in nouveau_fence_wait_uevent_handler.
+
+Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
+index 9118df035b28d..70bb6bb97af87 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
+@@ -156,7 +156,7 @@ nouveau_fence_wait_uevent_handler(struct nvif_notify *notify)
+
+ fence = list_entry(fctx->pending.next, typeof(*fence), head);
+ chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+- if (nouveau_fence_update(fence->channel, fctx))
++ if (nouveau_fence_update(chan, fctx))
+ ret = NVIF_NOTIFY_DROP;
+ }
+ spin_unlock_irqrestore(&fctx->lock, flags);
+--
+2.20.1
+
--- /dev/null
+From 6cb0d480615d61b33dae7b32ff3903dd274b72bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 11:46:15 +1000
+Subject: drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read
+ from fw
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 7adc77aa0e11f25b0e762859219c70852cd8d56f ]
+
+Method init is typically ordered by class in the FW image as ThreeD,
+TwoD, Compute.
+
+Due to a bug in parsing the FW into our internal format, we've been
+accidentally sending Twod + Compute methods to the ThreeD class, as
+well as Compute methods to the TwoD class - oops.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/nouveau/nvkm/engine/gr/gk20a.c | 21 ++++++++++---------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+index 500cb08dd6080..b57ab5cea9a10 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+@@ -143,23 +143,24 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+
+ nent = (fuc.size / sizeof(struct gk20a_fw_av));
+
+- pack = vzalloc((sizeof(*pack) * max_classes) +
+- (sizeof(*init) * (nent + 1)));
++ pack = vzalloc((sizeof(*pack) * (max_classes + 1)) +
++ (sizeof(*init) * (nent + max_classes + 1)));
+ if (!pack) {
+ ret = -ENOMEM;
+ goto end;
+ }
+
+- init = (void *)(pack + max_classes);
++ init = (void *)(pack + max_classes + 1);
+
+- for (i = 0; i < nent; i++) {
+- struct gf100_gr_init *ent = &init[i];
++ for (i = 0; i < nent; i++, init++) {
+ struct gk20a_fw_av *av = &((struct gk20a_fw_av *)fuc.data)[i];
+ u32 class = av->addr & 0xffff;
+ u32 addr = (av->addr & 0xffff0000) >> 14;
+
+ if (prevclass != class) {
+- pack[classidx].init = ent;
++ if (prevclass) /* Add terminator to the method list. */
++ init++;
++ pack[classidx].init = init;
+ pack[classidx].type = class;
+ prevclass = class;
+ if (++classidx >= max_classes) {
+@@ -169,10 +170,10 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+ }
+ }
+
+- ent->addr = addr;
+- ent->data = av->data;
+- ent->count = 1;
+- ent->pitch = 1;
++ init->addr = addr;
++ init->data = av->data;
++ init->count = 1;
++ init->pitch = 1;
+ }
+
+ *ppack = pack;
+--
+2.20.1
+
--- /dev/null
+From a8edc95a2db26e05bedd20369807dd61a57984f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 08:23:06 +1000
+Subject: drm/nouveau/mmu: fix comptag memory leak
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 35e4909b6a2b4005ced3c4238da60d926b78fdea ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/memory.c b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+index e85a08ecd9da5..4cc186262d344 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/memory.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+@@ -91,8 +91,8 @@ nvkm_memory_tags_get(struct nvkm_memory *memory, struct nvkm_device *device,
+ }
+
+ refcount_set(&tags->refcount, 1);
++ *ptags = memory->tags = tags;
+ mutex_unlock(&fb->subdev.mutex);
+- *ptags = tags;
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fdbacafe1060c7c9958614f7035bad5d56b5da54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 16:28:28 +0000
+Subject: drm/nouveau/nouveau: fix incorrect sizeof on args.src an args.dst
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f42e4b337b327b1336c978c4b5174990a25f68a0 ]
+
+The sizeof is currently on args.src and args.dst and should be on
+*args.src and *args.dst. Fortunately these sizes just so happen
+to be the same size so it worked, however, this should be fixed
+and it also cleans up static analysis warnings
+
+Addresses-Coverity: ("sizeof not portable")
+Fixes: f268307ec7c7 ("nouveau: simplify nouveau_dmem_migrate_vma")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_dmem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_dmem.c b/drivers/gpu/drm/nouveau/nouveau_dmem.c
+index fa14399415965..0ad5d87b5a8e5 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_dmem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_dmem.c
+@@ -635,10 +635,10 @@ nouveau_dmem_migrate_vma(struct nouveau_drm *drm,
+ unsigned long c, i;
+ int ret = -ENOMEM;
+
+- args.src = kcalloc(max, sizeof(args.src), GFP_KERNEL);
++ args.src = kcalloc(max, sizeof(*args.src), GFP_KERNEL);
+ if (!args.src)
+ goto out;
+- args.dst = kcalloc(max, sizeof(args.dst), GFP_KERNEL);
++ args.dst = kcalloc(max, sizeof(*args.dst), GFP_KERNEL);
+ if (!args.dst)
+ goto out_free_src;
+
+--
+2.20.1
+
--- /dev/null
+From def9c9689a96e75da1fdcba68b77b5656e75bdfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 08:46:01 +0300
+Subject: drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 3613a9bea95a1470dd42e4ed1cc7d86ebe0a2dc0 ]
+
+We accidentally set "psb" which is a no-op instead of "*psb" so it
+generates a static checker warning. We should probably set it before
+the first error return so that it's always initialized.
+
+Fixes: 923f1bd27bf1 ("drm/nouveau/secboot/gm20b: add secure boot support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+index df8b919dcf09b..ace6fefba4280 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+@@ -108,6 +108,7 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ struct gm200_secboot *gsb;
+ struct nvkm_acr *acr;
+
++ *psb = NULL;
+ acr = acr_r352_new(BIT(NVKM_SECBOOT_FALCON_FECS) |
+ BIT(NVKM_SECBOOT_FALCON_PMU));
+ if (IS_ERR(acr))
+@@ -116,10 +117,8 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ acr->optional_falcons = BIT(NVKM_SECBOOT_FALCON_PMU);
+
+ gsb = kzalloc(sizeof(*gsb), GFP_KERNEL);
+- if (!gsb) {
+- psb = NULL;
++ if (!gsb)
+ return -ENOMEM;
+- }
+ *psb = &gsb->base;
+
+ ret = nvkm_secboot_ctor(&gm20b_secboot, acr, device, index, &gsb->base);
+--
+2.20.1
+
--- /dev/null
+From 8c06b4b04199cdb870f87e1cb052df9502ae8319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 08:51:45 -0500
+Subject: drm/panel: simple: Add Logic PD Type 28 display support
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 0d35408afbeb603bc9972ae91e4dd2638bcffe52 ]
+
+Previously, there was an omap panel-dpi driver that would
+read generic timings from the device tree and set the display
+timing accordingly. This driver was removed so the screen
+no longer functions. This patch modifies the panel-simple
+file to setup the timings to the same values previously used.
+
+Fixes: 8bf4b1621178 ("drm/omap: Remove panel-dpi driver")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191016135147.7743-1-aford173@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-simple.c | 37 ++++++++++++++++++++++++++++
+ 1 file changed, 37 insertions(+)
+
+diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
+index 28fa6ba7b7673..8abb31f83ffc7 100644
+--- a/drivers/gpu/drm/panel/panel-simple.c
++++ b/drivers/gpu/drm/panel/panel-simple.c
+@@ -2048,6 +2048,40 @@ static const struct drm_display_mode mitsubishi_aa070mc01_mode = {
+ .flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC,
+ };
+
++static const struct drm_display_mode logicpd_type_28_mode = {
++ .clock = 9000,
++ .hdisplay = 480,
++ .hsync_start = 480 + 3,
++ .hsync_end = 480 + 3 + 42,
++ .htotal = 480 + 3 + 42 + 2,
++
++ .vdisplay = 272,
++ .vsync_start = 272 + 2,
++ .vsync_end = 272 + 2 + 11,
++ .vtotal = 272 + 2 + 11 + 3,
++ .vrefresh = 60,
++ .flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC,
++};
++
++static const struct panel_desc logicpd_type_28 = {
++ .modes = &logicpd_type_28_mode,
++ .num_modes = 1,
++ .bpc = 8,
++ .size = {
++ .width = 105,
++ .height = 67,
++ },
++ .delay = {
++ .prepare = 200,
++ .enable = 200,
++ .unprepare = 200,
++ .disable = 200,
++ },
++ .bus_format = MEDIA_BUS_FMT_RGB888_1X24,
++ .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE |
++ DRM_BUS_FLAG_SYNC_DRIVE_NEGEDGE,
++};
++
+ static const struct panel_desc mitsubishi_aa070mc01 = {
+ .modes = &mitsubishi_aa070mc01_mode,
+ .num_modes = 1,
+@@ -3264,6 +3298,9 @@ static const struct of_device_id platform_of_match[] = {
+ }, {
+ .compatible = "lg,lp129qe",
+ .data = &lg_lp129qe,
++ }, {
++ .compatible = "logicpd,type28",
++ .data = &logicpd_type_28,
+ }, {
+ .compatible = "mitsubishi,aa070mc01-ca1",
+ .data = &mitsubishi_aa070mc01,
+--
+2.20.1
+
--- /dev/null
+From 6ef596b7a649fe3842ca753e171086b299ddad52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 18:05:08 +0100
+Subject: drm/qxl: Complete exception handling in qxl_device_init()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Markus Elfring <elfring@users.sourceforge.net>
+
+[ Upstream commit dbe3ad61dcebc49fe3efca70a0f752a95b4600f2 ]
+
+A coccicheck run provided information like the following.
+
+drivers/gpu/drm/qxl/qxl_kms.c:295:1-7: ERROR: missing iounmap;
+ioremap on line 178 and execution via conditional on line 185
+
+Generated by: scripts/coccinelle/free/iounmap.cocci
+
+A jump target was specified in an if branch. The corresponding function
+call did not release the desired system resource then.
+Thus use the label “rom_unmap” instead to fix the exception handling
+for this function implementation.
+
+Fixes: 5043348a4969ae1661c008efe929abd0d76e3792 ("drm: qxl: Fix error handling at qxl_device_init")
+Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
+Link: http://patchwork.freedesktop.org/patch/msgid/5e5ef9c4-4d85-3c93-cf28-42cfcb5b0649@web.de
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/qxl/qxl_kms.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
+index 611cbe7aee690..bfc1631093e9b 100644
+--- a/drivers/gpu/drm/qxl/qxl_kms.c
++++ b/drivers/gpu/drm/qxl/qxl_kms.c
+@@ -184,7 +184,7 @@ int qxl_device_init(struct qxl_device *qdev,
+
+ if (!qxl_check_device(qdev)) {
+ r = -ENODEV;
+- goto surface_mapping_free;
++ goto rom_unmap;
+ }
+
+ r = qxl_bo_init(qdev);
+--
+2.20.1
+
--- /dev/null
+From a6509c2ff39025c96e3fe50708c29f93d29c71bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jun 2019 09:47:51 -0400
+Subject: drm: remove the newline for CRC source name.
+
+From: Dingchen Zhang <dingchen.zhang@amd.com>
+
+[ Upstream commit 72a848f5c46bab4c921edc9cbffd1ab273b2be17 ]
+
+userspace may transfer a newline, and this terminating newline
+is replaced by a '\0' to avoid followup issues.
+
+'len-1' is the index to replace the newline of CRC source name.
+
+v3: typo fix (Sam)
+
+v2: update patch subject, body and format. (Sam)
+
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Dingchen Zhang <dingchen.zhang@amd.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190610134751.14356-1-dingchen.zhang@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_debugfs_crc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
+index be1b7ba92ffe1..6a626c82e264b 100644
+--- a/drivers/gpu/drm/drm_debugfs_crc.c
++++ b/drivers/gpu/drm/drm_debugfs_crc.c
+@@ -140,8 +140,8 @@ static ssize_t crc_control_write(struct file *file, const char __user *ubuf,
+ if (IS_ERR(source))
+ return PTR_ERR(source);
+
+- if (source[len] == '\n')
+- source[len] = '\0';
++ if (source[len - 1] == '\n')
++ source[len - 1] = '\0';
+
+ ret = crtc->funcs->verify_crc_source(crtc, source, &values_cnt);
+ if (ret)
+--
+2.20.1
+
--- /dev/null
+From 78795940a99f5305ba5291c1b3d8fc36cb166bf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 23:37:58 -0500
+Subject: drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 40efb09a7f53125719e49864da008495e39aaa1e ]
+
+In vmw_cmdbuf_res_add if drm_ht_insert_item fails the allocated memory
+for cres should be released.
+
+Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+index 4ac55fc2bf970..44d858ce4ce7f 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+@@ -209,8 +209,10 @@ int vmw_cmdbuf_res_add(struct vmw_cmdbuf_res_manager *man,
+
+ cres->hash.key = user_key | (res_type << 24);
+ ret = drm_ht_insert_item(&man->resources, &cres->hash);
+- if (unlikely(ret != 0))
++ if (unlikely(ret != 0)) {
++ kfree(cres);
+ goto out_invalid_key;
++ }
+
+ cres->state = VMW_CMDBUF_RES_ADD;
+ cres->res = vmw_resource_reference(res);
+--
+2.20.1
+
--- /dev/null
+From 3ef50ebb228d8abccfcd12275fc709a64a243060 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 15:03:03 +0000
+Subject: EDAC/sifive: Fix return value check in ecc_register()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 6cd18453b68942913fd3b1913b707646e544c2ac ]
+
+In case of error, the function edac_device_alloc_ctl_info() returns a
+NULL pointer, not ERR_PTR(). Replace the IS_ERR() test in the return
+value check with a NULL test.
+
+Fixes: 91abaeaaff35 ("EDAC/sifive: Add EDAC platform driver for SiFive SoCs")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20200115150303.112627-1-weiyongjun1@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/sifive_edac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/edac/sifive_edac.c b/drivers/edac/sifive_edac.c
+index 413cdb4a591db..bb9ceeaf29bf9 100644
+--- a/drivers/edac/sifive_edac.c
++++ b/drivers/edac/sifive_edac.c
+@@ -54,8 +54,8 @@ static int ecc_register(struct platform_device *pdev)
+ p->dci = edac_device_alloc_ctl_info(0, "sifive_ecc", 1, "sifive_ecc",
+ 1, 1, NULL, 0,
+ edac_device_alloc_index());
+- if (IS_ERR(p->dci))
+- return PTR_ERR(p->dci);
++ if (!p->dci)
++ return -ENOMEM;
+
+ p->dci->dev = &pdev->dev;
+ p->dci->mod_name = "Sifive ECC Manager";
+--
+2.20.1
+
--- /dev/null
+From 440553d3d049cd205ffbf57f3f4401c41870f5ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:39:46 +0100
+Subject: efi/x86: Don't panic or BUG() on non-critical error conditions
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit e2d68a955e49d61fd0384f23e92058dc9b79be5e ]
+
+The logic in __efi_enter_virtual_mode() does a number of steps in
+sequence, all of which may fail in one way or the other. In most
+cases, we simply print an error and disable EFI runtime services
+support, but in some cases, we BUG() or panic() and bring down the
+system when encountering conditions that we could easily handle in
+the same way.
+
+While at it, replace a pointless page-to-virt-phys conversion with
+one that goes straight from struct page to physical.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: Matthew Garrett <mjg59@google.com>
+Cc: linux-efi@vger.kernel.org
+Link: https://lkml.kernel.org/r/20200103113953.9571-14-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi.c | 28 ++++++++++++++--------------
+ arch/x86/platform/efi/efi_64.c | 9 +++++----
+ 2 files changed, 19 insertions(+), 18 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 8a4f389330396..01d7ca492741d 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -954,16 +954,14 @@ static void __init __efi_enter_virtual_mode(void)
+
+ if (efi_alloc_page_tables()) {
+ pr_err("Failed to allocate EFI page tables\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ efi_merge_regions();
+ new_memmap = efi_map_regions(&count, &pg_shift);
+ if (!new_memmap) {
+ pr_err("Error reallocating memory, EFI runtime non-functional!\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ pa = __pa(new_memmap);
+@@ -977,8 +975,7 @@ static void __init __efi_enter_virtual_mode(void)
+
+ if (efi_memmap_init_late(pa, efi.memmap.desc_size * count)) {
+ pr_err("Failed to remap late EFI memory map\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ if (efi_enabled(EFI_DBG)) {
+@@ -986,12 +983,11 @@ static void __init __efi_enter_virtual_mode(void)
+ efi_print_memmap();
+ }
+
+- BUG_ON(!efi.systab);
++ if (WARN_ON(!efi.systab))
++ goto err;
+
+- if (efi_setup_page_tables(pa, 1 << pg_shift)) {
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
+- }
++ if (efi_setup_page_tables(pa, 1 << pg_shift))
++ goto err;
+
+ efi_sync_low_kernel_mappings();
+
+@@ -1011,9 +1007,9 @@ static void __init __efi_enter_virtual_mode(void)
+ }
+
+ if (status != EFI_SUCCESS) {
+- pr_alert("Unable to switch EFI into virtual mode (status=%lx)!\n",
+- status);
+- panic("EFI call to SetVirtualAddressMap() failed!");
++ pr_err("Unable to switch EFI into virtual mode (status=%lx)!\n",
++ status);
++ goto err;
+ }
+
+ efi_free_boot_services();
+@@ -1042,6 +1038,10 @@ static void __init __efi_enter_virtual_mode(void)
+
+ /* clean DUMMY object */
+ efi_delete_dummy_variable();
++ return;
++
++err:
++ clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+ }
+
+ void __init efi_enter_virtual_mode(void)
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index 08ce8177c3af1..52a1e5192fa80 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -392,11 +392,12 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
+ return 0;
+
+ page = alloc_page(GFP_KERNEL|__GFP_DMA32);
+- if (!page)
+- panic("Unable to allocate EFI runtime stack < 4GB\n");
++ if (!page) {
++ pr_err("Unable to allocate EFI runtime stack < 4GB\n");
++ return 1;
++ }
+
+- efi_scratch.phys_stack = virt_to_phys(page_address(page));
+- efi_scratch.phys_stack += PAGE_SIZE; /* stack grows down */
++ efi_scratch.phys_stack = page_to_phys(page + 1); /* stack grows down */
+
+ npages = (_etext - _text) >> PAGE_SHIFT;
+ text = __pa(_text);
+--
+2.20.1
+
--- /dev/null
+From ae5ca470057be3eaf845dc12fa35eaabd31703ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:39:37 +0100
+Subject: efi/x86: Map the entire EFI vendor string before copying it
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit ffc2760bcf2dba0dbef74013ed73eea8310cc52c ]
+
+Fix a couple of issues with the way we map and copy the vendor string:
+- we map only 2 bytes, which usually works since you get at least a
+ page, but if the vendor string happens to cross a page boundary,
+ a crash will result
+- only call early_memunmap() if early_memremap() succeeded, or we will
+ call it with a NULL address which it doesn't like,
+- while at it, switch to early_memremap_ro(), and array indexing rather
+ than pointer dereferencing to read the CHAR16 characters.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: Matthew Garrett <mjg59@google.com>
+Cc: linux-efi@vger.kernel.org
+Fixes: 5b83683f32b1 ("x86: EFI runtime service support")
+Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 425e025341db9..8a4f389330396 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -504,7 +504,6 @@ void __init efi_init(void)
+ efi_char16_t *c16;
+ char vendor[100] = "unknown";
+ int i = 0;
+- void *tmp;
+
+ #ifdef CONFIG_X86_32
+ if (boot_params.efi_info.efi_systab_hi ||
+@@ -529,14 +528,16 @@ void __init efi_init(void)
+ /*
+ * Show what we know for posterity
+ */
+- c16 = tmp = early_memremap(efi.systab->fw_vendor, 2);
++ c16 = early_memremap_ro(efi.systab->fw_vendor,
++ sizeof(vendor) * sizeof(efi_char16_t));
+ if (c16) {
+- for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i)
+- vendor[i] = *c16++;
++ for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i)
++ vendor[i] = c16[i];
+ vendor[i] = '\0';
+- } else
++ early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
++ } else {
+ pr_err("Could not map the firmware vendor!\n");
+- early_memunmap(tmp, 2);
++ }
+
+ pr_info("EFI v%u.%.02u by %s\n",
+ efi.systab->hdr.revision >> 16,
+--
+2.20.1
+
--- /dev/null
+From 8cf5ed61d84c4f70bc66b905013de3957b4572d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Dec 2019 12:12:22 -0600
+Subject: ext4: fix deadlock allocating bio_post_read_ctx from mempool
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 68e45330e341dad2d3a0a3f8ef2ec46a2a0a3bbc ]
+
+Without any form of coordination, any case where multiple allocations
+from the same mempool are needed at a time to make forward progress can
+deadlock under memory pressure.
+
+This is the case for struct bio_post_read_ctx, as one can be allocated
+to decrypt a Merkle tree page during fsverity_verify_bio(), which itself
+is running from a post-read callback for a data bio which has its own
+struct bio_post_read_ctx.
+
+Fix this by freeing the first bio_post_read_ctx before calling
+fsverity_verify_bio(). This works because verity (if enabled) is always
+the last post-read step.
+
+This deadlock can be reproduced by trying to read from an encrypted
+verity file after reducing NUM_PREALLOC_POST_READ_CTXS to 1 and patching
+mempool_alloc() to pretend that pool->alloc() always fails.
+
+Note that since NUM_PREALLOC_POST_READ_CTXS is actually 128, to actually
+hit this bug in practice would require reading from lots of encrypted
+verity files at the same time. But it's theoretically possible, as N
+available objects isn't enough to guarantee forward progress when > N/2
+threads each need 2 objects at a time.
+
+Fixes: 22cfe4b48ccb ("ext4: add fs-verity read support")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Link: https://lore.kernel.org/r/20191231181222.47684-1-ebiggers@kernel.org
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/readpage.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ext4/readpage.c b/fs/ext4/readpage.c
+index a30b203fa461c..a5f55fece9b04 100644
+--- a/fs/ext4/readpage.c
++++ b/fs/ext4/readpage.c
+@@ -57,6 +57,7 @@ enum bio_post_read_step {
+ STEP_INITIAL = 0,
+ STEP_DECRYPT,
+ STEP_VERITY,
++ STEP_MAX,
+ };
+
+ struct bio_post_read_ctx {
+@@ -106,10 +107,22 @@ static void verity_work(struct work_struct *work)
+ {
+ struct bio_post_read_ctx *ctx =
+ container_of(work, struct bio_post_read_ctx, work);
++ struct bio *bio = ctx->bio;
+
+- fsverity_verify_bio(ctx->bio);
++ /*
++ * fsverity_verify_bio() may call readpages() again, and although verity
++ * will be disabled for that, decryption may still be needed, causing
++ * another bio_post_read_ctx to be allocated. So to guarantee that
++ * mempool_alloc() never deadlocks we must free the current ctx first.
++ * This is safe because verity is the last post-read step.
++ */
++ BUILD_BUG_ON(STEP_VERITY + 1 != STEP_MAX);
++ mempool_free(ctx, bio_post_read_ctx_pool);
++ bio->bi_private = NULL;
+
+- bio_post_read_processing(ctx);
++ fsverity_verify_bio(bio);
++
++ __read_end_io(bio);
+ }
+
+ static void bio_post_read_processing(struct bio_post_read_ctx *ctx)
+--
+2.20.1
+
--- /dev/null
+From 5f8186da7da7d544f35cb4d598b49a24377efbef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:25:55 +0530
+Subject: ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+[ Upstream commit f629afe3369e9885fd6e9cc7a4f514b6a65cf9e9 ]
+
+Apparently our current rwsem code doesn't like doing the trylock, then
+lock for real scheme. So change our dax read/write methods to just do the
+trylock for the RWF_NOWAIT case.
+This seems to fix AIM7 regression in some scalable filesystems upto ~25%
+in some cases. Claimed in commit 942491c9e6d6 ("xfs: fix AIM7 regression")
+
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
+Tested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Link: https://lore.kernel.org/r/20191212055557.11151-2-riteshh@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/file.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index 8d2bbcc2d8133..fd7ce3573a00a 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -40,9 +40,10 @@ static ssize_t ext4_dax_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ struct inode *inode = file_inode(iocb->ki_filp);
+ ssize_t ret;
+
+- if (!inode_trylock_shared(inode)) {
+- if (iocb->ki_flags & IOCB_NOWAIT)
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock_shared(inode))
+ return -EAGAIN;
++ } else {
+ inode_lock_shared(inode);
+ }
+ /*
+@@ -190,9 +191,10 @@ ext4_dax_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct inode *inode = file_inode(iocb->ki_filp);
+ ssize_t ret;
+
+- if (!inode_trylock(inode)) {
+- if (iocb->ki_flags & IOCB_NOWAIT)
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock(inode))
+ return -EAGAIN;
++ } else {
+ inode_lock(inode);
+ }
+ ret = ext4_write_checks(iocb, from);
+--
+2.20.1
+
--- /dev/null
+From 3e9a87b1f57391737b44e560314373acbb2c7067 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:12 +0800
+Subject: ext4, jbd2: ensure panic when aborting with zero errno
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit 51f57b01e4a3c7d7bdceffd84de35144e8c538e7 ]
+
+JBD2_REC_ERR flag used to indicate the errno has been updated when jbd2
+aborted, and then __ext4_abort() and ext4_handle_error() can invoke
+panic if ERRORS_PANIC is specified. But if the journal has been aborted
+with zero errno, jbd2_journal_abort() didn't set this flag so we can
+no longer panic. Fix this by always record the proper errno in the
+journal superblock.
+
+Fixes: 4327ba52afd03 ("ext4, jbd2: ensure entering into panic after recording an error in superblock")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-3-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/checkpoint.c | 2 +-
+ fs/jbd2/journal.c | 15 ++++-----------
+ 2 files changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index a1909066bde66..62cf497f18eb4 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -164,7 +164,7 @@ void __jbd2_log_wait_for_space(journal_t *journal)
+ "journal space in %s\n", __func__,
+ journal->j_devname);
+ WARN_ON(1);
+- jbd2_journal_abort(journal, 0);
++ jbd2_journal_abort(journal, -EIO);
+ }
+ write_lock(&journal->j_state_lock);
+ } else {
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 389c9be4e7919..65e78d3a2f64c 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2123,12 +2123,10 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ __jbd2_journal_abort_hard(journal);
+
+- if (errno) {
+- jbd2_journal_update_sb_errno(journal);
+- write_lock(&journal->j_state_lock);
+- journal->j_flags |= JBD2_REC_ERR;
+- write_unlock(&journal->j_state_lock);
+- }
++ jbd2_journal_update_sb_errno(journal);
++ write_lock(&journal->j_state_lock);
++ journal->j_flags |= JBD2_REC_ERR;
++ write_unlock(&journal->j_state_lock);
+ }
+
+ /**
+@@ -2170,11 +2168,6 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+ * failure to disk. ext3_error, for example, now uses this
+ * functionality.
+ *
+- * Errors which originate from within the journaling layer will NOT
+- * supply an errno; a null errno implies that absolutely no further
+- * writes are done to the journal (unless there are any already in
+- * progress).
+- *
+ */
+
+ void jbd2_journal_abort(journal_t *journal, int errno)
+--
+2.20.1
+
--- /dev/null
+From 8982357a6693448ee87f7d2ac5b82b26055d2f60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 15:53:16 -0800
+Subject: f2fs: call f2fs_balance_fs outside of locked page
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit bdf03299248916640a835a05d32841bb3d31912d ]
+
+Otherwise, we can hit deadlock by waiting for the locked page in
+move_data_block in GC.
+
+ Thread A Thread B
+ - do_page_mkwrite
+ - f2fs_vm_page_mkwrite
+ - lock_page
+ - f2fs_balance_fs
+ - mutex_lock(gc_mutex)
+ - f2fs_gc
+ - do_garbage_collect
+ - ra_data_block
+ - grab_cache_page
+ - f2fs_balance_fs
+ - mutex_lock(gc_mutex)
+
+Fixes: 39a8695824510 ("f2fs: refactor ->page_mkwrite() flow")
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 44bc5f4a9ce19..c3a9da79ac997 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -50,7 +50,7 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+ struct page *page = vmf->page;
+ struct inode *inode = file_inode(vmf->vma->vm_file);
+ struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+- struct dnode_of_data dn = { .node_changed = false };
++ struct dnode_of_data dn;
+ int err;
+
+ if (unlikely(f2fs_cp_error(sbi))) {
+@@ -63,6 +63,9 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+ goto err;
+ }
+
++ /* should do out of any locked page */
++ f2fs_balance_fs(sbi, true);
++
+ sb_start_pagefault(inode->i_sb);
+
+ f2fs_bug_on(sbi, f2fs_has_inline_data(inode));
+@@ -120,8 +123,6 @@ static vm_fault_t f2fs_vm_page_mkwrite(struct vm_fault *vmf)
+ out_sem:
+ up_read(&F2FS_I(inode)->i_mmap_sem);
+
+- f2fs_balance_fs(sbi, dn.node_changed);
+-
+ sb_end_pagefault(inode->i_sb);
+ err:
+ return block_page_mkwrite_return(err);
+--
+2.20.1
+
--- /dev/null
+From b3c62c06746558e80a3af67a227323e1d0c1a3bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 17:41:41 +0800
+Subject: f2fs: fix memleak of kobject
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit fe396ad8e7526f059f7b8c7290d33a1b84adacab ]
+
+If kobject_init_and_add() failed, caller needs to invoke kobject_put()
+to release kobject explicitly.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 8544c0ab7b32b..170934430d7d7 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -729,10 +729,12 @@ int __init f2fs_init_sysfs(void)
+
+ ret = kobject_init_and_add(&f2fs_feat, &f2fs_feat_ktype,
+ NULL, "features");
+- if (ret)
++ if (ret) {
++ kobject_put(&f2fs_feat);
+ kset_unregister(&f2fs_kset);
+- else
++ } else {
+ f2fs_proc_root = proc_mkdir("fs/f2fs", NULL);
++ }
+ return ret;
+ }
+
+@@ -753,8 +755,11 @@ int f2fs_register_sysfs(struct f2fs_sb_info *sbi)
+ init_completion(&sbi->s_kobj_unregister);
+ err = kobject_init_and_add(&sbi->s_kobj, &f2fs_sb_ktype, NULL,
+ "%s", sb->s_id);
+- if (err)
++ if (err) {
++ kobject_put(&sbi->s_kobj);
++ wait_for_completion(&sbi->s_kobj_unregister);
+ return err;
++ }
+
+ if (f2fs_proc_root)
+ sbi->s_proc = proc_mkdir(sb->s_id, f2fs_proc_root);
+--
+2.20.1
+
--- /dev/null
+From 5b0ff9e769388a567451fb5a4964b0c6a82d0cef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 18:32:16 -0800
+Subject: f2fs: free sysfs kobject
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 820d366736c949ffe698d3b3fe1266a91da1766d ]
+
+Detected kmemleak.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index b558b64a4c9ca..8544c0ab7b32b 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -782,4 +782,5 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi)
+ remove_proc_entry(sbi->sb->s_id, f2fs_proc_root);
+ }
+ kobject_del(&sbi->s_kobj);
++ kobject_put(&sbi->s_kobj);
+ }
+--
+2.20.1
+
--- /dev/null
+From 8f23140b979b1a971e096ee1de8017487eb6ad8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Nov 2019 15:01:42 -0800
+Subject: f2fs: preallocate DIO blocks when forcing buffered_io
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 47501f87c61ad2aa234add63e1ae231521dbc3f5 ]
+
+The previous preallocation and DIO decision like below.
+
+ allow_outplace_dio !allow_outplace_dio
+f2fs_force_buffered_io (*) No_Prealloc / Buffered_IO Prealloc / Buffered_IO
+!f2fs_force_buffered_io No_Prealloc / DIO Prealloc / DIO
+
+But, Javier reported Case (*) where zoned device bypassed preallocation but
+fell back to buffered writes in f2fs_direct_IO(), resulting in stale data
+being read.
+
+In order to fix the issue, actually we need to preallocate blocks whenever
+we fall back to buffered IO like this. No change is made in the other cases.
+
+ allow_outplace_dio !allow_outplace_dio
+f2fs_force_buffered_io (*) Prealloc / Buffered_IO Prealloc / Buffered_IO
+!f2fs_force_buffered_io No_Prealloc / DIO Prealloc / DIO
+
+Reported-and-tested-by: Javier Gonzalez <javier@javigon.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Reviewed-by: Javier González <javier@javigon.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/data.c | 13 -------------
+ fs/f2fs/file.c | 43 +++++++++++++++++++++++++++++++++----------
+ 2 files changed, 33 insertions(+), 23 deletions(-)
+
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index 2e9c731658008..5d6fd940aab2e 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -1074,19 +1074,6 @@ int f2fs_preallocate_blocks(struct kiocb *iocb, struct iov_iter *from)
+ int err = 0;
+ bool direct_io = iocb->ki_flags & IOCB_DIRECT;
+
+- /* convert inline data for Direct I/O*/
+- if (direct_io) {
+- err = f2fs_convert_inline_inode(inode);
+- if (err)
+- return err;
+- }
+-
+- if (direct_io && allow_outplace_dio(inode, iocb, from))
+- return 0;
+-
+- if (is_inode_flag_set(inode, FI_NO_PREALLOC))
+- return 0;
+-
+ map.m_lblk = F2FS_BLK_ALIGN(iocb->ki_pos);
+ map.m_len = F2FS_BYTES_TO_BLK(iocb->ki_pos + iov_iter_count(from));
+ if (map.m_len > map.m_lblk)
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 72f308790a8e5..44bc5f4a9ce19 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -3348,18 +3348,41 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ ret = -EAGAIN;
+ goto out;
+ }
+- } else {
+- preallocated = true;
+- target_size = iocb->ki_pos + iov_iter_count(from);
++ goto write;
++ }
+
+- err = f2fs_preallocate_blocks(iocb, from);
+- if (err) {
+- clear_inode_flag(inode, FI_NO_PREALLOC);
+- inode_unlock(inode);
+- ret = err;
+- goto out;
+- }
++ if (is_inode_flag_set(inode, FI_NO_PREALLOC))
++ goto write;
++
++ if (iocb->ki_flags & IOCB_DIRECT) {
++ /*
++ * Convert inline data for Direct I/O before entering
++ * f2fs_direct_IO().
++ */
++ err = f2fs_convert_inline_inode(inode);
++ if (err)
++ goto out_err;
++ /*
++ * If force_buffere_io() is true, we have to allocate
++ * blocks all the time, since f2fs_direct_IO will fall
++ * back to buffered IO.
++ */
++ if (!f2fs_force_buffered_io(inode, iocb, from) &&
++ allow_outplace_dio(inode, iocb, from))
++ goto write;
++ }
++ preallocated = true;
++ target_size = iocb->ki_pos + iov_iter_count(from);
++
++ err = f2fs_preallocate_blocks(iocb, from);
++ if (err) {
++out_err:
++ clear_inode_flag(inode, FI_NO_PREALLOC);
++ inode_unlock(inode);
++ ret = err;
++ goto out;
+ }
++write:
+ ret = __generic_file_write_iter(iocb, from);
+ clear_inode_flag(inode, FI_NO_PREALLOC);
+
+--
+2.20.1
+
--- /dev/null
+From 84d04276c0b47d8ff83444681f7b23ac8829bbad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:59:58 -0800
+Subject: f2fs: set I_LINKABLE early to avoid wrong access by vfs
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 5b1dbb082f196278f82b6a15a13848efacb9ff11 ]
+
+This patch moves setting I_LINKABLE early in rename2(whiteout) to avoid the
+below warning.
+
+[ 3189.163385] WARNING: CPU: 3 PID: 59523 at fs/inode.c:358 inc_nlink+0x32/0x40
+[ 3189.246979] Call Trace:
+[ 3189.248707] f2fs_init_inode_metadata+0x2d6/0x440 [f2fs]
+[ 3189.251399] f2fs_add_inline_entry+0x162/0x8c0 [f2fs]
+[ 3189.254010] f2fs_add_dentry+0x69/0xe0 [f2fs]
+[ 3189.256353] f2fs_do_add_link+0xc5/0x100 [f2fs]
+[ 3189.258774] f2fs_rename2+0xabf/0x1010 [f2fs]
+[ 3189.261079] vfs_rename+0x3f8/0xaa0
+[ 3189.263056] ? tomoyo_path_rename+0x44/0x60
+[ 3189.265283] ? do_renameat2+0x49b/0x550
+[ 3189.267324] do_renameat2+0x49b/0x550
+[ 3189.269316] __x64_sys_renameat2+0x20/0x30
+[ 3189.271441] do_syscall_64+0x5a/0x230
+[ 3189.273410] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 3189.275848] RIP: 0033:0x7f270b4d9a49
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/namei.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index a1c507b0b4ac4..5d9584281935f 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -797,6 +797,7 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry,
+
+ if (whiteout) {
+ f2fs_i_links_write(inode, false);
++ inode->i_state |= I_LINKABLE;
+ *whiteout = inode;
+ } else {
+ d_tmpfile(dentry, inode);
+@@ -867,6 +868,12 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ F2FS_I(old_dentry->d_inode)->i_projid)))
+ return -EXDEV;
+
++ if (flags & RENAME_WHITEOUT) {
++ err = f2fs_create_whiteout(old_dir, &whiteout);
++ if (err)
++ return err;
++ }
++
+ err = dquot_initialize(old_dir);
+ if (err)
+ goto out;
+@@ -898,17 +905,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ }
+ }
+
+- if (flags & RENAME_WHITEOUT) {
+- err = f2fs_create_whiteout(old_dir, &whiteout);
+- if (err)
+- goto out_dir;
+- }
+-
+ if (new_inode) {
+
+ err = -ENOTEMPTY;
+ if (old_dir_entry && !f2fs_empty_dir(new_inode))
+- goto out_whiteout;
++ goto out_dir;
+
+ err = -ENOENT;
+ new_entry = f2fs_find_entry(new_dir, &new_dentry->d_name,
+@@ -916,7 +917,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (!new_entry) {
+ if (IS_ERR(new_page))
+ err = PTR_ERR(new_page);
+- goto out_whiteout;
++ goto out_dir;
+ }
+
+ f2fs_balance_fs(sbi, true);
+@@ -948,7 +949,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ err = f2fs_add_link(new_dentry, old_inode);
+ if (err) {
+ f2fs_unlock_op(sbi);
+- goto out_whiteout;
++ goto out_dir;
+ }
+
+ if (old_dir_entry)
+@@ -972,7 +973,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (IS_ERR(old_page))
+ err = PTR_ERR(old_page);
+ f2fs_unlock_op(sbi);
+- goto out_whiteout;
++ goto out_dir;
+ }
+ }
+ }
+@@ -991,7 +992,6 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ f2fs_delete_entry(old_entry, old_page, old_dir, NULL);
+
+ if (whiteout) {
+- whiteout->i_state |= I_LINKABLE;
+ set_inode_flag(whiteout, FI_INC_LINK);
+ err = f2fs_add_link(old_dentry, whiteout);
+ if (err)
+@@ -1027,15 +1027,14 @@ put_out_dir:
+ f2fs_unlock_op(sbi);
+ if (new_page)
+ f2fs_put_page(new_page, 0);
+-out_whiteout:
+- if (whiteout)
+- iput(whiteout);
+ out_dir:
+ if (old_dir_entry)
+ f2fs_put_page(old_dir_page, 0);
+ out_old:
+ f2fs_put_page(old_page, 0);
+ out:
++ if (whiteout)
++ iput(whiteout);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9c51184264a88a4f341594b1350260c79004f183 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 11:09:16 +0000
+Subject: fbdev: fix numbering of fbcon options
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit fd933c00ebe220060e66fb136a7050a242456566 ]
+
+Three shall be the number thou shalt count, and the number of the
+counting shall be three. Four shalt thou not count...
+
+One! Two! Five!
+
+Fixes: efb985f6b265 ("[PATCH] fbcon: Console Rotation - Add framebuffer console documentation")
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Jonathan Corbet <corbet@lwn.net>
+Cc: Matthew Wilcox <willy@infradead.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190827110854.12574-2-peda@axentia.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/fb/fbcon.rst | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/Documentation/fb/fbcon.rst b/Documentation/fb/fbcon.rst
+index ebca41785abea..65ba402551374 100644
+--- a/Documentation/fb/fbcon.rst
++++ b/Documentation/fb/fbcon.rst
+@@ -127,7 +127,7 @@ C. Boot options
+ is typically located on the same video card. Thus, the consoles that
+ are controlled by the VGA console will be garbled.
+
+-4. fbcon=rotate:<n>
++5. fbcon=rotate:<n>
+
+ This option changes the orientation angle of the console display. The
+ value 'n' accepts the following:
+@@ -152,21 +152,21 @@ C. Boot options
+ Actually, the underlying fb driver is totally ignorant of console
+ rotation.
+
+-5. fbcon=margin:<color>
++6. fbcon=margin:<color>
+
+ This option specifies the color of the margins. The margins are the
+ leftover area at the right and the bottom of the screen that are not
+ used by text. By default, this area will be black. The 'color' value
+ is an integer number that depends on the framebuffer driver being used.
+
+-6. fbcon=nodefer
++7. fbcon=nodefer
+
+ If the kernel is compiled with deferred fbcon takeover support, normally
+ the framebuffer contents, left in place by the firmware/bootloader, will
+ be preserved until there actually is some text is output to the console.
+ This option causes fbcon to bind immediately to the fbdev device.
+
+-7. fbcon=logo-pos:<location>
++8. fbcon=logo-pos:<location>
+
+ The only possible 'location' is 'center' (without quotes), and when
+ given, the bootup logo is moved from the default top-left corner
+--
+2.20.1
+
--- /dev/null
+From c9a41406ac1c7da03727ad3dac39d37dd53fd29c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 10:14:51 -0600
+Subject: fore200e: Fix incorrect checks of NULL pointer dereference
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit bbd20c939c8aa3f27fa30e86691af250bf92973a ]
+
+In fore200e_send and fore200e_close, the pointers from the arguments
+are dereferenced in the variable declaration block and then checked
+for NULL. The patch fixes these issues by avoiding NULL pointer
+dereferences.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/fore200e.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
+index f1a5002053132..8fbd36eb89410 100644
+--- a/drivers/atm/fore200e.c
++++ b/drivers/atm/fore200e.c
+@@ -1414,12 +1414,14 @@ fore200e_open(struct atm_vcc *vcc)
+ static void
+ fore200e_close(struct atm_vcc* vcc)
+ {
+- struct fore200e* fore200e = FORE200E_DEV(vcc->dev);
+ struct fore200e_vcc* fore200e_vcc;
++ struct fore200e* fore200e;
+ struct fore200e_vc_map* vc_map;
+ unsigned long flags;
+
+ ASSERT(vcc);
++ fore200e = FORE200E_DEV(vcc->dev);
++
+ ASSERT((vcc->vpi >= 0) && (vcc->vpi < 1<<FORE200E_VPI_BITS));
+ ASSERT((vcc->vci >= 0) && (vcc->vci < 1<<FORE200E_VCI_BITS));
+
+@@ -1464,10 +1466,10 @@ fore200e_close(struct atm_vcc* vcc)
+ static int
+ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+- struct fore200e* fore200e = FORE200E_DEV(vcc->dev);
+- struct fore200e_vcc* fore200e_vcc = FORE200E_VCC(vcc);
++ struct fore200e* fore200e;
++ struct fore200e_vcc* fore200e_vcc;
+ struct fore200e_vc_map* vc_map;
+- struct host_txq* txq = &fore200e->host_txq;
++ struct host_txq* txq;
+ struct host_txq_entry* entry;
+ struct tpd* tpd;
+ struct tpd_haddr tpd_haddr;
+@@ -1480,9 +1482,18 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ unsigned char* data;
+ unsigned long flags;
+
+- ASSERT(vcc);
+- ASSERT(fore200e);
+- ASSERT(fore200e_vcc);
++ if (!vcc)
++ return -EINVAL;
++
++ fore200e = FORE200E_DEV(vcc->dev);
++ fore200e_vcc = FORE200E_VCC(vcc);
++
++ if (!fore200e)
++ return -EINVAL;
++
++ txq = &fore200e->host_txq;
++ if (!fore200e_vcc)
++ return -EINVAL;
+
+ if (!test_bit(ATM_VF_READY, &vcc->flags)) {
+ DPRINTK(1, "VC %d.%d.%d not ready for tx\n", vcc->itf, vcc->vpi, vcc->vpi);
+--
+2.20.1
+
--- /dev/null
+From f6459c2c275c8e2a4b48460d0a9de0dd7e92ad68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 10:02:56 +0300
+Subject: ftrace: fpid_next() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit e4075e8bdffd93a9b6d6e1d52fabedceeca5a91b ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+Without patch:
+ # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid
+ dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset
+ id
+ no pid
+ 2+1 records in
+ 2+1 records out
+ 10 bytes copied, 0.000213285 s, 46.9 kB/s
+
+Notice the "id" followed by "no pid".
+
+With the patch:
+ # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid
+ dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset
+ id
+ 0+1 records in
+ 0+1 records out
+ 3 bytes copied, 0.000202112 s, 14.8 kB/s
+
+Notice that it only prints "id" and not the "no pid" afterward.
+
+Link: http://lkml.kernel.org/r/4f87c6ad-f114-30bb-8506-c32274ce2992@virtuozzo.com
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 407d8bf4ed93e..15160d707da45 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -6537,9 +6537,10 @@ static void *fpid_next(struct seq_file *m, void *v, loff_t *pos)
+ struct trace_array *tr = m->private;
+ struct trace_pid_list *pid_list = rcu_dereference_sched(tr->function_pids);
+
+- if (v == FTRACE_NO_PIDS)
++ if (v == FTRACE_NO_PIDS) {
++ (*pos)++;
+ return NULL;
+-
++ }
+ return trace_pid_next(pid_list, v, pos);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5787aff6bdf133ec51281eefb9502735849bb526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 16:39:28 +0100
+Subject: fuse: don't overflow LLONG_MAX with end offset
+
+From: Miklos Szeredi <mszeredi@redhat.com>
+
+[ Upstream commit 2f1398291bf35fe027914ae7a9610d8e601fbfde ]
+
+Handle the special case of fuse_readpages() wanting to read the last page
+of a hugest file possible and overflowing the end offset in the process.
+
+This is basically to unbreak xfstests:generic/525 and prevent filesystems
+from doing bad things with an overflowing offset.
+
+Reported-by: Xiao Yang <ice_yangxiao@163.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/fuse/file.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 695369f46f92d..3dd37a998ea93 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -803,6 +803,10 @@ static int fuse_do_readpage(struct file *file, struct page *page)
+
+ attr_ver = fuse_get_attr_version(fc);
+
++ /* Don't overflow end offset */
++ if (pos + (desc.length - 1) == LLONG_MAX)
++ desc.length--;
++
+ fuse_read_args_fill(&ia, file, pos, desc.length, FUSE_READ);
+ res = fuse_simple_request(fc, &ia.ap.args);
+ if (res < 0)
+@@ -888,6 +892,14 @@ static void fuse_send_readpages(struct fuse_io_args *ia, struct file *file)
+ ap->args.out_pages = true;
+ ap->args.page_zeroing = true;
+ ap->args.page_replace = true;
++
++ /* Don't overflow end offset */
++ if (pos + (count - 1) == LLONG_MAX) {
++ count--;
++ ap->descs[ap->num_pages - 1].length--;
++ }
++ WARN_ON((loff_t) (pos + count) < 0);
++
+ fuse_read_args_fill(ia, file, pos, count, FUSE_READ);
+ ia->read.attr_ver = fuse_get_attr_version(fc);
+ if (fc->async_read) {
+--
+2.20.1
+
--- /dev/null
+From 8340537fcada3b3a53808ce3739f6e7d0b8863ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 15:30:45 +0200
+Subject: gianfar: Fix TX timestamping with a stacked DSA driver
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit c26a2c2ddc0115eb088873f5c309cf46b982f522 ]
+
+The driver wrongly assumes that it is the only entity that can set the
+SKBTX_IN_PROGRESS bit of the current skb. Therefore, in the
+gfar_clean_tx_ring function, where the TX timestamp is collected if
+necessary, the aforementioned bit is used to discriminate whether or not
+the TX timestamp should be delivered to the socket's error queue.
+
+But a stacked driver such as a DSA switch can also set the
+SKBTX_IN_PROGRESS bit, which is actually exactly what it should do in
+order to denote that the hardware timestamping process is undergoing.
+
+Therefore, gianfar would misinterpret the "in progress" bit as being its
+own, and deliver a second skb clone in the socket's error queue,
+completely throwing off a PTP process which is not expecting to receive
+it, _even though_ TX timestamping is not enabled for gianfar.
+
+There have been discussions [0] as to whether non-MAC drivers need or
+not to set SKBTX_IN_PROGRESS at all (whose purpose is to avoid sending 2
+timestamps, a sw and a hw one, to applications which only expect one).
+But as of this patch, there are at least 2 PTP drivers that would break
+in conjunction with gianfar: the sja1105 DSA switch and the felix
+switch, by way of its ocelot core driver.
+
+So regardless of that conclusion, fix the gianfar driver to not do stuff
+based on flags set by others and not intended for it.
+
+[0]: https://www.spinics.net/lists/netdev/msg619699.html
+
+Fixes: f0ee7acfcdd4 ("gianfar: Add hardware TX timestamping support")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 51ad86417cb13..2580bcd850253 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2204,13 +2204,17 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ skb_dirtytx = tx_queue->skb_dirtytx;
+
+ while ((skb = tx_queue->tx_skbuff[skb_dirtytx])) {
++ bool do_tstamp;
++
++ do_tstamp = (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
++ priv->hwts_tx_en;
+
+ frags = skb_shinfo(skb)->nr_frags;
+
+ /* When time stamping, one additional TxBD must be freed.
+ * Also, we need to dma_unmap_single() the TxPAL.
+ */
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS))
++ if (unlikely(do_tstamp))
+ nr_txbds = frags + 2;
+ else
+ nr_txbds = frags + 1;
+@@ -2224,7 +2228,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ (lstatus & BD_LENGTH_MASK))
+ break;
+
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++ if (unlikely(do_tstamp)) {
+ next = next_txbd(bdp, base, tx_ring_size);
+ buflen = be16_to_cpu(next->length) +
+ GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+@@ -2234,7 +2238,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ dma_unmap_single(priv->dev, be32_to_cpu(bdp->bufPtr),
+ buflen, DMA_TO_DEVICE);
+
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++ if (unlikely(do_tstamp)) {
+ struct skb_shared_hwtstamps shhwtstamps;
+ u64 *ns = (u64 *)(((uintptr_t)skb->data + 0x10) &
+ ~0x7UL);
+--
+2.20.1
+
--- /dev/null
+From fb9e284e8858ba087bf24862639d7dd139edf8cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 21:26:05 +0800
+Subject: gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in
+ grgpio_irq_map/unmap()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit e36eaf94be8f7bc4e686246eed3cf92d845e2ef8 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/gpio/gpio-grgpio.c, 261:
+ request_irq in grgpio_irq_map
+drivers/gpio/gpio-grgpio.c, 255:
+ _raw_spin_lock_irqsave in grgpio_irq_map
+
+drivers/gpio/gpio-grgpio.c, 318:
+ free_irq in grgpio_irq_unmap
+drivers/gpio/gpio-grgpio.c, 299:
+ _raw_spin_lock_irqsave in grgpio_irq_unmap
+
+request_irq() and free_irq() can sleep at runtime.
+
+To fix these bugs, request_irq() and free_irq() are called without
+holding the spinlock.
+
+These bugs are found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20191218132605.10594-1-baijiaju1990@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-grgpio.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
+index 08234e64993a9..3224933f4c8f4 100644
+--- a/drivers/gpio/gpio-grgpio.c
++++ b/drivers/gpio/gpio-grgpio.c
+@@ -253,17 +253,16 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
+ lirq->irq = irq;
+ uirq = &priv->uirqs[lirq->index];
+ if (uirq->refcnt == 0) {
++ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ ret = request_irq(uirq->uirq, grgpio_irq_handler, 0,
+ dev_name(priv->dev), priv);
+ if (ret) {
+ dev_err(priv->dev,
+ "Could not request underlying irq %d\n",
+ uirq->uirq);
+-
+- spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+-
+ return ret;
+ }
++ spin_lock_irqsave(&priv->gc.bgpio_lock, flags);
+ }
+ uirq->refcnt++;
+
+@@ -309,8 +308,11 @@ static void grgpio_irq_unmap(struct irq_domain *d, unsigned int irq)
+ if (index >= 0) {
+ uirq = &priv->uirqs[lirq->index];
+ uirq->refcnt--;
+- if (uirq->refcnt == 0)
++ if (uirq->refcnt == 0) {
++ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ free_irq(uirq->uirq, priv);
++ return;
++ }
+ }
+
+ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+--
+2.20.1
+
--- /dev/null
+From 2910484a52d27732767039b2f23c73e827cee755 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 15:11:03 -0800
+Subject: gpiolib: Set lockdep class for hierarchical irq domains
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit c34f6dc8c9e6bbe9fba1d53acd6d9a3889599da3 ]
+
+I see the following lockdep splat in the qcom pinctrl driver when
+attempting to suspend the device.
+
+ ============================================
+ WARNING: possible recursive locking detected
+ 5.4.2 #2 Tainted: G S
+ --------------------------------------------
+ cat/6536 is trying to acquire lock:
+ ffffff814787ccc0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94
+
+ but task is already holding lock:
+ ffffff81436740c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&irq_desc_lock_class);
+ lock(&irq_desc_lock_class);
+
+ *** DEADLOCK ***
+
+ May be due to missing lock nesting notation
+
+ 7 locks held by cat/6536:
+ #0: ffffff8140e0c420 (sb_writers#7){.+.+}, at: vfs_write+0xc8/0x19c
+ #1: ffffff8121eec480 (&of->mutex){+.+.}, at: kernfs_fop_write+0x128/0x1f4
+ #2: ffffff8147cad668 (kn->count#263){.+.+}, at: kernfs_fop_write+0x130/0x1f4
+ #3: ffffffd011446000 (system_transition_mutex){+.+.}, at: pm_suspend+0x108/0x354
+ #4: ffffff814302b970 (&dev->mutex){....}, at: __device_suspend+0x16c/0x420
+ #5: ffffff81436740c0 (&irq_desc_lock_class){-.-.}, at: __irq_get_desc_lock+0x64/0x94
+ #6: ffffff81479b8c10 (&pctrl->lock){....}, at: msm_gpio_irq_set_wake+0x48/0x7c
+
+ stack backtrace:
+ CPU: 4 PID: 6536 Comm: cat Tainted: G S 5.4.2 #2
+ Call trace:
+ dump_backtrace+0x0/0x174
+ show_stack+0x20/0x2c
+ dump_stack+0xdc/0x144
+ __lock_acquire+0x52c/0x2268
+ lock_acquire+0x1dc/0x220
+ _raw_spin_lock_irqsave+0x64/0x80
+ __irq_get_desc_lock+0x64/0x94
+ irq_set_irq_wake+0x40/0x144
+ msm_gpio_irq_set_wake+0x5c/0x7c
+ set_irq_wake_real+0x40/0x5c
+ irq_set_irq_wake+0x70/0x144
+ cros_ec_rtc_suspend+0x38/0x4c
+ platform_pm_suspend+0x34/0x60
+ dpm_run_callback+0x64/0xcc
+ __device_suspend+0x314/0x420
+ dpm_suspend+0xf8/0x298
+ dpm_suspend_start+0x84/0xb4
+ suspend_devices_and_enter+0xbc/0x628
+ pm_suspend+0x214/0x354
+ state_store+0xb0/0x108
+ kobj_attr_store+0x14/0x24
+ sysfs_kf_write+0x4c/0x64
+ kernfs_fop_write+0x158/0x1f4
+ __vfs_write+0x54/0x18c
+ vfs_write+0xdc/0x19c
+ ksys_write+0x7c/0xe4
+ __arm64_sys_write+0x20/0x2c
+ el0_svc_common+0xa8/0x160
+ el0_svc_compat_handler+0x2c/0x38
+ el0_svc_compat+0x8/0x10
+
+This is because the msm_gpio_irq_set_wake() function calls
+irq_set_irq_wake() as a backup in case the irq comes in during the path
+to idle. Given that we're calling irqchip functions from within an
+irqchip we need to set the lockdep class to be different for this child
+controller vs. the default one that the parent irqchip gets.
+
+This used to be done before this driver was converted to hierarchical
+irq domains in commit e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in
+hierarchy") via the gpiochip_irq_map() function. With hierarchical irq
+domains this function has been replaced by
+gpiochip_hierarchy_irq_domain_alloc(). Therefore, set the lockdep class
+like was done previously in the irq domain path so we can avoid this
+lockdep warning.
+
+Fixes: fdd61a013a24 ("gpio: Add support for hierarchical IRQ domains")
+Cc: Thierry Reding <treding@nvidia.com>
+Cc: Brian Masney <masneyb@onstation.org>
+Cc: Lina Iyer <ilina@codeaurora.org>
+Cc: Marc Zyngier <maz@kernel.org>
+Cc: Maulik Shah <mkshah@codeaurora.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20200114231103.85641-1-swboyd@chromium.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 22506e4614b3f..484fa6560adcd 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -1924,6 +1924,7 @@ static int gpiochip_hierarchy_irq_domain_alloc(struct irq_domain *d,
+ parent_type);
+ chip_info(gc, "alloc_irqs_parent for %d parent hwirq %d\n",
+ irq, parent_hwirq);
++ irq_set_lockdep_class(irq, gc->irq.lock_key, gc->irq.request_key);
+ ret = irq_domain_alloc_irqs_parent(d, irq, 1, &parent_fwspec);
+ if (ret)
+ chip_err(gc,
+--
+2.20.1
+
--- /dev/null
+From f015b61552aebdd1581d5a9b183946f07bb3bdae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 15:41:38 +0100
+Subject: gpu/drm: ingenic: Avoid null pointer deference in plane atomic update
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit 354b051c5dcbeb35bbfd5d54161364fc7a75a58a ]
+
+It is possible that there is no drm_framebuffer associated with a given
+plane state.
+
+v2: Handle drm_plane->state which can be NULL too
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191210144142.33143-2-paul@crapouillou.net
+# *** extracted tags ***
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ingenic/ingenic-drm.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/ingenic/ingenic-drm.c b/drivers/gpu/drm/ingenic/ingenic-drm.c
+index 2e2ed653e9c6b..f156f245fdecf 100644
+--- a/drivers/gpu/drm/ingenic/ingenic-drm.c
++++ b/drivers/gpu/drm/ingenic/ingenic-drm.c
+@@ -371,14 +371,18 @@ static void ingenic_drm_plane_atomic_update(struct drm_plane *plane,
+ struct ingenic_drm *priv = drm_plane_get_priv(plane);
+ struct drm_plane_state *state = plane->state;
+ unsigned int width, height, cpp;
++ dma_addr_t addr;
+
+- width = state->crtc->state->adjusted_mode.hdisplay;
+- height = state->crtc->state->adjusted_mode.vdisplay;
+- cpp = state->fb->format->cpp[plane->index];
++ if (state && state->fb) {
++ addr = drm_fb_cma_get_gem_addr(state->fb, state, 0);
++ width = state->crtc->state->adjusted_mode.hdisplay;
++ height = state->crtc->state->adjusted_mode.vdisplay;
++ cpp = state->fb->format->cpp[plane->index];
+
+- priv->dma_hwdesc->addr = drm_fb_cma_get_gem_addr(state->fb, state, 0);
+- priv->dma_hwdesc->cmd = width * height * cpp / 4;
+- priv->dma_hwdesc->cmd |= JZ_LCD_CMD_EOF_IRQ;
++ priv->dma_hwdesc->addr = addr;
++ priv->dma_hwdesc->cmd = width * height * cpp / 4;
++ priv->dma_hwdesc->cmd |= JZ_LCD_CMD_EOF_IRQ;
++ }
+ }
+
+ static void ingenic_drm_encoder_atomic_mode_set(struct drm_encoder *encoder,
+--
+2.20.1
+
--- /dev/null
+From f067059890dbc3960fade370190a9052c0c670cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 09:10:47 +0300
+Subject: help_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 9f198a2ac543eaaf47be275531ad5cbd50db3edf ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/orangefs-debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
+index 25543a966c486..29eaa45443727 100644
+--- a/fs/orangefs/orangefs-debugfs.c
++++ b/fs/orangefs/orangefs-debugfs.c
+@@ -273,6 +273,7 @@ static void *help_start(struct seq_file *m, loff_t *pos)
+
+ static void *help_next(struct seq_file *m, void *v, loff_t *pos)
+ {
++ (*pos)++;
+ gossip_debug(GOSSIP_DEBUGFS_DEBUG, "help_next: start\n");
+
+ return NULL;
+--
+2.20.1
+
--- /dev/null
+From c9f924d1e03ba9732af30b947f2b0868e07ec9f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:15:46 -0700
+Subject: hostap: Adjust indentation in prism2_hostapd_add_sta
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b61156fba74f659d0bc2de8f2dbf5bad9f4b8faf ]
+
+Clang warns:
+
+../drivers/net/wireless/intersil/hostap/hostap_ap.c:2511:3: warning:
+misleading indentation; statement is not part of the previous 'if'
+[-Wmisleading-indentation]
+ if (sta->tx_supp_rates & WLAN_RATE_5M5)
+ ^
+../drivers/net/wireless/intersil/hostap/hostap_ap.c:2509:2: note:
+previous statement is here
+ if (sta->tx_supp_rates & WLAN_RATE_2M)
+ ^
+1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+Fixes: ff1d2767d5a4 ("Add HostAP wireless driver.")
+Link: https://github.com/ClangBuiltLinux/linux/issues/813
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/hostap/hostap_ap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+index 0094b1d2b5770..3ec46f48cfde1 100644
+--- a/drivers/net/wireless/intersil/hostap/hostap_ap.c
++++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+@@ -2508,7 +2508,7 @@ static int prism2_hostapd_add_sta(struct ap_data *ap,
+ sta->supported_rates[0] = 2;
+ if (sta->tx_supp_rates & WLAN_RATE_2M)
+ sta->supported_rates[1] = 4;
+- if (sta->tx_supp_rates & WLAN_RATE_5M5)
++ if (sta->tx_supp_rates & WLAN_RATE_5M5)
+ sta->supported_rates[2] = 11;
+ if (sta->tx_supp_rates & WLAN_RATE_11M)
+ sta->supported_rates[3] = 22;
+--
+2.20.1
+
--- /dev/null
+From 75228230b5986837e10b9047edd7b0b8677b10a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 05:58:32 +0100
+Subject: i40e: Relax i40e_xsk_wakeup's return value when PF is busy
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+
+[ Upstream commit c77e9f09143822623dd71a0fdc84331129e97c3a ]
+
+Return -EAGAIN instead of -ENETDOWN to provide a slightly milder
+information to user space so that an application will know to retry the
+syscall when __I40E_CONFIG_BUSY bit is set on pf->state.
+
+Fixes: b3873a5be757 ("net/i40e: Fix concurrency issues between config flow and XSK")
+Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Link: https://lore.kernel.org/bpf/20200205045834.56795-2-maciej.fijalkowski@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_xsk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+index f73cd917c44f7..3156de786d955 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c
+@@ -791,7 +791,7 @@ int i40e_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags)
+ struct i40e_ring *ring;
+
+ if (test_bit(__I40E_CONFIG_BUSY, pf->state))
+- return -ENETDOWN;
++ return -EAGAIN;
+
+ if (test_bit(__I40E_VSI_DOWN, vsi->state))
+ return -ENETDOWN;
+--
+2.20.1
+
--- /dev/null
+From e27e0cae34949c86e9d33112737952c23de184bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 13:30:22 +0200
+Subject: IB/core: Let IB core distribute cache update events
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 6b57cea9221b0247ad5111b348522625e489a8e4 ]
+
+Currently when the low level driver notifies Pkey, GID, and port change
+events they are notified to the registered handlers in the order they are
+registered.
+
+IB core and other ULPs such as IPoIB are interested in GID, LID, Pkey
+change events.
+
+Since all GID queries done by ULPs are serviced by IB core, and the IB
+core deferes cache updates to a work queue, it is possible for other
+clients to see stale cache data when they handle their own events.
+
+For example, the below call tree shows how ipoib will call
+rdma_query_gid() concurrently with the update to the cache sitting in the
+WQ.
+
+mlx5_ib_handle_event()
+ ib_dispatch_event()
+ ib_cache_event()
+ queue_work() -> slow cache update
+
+ [..]
+ ipoib_event()
+ queue_work()
+ [..]
+ work handler
+ ipoib_ib_dev_flush_light()
+ __ipoib_ib_dev_flush()
+ ipoib_dev_addr_changed_valid()
+ rdma_query_gid() <- Returns old GID, cache not updated.
+
+Move all the event dispatch to a work queue so that the cache update is
+always done before any clients are notified.
+
+Fixes: f35faa4ba956 ("IB/core: Simplify ib_query_gid to always refer to cache")
+Link: https://lore.kernel.org/r/20191212113024.336702-3-leon@kernel.org
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cache.c | 121 +++++++++++++++++-----------
+ drivers/infiniband/core/core_priv.h | 1 +
+ drivers/infiniband/core/device.c | 33 +++-----
+ include/rdma/ib_verbs.h | 9 ++-
+ 4 files changed, 92 insertions(+), 72 deletions(-)
+
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index 00fb3eacda194..65b10efca2b8c 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -51,9 +51,8 @@ struct ib_pkey_cache {
+
+ struct ib_update_work {
+ struct work_struct work;
+- struct ib_device *device;
+- u8 port_num;
+- bool enforce_security;
++ struct ib_event event;
++ bool enforce_security;
+ };
+
+ union ib_gid zgid;
+@@ -130,7 +129,7 @@ static void dispatch_gid_change_event(struct ib_device *ib_dev, u8 port)
+ event.element.port_num = port;
+ event.event = IB_EVENT_GID_CHANGE;
+
+- ib_dispatch_event(&event);
++ ib_dispatch_event_clients(&event);
+ }
+
+ static const char * const gid_type_str[] = {
+@@ -1387,9 +1386,8 @@ err:
+ return ret;
+ }
+
+-static void ib_cache_update(struct ib_device *device,
+- u8 port,
+- bool enforce_security)
++static int
++ib_cache_update(struct ib_device *device, u8 port, bool enforce_security)
+ {
+ struct ib_port_attr *tprops = NULL;
+ struct ib_pkey_cache *pkey_cache = NULL, *old_pkey_cache;
+@@ -1397,11 +1395,11 @@ static void ib_cache_update(struct ib_device *device,
+ int ret;
+
+ if (!rdma_is_port_valid(device, port))
+- return;
++ return -EINVAL;
+
+ tprops = kmalloc(sizeof *tprops, GFP_KERNEL);
+ if (!tprops)
+- return;
++ return -ENOMEM;
+
+ ret = ib_query_port(device, port, tprops);
+ if (ret) {
+@@ -1419,8 +1417,10 @@ static void ib_cache_update(struct ib_device *device,
+ pkey_cache = kmalloc(struct_size(pkey_cache, table,
+ tprops->pkey_tbl_len),
+ GFP_KERNEL);
+- if (!pkey_cache)
++ if (!pkey_cache) {
++ ret = -ENOMEM;
+ goto err;
++ }
+
+ pkey_cache->table_len = tprops->pkey_tbl_len;
+
+@@ -1452,50 +1452,84 @@ static void ib_cache_update(struct ib_device *device,
+
+ kfree(old_pkey_cache);
+ kfree(tprops);
+- return;
++ return 0;
+
+ err:
+ kfree(pkey_cache);
+ kfree(tprops);
++ return ret;
++}
++
++static void ib_cache_event_task(struct work_struct *_work)
++{
++ struct ib_update_work *work =
++ container_of(_work, struct ib_update_work, work);
++ int ret;
++
++ /* Before distributing the cache update event, first sync
++ * the cache.
++ */
++ ret = ib_cache_update(work->event.device, work->event.element.port_num,
++ work->enforce_security);
++
++ /* GID event is notified already for individual GID entries by
++ * dispatch_gid_change_event(). Hence, notifiy for rest of the
++ * events.
++ */
++ if (!ret && work->event.event != IB_EVENT_GID_CHANGE)
++ ib_dispatch_event_clients(&work->event);
++
++ kfree(work);
+ }
+
+-static void ib_cache_task(struct work_struct *_work)
++static void ib_generic_event_task(struct work_struct *_work)
+ {
+ struct ib_update_work *work =
+ container_of(_work, struct ib_update_work, work);
+
+- ib_cache_update(work->device,
+- work->port_num,
+- work->enforce_security);
++ ib_dispatch_event_clients(&work->event);
+ kfree(work);
+ }
+
+-static void ib_cache_event(struct ib_event_handler *handler,
+- struct ib_event *event)
++static bool is_cache_update_event(const struct ib_event *event)
++{
++ return (event->event == IB_EVENT_PORT_ERR ||
++ event->event == IB_EVENT_PORT_ACTIVE ||
++ event->event == IB_EVENT_LID_CHANGE ||
++ event->event == IB_EVENT_PKEY_CHANGE ||
++ event->event == IB_EVENT_CLIENT_REREGISTER ||
++ event->event == IB_EVENT_GID_CHANGE);
++}
++
++/**
++ * ib_dispatch_event - Dispatch an asynchronous event
++ * @event:Event to dispatch
++ *
++ * Low-level drivers must call ib_dispatch_event() to dispatch the
++ * event to all registered event handlers when an asynchronous event
++ * occurs.
++ */
++void ib_dispatch_event(const struct ib_event *event)
+ {
+ struct ib_update_work *work;
+
+- if (event->event == IB_EVENT_PORT_ERR ||
+- event->event == IB_EVENT_PORT_ACTIVE ||
+- event->event == IB_EVENT_LID_CHANGE ||
+- event->event == IB_EVENT_PKEY_CHANGE ||
+- event->event == IB_EVENT_CLIENT_REREGISTER ||
+- event->event == IB_EVENT_GID_CHANGE) {
+- work = kmalloc(sizeof *work, GFP_ATOMIC);
+- if (work) {
+- INIT_WORK(&work->work, ib_cache_task);
+- work->device = event->device;
+- work->port_num = event->element.port_num;
+- if (event->event == IB_EVENT_PKEY_CHANGE ||
+- event->event == IB_EVENT_GID_CHANGE)
+- work->enforce_security = true;
+- else
+- work->enforce_security = false;
+-
+- queue_work(ib_wq, &work->work);
+- }
+- }
++ work = kzalloc(sizeof(*work), GFP_ATOMIC);
++ if (!work)
++ return;
++
++ if (is_cache_update_event(event))
++ INIT_WORK(&work->work, ib_cache_event_task);
++ else
++ INIT_WORK(&work->work, ib_generic_event_task);
++
++ work->event = *event;
++ if (event->event == IB_EVENT_PKEY_CHANGE ||
++ event->event == IB_EVENT_GID_CHANGE)
++ work->enforce_security = true;
++
++ queue_work(ib_wq, &work->work);
+ }
++EXPORT_SYMBOL(ib_dispatch_event);
+
+ int ib_cache_setup_one(struct ib_device *device)
+ {
+@@ -1511,9 +1545,6 @@ int ib_cache_setup_one(struct ib_device *device)
+ rdma_for_each_port (device, p)
+ ib_cache_update(device, p, true);
+
+- INIT_IB_EVENT_HANDLER(&device->cache.event_handler,
+- device, ib_cache_event);
+- ib_register_event_handler(&device->cache.event_handler);
+ return 0;
+ }
+
+@@ -1535,14 +1566,12 @@ void ib_cache_release_one(struct ib_device *device)
+
+ void ib_cache_cleanup_one(struct ib_device *device)
+ {
+- /* The cleanup function unregisters the event handler,
+- * waits for all in-progress workqueue elements and cleans
+- * up the GID cache. This function should be called after
+- * the device was removed from the devices list and all
+- * clients were removed, so the cache exists but is
++ /* The cleanup function waits for all in-progress workqueue
++ * elements and cleans up the GID cache. This function should be
++ * called after the device was removed from the devices list and
++ * all clients were removed, so the cache exists but is
+ * non-functional and shouldn't be updated anymore.
+ */
+- ib_unregister_event_handler(&device->cache.event_handler);
+ flush_workqueue(ib_wq);
+ gid_table_cleanup_one(device);
+
+diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h
+index 9d07378b5b423..9b30773f2da05 100644
+--- a/drivers/infiniband/core/core_priv.h
++++ b/drivers/infiniband/core/core_priv.h
+@@ -149,6 +149,7 @@ unsigned long roce_gid_type_mask_support(struct ib_device *ib_dev, u8 port);
+ int ib_cache_setup_one(struct ib_device *device);
+ void ib_cache_cleanup_one(struct ib_device *device);
+ void ib_cache_release_one(struct ib_device *device);
++void ib_dispatch_event_clients(struct ib_event *event);
+
+ #ifdef CONFIG_CGROUP_RDMA
+ void ib_device_register_rdmacg(struct ib_device *device);
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index 2b5bd7206fc6e..2a770b8dca003 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -591,6 +591,7 @@ struct ib_device *_ib_alloc_device(size_t size)
+
+ INIT_LIST_HEAD(&device->event_handler_list);
+ spin_lock_init(&device->event_handler_lock);
++ init_rwsem(&device->event_handler_rwsem);
+ mutex_init(&device->unregistration_lock);
+ /*
+ * client_data needs to be alloc because we don't want our mark to be
+@@ -1932,17 +1933,15 @@ EXPORT_SYMBOL(ib_set_client_data);
+ *
+ * ib_register_event_handler() registers an event handler that will be
+ * called back when asynchronous IB events occur (as defined in
+- * chapter 11 of the InfiniBand Architecture Specification). This
+- * callback may occur in interrupt context.
++ * chapter 11 of the InfiniBand Architecture Specification). This
++ * callback occurs in workqueue context.
+ */
+ void ib_register_event_handler(struct ib_event_handler *event_handler)
+ {
+- unsigned long flags;
+-
+- spin_lock_irqsave(&event_handler->device->event_handler_lock, flags);
++ down_write(&event_handler->device->event_handler_rwsem);
+ list_add_tail(&event_handler->list,
+ &event_handler->device->event_handler_list);
+- spin_unlock_irqrestore(&event_handler->device->event_handler_lock, flags);
++ up_write(&event_handler->device->event_handler_rwsem);
+ }
+ EXPORT_SYMBOL(ib_register_event_handler);
+
+@@ -1955,35 +1954,23 @@ EXPORT_SYMBOL(ib_register_event_handler);
+ */
+ void ib_unregister_event_handler(struct ib_event_handler *event_handler)
+ {
+- unsigned long flags;
+-
+- spin_lock_irqsave(&event_handler->device->event_handler_lock, flags);
++ down_write(&event_handler->device->event_handler_rwsem);
+ list_del(&event_handler->list);
+- spin_unlock_irqrestore(&event_handler->device->event_handler_lock, flags);
++ up_write(&event_handler->device->event_handler_rwsem);
+ }
+ EXPORT_SYMBOL(ib_unregister_event_handler);
+
+-/**
+- * ib_dispatch_event - Dispatch an asynchronous event
+- * @event:Event to dispatch
+- *
+- * Low-level drivers must call ib_dispatch_event() to dispatch the
+- * event to all registered event handlers when an asynchronous event
+- * occurs.
+- */
+-void ib_dispatch_event(struct ib_event *event)
++void ib_dispatch_event_clients(struct ib_event *event)
+ {
+- unsigned long flags;
+ struct ib_event_handler *handler;
+
+- spin_lock_irqsave(&event->device->event_handler_lock, flags);
++ down_read(&event->device->event_handler_rwsem);
+
+ list_for_each_entry(handler, &event->device->event_handler_list, list)
+ handler->handler(handler, event);
+
+- spin_unlock_irqrestore(&event->device->event_handler_lock, flags);
++ up_read(&event->device->event_handler_rwsem);
+ }
+-EXPORT_SYMBOL(ib_dispatch_event);
+
+ static int iw_query_port(struct ib_device *device,
+ u8 port_num,
+diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
+index 75c7b5ed53c59..30d50528d710e 100644
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -2146,7 +2146,6 @@ struct ib_port_cache {
+
+ struct ib_cache {
+ rwlock_t lock;
+- struct ib_event_handler event_handler;
+ };
+
+ struct ib_port_immutable {
+@@ -2590,7 +2589,11 @@ struct ib_device {
+ struct rcu_head rcu_head;
+
+ struct list_head event_handler_list;
+- spinlock_t event_handler_lock;
++ /* Protects event_handler_list */
++ struct rw_semaphore event_handler_rwsem;
++
++ /* Protects QP's event_handler calls and open_qp list */
++ spinlock_t event_handler_lock;
+
+ struct rw_semaphore client_data_rwsem;
+ struct xarray client_data;
+@@ -2897,7 +2900,7 @@ bool ib_modify_qp_is_ok(enum ib_qp_state cur_state, enum ib_qp_state next_state,
+
+ void ib_register_event_handler(struct ib_event_handler *event_handler);
+ void ib_unregister_event_handler(struct ib_event_handler *event_handler);
+-void ib_dispatch_event(struct ib_event *event);
++void ib_dispatch_event(const struct ib_event *event);
+
+ int ib_query_port(struct ib_device *device,
+ u8 port_num, struct ib_port_attr *port_attr);
+--
+2.20.1
+
--- /dev/null
+From f4c9f3023d4d27d52089a6c26f5d33469aed826b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 08:42:35 -0500
+Subject: IB/hfi1: Add RcvShortLengthErrCnt to hfi1stats
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 2c9d4e26d1ab27ceae2ded2ffe930f8e5f5b2a89 ]
+
+This counter, RxShrErr, is required for error analysis and debug.
+
+Fixes: 7724105686e7 ("IB/hfi1: add driver files")
+Link: https://lore.kernel.org/r/20200106134235.119356.29123.stgit@awfm-01.aw.intel.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 1 +
+ drivers/infiniband/hw/hfi1/chip.h | 1 +
+ drivers/infiniband/hw/hfi1/chip_registers.h | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index d5961918fe157..10924f1220720 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -4114,6 +4114,7 @@ def_access_ibp_counter(rc_crwaits);
+ static struct cntr_entry dev_cntrs[DEV_CNTR_LAST] = {
+ [C_RCV_OVF] = RXE32_DEV_CNTR_ELEM(RcvOverflow, RCV_BUF_OVFL_CNT, CNTR_SYNTH),
+ [C_RX_LEN_ERR] = RXE32_DEV_CNTR_ELEM(RxLenErr, RCV_LENGTH_ERR_CNT, CNTR_SYNTH),
++[C_RX_SHORT_ERR] = RXE32_DEV_CNTR_ELEM(RxShrErr, RCV_SHORT_ERR_CNT, CNTR_SYNTH),
+ [C_RX_ICRC_ERR] = RXE32_DEV_CNTR_ELEM(RxICrcErr, RCV_ICRC_ERR_CNT, CNTR_SYNTH),
+ [C_RX_EBP] = RXE32_DEV_CNTR_ELEM(RxEbpCnt, RCV_EBP_CNT, CNTR_SYNTH),
+ [C_RX_TID_FULL] = RXE32_DEV_CNTR_ELEM(RxTIDFullEr, RCV_TID_FULL_ERR_CNT,
+diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
+index bfccd4ae07a72..af0061936c666 100644
+--- a/drivers/infiniband/hw/hfi1/chip.h
++++ b/drivers/infiniband/hw/hfi1/chip.h
+@@ -859,6 +859,7 @@ static inline int idx_from_vl(int vl)
+ enum {
+ C_RCV_OVF = 0,
+ C_RX_LEN_ERR,
++ C_RX_SHORT_ERR,
+ C_RX_ICRC_ERR,
+ C_RX_EBP,
+ C_RX_TID_FULL,
+diff --git a/drivers/infiniband/hw/hfi1/chip_registers.h b/drivers/infiniband/hw/hfi1/chip_registers.h
+index ab3589d17aee6..fb3ec9bff7a22 100644
+--- a/drivers/infiniband/hw/hfi1/chip_registers.h
++++ b/drivers/infiniband/hw/hfi1/chip_registers.h
+@@ -381,6 +381,7 @@
+ #define DC_LCB_STS_LINK_TRANSFER_ACTIVE (DC_LCB_CSRS + 0x000000000468)
+ #define DC_LCB_STS_ROUND_TRIP_LTP_CNT (DC_LCB_CSRS + 0x0000000004B0)
+ #define RCV_LENGTH_ERR_CNT 0
++#define RCV_SHORT_ERR_CNT 2
+ #define RCV_ICRC_ERR_CNT 6
+ #define RCV_EBP_CNT 9
+ #define RCV_BUF_OVFL_CNT 10
+--
+2.20.1
+
--- /dev/null
+From 18c803d7d65b47e369f4b58f33b13d32c165c065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 08:42:28 -0500
+Subject: IB/hfi1: Add software counter for ctxt0 seq drop
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 5ffd048698ea5139743acd45e8ab388a683642b8 ]
+
+All other code paths increment some form of drop counter.
+
+This was missed in the original implementation.
+
+Fixes: 82c2611daaf0 ("staging/rdma/hfi1: Handle packets with invalid RHF on context 0")
+Link: https://lore.kernel.org/r/20200106134228.119356.96828.stgit@awfm-01.aw.intel.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 10 ++++++++++
+ drivers/infiniband/hw/hfi1/chip.h | 1 +
+ drivers/infiniband/hw/hfi1/driver.c | 1 +
+ drivers/infiniband/hw/hfi1/hfi.h | 2 ++
+ 4 files changed, 14 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 9b1fb84a3d45b..d5961918fe157 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -1685,6 +1685,14 @@ static u64 access_sw_pio_drain(const struct cntr_entry *entry,
+ return dd->verbs_dev.n_piodrain;
+ }
+
++static u64 access_sw_ctx0_seq_drop(const struct cntr_entry *entry,
++ void *context, int vl, int mode, u64 data)
++{
++ struct hfi1_devdata *dd = context;
++
++ return dd->ctx0_seq_drop;
++}
++
+ static u64 access_sw_vtx_wait(const struct cntr_entry *entry,
+ void *context, int vl, int mode, u64 data)
+ {
+@@ -4249,6 +4257,8 @@ static struct cntr_entry dev_cntrs[DEV_CNTR_LAST] = {
+ access_sw_cpu_intr),
+ [C_SW_CPU_RCV_LIM] = CNTR_ELEM("RcvLimit", 0, 0, CNTR_NORMAL,
+ access_sw_cpu_rcv_limit),
++[C_SW_CTX0_SEQ_DROP] = CNTR_ELEM("SeqDrop0", 0, 0, CNTR_NORMAL,
++ access_sw_ctx0_seq_drop),
+ [C_SW_VTX_WAIT] = CNTR_ELEM("vTxWait", 0, 0, CNTR_NORMAL,
+ access_sw_vtx_wait),
+ [C_SW_PIO_WAIT] = CNTR_ELEM("PioWait", 0, 0, CNTR_NORMAL,
+diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
+index 4ca5ac8d7e9e4..bfccd4ae07a72 100644
+--- a/drivers/infiniband/hw/hfi1/chip.h
++++ b/drivers/infiniband/hw/hfi1/chip.h
+@@ -926,6 +926,7 @@ enum {
+ C_DC_PG_STS_TX_MBE_CNT,
+ C_SW_CPU_INTR,
+ C_SW_CPU_RCV_LIM,
++ C_SW_CTX0_SEQ_DROP,
+ C_SW_VTX_WAIT,
+ C_SW_PIO_WAIT,
+ C_SW_PIO_DRAIN,
+diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
+index 01aa1f132f55e..941b465244abe 100644
+--- a/drivers/infiniband/hw/hfi1/driver.c
++++ b/drivers/infiniband/hw/hfi1/driver.c
+@@ -734,6 +734,7 @@ static noinline int skip_rcv_packet(struct hfi1_packet *packet, int thread)
+ {
+ int ret;
+
++ packet->rcd->dd->ctx0_seq_drop++;
+ /* Set up for the next packet */
+ packet->rhqoff += packet->rsize;
+ if (packet->rhqoff >= packet->maxcnt)
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index 1af94650bd840..b79931cc74abe 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1153,6 +1153,8 @@ struct hfi1_devdata {
+
+ char *boardname; /* human readable board info */
+
++ u64 ctx0_seq_drop;
++
+ /* reset value */
+ u64 z_int_counter;
+ u64 z_rcv_limit;
+--
+2.20.1
+
--- /dev/null
+From 66ad911c7e8bf00ec93fb2355c54a8cb629c9448 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:06:07 +0300
+Subject: ide: serverworks: potential overflow in svwks_set_pio_mode()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ce1f31b4c0b9551dd51874dd5364654ed4ca13ae ]
+
+The "drive->dn" variable is a u8 controlled by root.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/serverworks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
+index ac6fc3fffa0de..458e72e034b09 100644
+--- a/drivers/ide/serverworks.c
++++ b/drivers/ide/serverworks.c
+@@ -115,6 +115,9 @@ static void svwks_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+ struct pci_dev *dev = to_pci_dev(hwif->dev);
+ const u8 pio = drive->pio_mode - XFER_PIO_0;
+
++ if (drive->dn >= ARRAY_SIZE(drive_pci))
++ return;
++
+ pci_write_config_byte(dev, drive_pci[drive->dn], pio_modes[pio]);
+
+ if (svwks_csb_check(dev)) {
+@@ -141,6 +144,9 @@ static void svwks_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+
+ u8 ultra_enable = 0, ultra_timing = 0, dma_timing = 0;
+
++ if (drive->dn >= ARRAY_SIZE(drive_pci2))
++ return;
++
+ pci_read_config_byte(dev, (0x56|hwif->channel), &ultra_timing);
+ pci_read_config_byte(dev, 0x54, &ultra_enable);
+
+--
+2.20.1
+
--- /dev/null
+From 406dacc3f357736aceb8aba867d9705d8b7f8dc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 17:03:21 -0800
+Subject: Input: edt-ft5x06 - work around first register access error
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit e112324cc0422c046f1cf54c56f333d34fa20885 ]
+
+The EP0700MLP1 returns bogus data on the first register read access
+(reading the threshold parameter from register 0x00):
+
+ edt_ft5x06 2-0038: crc error: 0xfc expected, got 0x40
+
+It ignores writes until then. This patch adds a dummy read after which
+the number of sensors and parameter read/writes work correctly.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
+index 5525f1fb1526e..240e8de24cd24 100644
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -1041,6 +1041,7 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ {
+ const struct edt_i2c_chip_data *chip_data;
+ struct edt_ft5x06_ts_data *tsdata;
++ u8 buf[2] = { 0xfc, 0x00 };
+ struct input_dev *input;
+ unsigned long irq_flags;
+ int error;
+@@ -1110,6 +1111,12 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ return error;
+ }
+
++ /*
++ * Dummy read access. EP0700MLP1 returns bogus data on the first
++ * register read access and ignores writes.
++ */
++ edt_ft5x06_ts_readwrite(tsdata->client, 2, buf, 2, buf);
++
+ edt_ft5x06_ts_set_regs(tsdata);
+ edt_ft5x06_ts_get_defaults(&client->dev, tsdata);
+ edt_ft5x06_ts_get_parameters(tsdata);
+--
+2.20.1
+
--- /dev/null
+From 7a3835756dfb8c2080a08f8ca0aedb5a306d5414 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 07:55:48 -0600
+Subject: iommu/amd: Check feature support bit before accessing MSI capability
+ registers
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 813071438e83d338ba5cfe98b3b26c890dc0a6c0 ]
+
+The IOMMU MMIO access to MSI capability registers is available only if
+the EFR[MsiCapMmioSup] is set. Current implementation assumes this bit
+is set if the EFR[XtSup] is set, which might not be the case.
+
+Fix by checking the EFR[MsiCapMmioSup] before accessing the MSI address
+low/high and MSI data registers via the MMIO.
+
+Fixes: 66929812955b ('iommu/amd: Add support for X2APIC IOMMU interrupts')
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 17 ++++++++++++-----
+ drivers/iommu/amd_iommu_types.h | 1 +
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 483f7bc379fa8..61628c906ce11 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -147,7 +147,7 @@ bool amd_iommu_dump;
+ bool amd_iommu_irq_remap __read_mostly;
+
+ int amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_VAPIC;
+-static int amd_iommu_xt_mode = IRQ_REMAP_X2APIC_MODE;
++static int amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
+
+ static bool amd_iommu_detected;
+ static bool __initdata amd_iommu_disabled;
+@@ -1534,8 +1534,15 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET;
+ if (((h->efr_reg & (0x1 << IOMMU_EFR_GASUP_SHIFT)) == 0))
+ amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY;
+- if (((h->efr_reg & (0x1 << IOMMU_EFR_XTSUP_SHIFT)) == 0))
+- amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
++ /*
++ * Note: Since iommu_update_intcapxt() leverages
++ * the IOMMU MMIO access to MSI capability block registers
++ * for MSI address lo/hi/data, we need to check both
++ * EFR[XtSup] and EFR[MsiCapMmioSup] for x2APIC support.
++ */
++ if ((h->efr_reg & BIT(IOMMU_EFR_XTSUP_SHIFT)) &&
++ (h->efr_reg & BIT(IOMMU_EFR_MSICAPMMIOSUP_SHIFT)))
++ amd_iommu_xt_mode = IRQ_REMAP_X2APIC_MODE;
+ break;
+ default:
+ return -EINVAL;
+@@ -1996,8 +2003,8 @@ static int iommu_init_intcapxt(struct amd_iommu *iommu)
+ struct irq_affinity_notify *notify = &iommu->intcapxt_notify;
+
+ /**
+- * IntCapXT requires XTSup=1, which can be inferred
+- * amd_iommu_xt_mode.
++ * IntCapXT requires XTSup=1 and MsiCapMmioSup=1,
++ * which can be inferred from amd_iommu_xt_mode.
+ */
+ if (amd_iommu_xt_mode != IRQ_REMAP_X2APIC_MODE)
+ return 0;
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index fc956479b94e6..1b4c340890662 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -383,6 +383,7 @@
+ /* IOMMU Extended Feature Register (EFR) */
+ #define IOMMU_EFR_XTSUP_SHIFT 2
+ #define IOMMU_EFR_GASUP_SHIFT 7
++#define IOMMU_EFR_MSICAPMMIOSUP_SHIFT 46
+
+ #define MAX_DOMAIN_ID 65536
+
+--
+2.20.1
+
--- /dev/null
+From 398ff927862393dbbde8eb985521583073372302 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 07:55:49 -0600
+Subject: iommu/amd: Only support x2APIC with IVHD type 11h/40h
+
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+
+[ Upstream commit 966b753cf3969553ca50bacd2b8c4ddade5ecc9e ]
+
+Current implementation for IOMMU x2APIC support makes use of
+the MMIO access to MSI capability block registers, which requires
+checking EFR[MsiCapMmioSup]. However, only IVHD type 11h/40h contain
+the information, and not in the IVHD type 10h IOMMU feature reporting
+field. Since the BIOS in newer systems, which supports x2APIC, would
+normally contain IVHD type 11h/40h, remove the IOMMU_FEAT_XTSUP_SHIFT
+check for IVHD type 10h, and only support x2APIC with IVHD type 11h/40h.
+
+Fixes: 66929812955b ('iommu/amd: Add support for X2APIC IOMMU interrupts')
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 2 --
+ drivers/iommu/amd_iommu_types.h | 1 -
+ 2 files changed, 3 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 61628c906ce11..d7cbca8bf2cd4 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -1523,8 +1523,6 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
+ iommu->mmio_phys_end = MMIO_CNTR_CONF_OFFSET;
+ if (((h->efr_attr & (0x1 << IOMMU_FEAT_GASUP_SHIFT)) == 0))
+ amd_iommu_guest_ir = AMD_IOMMU_GUEST_IR_LEGACY;
+- if (((h->efr_attr & (0x1 << IOMMU_FEAT_XTSUP_SHIFT)) == 0))
+- amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;
+ break;
+ case 0x11:
+ case 0x40:
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index 1b4c340890662..daeabd98c60e2 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -377,7 +377,6 @@
+ #define IOMMU_CAP_EFR 27
+
+ /* IOMMU Feature Reporting Field (for IVHD type 10h */
+-#define IOMMU_FEAT_XTSUP_SHIFT 0
+ #define IOMMU_FEAT_GASUP_SHIFT 6
+
+ /* IOMMU Extended Feature Register (EFR) */
+--
+2.20.1
+
--- /dev/null
+From 54889d57fde2cfee76bd0a41bf7894f5ca2fd73c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 15:21:47 +0000
+Subject: iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit d71e01716b3606a6648df7e5646ae12c75babde4 ]
+
+If, for some bizarre reason, the compiler decided to split up the write
+of STE DWORD 0, we could end up making a partial structure valid.
+
+Although this probably won't happen, follow the example of the
+context-descriptor code and use WRITE_ONCE() to ensure atomicity of the
+write.
+
+Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm-smmu-v3.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index ee8d48d863e16..ef6af714a7e64 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1643,7 +1643,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_master *master, u32 sid,
+ STRTAB_STE_1_EATS_TRANS));
+
+ arm_smmu_sync_ste_for_sid(smmu, sid);
+- dst[0] = cpu_to_le64(val);
++ /* See comment in arm_smmu_write_ctx_desc() */
++ WRITE_ONCE(dst[0], cpu_to_le64(val));
+ arm_smmu_sync_ste_for_sid(smmu, sid);
+
+ /* It's likely that we'll want to use the new STE soon */
+--
+2.20.1
+
--- /dev/null
+From bafa4456067925e2ef46832644bfa2eb28885bbf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 14:16:54 -0500
+Subject: iommu/iova: Silence warnings under memory pressure
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 944c9175397476199d4dd1028d87ddc582c35ee8 ]
+
+When running heavy memory pressure workloads, this 5+ old system is
+throwing endless warnings below because disk IO is too slow to recover
+from swapping. Since the volume from alloc_iova_fast() could be large,
+once it calls printk(), it will trigger disk IO (writing to the log
+files) and pending softirqs which could cause an infinite loop and make
+no progress for days by the ongoimng memory reclaim. This is the counter
+part for Intel where the AMD part has already been merged. See the
+commit 3d708895325b ("iommu/amd: Silence warnings under memory
+pressure"). Since the allocation failure will be reported in
+intel_alloc_iova(), so just call dev_err_once() there because even the
+"ratelimited" is too much, and silence the one in alloc_iova_mem() to
+avoid the expensive warn_alloc().
+
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ slab_out_of_memory: 66 callbacks suppressed
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ cache: iommu_iova, object size: 40, buffer size: 448, default order:
+0, min order: 0
+ node 0: slabs: 1822, objs: 16398, free: 0
+ node 1: slabs: 2051, objs: 18459, free: 31
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ cache: iommu_iova, object size: 40, buffer size: 448, default order:
+0, min order: 0
+ node 0: slabs: 1822, objs: 16398, free: 0
+ node 1: slabs: 2051, objs: 18459, free: 31
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ cache: iommu_iova, object size: 40, buffer size: 448, default order:
+0, min order: 0
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+ cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+ cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+ cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+ node 0: slabs: 697, objs: 4182, free: 0
+ node 0: slabs: 697, objs: 4182, free: 0
+ node 0: slabs: 697, objs: 4182, free: 0
+ node 0: slabs: 697, objs: 4182, free: 0
+ node 1: slabs: 381, objs: 2286, free: 27
+ node 1: slabs: 381, objs: 2286, free: 27
+ node 1: slabs: 381, objs: 2286, free: 27
+ node 1: slabs: 381, objs: 2286, free: 27
+ node 0: slabs: 1822, objs: 16398, free: 0
+ cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+ node 1: slabs: 2051, objs: 18459, free: 31
+ node 0: slabs: 697, objs: 4182, free: 0
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ node 1: slabs: 381, objs: 2286, free: 27
+ cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+ node 0: slabs: 697, objs: 4182, free: 0
+ node 1: slabs: 381, objs: 2286, free: 27
+ hpsa 0000:03:00.0: DMAR: Allocating 1-page iova failed
+ warn_alloc: 96 callbacks suppressed
+ kworker/11:1H: page allocation failure: order:0,
+mode:0xa20(GFP_ATOMIC), nodemask=(null),cpuset=/,mems_allowed=0-1
+ CPU: 11 PID: 1642 Comm: kworker/11:1H Tainted: G B
+ Hardware name: HP ProLiant XL420 Gen9/ProLiant XL420 Gen9, BIOS U19
+12/27/2015
+ Workqueue: kblockd blk_mq_run_work_fn
+ Call Trace:
+ dump_stack+0xa0/0xea
+ warn_alloc.cold.94+0x8a/0x12d
+ __alloc_pages_slowpath+0x1750/0x1870
+ __alloc_pages_nodemask+0x58a/0x710
+ alloc_pages_current+0x9c/0x110
+ alloc_slab_page+0xc9/0x760
+ allocate_slab+0x48f/0x5d0
+ new_slab+0x46/0x70
+ ___slab_alloc+0x4ab/0x7b0
+ __slab_alloc+0x43/0x70
+ kmem_cache_alloc+0x2dd/0x450
+ SLUB: Unable to allocate memory on node -1, gfp=0xa20(GFP_ATOMIC)
+ alloc_iova+0x33/0x210
+ cache: skbuff_head_cache, object size: 208, buffer size: 640, default
+order: 0, min order: 0
+ node 0: slabs: 697, objs: 4182, free: 0
+ alloc_iova_fast+0x62/0x3d1
+ node 1: slabs: 381, objs: 2286, free: 27
+ intel_alloc_iova+0xce/0xe0
+ intel_map_sg+0xed/0x410
+ scsi_dma_map+0xd7/0x160
+ scsi_queue_rq+0xbf7/0x1310
+ blk_mq_dispatch_rq_list+0x4d9/0xbc0
+ blk_mq_sched_dispatch_requests+0x24a/0x300
+ __blk_mq_run_hw_queue+0x156/0x230
+ blk_mq_run_work_fn+0x3b/0x40
+ process_one_work+0x579/0xb90
+ worker_thread+0x63/0x5b0
+ kthread+0x1e6/0x210
+ ret_from_fork+0x3a/0x50
+ Mem-Info:
+ active_anon:2422723 inactive_anon:361971 isolated_anon:34403
+ active_file:2285 inactive_file:1838 isolated_file:0
+ unevictable:0 dirty:1 writeback:5 unstable:0
+ slab_reclaimable:13972 slab_unreclaimable:453879
+ mapped:2380 shmem:154 pagetables:6948 bounce:0
+ free:19133 free_pcp:7363 free_cma:0
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 3 ++-
+ drivers/iommu/iova.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index dd5db856dcaf9..760a242d0801d 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3401,7 +3401,8 @@ static unsigned long intel_alloc_iova(struct device *dev,
+ iova_pfn = alloc_iova_fast(&domain->iovad, nrpages,
+ IOVA_PFN(dma_mask), true);
+ if (unlikely(!iova_pfn)) {
+- dev_err(dev, "Allocating %ld-page iova failed", nrpages);
++ dev_err_once(dev, "Allocating %ld-page iova failed\n",
++ nrpages);
+ return 0;
+ }
+
+diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
+index c7a914b9bbbc4..0e6a9536eca62 100644
+--- a/drivers/iommu/iova.c
++++ b/drivers/iommu/iova.c
+@@ -233,7 +233,7 @@ static DEFINE_MUTEX(iova_cache_mutex);
+
+ struct iova *alloc_iova_mem(void)
+ {
+- return kmem_cache_zalloc(iova_cache, GFP_ATOMIC);
++ return kmem_cache_zalloc(iova_cache, GFP_ATOMIC | __GFP_NOWARN);
+ }
+ EXPORT_SYMBOL(alloc_iova_mem);
+
+--
+2.20.1
+
--- /dev/null
+From 526f1e9fb25db61a82347cf3b1be5c55a4a99b7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 08:18:09 +0800
+Subject: iommu/vt-d: Avoid sending invalid page response
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 5f75585e19cc7018bf2016aa771632081ee2f313 ]
+
+Page responses should only be sent when last page in group (LPIG) or
+private data is present in the page request. This patch avoids sending
+invalid descriptors.
+
+Fixes: 5d308fc1ecf53 ("iommu/vt-d: Add 256-bit invalidation descriptor support")
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index ff7a3f9add325..518d0b2d12afd 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -654,11 +654,10 @@ static irqreturn_t prq_event_thread(int irq, void *d)
+ if (req->priv_data_present)
+ memcpy(&resp.qw2, req->priv_data,
+ sizeof(req->priv_data));
++ resp.qw2 = 0;
++ resp.qw3 = 0;
++ qi_submit_sync(&resp, iommu);
+ }
+- resp.qw2 = 0;
+- resp.qw3 = 0;
+- qi_submit_sync(&resp, iommu);
+-
+ head = (head + sizeof(*req)) & PRQ_RING_MASK;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fd5d55dfdcac0fff6cf960664dc5855e10a5572f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 08:18:07 +0800
+Subject: iommu/vt-d: Fix off-by-one in PASID allocation
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 39d630e332144028f56abba83d94291978e72df1 ]
+
+PASID allocator uses IDR which is exclusive for the end of the
+allocation range. There is no need to decrement pasid_max.
+
+Fixes: af39507305fb ("iommu/vt-d: Apply global PASID in SVA")
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index dca88f9fdf29a..ff7a3f9add325 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -317,7 +317,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
+ /* Do not use PASID 0 in caching mode (virtualised IOMMU) */
+ ret = intel_pasid_alloc_id(svm,
+ !!cap_caching_mode(iommu->cap),
+- pasid_max - 1, GFP_KERNEL);
++ pasid_max, GFP_KERNEL);
+ if (ret < 0) {
+ kfree(svm);
+ kfree(sdev);
+--
+2.20.1
+
--- /dev/null
+From cdd041f8b6ba789f6c38947490e7805c6be02062 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 08:18:04 +0800
+Subject: iommu/vt-d: Match CPU and IOMMU paging mode
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 79db7e1b4cf2a006f556099c13de3b12970fc6e3 ]
+
+When setting up first level page tables for sharing with CPU, we need
+to ensure IOMMU can support no less than the levels supported by the
+CPU.
+
+It is not adequate, as in the current code, to set up 5-level paging
+in PASID entry First Level Paging Mode(FLPM) solely based on CPU.
+
+Currently, intel_pasid_setup_first_level() is only used by native SVM
+code which already checks paging mode matches. However, future use of
+this helper function may not be limited to native SVM.
+https://lkml.org/lkml/2019/11/18/1037
+
+Fixes: 437f35e1cd4c8 ("iommu/vt-d: Add first level page table interface")
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-pasid.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/intel-pasid.c b/drivers/iommu/intel-pasid.c
+index 040a445be3009..e7cb0b8a73327 100644
+--- a/drivers/iommu/intel-pasid.c
++++ b/drivers/iommu/intel-pasid.c
+@@ -499,8 +499,16 @@ int intel_pasid_setup_first_level(struct intel_iommu *iommu,
+ }
+
+ #ifdef CONFIG_X86
+- if (cpu_feature_enabled(X86_FEATURE_LA57))
+- pasid_set_flpm(pte, 1);
++ /* Both CPU and IOMMU paging mode need to match */
++ if (cpu_feature_enabled(X86_FEATURE_LA57)) {
++ if (cap_5lp_support(iommu->cap)) {
++ pasid_set_flpm(pte, 1);
++ } else {
++ pr_err("VT-d has no 5-level paging support for CPU\n");
++ pasid_clear_entry(pte);
++ return -EINVAL;
++ }
++ }
+ #endif /* CONFIG_X86 */
+
+ pasid_set_domain_id(pte, did);
+--
+2.20.1
+
--- /dev/null
+From 9f13d42cab305e11a2d6d85540a116fbee595426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 09:52:36 +0800
+Subject: iommu/vt-d: Remove unnecessary WARN_ON_ONCE()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 857f081426e5aa38313426c13373730f1345fe95 ]
+
+Address field in device TLB invalidation descriptor is qualified
+by the S field. If S field is zero, a single page at page address
+specified by address [63:12] is requested to be invalidated. If S
+field is set, the least significant bit in the address field with
+value 0b (say bit N) indicates the invalidation address range. The
+spec doesn't require the address [N - 1, 0] to be cleared, hence
+remove the unnecessary WARN_ON_ONCE().
+
+Otherwise, the caller might set "mask = MAX_AGAW_PFN_WIDTH" in order
+to invalidating all the cached mappings on an endpoint, and below
+overflow error will be triggered.
+
+[...]
+UBSAN: Undefined behaviour in drivers/iommu/dmar.c:1354:3
+shift exponent 64 is too large for 64-bit type 'long long unsigned int'
+[...]
+
+Reported-and-tested-by: Frank <fgndev@posteo.de>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/dmar.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index eecd6a4216672..7196cabafb252 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1351,7 +1351,6 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
+ struct qi_desc desc;
+
+ if (mask) {
+- WARN_ON_ONCE(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1));
+ addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1;
+ desc.qw1 = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE;
+ } else
+--
+2.20.1
+
--- /dev/null
+From 53ff740a58f376a5170daeb3466148164ca19b62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:27 +0700
+Subject: ipw2x00: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit ebd77feb27e91bb5fe35a7818b7c13ea7435fb98 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/ipw2x00/ipw2100.c | 7 ++++---
+ drivers/net/wireless/intel/ipw2x00/ipw2200.c | 5 +++--
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+index 8dfbaff2d1fe2..a162146a43a72 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+@@ -3206,8 +3206,9 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
+ }
+ }
+
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
++static void ipw2100_irq_tasklet(unsigned long data)
+ {
++ struct ipw2100_priv *priv = (struct ipw2100_priv *)data;
+ struct net_device *dev = priv->net_dev;
+ unsigned long flags;
+ u32 inta, tmp;
+@@ -6007,7 +6008,7 @@ static void ipw2100_rf_kill(struct work_struct *work)
+ spin_unlock_irqrestore(&priv->low_lock, flags);
+ }
+
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv);
++static void ipw2100_irq_tasklet(unsigned long data);
+
+ static const struct net_device_ops ipw2100_netdev_ops = {
+ .ndo_open = ipw2100_open,
+@@ -6137,7 +6138,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
+ INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
+ INIT_DELAYED_WORK(&priv->scan_event, ipw2100_scan_event);
+
+- tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++ tasklet_init(&priv->irq_tasklet,
+ ipw2100_irq_tasklet, (unsigned long)priv);
+
+ /* NOTE: We do not start the deferred work for status checks yet */
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+index ed0f06532d5e2..ac5f797fb1ad1 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -1945,8 +1945,9 @@ static void notify_wx_assoc_event(struct ipw_priv *priv)
+ wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
+ }
+
+-static void ipw_irq_tasklet(struct ipw_priv *priv)
++static void ipw_irq_tasklet(unsigned long data)
+ {
++ struct ipw_priv *priv = (struct ipw_priv *)data;
+ u32 inta, inta_mask, handled = 0;
+ unsigned long flags;
+ int rc = 0;
+@@ -10680,7 +10681,7 @@ static int ipw_setup_deferred_work(struct ipw_priv *priv)
+ INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
+ #endif /* CONFIG_IPW2200_QOS */
+
+- tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++ tasklet_init(&priv->irq_tasklet,
+ ipw_irq_tasklet, (unsigned long)priv);
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From f1817deaaa924b5d13715d33660d1ac9cde0f10f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 15:10:21 +0800
+Subject: irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when
+ building INVALL
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit 107945227ac5d4c37911c7841b27c64b489ce9a9 ]
+
+It looks like an obvious mistake to use its_mapc_cmd descriptor when
+building the INVALL command block. It so far worked by luck because
+both its_mapc_cmd.col and its_invall_cmd.col sit at the same offset of
+the ITS command descriptor, but we should not rely on it.
+
+Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue")
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20191202071021.1251-1-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 787e8eec9a7f1..11f3b50dcdcb8 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -571,7 +571,7 @@ static struct its_collection *its_build_invall_cmd(struct its_node *its,
+ struct its_cmd_desc *desc)
+ {
+ its_encode_cmd(cmd, GITS_CMD_INVALL);
+- its_encode_collection(cmd, desc->its_mapc_cmd.col->col_id);
++ its_encode_collection(cmd, desc->its_invall_cmd.col->col_id);
+
+ its_fixup_cmd(cmd);
+
+--
+2.20.1
+
--- /dev/null
+From 742fa1fbf513093fb5280031cb98b4db72c0b68b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:24:57 +0000
+Subject: irqchip/gic-v3: Only provision redistributors that are enabled in
+ ACPI
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 926b5dfa6b8dc666ff398044af6906b156e1d949 ]
+
+We currently allocate redistributor region structures for
+individual redistributors when ACPI doesn't present us with
+compact MMIO regions covering multiple redistributors.
+
+It turns out that we allocate these structures even when
+the redistributor is flagged as disabled by ACPI. It works
+fine until someone actually tries to tarse one of these
+structures, and access the corresponding MMIO region.
+
+Instead, track the number of enabled redistributors, and
+only allocate what is required. This makes sure that there
+is no invalid data to misuse.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reported-by: Heyi Guo <guoheyi@huawei.com>
+Tested-by: Heyi Guo <guoheyi@huawei.com>
+Link: https://lore.kernel.org/r/20191216062745.63397-1-guoheyi@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 1edc99335a946..446603efbc90b 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1801,6 +1801,7 @@ static struct
+ struct redist_region *redist_regs;
+ u32 nr_redist_regions;
+ bool single_redist;
++ int enabled_rdists;
+ u32 maint_irq;
+ int maint_irq_mode;
+ phys_addr_t vcpu_base;
+@@ -1895,8 +1896,10 @@ static int __init gic_acpi_match_gicc(union acpi_subtable_headers *header,
+ * If GICC is enabled and has valid gicr base address, then it means
+ * GICR base is presented via GICC
+ */
+- if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address)
++ if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address) {
++ acpi_data.enabled_rdists++;
+ return 0;
++ }
+
+ /*
+ * It's perfectly valid firmware can pass disabled GICC entry, driver
+@@ -1926,8 +1929,10 @@ static int __init gic_acpi_count_gicr_regions(void)
+
+ count = acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_INTERRUPT,
+ gic_acpi_match_gicc, 0);
+- if (count > 0)
++ if (count > 0) {
+ acpi_data.single_redist = true;
++ count = acpi_data.enabled_rdists;
++ }
+
+ return count;
+ }
+--
+2.20.1
+
--- /dev/null
+From e3597ac500c29b87e8a5f93b1d39b8efc9a8bac1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 01:38:43 +0800
+Subject: irqchip/mbigen: Set driver .suppress_bind_attrs to avoid remove
+ problems
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit d6152e6ec9e2171280436f7b31a571509b9287e1 ]
+
+The following crash can be seen for setting
+CONFIG_DEBUG_TEST_DRIVER_REMOVE=y for DT FW (which some people still use):
+
+Hisilicon MBIGEN-V2 60080000.interrupt-controller: Failed to create mbi-gen irqdomain
+Hisilicon MBIGEN-V2: probe of 60080000.interrupt-controller failed with error -12
+
+[...]
+
+Unable to handle kernel paging request at virtual address 0000000000005008
+ Mem abort info:
+ ESR = 0x96000004
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ Data abort info:
+ ISV = 0, ISS = 0x00000004
+ CM = 0, WnR = 0
+ user pgtable: 4k pages, 48-bit VAs, pgdp=0000041fb9990000
+ [0000000000005008] pgd=0000000000000000
+ Internal error: Oops: 96000004 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 7 PID: 1 Comm: swapper/0 Not tainted 5.5.0-rc6-00002-g3fc42638a506-dirty #1622
+ Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
+ pstate: 40000085 (nZcv daIf -PAN -UAO)
+ pc : mbigen_set_type+0x38/0x60
+ lr : __irq_set_trigger+0x6c/0x188
+ sp : ffff800014b4b400
+ x29: ffff800014b4b400 x28: 0000000000000007
+ x27: 0000000000000000 x26: 0000000000000000
+ x25: ffff041fd83bd0d4 x24: ffff041fd83bd188
+ x23: 0000000000000000 x22: ffff80001193ce00
+ x21: 0000000000000004 x20: 0000000000000000
+ x19: ffff041fd83bd000 x18: ffffffffffffffff
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: ffff8000119098c8 x14: ffff041fb94ec91c
+ x13: ffff041fb94ec1a1 x12: 0000000000000030
+ x11: 0101010101010101 x10: 0000000000000040
+ x9 : 0000000000000000 x8 : ffff041fb98c6680
+ x7 : ffff800014b4b380 x6 : ffff041fd81636c8
+ x5 : 0000000000000000 x4 : 000000000000025f
+ x3 : 0000000000005000 x2 : 0000000000005008
+ x1 : 0000000000000004 x0 : 0000000080000000
+ Call trace:
+ mbigen_set_type+0x38/0x60
+ __setup_irq+0x744/0x900
+ request_threaded_irq+0xe0/0x198
+ pcie_pme_probe+0x98/0x118
+ pcie_port_probe_service+0x38/0x78
+ really_probe+0xa0/0x3e0
+ driver_probe_device+0x58/0x100
+ __device_attach_driver+0x90/0xb0
+ bus_for_each_drv+0x64/0xc8
+ __device_attach+0xd8/0x138
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ device_add+0x4c4/0x770
+ device_register+0x1c/0x28
+ pcie_port_device_register+0x1e4/0x4f0
+ pcie_portdrv_probe+0x34/0xd8
+ local_pci_probe+0x3c/0xa0
+ pci_device_probe+0x128/0x1c0
+ really_probe+0xa0/0x3e0
+ driver_probe_device+0x58/0x100
+ __device_attach_driver+0x90/0xb0
+ bus_for_each_drv+0x64/0xc8
+ __device_attach+0xd8/0x138
+ device_attach+0x10/0x18
+ pci_bus_add_device+0x4c/0xb8
+ pci_bus_add_devices+0x38/0x88
+ pci_host_probe+0x3c/0xc0
+ pci_host_common_probe+0xf0/0x208
+ hisi_pcie_almost_ecam_probe+0x24/0x30
+ platform_drv_probe+0x50/0xa0
+ really_probe+0xa0/0x3e0
+ driver_probe_device+0x58/0x100
+ device_driver_attach+0x6c/0x90
+ __driver_attach+0x84/0xc8
+ bus_for_each_dev+0x74/0xc8
+ driver_attach+0x20/0x28
+ bus_add_driver+0x148/0x1f0
+ driver_register+0x60/0x110
+ __platform_driver_register+0x40/0x48
+ hisi_pcie_almost_ecam_driver_init+0x1c/0x24
+
+The specific problem here is that the mbigen driver real probe has failed
+as the mbigen_of_create_domain()->of_platform_device_create() call fails,
+the reason for that being that we never destroyed the platform device
+created during the remove test dry run and there is some conflict.
+
+Since we generally would never want to unbind this driver, and to save
+adding a driver tear down path for that, just set the driver
+.suppress_bind_attrs member to avoid this possibility.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/1579196323-180137-1-git-send-email-john.garry@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-mbigen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
+index 3f09f658e8e29..6b566bba263bd 100644
+--- a/drivers/irqchip/irq-mbigen.c
++++ b/drivers/irqchip/irq-mbigen.c
+@@ -374,6 +374,7 @@ static struct platform_driver mbigen_platform_driver = {
+ .name = "Hisilicon MBIGEN-V2",
+ .of_match_table = mbigen_of_match,
+ .acpi_match_table = ACPI_PTR(mbigen_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = mbigen_device_probe,
+ };
+--
+2.20.1
+
--- /dev/null
+From c91684e41d303a1c7de35f2b4881eb9be6e7d34d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 20:48:56 +0100
+Subject: isdn: don't mark kcapi_proc_exit as __exit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b33bdf8020c94438269becc6dace9ed49257c4ba ]
+
+As everybody pointed out by now, my patch to clean up CAPI introduced
+a link time warning, as the two parts of the capi driver are now in
+one module and the exit function may need to be called in the error
+path of the init function:
+
+>> WARNING: drivers/isdn/capi/kernelcapi.o(.text+0xea4): Section mismatch in reference from the function kcapi_exit() to the function .exit.text:kcapi_proc_exit()
+ The function kcapi_exit() references a function in an exit section.
+ Often the function kcapi_proc_exit() has valid usage outside the exit section
+ and the fix is to remove the __exit annotation of kcapi_proc_exit.
+
+Remove the incorrect __exit annotation.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: kernelci.org bot <bot@kernelci.org>
+Reported-by: Olof's autobuilder <build@lixom.net>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20191216194909.1983639-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/capi/kcapi_proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/capi/kcapi_proc.c b/drivers/isdn/capi/kcapi_proc.c
+index c94bd12c0f7c6..28cd051f1dfd9 100644
+--- a/drivers/isdn/capi/kcapi_proc.c
++++ b/drivers/isdn/capi/kcapi_proc.c
+@@ -239,7 +239,7 @@ kcapi_proc_init(void)
+ proc_create_seq("capi/driver", 0, NULL, &seq_capi_driver_ops);
+ }
+
+-void __exit
++void
+ kcapi_proc_exit(void)
+ {
+ remove_proc_entry("capi/driver", NULL);
+--
+2.20.1
+
--- /dev/null
+From a74a7f794ae4cc94d0184c74e6269397ea221ce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jan 2020 00:09:54 +0000
+Subject: iwlegacy: ensure loop counter addr does not wrap and cause an
+ infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c2f9a4e4a5abfc84c01b738496b3fd2d471e0b18 ]
+
+The loop counter addr is a u16 where as the upper limit of the loop
+is an int. In the unlikely event that the il->cfg->eeprom_size is
+greater than 64K then we end up with an infinite loop since addr will
+wrap around an never reach upper loop limit. Fix this by making addr
+an int.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
+index 73f7bbf742bc6..746749f379964 100644
+--- a/drivers/net/wireless/intel/iwlegacy/common.c
++++ b/drivers/net/wireless/intel/iwlegacy/common.c
+@@ -699,7 +699,7 @@ il_eeprom_init(struct il_priv *il)
+ u32 gp = _il_rd(il, CSR_EEPROM_GP);
+ int sz;
+ int ret;
+- u16 addr;
++ int addr;
+
+ /* allocate eeprom */
+ sz = il->cfg->eeprom_size;
+--
+2.20.1
+
--- /dev/null
+From 98822ae0cc908e4ec8056ba9b5dc984b32d55fb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:28 +0700
+Subject: iwlegacy: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit da5e57e8a6a3e69dac2937ba63fa86355628fbb2 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 5 +++--
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 4fbcc7fba3cc1..e2e9c3e8fff51 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -1376,8 +1376,9 @@ il3945_dump_nic_error_log(struct il_priv *il)
+ }
+
+ static void
+-il3945_irq_tasklet(struct il_priv *il)
++il3945_irq_tasklet(unsigned long data)
+ {
++ struct il_priv *il = (struct il_priv *)data;
+ u32 inta, handled = 0;
+ u32 inta_fh;
+ unsigned long flags;
+@@ -3403,7 +3404,7 @@ il3945_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_init(&il->irq_tasklet,
+- (void (*)(unsigned long))il3945_irq_tasklet,
++ il3945_irq_tasklet,
+ (unsigned long)il);
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index ffb705b18fb13..5fe17039a3375 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4344,8 +4344,9 @@ il4965_synchronize_irq(struct il_priv *il)
+ }
+
+ static void
+-il4965_irq_tasklet(struct il_priv *il)
++il4965_irq_tasklet(unsigned long data)
+ {
++ struct il_priv *il = (struct il_priv *)data;
+ u32 inta, handled = 0;
+ u32 inta_fh;
+ unsigned long flags;
+@@ -6238,7 +6239,7 @@ il4965_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_init(&il->irq_tasklet,
+- (void (*)(unsigned long))il4965_irq_tasklet,
++ il4965_irq_tasklet,
+ (unsigned long)il);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d079636fd48f40101a5bc86a01ecec6cd32cdc36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2020 15:45:28 +0200
+Subject: iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta()
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit 12d47f0ea5e0aa63f19ba618da55a7c67850ca10 ]
+
+Fix a kernel panic by checking that the sta is not NULL.
+This could happen during a reconfig flow, as mac80211 moves the sta
+between all the states without really checking if the previous state was
+successfully set. So, if for some reason we failed to add back the
+station, subsequent calls to sta_state() callback will be done when the
+station is NULL. This would result in a following panic:
+
+BUG: unable to handle kernel NULL pointer dereference at
+0000000000000040
+IP: iwl_mvm_cfg_he_sta+0xfc/0x690 [iwlmvm]
+[..]
+Call Trace:
+ iwl_mvm_mac_sta_state+0x629/0x6f0 [iwlmvm]
+ drv_sta_state+0xf4/0x950 [mac80211]
+ ieee80211_reconfig+0xa12/0x2180 [mac80211]
+ ieee80211_restart_work+0xbb/0xe0 [mac80211]
+ process_one_work+0x1e2/0x610
+ worker_thread+0x4d/0x3e0
+[..]
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 18ccc2692437f..6ca087ffd163b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -5,10 +5,9 @@
+ *
+ * GPL LICENSE SUMMARY
+ *
+- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -28,10 +27,9 @@
+ *
+ * BSD LICENSE
+ *
+- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 - 2019 Intel Corporation
++ * Copyright(c) 2012 - 2014, 2018 - 2020 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -2025,7 +2023,7 @@ static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm,
+ rcu_read_lock();
+
+ sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_ctxt_cmd.sta_id]);
+- if (IS_ERR(sta)) {
++ if (IS_ERR_OR_NULL(sta)) {
+ rcu_read_unlock();
+ WARN(1, "Can't find STA to configure HE\n");
+ return;
+--
+2.20.1
+
--- /dev/null
+From b0ba9716c56b042142bcfcdbd49ac9eeec037b11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2020 15:45:24 +0200
+Subject: iwlwifi: mvm: Fix thermal zone registration
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit baa6cf8450b72dcab11f37c47efce7c5b9b8ad0f ]
+
+Use a unique name when registering a thermal zone. Otherwise, with
+multiple NICS, we hit the following warning during the unregistration.
+
+WARNING: CPU: 2 PID: 3525 at fs/sysfs/group.c:255
+ RIP: 0010:sysfs_remove_group+0x80/0x90
+ Call Trace:
+ dpm_sysfs_remove+0x57/0x60
+ device_del+0x5a/0x350
+ ? sscanf+0x4e/0x70
+ device_unregister+0x1a/0x60
+ hwmon_device_unregister+0x4a/0xa0
+ thermal_remove_hwmon_sysfs+0x175/0x1d0
+ thermal_zone_device_unregister+0x188/0x1e0
+ iwl_mvm_thermal_exit+0xe7/0x100 [iwlmvm]
+ iwl_op_mode_mvm_stop+0x27/0x180 [iwlmvm]
+ _iwl_op_mode_stop.isra.3+0x2b/0x50 [iwlwifi]
+ iwl_opmode_deregister+0x90/0xa0 [iwlwifi]
+ __exit_compat+0x10/0x2c7 [iwlmvm]
+ __x64_sys_delete_module+0x13f/0x270
+ do_syscall_64+0x5a/0x110
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+index f0c539b37ea70..a630e4edd9b4d 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+@@ -731,7 +731,8 @@ static struct thermal_zone_device_ops tzone_ops = {
+ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+ {
+ int i;
+- char name[] = "iwlwifi";
++ char name[16];
++ static atomic_t counter = ATOMIC_INIT(0);
+
+ if (!iwl_mvm_is_tt_in_fw(mvm)) {
+ mvm->tz_device.tzone = NULL;
+@@ -741,6 +742,7 @@ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+
+ BUILD_BUG_ON(ARRAY_SIZE(name) >= THERMAL_NAME_LENGTH);
+
++ sprintf(name, "iwlwifi_%u", atomic_inc_return(&counter) & 0xFF);
+ mvm->tz_device.tzone = thermal_zone_device_register(name,
+ IWL_MAX_DTS_TRIPS,
+ IWL_WRITABLE_TRIPS_MSK,
+--
+2.20.1
+
--- /dev/null
+From eeadfff4fd1907eda4f9605c01bc981349f424a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 10:25:42 +0800
+Subject: jbd2: clear JBD2_ABORT flag before journal_reset to update log tail
+ info when load journal
+
+From: Kai Li <li.kai4@h3c.com>
+
+[ Upstream commit a09decff5c32060639a685581c380f51b14e1fc2 ]
+
+If the journal is dirty when the filesystem is mounted, jbd2 will replay
+the journal but the journal superblock will not be updated by
+journal_reset() because JBD2_ABORT flag is still set (it was set in
+journal_init_common()). This is problematic because when a new transaction
+is then committed, it will be recorded in block 1 (journal->j_tail was set
+to 1 in journal_reset()). If unclean shutdown happens again before the
+journal superblock is updated, the new recorded transaction will not be
+replayed during the next mount (because of stale sb->s_start and
+sb->s_sequence values) which can lead to filesystem corruption.
+
+Fixes: 85e0c4e89c1b ("jbd2: if the journal is aborted then don't allow update of the log tail")
+Signed-off-by: Kai Li <li.kai4@h3c.com>
+Link: https://lore.kernel.org/r/20200111022542.5008-1-li.kai4@h3c.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/journal.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index ef485f892d1b0..389c9be4e7919 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1682,6 +1682,11 @@ int jbd2_journal_load(journal_t *journal)
+ journal->j_devname);
+ return -EFSCORRUPTED;
+ }
++ /*
++ * clear JBD2_ABORT flag initialized in journal_init_common
++ * here to update log tail information with the newest seq.
++ */
++ journal->j_flags &= ~JBD2_ABORT;
+
+ /* OK, we've finished with the dynamic journal bits:
+ * reinitialise the dynamic contents of the superblock in memory
+@@ -1689,7 +1694,6 @@ int jbd2_journal_load(journal_t *journal)
+ if (journal_reset(journal))
+ goto recovery_error;
+
+- journal->j_flags &= ~JBD2_ABORT;
+ journal->j_flags |= JBD2_LOADED;
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From 718cb80d633832ea2d8d075903e049bbf24c0987 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:13 +0800
+Subject: jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit 0e98c084a21177ef136149c6a293b3d1eb33ff92 ]
+
+Commit fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer") want
+to allow jbd2 layer to distinguish shutdown journal abort from other
+error cases. So the ESHUTDOWN should be taken precedence over any other
+errno which has already been recoded after EXT4_FLAGS_SHUTDOWN is set,
+but it only update errno in the journal suoerblock now if the old errno
+is 0.
+
+Fixes: fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-4-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/journal.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 65e78d3a2f64c..c1ce2805c5639 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2114,8 +2114,7 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ if (journal->j_flags & JBD2_ABORT) {
+ write_unlock(&journal->j_state_lock);
+- if (!old_errno && old_errno != -ESHUTDOWN &&
+- errno == -ESHUTDOWN)
++ if (old_errno != -ESHUTDOWN && errno == -ESHUTDOWN)
+ jbd2_journal_update_sb_errno(journal);
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From af9dc663093a00e902439571d36db391df711953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:11 +0800
+Subject: jbd2: switch to use jbd2_journal_abort() when failed to submit the
+ commit record
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit d0a186e0d3e7ac05cc77da7c157dae5aa59f95d9 ]
+
+We invoke jbd2_journal_abort() to abort the journal and record errno
+in the jbd2 superblock when committing journal transaction besides the
+failure on submitting the commit record. But there is no need for the
+case and we can also invoke jbd2_journal_abort() instead of
+__jbd2_journal_abort_hard().
+
+Fixes: 818d276ceb83a ("ext4: Add the journal checksum feature")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-2-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/commit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 2a42904bcd62c..754ec3c47d6fb 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -784,7 +784,7 @@ start_journal_io:
+ err = journal_submit_commit_record(journal, commit_transaction,
+ &cbh, crc32_sum);
+ if (err)
+- __jbd2_journal_abort_hard(journal);
++ jbd2_journal_abort(journal, err);
+ }
+
+ blk_finish_plug(&plug);
+@@ -877,7 +877,7 @@ start_journal_io:
+ err = journal_submit_commit_record(journal, commit_transaction,
+ &cbh, crc32_sum);
+ if (err)
+- __jbd2_journal_abort_hard(journal);
++ jbd2_journal_abort(journal, err);
+ }
+ if (cbh)
+ err = journal_wait_on_commit_record(journal, cbh);
+--
+2.20.1
+
--- /dev/null
+From d19b466c79501a183cfeb65bfdfc755b8270ed51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:02:24 +0900
+Subject: kbuild: remove *.tmp file when filechk fails
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 88fe89a47153facd8cb2d06d5c8727f7224c43c2 ]
+
+Bartosz Golaszewski reports that when "make {menu,n,g,x}config" fails
+due to missing packages, a temporary file is left over, which is not
+ignored by git.
+
+For example, if GTK+ is not installed:
+
+ $ make gconfig
+ *
+ * Unable to find the GTK+ installation. Please make sure that
+ * the GTK+ 2.0 development package is correctly installed.
+ * You need gtk+-2.0 gmodule-2.0 libglade-2.0
+ *
+ scripts/kconfig/Makefile:208: recipe for target 'scripts/kconfig/gconf-cfg' failed
+ make[1]: *** [scripts/kconfig/gconf-cfg] Error 1
+ Makefile:567: recipe for target 'gconfig' failed
+ make: *** [gconfig] Error 2
+ $ git status
+ HEAD detached at v5.4
+ Untracked files:
+ (use "git add <file>..." to include in what will be committed)
+
+ scripts/kconfig/gconf-cfg.tmp
+
+ nothing added to commit but untracked files present (use "git add" to track)
+
+This is because the check scripts are run with filechk, which misses
+to clean up the temporary file on failure.
+
+When the line
+
+ { $(filechk_$(1)); } > $@.tmp;
+
+... fails, it exits immediately due to the 'set -e'. Use trap to make
+sure to delete the temporary file on exit.
+
+For extra safety, I replaced $@.tmp with $(dot-target).tmp to make it
+a hidden file.
+
+Reported-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Kbuild.include | 15 +++++++--------
+ 1 file changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
+index 10ba926ae2924..d1dd4a6b6adb6 100644
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -55,14 +55,13 @@ kecho := $($(quiet)kecho)
+ # - stdin is piped in from the first prerequisite ($<) so one has
+ # to specify a valid file as first prerequisite (often the kbuild file)
+ define filechk
+- $(Q)set -e; \
+- mkdir -p $(dir $@); \
+- { $(filechk_$(1)); } > $@.tmp; \
+- if [ -r $@ ] && cmp -s $@ $@.tmp; then \
+- rm -f $@.tmp; \
+- else \
+- $(kecho) ' UPD $@'; \
+- mv -f $@.tmp $@; \
++ $(Q)set -e; \
++ mkdir -p $(dir $@); \
++ trap "rm -f $(dot-target).tmp" EXIT; \
++ { $(filechk_$(1)); } > $(dot-target).tmp; \
++ if [ ! -r $@ ] || ! cmp -s $@ $(dot-target).tmp; then \
++ $(kecho) ' UPD $@'; \
++ mv -f $(dot-target).tmp $@; \
+ fi
+ endef
+
+--
+2.20.1
+
--- /dev/null
+From 4e6f9f8368fae4e4aeaaa49b7d2873230d6768bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2020 02:14:35 +0900
+Subject: kbuild: use -S instead of -E for precise cc-option test in Kconfig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 3bed1b7b9d79ca40e41e3af130931a3225e951a3 ]
+
+Currently, -E (stop after the preprocessing stage) is used to check
+whether the given compiler flag is supported.
+
+While it is faster than -S (or -c), it can be false-positive. You need
+to run the compilation proper to check the flag more precisely.
+
+For example, -E and -S disagree about the support of
+"--param asan-instrument-allocas=1".
+
+$ gcc -Werror --param asan-instrument-allocas=1 -E -x c /dev/null -o /dev/null
+$ echo $?
+0
+
+$ gcc -Werror --param asan-instrument-allocas=1 -S -x c /dev/null -o /dev/null
+cc1: error: invalid --param name ‘asan-instrument-allocas’; did you mean ‘asan-instrument-writes’?
+$ echo $?
+1
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Kconfig.include | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
+index d4adfbe426903..bfb44b265a948 100644
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -25,7 +25,7 @@ failure = $(if-success,$(1),n,y)
+
+ # $(cc-option,<flag>)
+ # Return y if the compiler supports <flag>, n otherwise
+-cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -E -x c /dev/null -o /dev/null)
++cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -S -x c /dev/null -o /dev/null)
+
+ # $(ld-option,<flag>)
+ # Return y if the linker supports <flag>, n otherwise
+--
+2.20.1
+
--- /dev/null
+From 5c77ce00d629016a0b781084eac1625b847fe6b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 14:03:11 +0900
+Subject: kconfig: fix broken dependency in randconfig-generated .config
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit c8fb7d7e48d11520ad24808cfce7afb7b9c9f798 ]
+
+Running randconfig on arm64 using KCONFIG_SEED=0x40C5E904 (e.g. on v5.5)
+produces the .config with CONFIG_EFI=y and CONFIG_CPU_BIG_ENDIAN=y,
+which does not meet the !CONFIG_CPU_BIG_ENDIAN dependency.
+
+This is because the user choice for CONFIG_CPU_LITTLE_ENDIAN vs
+CONFIG_CPU_BIG_ENDIAN is set by randomize_choice_values() after the
+value of CONFIG_EFI is calculated.
+
+When this happens, the has_changed flag should be set.
+
+Currently, it takes the result from the last iteration. It should
+accumulate all the results of the loop.
+
+Fixes: 3b9a19e08960 ("kconfig: loop as long as we changed some symbols in randconfig")
+Reported-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/confdata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index 3569d2dec37ce..17298239e3633 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -1353,7 +1353,7 @@ bool conf_set_all_new_symbols(enum conf_def_mode mode)
+
+ sym_calc_value(csym);
+ if (mode == def_random)
+- has_changed = randomize_choice_values(csym);
++ has_changed |= randomize_choice_values(csym);
+ else {
+ set_all_choice_values(csym);
+ has_changed = true;
+--
+2.20.1
+
--- /dev/null
+From 9d24972683132dceaccfcdb9870456330da077d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 19:54:55 +0800
+Subject: kernel/module: Fix memleak in module_add_modinfo_attrs()
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit f6d061d617124abbd55396a3bc37b9bf7d33233c ]
+
+In module_add_modinfo_attrs() if sysfs_create_file() fails
+on the first iteration of the loop (so i = 0), we forget to
+free the modinfo_attrs.
+
+Fixes: bc6f2a757d52 ("kernel/module: Fix mem leak in module_add_modinfo_attrs")
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index cb09a5f37a5fc..9fb8fa22e16b3 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -1781,6 +1781,8 @@ static int module_add_modinfo_attrs(struct module *mod)
+ error_out:
+ if (i > 0)
+ module_remove_modinfo_attrs(mod, --i);
++ else
++ kfree(mod->modinfo_attrs);
+ return error;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 6bfe9a3312cceb10dccd41dc26fde0c6e88809c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 22:11:58 +0530
+Subject: kselftest: Minimise dependency of get_size on C library interfaces
+
+From: Siddhesh Poyarekar <siddhesh@gotplt.org>
+
+[ Upstream commit 6b64a650f0b2ae3940698f401732988699eecf7a ]
+
+It was observed[1] on arm64 that __builtin_strlen led to an infinite
+loop in the get_size selftest. This is because __builtin_strlen (and
+other builtins) may sometimes result in a call to the C library
+function. The C library implementation of strlen uses an IFUNC
+resolver to load the most efficient strlen implementation for the
+underlying machine and hence has a PLT indirection even for static
+binaries. Because this binary avoids the C library startup routines,
+the PLT initialization never happens and hence the program gets stuck
+in an infinite loop.
+
+On x86_64 the __builtin_strlen just happens to expand inline and avoid
+the call but that is not always guaranteed.
+
+Further, while testing on x86_64 (Fedora 31), it was observed that the
+test also failed with a segfault inside write() because the generated
+code for the write function in glibc seems to access TLS before the
+syscall (probably due to the cancellation point check) and fails
+because TLS is not initialised.
+
+To mitigate these problems, this patch reduces the interface with the
+C library to just the syscall function. The syscall function still
+sets errno on failure, which is undesirable but for now it only
+affects cases where syscalls fail.
+
+[1] https://bugs.linaro.org/show_bug.cgi?id=5479
+
+Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
+Reported-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
+Tested-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
+Reviewed-by: Tim Bird <tim.bird@sony.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/size/get_size.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/size/get_size.c b/tools/testing/selftests/size/get_size.c
+index 2ad45b9443550..2980b1a63366b 100644
+--- a/tools/testing/selftests/size/get_size.c
++++ b/tools/testing/selftests/size/get_size.c
+@@ -11,23 +11,35 @@
+ * own execution. It also attempts to have as few dependencies
+ * on kernel features as possible.
+ *
+- * It should be statically linked, with startup libs avoided.
+- * It uses no library calls, and only the following 3 syscalls:
++ * It should be statically linked, with startup libs avoided. It uses
++ * no library calls except the syscall() function for the following 3
++ * syscalls:
+ * sysinfo(), write(), and _exit()
+ *
+ * For output, it avoids printf (which in some C libraries
+ * has large external dependencies) by implementing it's own
+ * number output and print routines, and using __builtin_strlen()
++ *
++ * The test may crash if any of the above syscalls fails because in some
++ * libc implementations (e.g. the GNU C Library) errno is saved in
++ * thread-local storage, which does not get initialized due to avoiding
++ * startup libs.
+ */
+
+ #include <sys/sysinfo.h>
+ #include <unistd.h>
++#include <sys/syscall.h>
+
+ #define STDOUT_FILENO 1
+
+ static int print(const char *s)
+ {
+- return write(STDOUT_FILENO, s, __builtin_strlen(s));
++ size_t len = 0;
++
++ while (s[len] != '\0')
++ len++;
++
++ return syscall(SYS_write, STDOUT_FILENO, s, len);
+ }
+
+ static inline char *num_to_str(unsigned long num, char *buf, int len)
+@@ -79,12 +91,12 @@ void _start(void)
+ print("TAP version 13\n");
+ print("# Testing system size.\n");
+
+- ccode = sysinfo(&info);
++ ccode = syscall(SYS_sysinfo, &info);
+ if (ccode < 0) {
+ print("not ok 1");
+ print(test_name);
+ print(" ---\n reason: \"could not get sysinfo\"\n ...\n");
+- _exit(ccode);
++ syscall(SYS_exit, ccode);
+ }
+ print("ok 1");
+ print(test_name);
+@@ -100,5 +112,5 @@ void _start(void)
+ print(" ...\n");
+ print("1..1\n");
+
+- _exit(0);
++ syscall(SYS_exit, 0);
+ }
+--
+2.20.1
+
--- /dev/null
+From b863b6b4b0c208ee7e45fe2c2729d581b9c4c036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 14:27:40 +0800
+Subject: KVM: PPC: Remove set but not used variable 'ra', 'rs', 'rt'
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 4de0a8355463e068e443b48eb5ae32370155368b ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+arch/powerpc/kvm/emulate_loadstore.c: In function kvmppc_emulate_loadstore:
+arch/powerpc/kvm/emulate_loadstore.c:87:6: warning: variable ra set but not used [-Wunused-but-set-variable]
+arch/powerpc/kvm/emulate_loadstore.c: In function kvmppc_emulate_loadstore:
+arch/powerpc/kvm/emulate_loadstore.c:87:10: warning: variable rs set but not used [-Wunused-but-set-variable]
+arch/powerpc/kvm/emulate_loadstore.c: In function kvmppc_emulate_loadstore:
+arch/powerpc/kvm/emulate_loadstore.c:87:14: warning: variable rt set but not used [-Wunused-but-set-variable]
+
+They are not used since commit 2b33cb585f94 ("KVM: PPC: Reimplement
+LOAD_FP/STORE_FP instruction mmio emulation with analyse_instr() input")
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/emulate_loadstore.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/arch/powerpc/kvm/emulate_loadstore.c b/arch/powerpc/kvm/emulate_loadstore.c
+index 2e496eb86e94a..1139bc56e0045 100644
+--- a/arch/powerpc/kvm/emulate_loadstore.c
++++ b/arch/powerpc/kvm/emulate_loadstore.c
+@@ -73,7 +73,6 @@ int kvmppc_emulate_loadstore(struct kvm_vcpu *vcpu)
+ {
+ struct kvm_run *run = vcpu->run;
+ u32 inst;
+- int ra, rs, rt;
+ enum emulation_result emulated = EMULATE_FAIL;
+ int advance = 1;
+ struct instruction_op op;
+@@ -85,10 +84,6 @@ int kvmppc_emulate_loadstore(struct kvm_vcpu *vcpu)
+ if (emulated != EMULATE_DONE)
+ return emulated;
+
+- ra = get_ra(inst);
+- rs = get_rs(inst);
+- rt = get_rt(inst);
+-
+ vcpu->arch.mmio_vsx_copy_nums = 0;
+ vcpu->arch.mmio_vsx_offset = 0;
+ vcpu->arch.mmio_copy_type = KVMPPC_VSX_COPY_NONE;
+--
+2.20.1
+
--- /dev/null
+From 1d239c8395c99d0db74ffe44bd3436c56367d656 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 07:40:43 -0500
+Subject: KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+[ Upstream commit c611990844c28c61ca4b35ff69d3a2ae95ccd486 ]
+
+There is no ENOTSUPP for userspace.
+
+Reported-by: Julian Wiedmann <jwi@linux.ibm.com>
+Fixes: 519783935451 ("KVM: s390: introduce ais mode modify function")
+Fixes: 2c1a48f2e5ed ("KVM: S390: add new group for flic")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/interrupt.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index d1ccc168c0714..62388a678b91a 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -2191,7 +2191,7 @@ static int flic_ais_mode_get_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ return -EINVAL;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ mutex_lock(&fi->ais_lock);
+ ais.simm = fi->simm;
+@@ -2500,7 +2500,7 @@ static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
+ int ret = 0;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
+ return -EFAULT;
+@@ -2580,7 +2580,7 @@ static int flic_ais_mode_set_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ struct kvm_s390_ais_all ais;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&ais, (void __user *)attr->addr, sizeof(ais)))
+ return -EFAULT;
+--
+2.20.1
+
--- /dev/null
+From 2e37f9ebb4dfa4c1136d6836128037ae0124126d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 23:02:55 +0200
+Subject: leds: pca963x: Fix open-drain initialization
+
+From: Zahari Petkov <zahari@balena.io>
+
+[ Upstream commit 697529091ac7a0a90ca349b914bb30641c13c753 ]
+
+Before commit bb29b9cccd95 ("leds: pca963x: Add bindings to invert
+polarity") Mode register 2 was initialized directly with either 0x01
+or 0x05 for open-drain or totem pole (push-pull) configuration.
+
+Afterwards, MODE2 initialization started using bitwise operations on
+top of the default MODE2 register value (0x05). Using bitwise OR for
+setting OUTDRV with 0x01 and 0x05 does not produce correct results.
+When open-drain is used, instead of setting OUTDRV to 0, the driver
+keeps it as 1:
+
+Open-drain: 0x05 | 0x01 -> 0x05 (0b101 - incorrect)
+Totem pole: 0x05 | 0x05 -> 0x05 (0b101 - correct but still wrong)
+
+Now OUTDRV setting uses correct bitwise operations for initialization:
+
+Open-drain: 0x05 & ~0x04 -> 0x01 (0b001 - correct)
+Totem pole: 0x05 | 0x04 -> 0x05 (0b101 - correct)
+
+Additional MODE2 register definitions are introduced now as well.
+
+Fixes: bb29b9cccd95 ("leds: pca963x: Add bindings to invert polarity")
+Signed-off-by: Zahari Petkov <zahari@balena.io>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-pca963x.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/leds/leds-pca963x.c b/drivers/leds/leds-pca963x.c
+index 4afc317901a89..66cdc003b8f42 100644
+--- a/drivers/leds/leds-pca963x.c
++++ b/drivers/leds/leds-pca963x.c
+@@ -40,6 +40,8 @@
+ #define PCA963X_LED_PWM 0x2 /* Controlled through PWM */
+ #define PCA963X_LED_GRP_PWM 0x3 /* Controlled through PWM/GRPPWM */
+
++#define PCA963X_MODE2_OUTDRV 0x04 /* Open-drain or totem pole */
++#define PCA963X_MODE2_INVRT 0x10 /* Normal or inverted direction */
+ #define PCA963X_MODE2_DMBLNK 0x20 /* Enable blinking */
+
+ #define PCA963X_MODE1 0x00
+@@ -438,12 +440,12 @@ static int pca963x_probe(struct i2c_client *client,
+ PCA963X_MODE2);
+ /* Configure output: open-drain or totem pole (push-pull) */
+ if (pdata->outdrv == PCA963X_OPEN_DRAIN)
+- mode2 |= 0x01;
++ mode2 &= ~PCA963X_MODE2_OUTDRV;
+ else
+- mode2 |= 0x05;
++ mode2 |= PCA963X_MODE2_OUTDRV;
+ /* Configure direction: normal or inverted */
+ if (pdata->dir == PCA963X_INVERTED)
+- mode2 |= 0x10;
++ mode2 |= PCA963X_MODE2_INVRT;
+ i2c_smbus_write_byte_data(pca963x->chip->client, PCA963X_MODE2,
+ mode2);
+ }
+--
+2.20.1
+
--- /dev/null
+From 935ae80855b1cb627b4c6c720810ba16a5aaf047 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:16:37 -0800
+Subject: lib/scatterlist.c: adjust indentation in __sg_alloc_table
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4e456fee215677584cafa7f67298a76917e89c64 ]
+
+Clang warns:
+
+ ../lib/scatterlist.c:314:5: warning: misleading indentation; statement
+ is not part of the previous 'if' [-Wmisleading-indentation]
+ return -ENOMEM;
+ ^
+ ../lib/scatterlist.c:311:4: note: previous statement is here
+ if (prv)
+ ^
+ 1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+Link: http://lkml.kernel.org/r/20191218033606.11942-1-natechancellor@gmail.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/830
+Fixes: edce6820a9fd ("scatterlist: prevent invalid free when alloc fails")
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/scatterlist.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index c2cf2c311b7db..5813072bc5895 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -311,7 +311,7 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
+ if (prv)
+ table->nents = ++table->orig_nents;
+
+- return -ENOMEM;
++ return -ENOMEM;
+ }
+
+ sg_init_table(sg, alloc_size);
+--
+2.20.1
+
--- /dev/null
+From cdbd99ab8664b76edd3048cb01ef96b8ea22579b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2019 23:38:40 +0100
+Subject: media: cx23885: Add support for AVerMedia CE310B
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit dc4cac67e13515835ed8081d510aa507aacb013b ]
+
+The AVerMedia CE310B is a simple composite + S-Video + stereo audio
+capture card, and uses only the CX23888 to perform all of these
+functions.
+
+I've tested both video inputs and the audio interface and confirmed that
+they're all working. However, there are some issues:
+
+* Sometimes when I switch inputs the video signal turns black and can't
+ be recovered until the system is rebooted. I haven't been able to
+ determine the cause of this behavior, nor have I found a solution to
+ fix it or any workarounds other than rebooting.
+* The card sometimes seems to have trouble syncing to the video signal,
+ and some of the VBI data appears as noise at the top of the frame, but
+ I assume that to be a result of my very noisy RF environment and the
+ card's unshielded input traces rather than a configuration issue.
+
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx23885/cx23885-cards.c | 24 +++++++++++++++++++++++
+ drivers/media/pci/cx23885/cx23885-video.c | 3 ++-
+ drivers/media/pci/cx23885/cx23885.h | 1 +
+ 3 files changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c
+index 8644205d3cd33..8e5a2c580821e 100644
+--- a/drivers/media/pci/cx23885/cx23885-cards.c
++++ b/drivers/media/pci/cx23885/cx23885-cards.c
+@@ -801,6 +801,25 @@ struct cx23885_board cx23885_boards[] = {
+ .name = "Hauppauge WinTV-Starburst2",
+ .portb = CX23885_MPEG_DVB,
+ },
++ [CX23885_BOARD_AVERMEDIA_CE310B] = {
++ .name = "AVerMedia CE310B",
++ .porta = CX23885_ANALOG_VIDEO,
++ .force_bff = 1,
++ .input = {{
++ .type = CX23885_VMUX_COMPOSITE1,
++ .vmux = CX25840_VIN1_CH1 |
++ CX25840_NONE_CH2 |
++ CX25840_NONE0_CH3,
++ .amux = CX25840_AUDIO7,
++ }, {
++ .type = CX23885_VMUX_SVIDEO,
++ .vmux = CX25840_VIN8_CH1 |
++ CX25840_NONE_CH2 |
++ CX25840_VIN7_CH3 |
++ CX25840_SVIDEO_ON,
++ .amux = CX25840_AUDIO7,
++ } },
++ },
+ };
+ const unsigned int cx23885_bcount = ARRAY_SIZE(cx23885_boards);
+
+@@ -1124,6 +1143,10 @@ struct cx23885_subid cx23885_subids[] = {
+ .subvendor = 0x0070,
+ .subdevice = 0xf02a,
+ .card = CX23885_BOARD_HAUPPAUGE_STARBURST2,
++ }, {
++ .subvendor = 0x1461,
++ .subdevice = 0x3100,
++ .card = CX23885_BOARD_AVERMEDIA_CE310B,
+ },
+ };
+ const unsigned int cx23885_idcount = ARRAY_SIZE(cx23885_subids);
+@@ -2348,6 +2371,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
+ case CX23885_BOARD_DVBSKY_T982:
+ case CX23885_BOARD_VIEWCAST_260E:
+ case CX23885_BOARD_VIEWCAST_460E:
++ case CX23885_BOARD_AVERMEDIA_CE310B:
+ dev->sd_cx25840 = v4l2_i2c_new_subdev(&dev->v4l2_dev,
+ &dev->i2c_bus[2].i2c_adap,
+ "cx25840", 0x88 >> 1, NULL);
+diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c
+index 8098b15493de9..7fc408ee4934f 100644
+--- a/drivers/media/pci/cx23885/cx23885-video.c
++++ b/drivers/media/pci/cx23885/cx23885-video.c
+@@ -257,7 +257,8 @@ static int cx23885_video_mux(struct cx23885_dev *dev, unsigned int input)
+ (dev->board == CX23885_BOARD_MYGICA_X8507) ||
+ (dev->board == CX23885_BOARD_AVERMEDIA_HC81R) ||
+ (dev->board == CX23885_BOARD_VIEWCAST_260E) ||
+- (dev->board == CX23885_BOARD_VIEWCAST_460E)) {
++ (dev->board == CX23885_BOARD_VIEWCAST_460E) ||
++ (dev->board == CX23885_BOARD_AVERMEDIA_CE310B)) {
+ /* Configure audio routing */
+ v4l2_subdev_call(dev->sd_cx25840, audio, s_routing,
+ INPUT(input)->amux, 0, 0);
+diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h
+index a95a2e4c6a0d3..c472498e57c4e 100644
+--- a/drivers/media/pci/cx23885/cx23885.h
++++ b/drivers/media/pci/cx23885/cx23885.h
+@@ -101,6 +101,7 @@
+ #define CX23885_BOARD_HAUPPAUGE_STARBURST2 59
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_DVB_885 60
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_ATSC_885 61
++#define CX23885_BOARD_AVERMEDIA_CE310B 62
+
+ #define GPIO_0 0x00000001
+ #define GPIO_1 0x00000002
+--
+2.20.1
+
--- /dev/null
+From f256c775360954dac1cc1dafb88bd5fc7acd7277 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 08:55:24 +0100
+Subject: media: i2c: mt9v032: fix enum mbus codes and frame sizes
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 1451d5ae351d938a0ab1677498c893f17b9ee21d ]
+
+This driver supports both the mt9v032 (color) and the mt9v022 (mono)
+sensors. Depending on which sensor is used, the format from the sensor is
+different. The format.code inside the dev struct holds this information.
+The enum mbus and enum frame sizes need to take into account both type of
+sensors, not just the color one. To solve this, use the format.code in
+these functions instead of the hardcoded bayer color format (which is only
+used for mt9v032).
+
+[Sakari Ailus: rewrapped commit message]
+
+Suggested-by: Wenyou Yang <wenyou.yang@microchip.com>
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9v032.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/mt9v032.c b/drivers/media/i2c/mt9v032.c
+index 4b9b98cf6674c..5bd3ae82992f3 100644
+--- a/drivers/media/i2c/mt9v032.c
++++ b/drivers/media/i2c/mt9v032.c
+@@ -428,10 +428,12 @@ static int mt9v032_enum_mbus_code(struct v4l2_subdev *subdev,
+ struct v4l2_subdev_pad_config *cfg,
+ struct v4l2_subdev_mbus_code_enum *code)
+ {
++ struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
+ if (code->index > 0)
+ return -EINVAL;
+
+- code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++ code->code = mt9v032->format.code;
+ return 0;
+ }
+
+@@ -439,7 +441,11 @@ static int mt9v032_enum_frame_size(struct v4l2_subdev *subdev,
+ struct v4l2_subdev_pad_config *cfg,
+ struct v4l2_subdev_frame_size_enum *fse)
+ {
+- if (fse->index >= 3 || fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++ struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
++ if (fse->index >= 3)
++ return -EINVAL;
++ if (mt9v032->format.code != fse->code)
+ return -EINVAL;
+
+ fse->min_width = MT9V032_WINDOW_WIDTH_DEF / (1 << fse->index);
+--
+2.20.1
+
--- /dev/null
+From 7610346626485c83258874968320e1f1e04c09e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 15:11:59 +0100
+Subject: media: meson: add missing allocation failure check on new_buf
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 11e0e167d071a28288a7a0a211d48c571d19b56f ]
+
+Currently if the allocation of new_buf fails then a null pointer
+dereference occurs when assiging new_buf->vb. Avoid this by returning
+early on a memory allocation failure as there is not much more can
+be done at this point.
+
+Addresses-Coverity: ("Dereference null return")
+
+Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/media/meson/vdec/vdec.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
+index 0a1a04fd5d13d..8dd1396909d7e 100644
+--- a/drivers/staging/media/meson/vdec/vdec.c
++++ b/drivers/staging/media/meson/vdec/vdec.c
+@@ -133,6 +133,8 @@ vdec_queue_recycle(struct amvdec_session *sess, struct vb2_buffer *vb)
+ struct amvdec_buffer *new_buf;
+
+ new_buf = kmalloc(sizeof(*new_buf), GFP_KERNEL);
++ if (!new_buf)
++ return;
+ new_buf->vb = vb;
+
+ mutex_lock(&sess->bufs_recycle_lock);
+--
+2.20.1
+
--- /dev/null
+From 838a685d16e5c332d0041d6e07d51b6a506e2124 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 13:42:11 +0100
+Subject: media: ov5640: Fix check for PLL1 exceeding max allowed rate
+
+From: Adam Ford <aford173@gmail.com>
+
+[ Upstream commit 2e3df204f9af42a47823ee955c08950373417420 ]
+
+The variable _rate is by ov5640_compute_sys_clk() which returns
+zero if the PLL exceeds 1GHz. Unfortunately, the check to see
+if the max PLL1 output is checking 'rate' and not '_rate' and
+'rate' does not ever appear to be 0.
+
+This patch changes the check against the returned value of
+'_rate' to determine if the PLL1 output exceeds 1GHz.
+
+Fixes: aa2882481cad ("media: ov5640: Adjust the clock based on the expected rate")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov5640.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
+index 18dd2d717088b..a398ea81e422b 100644
+--- a/drivers/media/i2c/ov5640.c
++++ b/drivers/media/i2c/ov5640.c
+@@ -874,7 +874,7 @@ static unsigned long ov5640_calc_sys_clk(struct ov5640_dev *sensor,
+ * We have reached the maximum allowed PLL1 output,
+ * increase sysdiv.
+ */
+- if (!rate)
++ if (!_rate)
+ break;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 4d76e8fc294762ed5d5dd5963fb961c4ca4fbf34 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 11:34:01 +0100
+Subject: media: sti: bdisp: fix a possible sleep-in-atomic-context bug in
+ bdisp_device_run()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit bb6d42061a05d71dd73f620582d9e09c8fbf7f5b ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/media/platform/sti/bdisp/bdisp-hw.c, 385:
+ msleep in bdisp_hw_reset
+drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 341:
+ bdisp_hw_reset in bdisp_device_run
+drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 317:
+ _raw_spin_lock_irqsave in bdisp_device_run
+
+To fix this bug, msleep() is replaced with udelay().
+
+This bug is found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Fabien Dessenne <fabien.dessenne@st.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sti/bdisp/bdisp-hw.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-hw.c b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+index 4372abbb5950f..a74e9fd652389 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-hw.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+@@ -14,8 +14,8 @@
+ #define MAX_SRC_WIDTH 2048
+
+ /* Reset & boot poll config */
+-#define POLL_RST_MAX 50
+-#define POLL_RST_DELAY_MS 20
++#define POLL_RST_MAX 500
++#define POLL_RST_DELAY_MS 2
+
+ enum bdisp_target_plan {
+ BDISP_RGB,
+@@ -382,7 +382,7 @@ int bdisp_hw_reset(struct bdisp_dev *bdisp)
+ for (i = 0; i < POLL_RST_MAX; i++) {
+ if (readl(bdisp->regs + BLT_STA1) & BLT_STA1_IDLE)
+ break;
+- msleep(POLL_RST_DELAY_MS);
++ udelay(POLL_RST_DELAY_MS * 1000);
+ }
+ if (i == POLL_RST_MAX)
+ dev_err(bdisp->dev, "Reset timeout\n");
+--
+2.20.1
+
--- /dev/null
+From a537b718ae192624b92f1ac215217662f819b9ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 17:59:15 +0100
+Subject: media: sun4i-csi: Deal with DRAM offset
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 249b286171fa9c358e8d5c825b48c4ebea97c498 ]
+
+On Allwinner SoCs, some high memory bandwidth devices do DMA directly
+over the memory bus (called MBUS), instead of the system bus. These
+devices include the CSI camera sensor interface, video (codec) engine,
+display subsystem, etc.. The memory bus has a different addressing
+scheme without the DRAM starting offset.
+
+Deal with this using the "interconnects" property from the device tree,
+or if that is not available, set dev->dma_pfn_offset to PHYS_PFN_OFFSET.
+
+Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../platform/sunxi/sun4i-csi/sun4i_csi.c | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
+index f36dc6258900e..b8b07c1de2a8e 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.c
+@@ -11,6 +11,7 @@
+ #include <linux/module.h>
+ #include <linux/mutex.h>
+ #include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/of_graph.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+@@ -155,6 +156,27 @@ static int sun4i_csi_probe(struct platform_device *pdev)
+ subdev = &csi->subdev;
+ vdev = &csi->vdev;
+
++ /*
++ * On Allwinner SoCs, some high memory bandwidth devices do DMA
++ * directly over the memory bus (called MBUS), instead of the
++ * system bus. The memory bus has a different addressing scheme
++ * without the DRAM starting offset.
++ *
++ * In some cases this can be described by an interconnect in
++ * the device tree. In other cases where the hardware is not
++ * fully understood and the interconnect is left out of the
++ * device tree, fall back to a default offset.
++ */
++ if (of_find_property(csi->dev->of_node, "interconnects", NULL)) {
++ ret = of_dma_configure(csi->dev, csi->dev->of_node, true);
++ if (ret)
++ return ret;
++ } else {
++#ifdef PHYS_PFN_OFFSET
++ csi->dev->dma_pfn_offset = PHYS_PFN_OFFSET;
++#endif
++ }
++
+ csi->mdev.dev = csi->dev;
+ strscpy(csi->mdev.model, "Allwinner Video Capture Device",
+ sizeof(csi->mdev.model));
+--
+2.20.1
+
--- /dev/null
+From 26c3eea785b32983beee9223bac7bc0619b6e1a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 17:59:13 +0100
+Subject: media: sun4i-csi: Fix data sampling polarity handling
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit cf9e6d5dbdd56ef2aa72f28c806711c4293c8848 ]
+
+The CLK_POL field specifies whether data is sampled on the falling or
+rising edge of PCLK, not whether the data lines are active high or low.
+Evidence of this can be found in the timing diagram labeled "horizontal
+size setting and pixel clock timing".
+
+Fix the setting by checking the correct flag, V4L2_MBUS_PCLK_SAMPLE_RISING.
+While at it, reorder the three polarity flag checks so HSYNC and VSYNC
+are grouped together.
+
+Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+index d6979e11a67b2..8b567d0f019bf 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+@@ -279,8 +279,8 @@ static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ csi->regs + CSI_WIN_CTRL_H_REG);
+
+ hsync_pol = !!(bus->flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH);
+- pclk_pol = !!(bus->flags & V4L2_MBUS_DATA_ACTIVE_HIGH);
+ vsync_pol = !!(bus->flags & V4L2_MBUS_VSYNC_ACTIVE_HIGH);
++ pclk_pol = !!(bus->flags & V4L2_MBUS_PCLK_SAMPLE_RISING);
+ writel(CSI_CFG_INPUT_FMT(csi_fmt->input) |
+ CSI_CFG_OUTPUT_FMT(csi_fmt->output) |
+ CSI_CFG_VSYNC_POL(vsync_pol) |
+--
+2.20.1
+
--- /dev/null
+From 8ee8c45b515ad94f12cc2deaa2bee8a4f90c0ce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 17:59:14 +0100
+Subject: media: sun4i-csi: Fix [HV]sync polarity handling
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 1948dcf0f928b8bcdca57ca3fba8545ba380fc29 ]
+
+The Allwinner camera sensor interface has a different definition of
+[HV]sync. While the timing diagram uses the names HSYNC and VSYNC,
+the note following the diagram and register names use HREF and VREF.
+Combined they imply the hardware uses either [HV]REF or inverted
+[HV]SYNC. There are also registers to set horizontal skip lengths
+in pixels and vertical skip lengths in lines, also known as back
+porches.
+
+Fix the polarity handling by using the opposite polarity flag for
+the checks. Also rename `[hv]sync_pol` to `[hv]ref_pol` to better
+match the hardware register description.
+
+Fixes: 577bbf23b758 ("media: sunxi: Add A10 CSI driver")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../media/platform/sunxi/sun4i-csi/sun4i_csi.h | 4 ++--
+ .../media/platform/sunxi/sun4i-csi/sun4i_dma.c | 18 +++++++++++++-----
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h
+index 001c8bde006ce..88d39b3554c4b 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_csi.h
+@@ -22,8 +22,8 @@
+ #define CSI_CFG_INPUT_FMT(fmt) ((fmt) << 20)
+ #define CSI_CFG_OUTPUT_FMT(fmt) ((fmt) << 16)
+ #define CSI_CFG_YUV_DATA_SEQ(seq) ((seq) << 8)
+-#define CSI_CFG_VSYNC_POL(pol) ((pol) << 2)
+-#define CSI_CFG_HSYNC_POL(pol) ((pol) << 1)
++#define CSI_CFG_VREF_POL(pol) ((pol) << 2)
++#define CSI_CFG_HREF_POL(pol) ((pol) << 1)
+ #define CSI_CFG_PCLK_POL(pol) ((pol) << 0)
+
+ #define CSI_CPT_CTRL_REG 0x08
+diff --git a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+index 8b567d0f019bf..78fa1c535ac64 100644
+--- a/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
++++ b/drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c
+@@ -228,7 +228,7 @@ static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ struct sun4i_csi *csi = vb2_get_drv_priv(vq);
+ struct v4l2_fwnode_bus_parallel *bus = &csi->bus;
+ const struct sun4i_csi_format *csi_fmt;
+- unsigned long hsync_pol, pclk_pol, vsync_pol;
++ unsigned long href_pol, pclk_pol, vref_pol;
+ unsigned long flags;
+ unsigned int i;
+ int ret;
+@@ -278,13 +278,21 @@ static int sun4i_csi_start_streaming(struct vb2_queue *vq, unsigned int count)
+ writel(CSI_WIN_CTRL_H_ACTIVE(csi->fmt.height),
+ csi->regs + CSI_WIN_CTRL_H_REG);
+
+- hsync_pol = !!(bus->flags & V4L2_MBUS_HSYNC_ACTIVE_HIGH);
+- vsync_pol = !!(bus->flags & V4L2_MBUS_VSYNC_ACTIVE_HIGH);
++ /*
++ * This hardware uses [HV]REF instead of [HV]SYNC. Based on the
++ * provided timing diagrams in the manual, positive polarity
++ * equals active high [HV]REF.
++ *
++ * When the back porch is 0, [HV]REF is more or less equivalent
++ * to [HV]SYNC inverted.
++ */
++ href_pol = !!(bus->flags & V4L2_MBUS_HSYNC_ACTIVE_LOW);
++ vref_pol = !!(bus->flags & V4L2_MBUS_VSYNC_ACTIVE_LOW);
+ pclk_pol = !!(bus->flags & V4L2_MBUS_PCLK_SAMPLE_RISING);
+ writel(CSI_CFG_INPUT_FMT(csi_fmt->input) |
+ CSI_CFG_OUTPUT_FMT(csi_fmt->output) |
+- CSI_CFG_VSYNC_POL(vsync_pol) |
+- CSI_CFG_HSYNC_POL(hsync_pol) |
++ CSI_CFG_VREF_POL(vref_pol) |
++ CSI_CFG_HREF_POL(href_pol) |
+ CSI_CFG_PCLK_POL(pclk_pol),
+ csi->regs + CSI_CFG_REG);
+
+--
+2.20.1
+
--- /dev/null
+From ca8f8fe96e11a623210da349934f220a397a683b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 11:31:23 +0200
+Subject: media: uvcvideo: Add a quirk to force GEO GC6500 Camera
+ bits-per-pixel value
+
+From: Sergey Zakharchenko <szakharchenko@digital-loggers.com>
+
+[ Upstream commit 1dd2e8f942574e2be18374ebb81751082d8d467c ]
+
+This device does not function correctly in raw mode in kernel
+versions validating buffer sizes in bulk mode. It erroneously
+announces 16 bits per pixel instead of 12 for NV12 format, so it
+needs this quirk to fix computed frame size and avoid legitimate
+frames getting discarded.
+
+[Move info and div variables to local scope]
+
+Signed-off-by: Sergey Zakharchenko <szakharchenko@digital-loggers.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 25 +++++++++++++++++++++++++
+ drivers/media/usb/uvc/uvcvideo.h | 1 +
+ 2 files changed, 26 insertions(+)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 2b688cc39bb81..99883550375e9 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -497,6 +497,22 @@ static int uvc_parse_format(struct uvc_device *dev,
+ }
+ }
+
++ /* Some devices report bpp that doesn't match the format. */
++ if (dev->quirks & UVC_QUIRK_FORCE_BPP) {
++ const struct v4l2_format_info *info =
++ v4l2_format_info(format->fcc);
++
++ if (info) {
++ unsigned int div = info->hdiv * info->vdiv;
++
++ n = info->bpp[0] * div;
++ for (i = 1; i < info->comp_planes; i++)
++ n += info->bpp[i];
++
++ format->bpp = DIV_ROUND_UP(8 * n, div);
++ }
++ }
++
+ if (buffer[2] == UVC_VS_FORMAT_UNCOMPRESSED) {
+ ftype = UVC_VS_FRAME_UNCOMPRESSED;
+ } else {
+@@ -2874,6 +2890,15 @@ static const struct usb_device_id uvc_ids[] = {
+ .bInterfaceSubClass = 1,
+ .bInterfaceProtocol = 0,
+ .driver_info = (kernel_ulong_t)&uvc_quirk_force_y8 },
++ /* GEO Semiconductor GC6500 */
++ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
++ | USB_DEVICE_ID_MATCH_INT_INFO,
++ .idVendor = 0x29fe,
++ .idProduct = 0x4d53,
++ .bInterfaceClass = USB_CLASS_VIDEO,
++ .bInterfaceSubClass = 1,
++ .bInterfaceProtocol = 0,
++ .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_FORCE_BPP) },
+ /* Intel RealSense D4M */
+ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE
+ | USB_DEVICE_ID_MATCH_INT_INFO,
+diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
+index c7c1baa90dea8..24e3d8c647e77 100644
+--- a/drivers/media/usb/uvc/uvcvideo.h
++++ b/drivers/media/usb/uvc/uvcvideo.h
+@@ -198,6 +198,7 @@
+ #define UVC_QUIRK_RESTRICT_FRAME_RATE 0x00000200
+ #define UVC_QUIRK_RESTORE_CTRLS_ON_INIT 0x00000400
+ #define UVC_QUIRK_FORCE_Y8 0x00000800
++#define UVC_QUIRK_FORCE_BPP 0x00001000
+
+ /* Format flags */
+ #define UVC_FMT_FLAG_COMPRESSED 0x00000001
+--
+2.20.1
+
--- /dev/null
+From 4957ff12d57e0837fabee51cbaa4acc6fe069577 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Dec 2019 22:11:40 +0100
+Subject: media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in
+ v4l2_device macros
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit afb34781620274236bd9fc9246e22f6963ef5262 ]
+
+When building with Clang + -Wtautological-constant-compare, several of
+the ivtv and cx18 drivers warn along the lines of:
+
+ drivers/media/pci/cx18/cx18-driver.c:1005:21: warning: converting the
+ result of '<<' to a boolean always evaluates to true
+ [-Wtautological-constant-compare]
+ cx18_call_hw(cx, CX18_HW_GPIO_RESET_CTRL,
+ ^
+ drivers/media/pci/cx18/cx18-cards.h:18:37: note: expanded from macro
+ 'CX18_HW_GPIO_RESET_CTRL'
+ #define CX18_HW_GPIO_RESET_CTRL (1 << 6)
+ ^
+ 1 warning generated.
+
+This warning happens because the shift operation is implicitly converted
+to a boolean in v4l2_device_mask_call_all before being negated. This can
+be solved by just comparing the mask result to 0 explicitly so that
+there is no boolean conversion. The ultimate goal is to enable
+-Wtautological-compare globally because there are several subwarnings
+that would be helpful to have.
+
+For visual consistency and avoidance of these warnings in the future,
+all of the implicitly boolean conversions in the v4l2_device macros
+are converted to explicit ones as well.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/752
+
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/media/v4l2-device.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
+index e0b8f2602670d..a0e93f0ef62a1 100644
+--- a/include/media/v4l2-device.h
++++ b/include/media/v4l2-device.h
+@@ -371,7 +371,7 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ struct v4l2_subdev *__sd; \
+ \
+ __v4l2_device_call_subdevs_p(v4l2_dev, __sd, \
+- !(grpid) || __sd->grp_id == (grpid), o, f , \
++ (grpid) == 0 || __sd->grp_id == (grpid), o, f , \
+ ##args); \
+ } while (0)
+
+@@ -403,7 +403,7 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ ({ \
+ struct v4l2_subdev *__sd; \
+ __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, \
+- !(grpid) || __sd->grp_id == (grpid), o, f , \
++ (grpid) == 0 || __sd->grp_id == (grpid), o, f , \
+ ##args); \
+ })
+
+@@ -431,8 +431,8 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ struct v4l2_subdev *__sd; \
+ \
+ __v4l2_device_call_subdevs_p(v4l2_dev, __sd, \
+- !(grpmsk) || (__sd->grp_id & (grpmsk)), o, f , \
+- ##args); \
++ (grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o, \
++ f , ##args); \
+ } while (0)
+
+ /**
+@@ -462,8 +462,8 @@ static inline bool v4l2_device_supports_requests(struct v4l2_device *v4l2_dev)
+ ({ \
+ struct v4l2_subdev *__sd; \
+ __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, \
+- !(grpmsk) || (__sd->grp_id & (grpmsk)), o, f , \
+- ##args); \
++ (grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o, \
++ f , ##args); \
+ })
+
+
+--
+2.20.1
+
--- /dev/null
+From d3a3bb3c17ab7d0cd9102de06c986053cdec8d42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 18:44:34 +0530
+Subject: microblaze: Prevent the overflow of the start
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+
+[ Upstream commit 061d2c1d593076424c910cb1b64ecdb5c9a6923f ]
+
+In case the start + cache size is more than the max int the
+start overflows.
+Prevent the same.
+
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/kernel/cpu/cache.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/microblaze/kernel/cpu/cache.c b/arch/microblaze/kernel/cpu/cache.c
+index 0bde47e4fa694..dcba53803fa5f 100644
+--- a/arch/microblaze/kernel/cpu/cache.c
++++ b/arch/microblaze/kernel/cpu/cache.c
+@@ -92,7 +92,8 @@ static inline void __disable_dcache_nomsr(void)
+ #define CACHE_LOOP_LIMITS(start, end, cache_line_length, cache_size) \
+ do { \
+ int align = ~(cache_line_length - 1); \
+- end = min(start + cache_size, end); \
++ if (start < UINT_MAX - cache_size) \
++ end = min(start + cache_size, end); \
+ start &= align; \
+ } while (0)
+
+--
+2.20.1
+
--- /dev/null
+From 0b109a260e3cb0c5eec67dbf7272796c96836b50 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 09:30:42 +0800
+Subject: MIPS: Loongson: Fix potential NULL dereference in
+ loongson3_platform_init()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 72d052e28d1d2363f9107be63ef3a3afdea6143c ]
+
+If kzalloc fails, it should return -ENOMEM, otherwise may trigger a NULL
+pointer dereference.
+
+Fixes: 3adeb2566b9b ("MIPS: Loongson: Improve LEFI firmware interface")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/loongson64/loongson-3/platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/mips/loongson64/loongson-3/platform.c b/arch/mips/loongson64/loongson-3/platform.c
+index 13f3404f00300..9674ae1361a85 100644
+--- a/arch/mips/loongson64/loongson-3/platform.c
++++ b/arch/mips/loongson64/loongson-3/platform.c
+@@ -27,6 +27,9 @@ static int __init loongson3_platform_init(void)
+ continue;
+
+ pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL);
++ if (!pdev)
++ return -ENOMEM;
++
+ pdev->name = loongson_sysconf.sensors[i].name;
+ pdev->id = loongson_sysconf.sensors[i].id;
+ pdev->dev.platform_data = &loongson_sysconf.sensors[i];
+--
+2.20.1
+
--- /dev/null
+From 9b23533a261d0e2c5dab7db701f5885a52d4b91d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 22:36:55 +0100
+Subject: misc: xilinx_sdfec: fix xsdfec_poll()'s return type
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit fa4e7fc1386078edcfddd8848cb0374f4af74fe7 ]
+
+xsdfec_poll() is defined as returning 'unsigned int' but the
+.poll method is declared as returning '__poll_t', a bitwise type.
+
+Fix this by using the proper return type and using the EPOLL
+constants instead of the POLL ones, as required for __poll_t.
+
+CC: Derek Kiernan <derek.kiernan@xilinx.com>
+CC: Dragan Cvetic <dragan.cvetic@xilinx.com>
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Acked-by: Dragan Cvetic <dragan.cvetic@xilinx.com>
+Link: https://lore.kernel.org/r/20191209213655.57985-1-luc.vanoostenryck@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/xilinx_sdfec.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/misc/xilinx_sdfec.c b/drivers/misc/xilinx_sdfec.c
+index 11835969e9828..48ba7e02bed72 100644
+--- a/drivers/misc/xilinx_sdfec.c
++++ b/drivers/misc/xilinx_sdfec.c
+@@ -1025,25 +1025,25 @@ static long xsdfec_dev_compat_ioctl(struct file *file, unsigned int cmd,
+ }
+ #endif
+
+-static unsigned int xsdfec_poll(struct file *file, poll_table *wait)
++static __poll_t xsdfec_poll(struct file *file, poll_table *wait)
+ {
+- unsigned int mask = 0;
++ __poll_t mask = 0;
+ struct xsdfec_dev *xsdfec;
+
+ xsdfec = container_of(file->private_data, struct xsdfec_dev, miscdev);
+
+ if (!xsdfec)
+- return POLLNVAL | POLLHUP;
++ return EPOLLNVAL | EPOLLHUP;
+
+ poll_wait(file, &xsdfec->waitq, wait);
+
+ /* XSDFEC ISR detected an error */
+ spin_lock_irqsave(&xsdfec->error_data_lock, xsdfec->flags);
+ if (xsdfec->state_updated)
+- mask |= POLLIN | POLLPRI;
++ mask |= EPOLLIN | EPOLLPRI;
+
+ if (xsdfec->stats_updated)
+- mask |= POLLIN | POLLRDNORM;
++ mask |= EPOLLIN | EPOLLRDNORM;
+ spin_unlock_irqrestore(&xsdfec->error_data_lock, xsdfec->flags);
+
+ return mask;
+--
+2.20.1
+
--- /dev/null
+From d7764762db79c1d25f1274e8bf1529ad563d66d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 22:51:44 +0100
+Subject: mlx5: work around high stack usage with gcc
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 42ae1a5c76691928ed217c7e40269db27f5225e9 ]
+
+In some configurations, gcc tries too hard to optimize this code:
+
+drivers/net/ethernet/mellanox/mlx5/core/en_stats.c: In function 'mlx5e_grp_sw_update_stats':
+drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:302:1: error: the frame size of 1336 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+As was stated in the bug report, the reason is that gcc runs into a corner
+case in the register allocator that is rather hard to fix in a good way.
+
+As there is an easy way to work around it, just add a comment and the
+barrier that stops gcc from trying to overoptimize the function.
+
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92657
+Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 9f09253f9f466..a05158472ed11 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -297,6 +297,9 @@ static void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
+ s->tx_tls_drop_bypass_req += sq_stats->tls_drop_bypass_req;
+ #endif
+ s->tx_cqes += sq_stats->cqes;
++
++ /* https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92657 */
++ barrier();
+ }
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 818ca8c6235e34dc4d4bfb0e2975032753ba03ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 19:26:28 +0200
+Subject: mlxsw: spectrum_dpipe: Add missing error path
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 3a99cbb6fa7bca1995586ec2dc21b0368aad4937 ]
+
+In case devlink_dpipe_entry_ctx_prepare() failed, release RTNL that was
+previously taken and free the memory allocated by
+mlxsw_sp_erif_entry_prepare().
+
+Fixes: 2ba5999f009d ("mlxsw: spectrum: Add Support for erif table entries access")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+index 49933818c6f59..2dc0978428e64 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+@@ -215,7 +215,7 @@ mlxsw_sp_dpipe_table_erif_entries_dump(void *priv, bool counters_enabled,
+ start_again:
+ err = devlink_dpipe_entry_ctx_prepare(dump_ctx);
+ if (err)
+- return err;
++ goto err_ctx_prepare;
+ j = 0;
+ for (; i < rif_count; i++) {
+ struct mlxsw_sp_rif *rif = mlxsw_sp_rif_by_index(mlxsw_sp, i);
+@@ -247,6 +247,7 @@ start_again:
+ return 0;
+ err_entry_append:
+ err_entry_get:
++err_ctx_prepare:
+ rtnl_unlock();
+ devlink_dpipe_entry_clear(&entry);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From c722ddf3590c78aca2d9f64c5ab2bfc7aa352f6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 13:32:21 +0100
+Subject: module: avoid setting info->name early in case we can fall back to
+ info->mod->name
+
+From: Jessica Yu <jeyu@kernel.org>
+
+[ Upstream commit 708e0ada1916be765b7faa58854062f2bc620bbf ]
+
+In setup_load_info(), info->name (which contains the name of the module,
+mostly used for early logging purposes before the module gets set up)
+gets unconditionally assigned if .modinfo is missing despite the fact
+that there is an if (!info->name) check near the end of the function.
+Avoid assigning a placeholder string to info->name if .modinfo doesn't
+exist, so that we can fall back to info->mod->name later on.
+
+Fixes: 5fdc7db6448a ("module: setup load info before module_sig_check()")
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 135861c2ac782..a2a47f4a33a78 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -3059,9 +3059,7 @@ static int setup_load_info(struct load_info *info, int flags)
+
+ /* Try to find a name early so we can log errors with a module name */
+ info->index.info = find_sec(info, ".modinfo");
+- if (!info->index.info)
+- info->name = "(missing .modinfo section)";
+- else
++ if (info->index.info)
+ info->name = get_modinfo(info, "name");
+
+ /* Find internal symbols and strings. */
+@@ -3076,14 +3074,15 @@ static int setup_load_info(struct load_info *info, int flags)
+ }
+
+ if (info->index.sym == 0) {
+- pr_warn("%s: module has no symbols (stripped?)\n", info->name);
++ pr_warn("%s: module has no symbols (stripped?)\n",
++ info->name ?: "(missing .modinfo section or name field)");
+ return -ENOEXEC;
+ }
+
+ info->index.mod = find_sec(info, ".gnu.linkonce.this_module");
+ if (!info->index.mod) {
+ pr_warn("%s: No module found in object\n",
+- info->name ?: "(missing .modinfo name field)");
++ info->name ?: "(missing .modinfo section or name field)");
+ return -ENOEXEC;
+ }
+ /* This is temporary: point mod into copy of data. */
+--
+2.20.1
+
--- /dev/null
+From e818270c9036821705d2b141aef825112d77b9b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 15:14:04 +0900
+Subject: modules: lockdep: Suppress suspicious RCU usage warning
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit bf08949cc8b98b7d1e20cfbba169a5938d42dae8 ]
+
+While running kprobe module test, find_module_all() caused
+a suspicious RCU usage warning.
+
+-----
+ =============================
+ WARNING: suspicious RCU usage
+ 5.4.0-next-20191202+ #63 Not tainted
+ -----------------------------
+ kernel/module.c:619 RCU-list traversed in non-reader section!!
+
+ other info that might help us debug this:
+
+ rcu_scheduler_active = 2, debug_locks = 1
+ 1 lock held by rmmod/642:
+ #0: ffffffff8227da80 (module_mutex){+.+.}, at: __x64_sys_delete_module+0x9a/0x230
+
+ stack backtrace:
+ CPU: 0 PID: 642 Comm: rmmod Not tainted 5.4.0-next-20191202+ #63
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x71/0xa0
+ find_module_all+0xc1/0xd0
+ __x64_sys_delete_module+0xac/0x230
+ ? do_syscall_64+0x12/0x1f0
+ do_syscall_64+0x50/0x1f0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ RIP: 0033:0x4b6d49
+-----
+
+This is because list_for_each_entry_rcu(modules) is called
+without rcu_read_lock(). This is safe because the module_mutex
+is locked.
+
+Pass lockdep_is_held(&module_mutex) to the list_for_each_entry_rcu()
+to suppress this warning, This also fixes similar issue in
+mod_find() and each_symbol_section().
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 9fb8fa22e16b3..135861c2ac782 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -214,7 +214,8 @@ static struct module *mod_find(unsigned long addr)
+ {
+ struct module *mod;
+
+- list_for_each_entry_rcu(mod, &modules, list) {
++ list_for_each_entry_rcu(mod, &modules, list,
++ lockdep_is_held(&module_mutex)) {
+ if (within_module(addr, mod))
+ return mod;
+ }
+@@ -448,7 +449,8 @@ bool each_symbol_section(bool (*fn)(const struct symsearch *arr,
+ if (each_symbol_in_section(arr, ARRAY_SIZE(arr), NULL, fn, data))
+ return true;
+
+- list_for_each_entry_rcu(mod, &modules, list) {
++ list_for_each_entry_rcu(mod, &modules, list,
++ lockdep_is_held(&module_mutex)) {
+ struct symsearch arr[] = {
+ { mod->syms, mod->syms + mod->num_syms, mod->crcs,
+ NOT_GPL_ONLY, false },
+@@ -616,7 +618,8 @@ static struct module *find_module_all(const char *name, size_t len,
+
+ module_assert_mutex_or_preempt();
+
+- list_for_each_entry_rcu(mod, &modules, list) {
++ list_for_each_entry_rcu(mod, &modules, list,
++ lockdep_is_held(&module_mutex)) {
+ if (!even_unformed && mod->state == MODULE_STATE_UNFORMED)
+ continue;
+ if (strlen(mod->name) == len && !memcmp(mod->name, name, len))
+--
+2.20.1
+
--- /dev/null
+From cdeb9aafc848a8274ba9311b131e23501273c39d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 11:18:57 +0800
+Subject: nbd: add a flush_workqueue in nbd_start_device
+
+From: Sun Ke <sunke32@huawei.com>
+
+[ Upstream commit 5c0dd228b5fc30a3b732c7ae2657e0161ec7ed80 ]
+
+When kzalloc fail, may cause trying to destroy the
+workqueue from inside the workqueue.
+
+If num_connections is m (2 < m), and NO.1 ~ NO.n
+(1 < n < m) kzalloc are successful. The NO.(n + 1)
+failed. Then, nbd_start_device will return ENOMEM
+to nbd_start_device_ioctl, and nbd_start_device_ioctl
+will return immediately without running flush_workqueue.
+However, we still have n recv threads. If nbd_release
+run first, recv threads may have to drop the last
+config_refs and try to destroy the workqueue from
+inside the workqueue.
+
+To fix it, add a flush_workqueue in nbd_start_device.
+
+Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs")
+Signed-off-by: Sun Ke <sunke32@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index b4607dd961852..78181908f0df6 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1265,6 +1265,16 @@ static int nbd_start_device(struct nbd_device *nbd)
+ args = kzalloc(sizeof(*args), GFP_KERNEL);
+ if (!args) {
+ sock_shutdown(nbd);
++ /*
++ * If num_connections is m (2 < m),
++ * and NO.1 ~ NO.n(1 < n < m) kzallocs are successful.
++ * But NO.(n + 1) failed. We still have n recv threads.
++ * So, add flush_workqueue here to prevent recv threads
++ * dropping the last config_refs and trying to destroy
++ * the workqueue from inside the workqueue.
++ */
++ if (i)
++ flush_workqueue(nbd->recv_workq);
+ return -ENOMEM;
+ }
+ sk_set_memalloc(config->socks[i]->sock->sk);
+--
+2.20.1
+
--- /dev/null
+From 460a1f07b8bf727ea3ea6cab68b7650aaa03d254 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 13:04:46 +0100
+Subject: net: ethernet: ixp4xx: Standard module init
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit c83db9ef5640548631707e8b4a7bcddc115fdbae ]
+
+The IXP4xx driver was initializing the MDIO bus before even
+probing, in the callbacks supposed to be used for setting up
+the module itself, and with the side effect of trying to
+register the MDIO bus as soon as this module was loaded or
+compiled into the kernel whether the device was discovered
+or not.
+
+This does not work with multiplatform environments.
+
+To get rid of this: set up the MDIO bus from the probe()
+callback and remove it in the remove() callback. Rename
+the probe() and remove() calls to reflect the most common
+conventions.
+
+Since there is a bit of checking for the ethernet feature
+to be present in the MDIO registering function, making the
+whole module not even be registered if we can't find an
+MDIO bus, we need something similar: register the MDIO
+bus when the corresponding ethernet is probed, and
+return -EPROBE_DEFER on the other interfaces until this
+happens. If no MDIO bus is present on any of the
+registered interfaces we will eventually bail out.
+
+None of the platforms I've seen has e.g. MDIO on EthB
+and only uses EthC, there is always a Ethernet hardware
+on the NPE (B, C) that has the MDIO bus, we just might
+have to wait for it.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xscale/ixp4xx_eth.c | 96 +++++++++++-------------
+ 1 file changed, 44 insertions(+), 52 deletions(-)
+
+diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
+index 6fc04ffb22c2a..d4e095d0e8f14 100644
+--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
++++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
+@@ -517,25 +517,14 @@ static int ixp4xx_mdio_write(struct mii_bus *bus, int phy_id, int location,
+ return ret;
+ }
+
+-static int ixp4xx_mdio_register(void)
++static int ixp4xx_mdio_register(struct eth_regs __iomem *regs)
+ {
+ int err;
+
+ if (!(mdio_bus = mdiobus_alloc()))
+ return -ENOMEM;
+
+- if (cpu_is_ixp43x()) {
+- /* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
+- if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
+- return -ENODEV;
+- mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
+- } else {
+- /* All MII PHY accesses use NPE-B Ethernet registers */
+- if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
+- return -ENODEV;
+- mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
+- }
+-
++ mdio_regs = regs;
+ __raw_writel(DEFAULT_CORE_CNTRL, &mdio_regs->core_control);
+ spin_lock_init(&mdio_lock);
+ mdio_bus->name = "IXP4xx MII Bus";
+@@ -1374,7 +1363,7 @@ static const struct net_device_ops ixp4xx_netdev_ops = {
+ .ndo_validate_addr = eth_validate_addr,
+ };
+
+-static int eth_init_one(struct platform_device *pdev)
++static int ixp4xx_eth_probe(struct platform_device *pdev)
+ {
+ struct port *port;
+ struct net_device *dev;
+@@ -1384,7 +1373,7 @@ static int eth_init_one(struct platform_device *pdev)
+ char phy_id[MII_BUS_ID_SIZE + 3];
+ int err;
+
+- if (!(dev = alloc_etherdev(sizeof(struct port))))
++ if (!(dev = devm_alloc_etherdev(&pdev->dev, sizeof(struct port))))
+ return -ENOMEM;
+
+ SET_NETDEV_DEV(dev, &pdev->dev);
+@@ -1394,20 +1383,51 @@ static int eth_init_one(struct platform_device *pdev)
+
+ switch (port->id) {
+ case IXP4XX_ETH_NPEA:
++ /* If the MDIO bus is not up yet, defer probe */
++ if (!mdio_bus)
++ return -EPROBE_DEFER;
+ port->regs = (struct eth_regs __iomem *)IXP4XX_EthA_BASE_VIRT;
+ regs_phys = IXP4XX_EthA_BASE_PHYS;
+ break;
+ case IXP4XX_ETH_NPEB:
++ /*
++ * On all except IXP43x, NPE-B is used for the MDIO bus.
++ * If there is no NPE-B in the feature set, bail out, else
++ * register the MDIO bus.
++ */
++ if (!cpu_is_ixp43x()) {
++ if (!(ixp4xx_read_feature_bits() &
++ IXP4XX_FEATURE_NPEB_ETH0))
++ return -ENODEV;
++ /* Else register the MDIO bus on NPE-B */
++ if ((err = ixp4xx_mdio_register(IXP4XX_EthC_BASE_VIRT)))
++ return err;
++ }
++ if (!mdio_bus)
++ return -EPROBE_DEFER;
+ port->regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
+ regs_phys = IXP4XX_EthB_BASE_PHYS;
+ break;
+ case IXP4XX_ETH_NPEC:
++ /*
++ * IXP43x lacks NPE-B and uses NPE-C for the MDIO bus access,
++ * of there is no NPE-C, no bus, nothing works, so bail out.
++ */
++ if (cpu_is_ixp43x()) {
++ if (!(ixp4xx_read_feature_bits() &
++ IXP4XX_FEATURE_NPEC_ETH))
++ return -ENODEV;
++ /* Else register the MDIO bus on NPE-C */
++ if ((err = ixp4xx_mdio_register(IXP4XX_EthC_BASE_VIRT)))
++ return err;
++ }
++ if (!mdio_bus)
++ return -EPROBE_DEFER;
+ port->regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
+ regs_phys = IXP4XX_EthC_BASE_PHYS;
+ break;
+ default:
+- err = -ENODEV;
+- goto err_free;
++ return -ENODEV;
+ }
+
+ dev->netdev_ops = &ixp4xx_netdev_ops;
+@@ -1416,10 +1436,8 @@ static int eth_init_one(struct platform_device *pdev)
+
+ netif_napi_add(dev, &port->napi, eth_poll, NAPI_WEIGHT);
+
+- if (!(port->npe = npe_request(NPE_ID(port->id)))) {
+- err = -EIO;
+- goto err_free;
+- }
++ if (!(port->npe = npe_request(NPE_ID(port->id))))
++ return -EIO;
+
+ port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
+ if (!port->mem_res) {
+@@ -1465,12 +1483,10 @@ err_free_mem:
+ release_resource(port->mem_res);
+ err_npe_rel:
+ npe_release(port->npe);
+-err_free:
+- free_netdev(dev);
+ return err;
+ }
+
+-static int eth_remove_one(struct platform_device *pdev)
++static int ixp4xx_eth_remove(struct platform_device *pdev)
+ {
+ struct net_device *dev = platform_get_drvdata(pdev);
+ struct phy_device *phydev = dev->phydev;
+@@ -1478,45 +1494,21 @@ static int eth_remove_one(struct platform_device *pdev)
+
+ unregister_netdev(dev);
+ phy_disconnect(phydev);
++ ixp4xx_mdio_remove();
+ npe_port_tab[NPE_ID(port->id)] = NULL;
+ npe_release(port->npe);
+ release_resource(port->mem_res);
+- free_netdev(dev);
+ return 0;
+ }
+
+ static struct platform_driver ixp4xx_eth_driver = {
+ .driver.name = DRV_NAME,
+- .probe = eth_init_one,
+- .remove = eth_remove_one,
++ .probe = ixp4xx_eth_probe,
++ .remove = ixp4xx_eth_remove,
+ };
+-
+-static int __init eth_init_module(void)
+-{
+- int err;
+-
+- /*
+- * FIXME: we bail out on device tree boot but this really needs
+- * to be fixed in a nicer way: this registers the MDIO bus before
+- * even matching the driver infrastructure, we should only probe
+- * detected hardware.
+- */
+- if (of_have_populated_dt())
+- return -ENODEV;
+- if ((err = ixp4xx_mdio_register()))
+- return err;
+- return platform_driver_register(&ixp4xx_eth_driver);
+-}
+-
+-static void __exit eth_cleanup_module(void)
+-{
+- platform_driver_unregister(&ixp4xx_eth_driver);
+- ixp4xx_mdio_remove();
+-}
++module_platform_driver(ixp4xx_eth_driver);
+
+ MODULE_AUTHOR("Krzysztof Halasa");
+ MODULE_DESCRIPTION("Intel IXP4xx Ethernet driver");
+ MODULE_LICENSE("GPL v2");
+ MODULE_ALIAS("platform:ixp4xx_eth");
+-module_init(eth_init_module);
+-module_exit(eth_cleanup_module);
+--
+2.20.1
+
--- /dev/null
+From 46f53924a57574a2c65f6a7d86bacd96c65b1a47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 17:03:19 -0800
+Subject: net: phy: fixed_phy: fix use-after-free when checking link GPIO
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit d266f19f3ae7fbcaf92229639b78d2110ae44f33 ]
+
+If we fail to locate GPIO for any reason other than deferral or
+not-found-GPIO, we try to print device tree node info, however if might
+be freed already as we called of_node_put() on it.
+
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/fixed_phy.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index 7c5265fd2b94d..4190f9ed5313d 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -212,16 +212,13 @@ static struct gpio_desc *fixed_phy_get_gpiod(struct device_node *np)
+ */
+ gpiod = gpiod_get_from_of_node(fixed_link_node, "link-gpios", 0,
+ GPIOD_IN, "mdio");
+- of_node_put(fixed_link_node);
+- if (IS_ERR(gpiod)) {
+- if (PTR_ERR(gpiod) == -EPROBE_DEFER)
+- return gpiod;
+-
++ if (IS_ERR(gpiod) && PTR_ERR(gpiod) != -EPROBE_DEFER) {
+ if (PTR_ERR(gpiod) != -ENOENT)
+ pr_err("error getting GPIO for fixed link %pOF, proceed without\n",
+ fixed_link_node);
+ gpiod = NULL;
+ }
++ of_node_put(fixed_link_node);
+
+ return gpiod;
+ }
+--
+2.20.1
+
--- /dev/null
+From d7f86bc4face0d1dc936a5ba949a747ae173138a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 19:51:47 +0100
+Subject: net: phy: realtek: add logging for the RGMII TX delay configuration
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 3aec743d69822d22d4a5b60deb9518ed8be6fa67 ]
+
+RGMII requires a delay of 2ns between the data and the clock signal.
+There are at least three ways this can happen. One possibility is by
+having the PHY generate this delay.
+This is a common source for problems (for example with slow TX speeds or
+packet loss when sending data). The TX delay configuration of the
+RTL8211F PHY can be set either by pin-strappping the RXD1 pin (HIGH
+means enabled, LOW means disabled) or through configuring a paged
+register. The setting from the RXD1 pin is also reflected in the
+register.
+
+Add debug logging to the TX delay configuration on RTL8211F so it's
+easier to spot these issues (for example if the TX delay is enabled for
+both, the RTL8211F PHY and the MAC).
+This is especially helpful because there is no public datasheet for the
+RTL8211F PHY available with all the RX/TX delay specifics.
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/realtek.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c
+index 677c45985338a..c76df51dd3c51 100644
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -171,7 +171,9 @@ static int rtl8211c_config_init(struct phy_device *phydev)
+
+ static int rtl8211f_config_init(struct phy_device *phydev)
+ {
++ struct device *dev = &phydev->mdio.dev;
+ u16 val;
++ int ret;
+
+ /* enable TX-delay for rgmii-{id,txid}, and disable it for rgmii and
+ * rgmii-rxid. The RX-delay can be enabled by the external RXDLY pin.
+@@ -189,7 +191,22 @@ static int rtl8211f_config_init(struct phy_device *phydev)
+ return 0;
+ }
+
+- return phy_modify_paged(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY, val);
++ ret = phy_modify_paged_changed(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY,
++ val);
++ if (ret < 0) {
++ dev_err(dev, "Failed to update the TX delay register\n");
++ return ret;
++ } else if (ret) {
++ dev_dbg(dev,
++ "%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
++ val ? "Enabling" : "Disabling");
++ } else {
++ dev_dbg(dev,
++ "2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
++ val ? "enabled" : "disabled");
++ }
++
++ return 0;
+ }
+
+ static int rtl8211e_config_init(struct phy_device *phydev)
+--
+2.20.1
+
--- /dev/null
+From c0be870967e4b6a5bcbd690239926168d1e28754 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 15:55:51 +0100
+Subject: net/wan/fsl_ucc_hdlc: reject muram offsets above 64K
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 148587a59f6b85831695e0497d9dd1af5f0495af ]
+
+Qiang Zhao points out that these offsets get written to 16-bit
+registers, and there are some QE platforms with more than 64K
+muram. So it is possible that qe_muram_alloc() gives us an allocation
+that can't actually be used by the hardware, so detect and reject
+that.
+
+Reported-by: Qiang Zhao <qiang.zhao@nxp.com>
+Reviewed-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index aef7de225783f..4ad0a0c33d853 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -245,6 +245,11 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ ret = -ENOMEM;
+ goto free_riptr;
+ }
++ if (riptr != (u16)riptr || tiptr != (u16)tiptr) {
++ dev_err(priv->dev, "MURAM allocation out of addressable range\n");
++ ret = -ENOMEM;
++ goto free_tiptr;
++ }
+
+ /* Set RIPTR, TIPTR */
+ iowrite16be(riptr, &priv->ucc_pram->riptr);
+--
+2.20.1
+
--- /dev/null
+From 5d7a4bf11c34cd522394c3e589b092befdcea226 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 16:53:06 +0800
+Subject: netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 0705f95c332081036d85f26691e9d3cd7d901c31 ]
+
+ERSPAN_VERSION is an attribute parsed in kernel side, nla_policy
+type should be added for it, like other attributes.
+
+Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_tunnel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 5284fcf16be73..f8d2919cf9fdc 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -248,8 +248,9 @@ static int nft_tunnel_obj_vxlan_init(const struct nlattr *attr,
+ }
+
+ static const struct nla_policy nft_tunnel_opts_erspan_policy[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1] = {
++ [NFTA_TUNNEL_KEY_ERSPAN_VERSION] = { .type = NLA_U32 },
+ [NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX] = { .type = NLA_U32 },
+- [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 },
++ [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 },
+ [NFTA_TUNNEL_KEY_ERSPAN_V2_HWID] = { .type = NLA_U8 },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From fbb7b2675b21590c492921a7e997953d76a8ff81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 21:08:45 +0800
+Subject: NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use
+ le16_add_cpu().
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 718eae277e62a26e5862eb72a830b5e0fe37b04a ]
+
+Convert cpu_to_le16(le16_to_cpu(frame->datalen) + len) to
+use le16_add_cpu(), which is more concise and does the same thing.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/port100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
+index 604dba4f18afd..8e4d355dc3aec 100644
+--- a/drivers/nfc/port100.c
++++ b/drivers/nfc/port100.c
+@@ -565,7 +565,7 @@ static void port100_tx_update_payload_len(void *_frame, int len)
+ {
+ struct port100_frame *frame = _frame;
+
+- frame->datalen = cpu_to_le16(le16_to_cpu(frame->datalen) + len);
++ le16_add_cpu(&frame->datalen, len);
+ }
+
+ static bool port100_rx_frame_is_valid(void *_frame)
+--
+2.20.1
+
--- /dev/null
+From 1720f5f4662dc32abb750dab7b125204a3261a2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 03:47:53 +0000
+Subject: NFS: Fix memory leaks
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 123c23c6a7b7ecd2a3d6060bea1d94019f71fd66 ]
+
+In _nfs42_proc_copy(), 'res->commit_res.verf' is allocated through
+kzalloc() if 'args->sync' is true. In the following code, if
+'res->synchronous' is false, handle_async_copy() will be invoked. If an
+error occurs during the invocation, the following code will not be executed
+and the error will be returned . However, the allocated
+'res->commit_res.verf' is not deallocated, leading to a memory leak. This
+is also true if the invocation of process_copy_commit() returns an error.
+
+To fix the above leaks, redirect the execution to the 'out' label if an
+error is encountered.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index 5196bfa7894d2..9b61c80a93e9e 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -283,14 +283,14 @@ static ssize_t _nfs42_proc_copy(struct file *src,
+ status = handle_async_copy(res, server, src, dst,
+ &args->src_stateid);
+ if (status)
+- return status;
++ goto out;
+ }
+
+ if ((!res->synchronous || !args->sync) &&
+ res->write_res.verifier.committed != NFS_FILE_SYNC) {
+ status = process_copy_commit(dst, pos_dst, res);
+ if (status)
+- return status;
++ goto out;
+ }
+
+ truncate_pagecache_range(dst_inode, pos_dst,
+--
+2.20.1
+
--- /dev/null
+From 36c3cdd210cd8d50c6147a825e2d03aab73b7740 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 14:57:23 -0500
+Subject: nfsd: Clone should commit src file metadata too
+
+From: Trond Myklebust <trondmy@gmail.com>
+
+[ Upstream commit 57f64034966fb945fc958f95f0c51e47af590344 ]
+
+vfs_clone_file_range() can modify the metadata on the source file too,
+so we need to commit that to stable storage as well.
+
+Reported-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Acked-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/vfs.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index fc38b9fe45495..005d1802ab40e 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -280,19 +280,25 @@ out:
+ * Commit metadata changes to stable storage.
+ */
+ static int
+-commit_metadata(struct svc_fh *fhp)
++commit_inode_metadata(struct inode *inode)
+ {
+- struct inode *inode = d_inode(fhp->fh_dentry);
+ const struct export_operations *export_ops = inode->i_sb->s_export_op;
+
+- if (!EX_ISSYNC(fhp->fh_export))
+- return 0;
+-
+ if (export_ops->commit_metadata)
+ return export_ops->commit_metadata(inode);
+ return sync_inode_metadata(inode, 1);
+ }
+
++static int
++commit_metadata(struct svc_fh *fhp)
++{
++ struct inode *inode = d_inode(fhp->fh_dentry);
++
++ if (!EX_ISSYNC(fhp->fh_export))
++ return 0;
++ return commit_inode_metadata(inode);
++}
++
+ /*
+ * Go over the attributes and take care of the small differences between
+ * NFS semantics and what Linux expects.
+@@ -537,6 +543,9 @@ __be32 nfsd4_clone_file_range(struct file *src, u64 src_pos, struct file *dst,
+ if (sync) {
+ loff_t dst_end = count ? dst_pos + count - 1 : LLONG_MAX;
+ int status = vfs_fsync_range(dst, dst_pos, dst_end, 0);
++
++ if (!status)
++ status = commit_inode_metadata(file_inode(src));
+ if (status < 0)
+ return nfserrno(status);
+ }
+--
+2.20.1
+
--- /dev/null
+From 38711c854041bcd9ee879750c702d3ba598339ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:07:32 -0500
+Subject: nfsd4: avoid NULL deference on strange COPY compounds
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit d781e3df710745fbbaee4eb07fd5b64331a1b175 ]
+
+With cross-server COPY we've introduced the possibility that the current
+or saved filehandle might not have fh_dentry/fh_export filled in, but we
+missed a place that assumed it was. I think this could be triggered by
+a compound like:
+
+ PUTFH(foreign filehandle)
+ GETATTR
+ SAVEFH
+ COPY
+
+First, check_if_stalefh_allowed sets no_verify on the first (PUTFH) op.
+Then op_func = nfsd4_putfh runs and leaves current_fh->fh_export NULL.
+need_wrongsec_check returns true, since this PUTFH has OP_IS_PUTFH_LIKE
+set and GETATTR does not have OP_HANDLES_WRONGSEC set.
+
+We should probably also consider tightening the checks in
+check_if_stalefh_allowed and double-checking that we don't assume the
+filehandle is verified elsewhere in the compound. But I think this
+fixes the immediate issue.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 4e48f1cccab3 "NFSD: allow inter server COPY to have... "
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 4798667af647c..4d1d0bf8e385f 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -2025,7 +2025,8 @@ nfsd4_proc_compound(struct svc_rqst *rqstp)
+ if (op->opdesc->op_flags & OP_CLEAR_STATEID)
+ clear_current_stateid(cstate);
+
+- if (need_wrongsec_check(rqstp))
++ if (current_fh->fh_export &&
++ need_wrongsec_check(rqstp))
+ op->status = check_nfsd_access(current_fh->fh_export, rqstp);
+ }
+ encode_op:
+--
+2.20.1
+
--- /dev/null
+From 71339bfc3b3524c203807cb52f9515f703ff4933 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 19:40:24 +0100
+Subject: nvme-pci: remove nvmeq->tags
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit cfa27356f835dc7755192e7b941d4f4851acbcc7 ]
+
+There is no real need to have a pointer to the tagset in
+struct nvme_queue, as we only need it in a single place, and that place
+can derive the used tagset from the device and qid trivially. This
+fixes a problem with stale pointer exposure when tagsets are reset,
+and also shrinks the nvme_queue structure. It also matches what most
+other transports have done since day 1.
+
+Reported-by: Edmund Nadolski <edmund.nadolski@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 14d513087a14b..f34a56d588d31 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -167,7 +167,6 @@ struct nvme_queue {
+ /* only used for poll queues: */
+ spinlock_t cq_poll_lock ____cacheline_aligned_in_smp;
+ volatile struct nvme_completion *cqes;
+- struct blk_mq_tags **tags;
+ dma_addr_t sq_dma_addr;
+ dma_addr_t cq_dma_addr;
+ u32 __iomem *q_db;
+@@ -377,29 +376,17 @@ static int nvme_admin_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
+
+ WARN_ON(hctx_idx != 0);
+ WARN_ON(dev->admin_tagset.tags[0] != hctx->tags);
+- WARN_ON(nvmeq->tags);
+
+ hctx->driver_data = nvmeq;
+- nvmeq->tags = &dev->admin_tagset.tags[0];
+ return 0;
+ }
+
+-static void nvme_admin_exit_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx)
+-{
+- struct nvme_queue *nvmeq = hctx->driver_data;
+-
+- nvmeq->tags = NULL;
+-}
+-
+ static int nvme_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
+ unsigned int hctx_idx)
+ {
+ struct nvme_dev *dev = data;
+ struct nvme_queue *nvmeq = &dev->queues[hctx_idx + 1];
+
+- if (!nvmeq->tags)
+- nvmeq->tags = &dev->tagset.tags[hctx_idx];
+-
+ WARN_ON(dev->tagset.tags[hctx_idx] != hctx->tags);
+ hctx->driver_data = nvmeq;
+ return 0;
+@@ -950,6 +937,13 @@ static inline void nvme_ring_cq_doorbell(struct nvme_queue *nvmeq)
+ writel(head, nvmeq->q_db + nvmeq->dev->db_stride);
+ }
+
++static inline struct blk_mq_tags *nvme_queue_tagset(struct nvme_queue *nvmeq)
++{
++ if (!nvmeq->qid)
++ return nvmeq->dev->admin_tagset.tags[0];
++ return nvmeq->dev->tagset.tags[nvmeq->qid - 1];
++}
++
+ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
+ {
+ volatile struct nvme_completion *cqe = &nvmeq->cqes[idx];
+@@ -975,7 +969,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx)
+ return;
+ }
+
+- req = blk_mq_tag_to_rq(*nvmeq->tags, cqe->command_id);
++ req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), cqe->command_id);
+ trace_nvme_sq(req, cqe->sq_head, nvmeq->sq_tail);
+ nvme_end_request(req, cqe->status, cqe->result);
+ }
+@@ -1578,7 +1572,6 @@ static const struct blk_mq_ops nvme_mq_admin_ops = {
+ .queue_rq = nvme_queue_rq,
+ .complete = nvme_pci_complete_rq,
+ .init_hctx = nvme_admin_init_hctx,
+- .exit_hctx = nvme_admin_exit_hctx,
+ .init_request = nvme_init_request,
+ .timeout = nvme_timeout,
+ };
+--
+2.20.1
+
--- /dev/null
+From 6dcb57c7d3358837590fa32d5bea2d21bd5c6ebd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 13:08:16 +0530
+Subject: nvmet: Pass lockdep expression to RCU lists
+
+From: Amol Grover <frextrite@gmail.com>
+
+[ Upstream commit 4ac76436a6d07dec1c3c766f234aa787a16e8f65 ]
+
+ctrl->subsys->namespaces and subsys->namespaces are traversed with
+list_for_each_entry_rcu outside an RCU read-side critical section but
+under the protection of ctrl->subsys->lock and subsys->lock respectively.
+
+Hence, add the corresponding lockdep expression to the list traversal
+primitive to silence false-positive lockdep warnings, and harden RCU
+lists.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Amol Grover <frextrite@gmail.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/target/core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
+index 3a67e244e5685..57a4062cbb59e 100644
+--- a/drivers/nvme/target/core.c
++++ b/drivers/nvme/target/core.c
+@@ -555,7 +555,8 @@ int nvmet_ns_enable(struct nvmet_ns *ns)
+ } else {
+ struct nvmet_ns *old;
+
+- list_for_each_entry_rcu(old, &subsys->namespaces, dev_link) {
++ list_for_each_entry_rcu(old, &subsys->namespaces, dev_link,
++ lockdep_is_held(&subsys->lock)) {
+ BUG_ON(ns->nsid == old->nsid);
+ if (ns->nsid < old->nsid)
+ break;
+@@ -1174,7 +1175,8 @@ static void nvmet_setup_p2p_ns_map(struct nvmet_ctrl *ctrl,
+
+ ctrl->p2p_client = get_device(req->p2p_client);
+
+- list_for_each_entry_rcu(ns, &ctrl->subsys->namespaces, dev_link)
++ list_for_each_entry_rcu(ns, &ctrl->subsys->namespaces, dev_link,
++ lockdep_is_held(&ctrl->subsys->lock))
+ nvmet_p2pmem_ns_add_p2p(ctrl, ns);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fed118fa0424dd121bcd8c5926a768ab10e2123b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 12:14:08 -0600
+Subject: objtool: Fix ARCH=x86_64 build error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shile Zhang <shile.zhang@linux.alibaba.com>
+
+[ Upstream commit 8580bed7e751e6d4f17881e059daf3cb37ba4717 ]
+
+Building objtool with ARCH=x86_64 fails with:
+
+ $make ARCH=x86_64 -C tools/objtool
+ ...
+ CC arch/x86/decode.o
+ arch/x86/decode.c:10:22: fatal error: asm/insn.h: No such file or directory
+ #include <asm/insn.h>
+ ^
+ compilation terminated.
+ mv: cannot stat ‘arch/x86/.decode.o.tmp’: No such file or directory
+ make[2]: *** [arch/x86/decode.o] Error 1
+ ...
+
+The root cause is that the command-line variable 'ARCH' cannot be
+overridden. It can be replaced by 'SRCARCH', which is defined in
+'tools/scripts/Makefile.arch'.
+
+Signed-off-by: Shile Zhang <shile.zhang@linux.alibaba.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: Kamalesh Babulal <kamalesh@linux.vnet.ibm.com>
+Link: https://lore.kernel.org/r/d5d11370ae116df6c653493acd300ec3d7f5e925.1579543924.git.jpoimboe@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/objtool/Makefile | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index d2a19b0bc05aa..ee08aeff30a19 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -2,10 +2,6 @@
+ include ../scripts/Makefile.include
+ include ../scripts/Makefile.arch
+
+-ifeq ($(ARCH),x86_64)
+-ARCH := x86
+-endif
+-
+ # always use the host compiler
+ HOSTAR ?= ar
+ HOSTCC ?= gcc
+@@ -33,7 +29,7 @@ all: $(OBJTOOL)
+
+ INCLUDES := -I$(srctree)/tools/include \
+ -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
+- -I$(srctree)/tools/arch/$(ARCH)/include
++ -I$(srctree)/tools/arch/$(SRCARCH)/include
+ WARNINGS := $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -Wno-packed
+ CFLAGS := -Werror $(WARNINGS) $(KBUILD_HOSTCFLAGS) -g $(INCLUDES) $(LIBELF_FLAGS)
+ LDFLAGS += $(LIBELF_LIBS) $(LIBSUBCMD) $(KBUILD_HOSTLDFLAGS)
+--
+2.20.1
+
--- /dev/null
+From bcc54f525efa8ca5ea5af64cdabbb16c14839d87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:11:50 -0800
+Subject: ocfs2: fix a NULL pointer dereference when call
+ ocfs2_update_inode_fsync_trans()
+
+From: wangyan <wangyan122@huawei.com>
+
+[ Upstream commit 9f16ca48fc818a17de8be1f75d08e7f4addc4497 ]
+
+I found a NULL pointer dereference in ocfs2_update_inode_fsync_trans(),
+handle->h_transaction may be NULL in this situation:
+
+ocfs2_file_write_iter
+ ->__generic_file_write_iter
+ ->generic_perform_write
+ ->ocfs2_write_begin
+ ->ocfs2_write_begin_nolock
+ ->ocfs2_write_cluster_by_desc
+ ->ocfs2_write_cluster
+ ->ocfs2_mark_extent_written
+ ->ocfs2_change_extent_flag
+ ->ocfs2_split_extent
+ ->ocfs2_try_to_merge_extent
+ ->ocfs2_extend_rotate_transaction
+ ->ocfs2_extend_trans
+ ->jbd2_journal_restart
+ ->jbd2__journal_restart
+ // handle->h_transaction is NULL here
+ ->handle->h_transaction = NULL;
+ ->start_this_handle
+ /* journal aborted due to storage
+ network disconnection, return error */
+ ->return -EROFS;
+ /* line 3806 in ocfs2_try_to_merge_extent (),
+ it will ignore ret error. */
+ ->ret = 0;
+ ->...
+ ->ocfs2_write_end
+ ->ocfs2_write_end_nolock
+ ->ocfs2_update_inode_fsync_trans
+ // NULL pointer dereference
+ ->oi->i_sync_tid = handle->h_transaction->t_tid;
+
+The information of NULL pointer dereference as follows:
+ JBD2: Detected IO errors while flushing file data on dm-11-45
+ Aborting journal on device dm-11-45.
+ JBD2: Error -5 detected when updating journal superblock for dm-11-45.
+ (dd,22081,3):ocfs2_extend_trans:474 ERROR: status = -30
+ (dd,22081,3):ocfs2_try_to_merge_extent:3877 ERROR: status = -30
+ Unable to handle kernel NULL pointer dereference at
+ virtual address 0000000000000008
+ Mem abort info:
+ ESR = 0x96000004
+ Exception class = DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ Data abort info:
+ ISV = 0, ISS = 0x00000004
+ CM = 0, WnR = 0
+ user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000e74e1338
+ [0000000000000008] pgd=0000000000000000
+ Internal error: Oops: 96000004 [#1] SMP
+ Process dd (pid: 22081, stack limit = 0x00000000584f35a9)
+ CPU: 3 PID: 22081 Comm: dd Kdump: loaded
+ Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 0.98 08/25/2019
+ pstate: 60400009 (nZCv daif +PAN -UAO)
+ pc : ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2]
+ lr : ocfs2_write_end_nolock+0x2a0/0x550 [ocfs2]
+ sp : ffff0000459fba70
+ x29: ffff0000459fba70 x28: 0000000000000000
+ x27: ffff807ccf7f1000 x26: 0000000000000001
+ x25: ffff807bdff57970 x24: ffff807caf1d4000
+ x23: ffff807cc79e9000 x22: 0000000000001000
+ x21: 000000006c6cd000 x20: ffff0000091d9000
+ x19: ffff807ccb239db0 x18: ffffffffffffffff
+ x17: 000000000000000e x16: 0000000000000007
+ x15: ffff807c5e15bd78 x14: 0000000000000000
+ x13: 0000000000000000 x12: 0000000000000000
+ x11: 0000000000000000 x10: 0000000000000001
+ x9 : 0000000000000228 x8 : 000000000000000c
+ x7 : 0000000000000fff x6 : ffff807a308ed6b0
+ x5 : ffff7e01f10967c0 x4 : 0000000000000018
+ x3 : d0bc661572445600 x2 : 0000000000000000
+ x1 : 000000001b2e0200 x0 : 0000000000000000
+ Call trace:
+ ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2]
+ ocfs2_write_end+0x4c/0x80 [ocfs2]
+ generic_perform_write+0x108/0x1a8
+ __generic_file_write_iter+0x158/0x1c8
+ ocfs2_file_write_iter+0x668/0x950 [ocfs2]
+ __vfs_write+0x11c/0x190
+ vfs_write+0xac/0x1c0
+ ksys_write+0x6c/0xd8
+ __arm64_sys_write+0x24/0x30
+ el0_svc_common+0x78/0x130
+ el0_svc_handler+0x38/0x78
+ el0_svc+0x8/0xc
+
+To prevent NULL pointer dereference in this situation, we use
+is_handle_aborted() before using handle->h_transaction->t_tid.
+
+Link: http://lkml.kernel.org/r/03e750ab-9ade-83aa-b000-b9e81e34e539@huawei.com
+Signed-off-by: Yan Wang <wangyan122@huawei.com>
+Reviewed-by: Jun Piao <piaojun@huawei.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
+index 3103ba7f97a28..bfe611ed1b1d7 100644
+--- a/fs/ocfs2/journal.h
++++ b/fs/ocfs2/journal.h
+@@ -597,9 +597,11 @@ static inline void ocfs2_update_inode_fsync_trans(handle_t *handle,
+ {
+ struct ocfs2_inode_info *oi = OCFS2_I(inode);
+
+- oi->i_sync_tid = handle->h_transaction->t_tid;
+- if (datasync)
+- oi->i_datasync_tid = handle->h_transaction->t_tid;
++ if (!is_handle_aborted(handle)) {
++ oi->i_sync_tid = handle->h_transaction->t_tid;
++ if (datasync)
++ oi->i_datasync_tid = handle->h_transaction->t_tid;
++ }
+ }
+
+ #endif /* OCFS2_JOURNAL_H */
+--
+2.20.1
+
--- /dev/null
+From b58eb310328cfb91a038292189b66cb585323d65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:11:40 -0800
+Subject: ocfs2: make local header paths relative to C files
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit ca322fb6030956c2337fbf1c1beeb08c5dd5c943 ]
+
+Gang He reports the failure of building fs/ocfs2/ as an external module
+of the kernel installed on the system:
+
+ $ cd fs/ocfs2
+ $ make -C /lib/modules/`uname -r`/build M=`pwd` modules
+
+If you want to make it work reliably, I'd recommend to remove ccflags-y
+from the Makefiles, and to make header paths relative to the C files. I
+think this is the correct usage of the #include "..." directive.
+
+Link: http://lkml.kernel.org/r/20191227022950.14804-1-ghe@suse.com
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Gang He <ghe@suse.com>
+Reported-by: Gang He <ghe@suse.com>
+Reviewed-by: Gang He <ghe@suse.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/dlm/Makefile | 2 --
+ fs/ocfs2/dlm/dlmast.c | 8 ++++----
+ fs/ocfs2/dlm/dlmconvert.c | 8 ++++----
+ fs/ocfs2/dlm/dlmdebug.c | 8 ++++----
+ fs/ocfs2/dlm/dlmdomain.c | 8 ++++----
+ fs/ocfs2/dlm/dlmlock.c | 8 ++++----
+ fs/ocfs2/dlm/dlmmaster.c | 8 ++++----
+ fs/ocfs2/dlm/dlmrecovery.c | 8 ++++----
+ fs/ocfs2/dlm/dlmthread.c | 8 ++++----
+ fs/ocfs2/dlm/dlmunlock.c | 8 ++++----
+ fs/ocfs2/dlmfs/Makefile | 2 --
+ fs/ocfs2/dlmfs/dlmfs.c | 4 ++--
+ fs/ocfs2/dlmfs/userdlm.c | 6 +++---
+ 13 files changed, 41 insertions(+), 45 deletions(-)
+
+diff --git a/fs/ocfs2/dlm/Makefile b/fs/ocfs2/dlm/Makefile
+index 38b2243727763..5e700b45d32d2 100644
+--- a/fs/ocfs2/dlm/Makefile
++++ b/fs/ocfs2/dlm/Makefile
+@@ -1,6 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-ccflags-y := -I $(srctree)/$(src)/..
+-
+ obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o
+
+ ocfs2_dlm-objs := dlmdomain.o dlmdebug.o dlmthread.o dlmrecovery.o \
+diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c
+index 4de89af96abf0..6abaded3ff6bd 100644
+--- a/fs/ocfs2/dlm/dlmast.c
++++ b/fs/ocfs2/dlm/dlmast.c
+@@ -23,15 +23,15 @@
+ #include <linux/spinlock.h>
+
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ static void dlm_update_lvb(struct dlm_ctxt *dlm, struct dlm_lock_resource *res,
+ struct dlm_lock *lock);
+diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
+index 965f45dbe17bf..6051edc33aefa 100644
+--- a/fs/ocfs2/dlm/dlmconvert.c
++++ b/fs/ocfs2/dlm/dlmconvert.c
+@@ -23,9 +23,9 @@
+ #include <linux/spinlock.h>
+
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -33,7 +33,7 @@
+ #include "dlmconvert.h"
+
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ /* NOTE: __dlmconvert_master is the only function in here that
+ * needs a spinlock held on entry (res->spinlock) and it is the
+diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
+index 4d0b452012b25..c5c6efba7b5e2 100644
+--- a/fs/ocfs2/dlm/dlmdebug.c
++++ b/fs/ocfs2/dlm/dlmdebug.c
+@@ -17,9 +17,9 @@
+ #include <linux/debugfs.h>
+ #include <linux/export.h>
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -27,7 +27,7 @@
+ #include "dlmdebug.h"
+
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ static int stringify_lockname(const char *lockname, int locklen, char *buf,
+ int len);
+diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
+index ee6f459f97706..357cfc702ce36 100644
+--- a/fs/ocfs2/dlm/dlmdomain.c
++++ b/fs/ocfs2/dlm/dlmdomain.c
+@@ -20,9 +20,9 @@
+ #include <linux/debugfs.h>
+ #include <linux/sched/signal.h>
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -30,7 +30,7 @@
+ #include "dlmdebug.h"
+
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_DOMAIN)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ /*
+ * ocfs2 node maps are array of long int, which limits to send them freely
+diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
+index baff087f38632..83f0760e4fbaa 100644
+--- a/fs/ocfs2/dlm/dlmlock.c
++++ b/fs/ocfs2/dlm/dlmlock.c
+@@ -25,9 +25,9 @@
+ #include <linux/delay.h>
+
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -35,7 +35,7 @@
+ #include "dlmconvert.h"
+
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ static struct kmem_cache *dlm_lock_cache;
+
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 74b768ca1cd88..c9d7037b6793c 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -25,9 +25,9 @@
+ #include <linux/delay.h>
+
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+@@ -35,7 +35,7 @@
+ #include "dlmdebug.h"
+
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_MASTER)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ static void dlm_mle_node_down(struct dlm_ctxt *dlm,
+ struct dlm_master_list_entry *mle,
+diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
+index 064ce5bbc3f6c..bcaaca5112d6e 100644
+--- a/fs/ocfs2/dlm/dlmrecovery.c
++++ b/fs/ocfs2/dlm/dlmrecovery.c
+@@ -26,16 +26,16 @@
+ #include <linux/delay.h>
+
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+ #include "dlmdomain.h"
+
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_RECOVERY)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node);
+
+diff --git a/fs/ocfs2/dlm/dlmthread.c b/fs/ocfs2/dlm/dlmthread.c
+index 61c51c268460a..fd40c17cd0225 100644
+--- a/fs/ocfs2/dlm/dlmthread.c
++++ b/fs/ocfs2/dlm/dlmthread.c
+@@ -25,16 +25,16 @@
+ #include <linux/delay.h>
+
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+ #include "dlmdomain.h"
+
+ #define MLOG_MASK_PREFIX (ML_DLM|ML_DLM_THREAD)
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ static int dlm_thread(void *data);
+ static void dlm_flush_asts(struct dlm_ctxt *dlm);
+diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
+index 3883633e82eb9..dcb17ca8ae74d 100644
+--- a/fs/ocfs2/dlm/dlmunlock.c
++++ b/fs/ocfs2/dlm/dlmunlock.c
+@@ -23,15 +23,15 @@
+ #include <linux/spinlock.h>
+ #include <linux/delay.h>
+
+-#include "cluster/heartbeat.h"
+-#include "cluster/nodemanager.h"
+-#include "cluster/tcp.h"
++#include "../cluster/heartbeat.h"
++#include "../cluster/nodemanager.h"
++#include "../cluster/tcp.h"
+
+ #include "dlmapi.h"
+ #include "dlmcommon.h"
+
+ #define MLOG_MASK_PREFIX ML_DLM
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+ #define DLM_UNLOCK_FREE_LOCK 0x00000001
+ #define DLM_UNLOCK_CALL_AST 0x00000002
+diff --git a/fs/ocfs2/dlmfs/Makefile b/fs/ocfs2/dlmfs/Makefile
+index a9874e441bd4a..c7895f65be0ea 100644
+--- a/fs/ocfs2/dlmfs/Makefile
++++ b/fs/ocfs2/dlmfs/Makefile
+@@ -1,6 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+-ccflags-y := -I $(srctree)/$(src)/..
+-
+ obj-$(CONFIG_OCFS2_FS) += ocfs2_dlmfs.o
+
+ ocfs2_dlmfs-objs := userdlm.o dlmfs.o
+diff --git a/fs/ocfs2/dlmfs/dlmfs.c b/fs/ocfs2/dlmfs/dlmfs.c
+index 4f1668c81e1f1..8e4f1ace467c1 100644
+--- a/fs/ocfs2/dlmfs/dlmfs.c
++++ b/fs/ocfs2/dlmfs/dlmfs.c
+@@ -33,11 +33,11 @@
+
+ #include <linux/uaccess.h>
+
+-#include "stackglue.h"
++#include "../stackglue.h"
+ #include "userdlm.h"
+
+ #define MLOG_MASK_PREFIX ML_DLMFS
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+
+ static const struct super_operations dlmfs_ops;
+diff --git a/fs/ocfs2/dlmfs/userdlm.c b/fs/ocfs2/dlmfs/userdlm.c
+index 525b14ddfba50..3df5be25bfb1f 100644
+--- a/fs/ocfs2/dlmfs/userdlm.c
++++ b/fs/ocfs2/dlmfs/userdlm.c
+@@ -21,12 +21,12 @@
+ #include <linux/types.h>
+ #include <linux/crc32.h>
+
+-#include "ocfs2_lockingver.h"
+-#include "stackglue.h"
++#include "../ocfs2_lockingver.h"
++#include "../stackglue.h"
+ #include "userdlm.h"
+
+ #define MLOG_MASK_PREFIX ML_DLMFS
+-#include "cluster/masklog.h"
++#include "../cluster/masklog.h"
+
+
+ static inline struct user_lock_res *user_lksb_to_lock_res(struct ocfs2_dlm_lksb *lksb)
+--
+2.20.1
+
--- /dev/null
+From cbd19eab1f77f5f363dfc5aa9412895624142d92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 14:41:07 +0530
+Subject: opp: Free static OPPs on errors while adding them
+
+From: Viresh Kumar <viresh.kumar@linaro.org>
+
+[ Upstream commit ba0033192145cbd4e70ef64552958b13d597eb9e ]
+
+The static OPPs aren't getting freed properly, if errors occur while
+adding them. Fix that by calling _put_opp_list_kref() and putting their
+reference on failures.
+
+Fixes: 11e1a1648298 ("opp: Don't decrement uninitialized list_kref")
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/opp/of.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/opp/of.c b/drivers/opp/of.c
+index 1cbb58240b801..1e5fcdee043c4 100644
+--- a/drivers/opp/of.c
++++ b/drivers/opp/of.c
+@@ -678,15 +678,17 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
+ dev_err(dev, "%s: Failed to add OPP, %d\n", __func__,
+ ret);
+ of_node_put(np);
+- return ret;
++ goto put_list_kref;
+ } else if (opp) {
+ count++;
+ }
+ }
+
+ /* There should be one of more OPP defined */
+- if (WARN_ON(!count))
+- return -ENOENT;
++ if (WARN_ON(!count)) {
++ ret = -ENOENT;
++ goto put_list_kref;
++ }
+
+ list_for_each_entry(opp, &opp_table->opp_list, node)
+ pstate_count += !!opp->pstate;
+@@ -695,7 +697,8 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
+ if (pstate_count && pstate_count != count) {
+ dev_err(dev, "Not all nodes have performance state set (%d: %d)\n",
+ count, pstate_count);
+- return -ENOENT;
++ ret = -ENOENT;
++ goto put_list_kref;
+ }
+
+ if (pstate_count)
+@@ -704,6 +707,11 @@ static int _of_add_opp_table_v2(struct device *dev, struct opp_table *opp_table)
+ opp_table->parsed_static_opps = true;
+
+ return 0;
++
++put_list_kref:
++ _put_opp_list_kref(opp_table);
++
++ return ret;
+ }
+
+ /* Initializes OPP tables based on old-deprecated bindings */
+@@ -738,6 +746,7 @@ static int _of_add_opp_table_v1(struct device *dev, struct opp_table *opp_table)
+ if (ret) {
+ dev_err(dev, "%s: Failed to add OPP %ld (%d)\n",
+ __func__, freq, ret);
++ _put_opp_list_kref(opp_table);
+ return ret;
+ }
+ nr -= 2;
+--
+2.20.1
+
--- /dev/null
+From aecd27a7a2e919d5706309086ae173fa32dfd012 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 13:58:58 -0600
+Subject: orinoco: avoid assertion in case of NULL pointer
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit c705f9fc6a1736dcf6ec01f8206707c108dca824 ]
+
+In ezusb_init, if upriv is NULL, the code crashes. However, the caller
+in ezusb_probe can handle the error and print the failure message.
+The patch replaces the BUG_ON call to error return.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/orinoco/orinoco_usb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index 8c79b963bcffb..e753f43e0162f 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1361,7 +1361,8 @@ static int ezusb_init(struct hermes *hw)
+ int retval;
+
+ BUG_ON(in_interrupt());
+- BUG_ON(!upriv);
++ if (!upriv)
++ return -EINVAL;
+
+ upriv->reply_count = 0;
+ /* Write the MAGIC number on the simulated registers to keep
+--
+2.20.1
+
--- /dev/null
+From f9c250173159f8f15ef4f22efb88a223d6f5c487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 14:31:11 -0500
+Subject: padata: always acquire cpu_hotplug_lock before pinst->lock
+
+From: Daniel Jordan <daniel.m.jordan@oracle.com>
+
+[ Upstream commit 38228e8848cd7dd86ccb90406af32de0cad24be3 ]
+
+lockdep complains when padata's paths to update cpumasks via CPU hotplug
+and sysfs are both taken:
+
+ # echo 0 > /sys/devices/system/cpu/cpu1/online
+ # echo ff > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
+
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 5.4.0-rc8-padata-cpuhp-v3+ #1 Not tainted
+ ------------------------------------------------------
+ bash/205 is trying to acquire lock:
+ ffffffff8286bcd0 (cpu_hotplug_lock.rw_sem){++++}, at: padata_set_cpumask+0x2b/0x120
+
+ but task is already holding lock:
+ ffff8880001abfa0 (&pinst->lock){+.+.}, at: padata_set_cpumask+0x26/0x120
+
+ which lock already depends on the new lock.
+
+padata doesn't take cpu_hotplug_lock and pinst->lock in a consistent
+order. Which should be first? CPU hotplug calls into padata with
+cpu_hotplug_lock already held, so it should have priority.
+
+Fixes: 6751fb3c0e0c ("padata: Use get_online_cpus/put_online_cpus")
+Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Cc: Eric Biggers <ebiggers@kernel.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: linux-crypto@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index fda7a7039422d..fdbbe96547713 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -643,8 +643,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ struct cpumask *serial_mask, *parallel_mask;
+ int err = -EINVAL;
+
+- mutex_lock(&pinst->lock);
+ get_online_cpus();
++ mutex_lock(&pinst->lock);
+
+ switch (cpumask_type) {
+ case PADATA_CPU_PARALLEL:
+@@ -662,8 +662,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ err = __padata_set_cpumasks(pinst, parallel_mask, serial_mask);
+
+ out:
+- put_online_cpus();
+ mutex_unlock(&pinst->lock);
++ put_online_cpus();
+
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From 33d2c7a604ba9e379180905feca9474316979435 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 14:31:10 -0500
+Subject: padata: validate cpumask without removed CPU during offline
+
+From: Daniel Jordan <daniel.m.jordan@oracle.com>
+
+[ Upstream commit 894c9ef9780c5cf2f143415e867ee39a33ecb75d ]
+
+Configuring an instance's parallel mask without any online CPUs...
+
+ echo 2 > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
+ echo 0 > /sys/devices/system/cpu/cpu1/online
+
+...makes tcrypt mode=215 crash like this:
+
+ divide error: 0000 [#1] SMP PTI
+ CPU: 4 PID: 283 Comm: modprobe Not tainted 5.4.0-rc8-padata-doc-v2+ #2
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191013_105130-anatol 04/01/2014
+ RIP: 0010:padata_do_parallel+0x114/0x300
+ Call Trace:
+ pcrypt_aead_encrypt+0xc0/0xd0 [pcrypt]
+ crypto_aead_encrypt+0x1f/0x30
+ do_mult_aead_op+0x4e/0xdf [tcrypt]
+ test_mb_aead_speed.constprop.0.cold+0x226/0x564 [tcrypt]
+ do_test+0x28c2/0x4d49 [tcrypt]
+ tcrypt_mod_init+0x55/0x1000 [tcrypt]
+ ...
+
+cpumask_weight() in padata_cpu_hash() returns 0 because the mask has no
+CPUs. The problem is __padata_remove_cpu() checks for valid masks too
+early and so doesn't mark the instance PADATA_INVALID as expected, which
+would have made padata_do_parallel() return error before doing the
+division.
+
+Fix by introducing a second padata CPU hotplug state before
+CPUHP_BRINGUP_CPU so that __padata_remove_cpu() sees the online mask
+without @cpu. No need for the second argument to padata_replace() since
+@cpu is now already missing from the online mask.
+
+Fixes: 33e54450683c ("padata: Handle empty padata cpumasks")
+Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Cc: Eric Biggers <ebiggers@kernel.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-crypto@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/cpuhotplug.h | 1 +
+ kernel/padata.c | 30 ++++++++++++++++++------------
+ 2 files changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/include/linux/cpuhotplug.h b/include/linux/cpuhotplug.h
+index 068793a619ca8..2d55cee638fc6 100644
+--- a/include/linux/cpuhotplug.h
++++ b/include/linux/cpuhotplug.h
+@@ -59,6 +59,7 @@ enum cpuhp_state {
+ CPUHP_IOMMU_INTEL_DEAD,
+ CPUHP_LUSTRE_CFS_DEAD,
+ CPUHP_AP_ARM_CACHE_B15_RAC_DEAD,
++ CPUHP_PADATA_DEAD,
+ CPUHP_WORKQUEUE_PREP,
+ CPUHP_POWER_NUMA_PREPARE,
+ CPUHP_HRTIMERS_PREPARE,
+diff --git a/kernel/padata.c b/kernel/padata.c
+index 9c82ee4a97323..fda7a7039422d 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -512,7 +512,7 @@ static int padata_replace_one(struct padata_shell *ps)
+ return 0;
+ }
+
+-static int padata_replace(struct padata_instance *pinst, int cpu)
++static int padata_replace(struct padata_instance *pinst)
+ {
+ int notification_mask = 0;
+ struct padata_shell *ps;
+@@ -523,16 +523,12 @@ static int padata_replace(struct padata_instance *pinst, int cpu)
+ cpumask_copy(pinst->omask, pinst->rcpumask.pcpu);
+ cpumask_and(pinst->rcpumask.pcpu, pinst->cpumask.pcpu,
+ cpu_online_mask);
+- if (cpu >= 0)
+- cpumask_clear_cpu(cpu, pinst->rcpumask.pcpu);
+ if (!cpumask_equal(pinst->omask, pinst->rcpumask.pcpu))
+ notification_mask |= PADATA_CPU_PARALLEL;
+
+ cpumask_copy(pinst->omask, pinst->rcpumask.cbcpu);
+ cpumask_and(pinst->rcpumask.cbcpu, pinst->cpumask.cbcpu,
+ cpu_online_mask);
+- if (cpu >= 0)
+- cpumask_clear_cpu(cpu, pinst->rcpumask.cbcpu);
+ if (!cpumask_equal(pinst->omask, pinst->rcpumask.cbcpu))
+ notification_mask |= PADATA_CPU_SERIAL;
+
+@@ -624,7 +620,7 @@ out_replace:
+ cpumask_copy(pinst->cpumask.pcpu, pcpumask);
+ cpumask_copy(pinst->cpumask.cbcpu, cbcpumask);
+
+- err = padata_setup_cpumasks(pinst) ?: padata_replace(pinst, -1);
++ err = padata_setup_cpumasks(pinst) ?: padata_replace(pinst);
+
+ if (valid)
+ __padata_start(pinst);
+@@ -715,7 +711,7 @@ static int __padata_add_cpu(struct padata_instance *pinst, int cpu)
+ int err = 0;
+
+ if (cpumask_test_cpu(cpu, cpu_online_mask)) {
+- err = padata_replace(pinst, -1);
++ err = padata_replace(pinst);
+
+ if (padata_validate_cpumask(pinst, pinst->cpumask.pcpu) &&
+ padata_validate_cpumask(pinst, pinst->cpumask.cbcpu))
+@@ -729,12 +725,12 @@ static int __padata_remove_cpu(struct padata_instance *pinst, int cpu)
+ {
+ int err = 0;
+
+- if (cpumask_test_cpu(cpu, cpu_online_mask)) {
++ if (!cpumask_test_cpu(cpu, cpu_online_mask)) {
+ if (!padata_validate_cpumask(pinst, pinst->cpumask.pcpu) ||
+ !padata_validate_cpumask(pinst, pinst->cpumask.cbcpu))
+ __padata_stop(pinst);
+
+- err = padata_replace(pinst, cpu);
++ err = padata_replace(pinst);
+ }
+
+ return err;
+@@ -796,7 +792,7 @@ static int padata_cpu_online(unsigned int cpu, struct hlist_node *node)
+ return ret;
+ }
+
+-static int padata_cpu_prep_down(unsigned int cpu, struct hlist_node *node)
++static int padata_cpu_dead(unsigned int cpu, struct hlist_node *node)
+ {
+ struct padata_instance *pinst;
+ int ret;
+@@ -817,6 +813,7 @@ static enum cpuhp_state hp_online;
+ static void __padata_free(struct padata_instance *pinst)
+ {
+ #ifdef CONFIG_HOTPLUG_CPU
++ cpuhp_state_remove_instance_nocalls(CPUHP_PADATA_DEAD, &pinst->node);
+ cpuhp_state_remove_instance_nocalls(hp_online, &pinst->node);
+ #endif
+
+@@ -1024,6 +1021,8 @@ static struct padata_instance *padata_alloc(const char *name,
+
+ #ifdef CONFIG_HOTPLUG_CPU
+ cpuhp_state_add_instance_nocalls_cpuslocked(hp_online, &pinst->node);
++ cpuhp_state_add_instance_nocalls_cpuslocked(CPUHP_PADATA_DEAD,
++ &pinst->node);
+ #endif
+
+ put_online_cpus();
+@@ -1136,17 +1135,24 @@ static __init int padata_driver_init(void)
+ int ret;
+
+ ret = cpuhp_setup_state_multi(CPUHP_AP_ONLINE_DYN, "padata:online",
+- padata_cpu_online,
+- padata_cpu_prep_down);
++ padata_cpu_online, NULL);
+ if (ret < 0)
+ return ret;
+ hp_online = ret;
++
++ ret = cpuhp_setup_state_multi(CPUHP_PADATA_DEAD, "padata:dead",
++ NULL, padata_cpu_dead);
++ if (ret < 0) {
++ cpuhp_remove_multi_state(hp_online);
++ return ret;
++ }
+ return 0;
+ }
+ module_init(padata_driver_init);
+
+ static __exit void padata_driver_exit(void)
+ {
++ cpuhp_remove_multi_state(CPUHP_PADATA_DEAD);
+ cpuhp_remove_multi_state(hp_online);
+ }
+ module_exit(padata_driver_exit);
+--
+2.20.1
+
--- /dev/null
+From 527bffa07f1604d5963e8f6ef53640662b539aaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 16:25:40 -0600
+Subject: PCI: Add DMA alias quirk for PLX PEX NTB
+
+From: James Sewart <jamessewart@arista.com>
+
+[ Upstream commit 7b90dfc4873b87c468cc6046538f46a531c1d785 ]
+
+The PLX PEX NTB forwards DMA transactions using Requester IDs that don't
+exist as PCI devices. The devfn for a transaction is used as an index into
+a lookup table storing the origin of a transaction on the other side of the
+bridge.
+
+Alias all possible devfns to the NTB device so that any transaction coming
+in is governed by the mappings for the NTB.
+
+Signed-off-by: James Sewart <jamessewart@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 67a9ad3734d18..2fdceaab73072 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5352,6 +5352,21 @@ SWITCHTEC_QUIRK(0x8574); /* PFXI 64XG3 */
+ SWITCHTEC_QUIRK(0x8575); /* PFXI 80XG3 */
+ SWITCHTEC_QUIRK(0x8576); /* PFXI 96XG3 */
+
++/*
++ * The PLX NTB uses devfn proxy IDs to move TLPs between NT endpoints.
++ * These IDs are used to forward responses to the originator on the other
++ * side of the NTB. Alias all possible IDs to the NTB to permit access when
++ * the IOMMU is turned on.
++ */
++static void quirk_plx_ntb_dma_alias(struct pci_dev *pdev)
++{
++ pci_info(pdev, "Setting PLX NTB proxy ID aliases\n");
++ /* PLX NTB may use all 256 devfns */
++ pci_add_dma_alias(pdev, 0, 256);
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PLX, 0x87b0, quirk_plx_ntb_dma_alias);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_PLX, 0x87b1, quirk_plx_ntb_dma_alias);
++
+ /*
+ * On Lenovo Thinkpad P50 SKUs with a Nvidia Quadro M1000M, the BIOS does
+ * not always reset the secondary Nvidia GPU between reboots if the system
+--
+2.20.1
+
--- /dev/null
+From 08b85269c54e90bc0d539102addc882a3754d6d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 13:38:35 +0800
+Subject: PCI: Add generic quirk for increasing D3hot delay
+
+From: Daniel Drake <drake@endlessm.com>
+
+[ Upstream commit 62fe23df067715a21c4aef44068efe7ceaa8f627 ]
+
+Separate the D3 delay increase functionality out of quirk_radeon_pm() into
+its own function so that it can be shared with other quirks, including the
+AMD Ryzen XHCI quirk that will be introduced in a followup commit.
+
+Tweak the function name and message to indicate more clearly that the delay
+relates to a D3hot-to-D0 transition.
+
+Link: https://lore.kernel.org/r/20191127053836.31624-1-drake@endlessm.com
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7afbce082d83e..5c863af9452ec 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1871,16 +1871,21 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2609, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260a, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260b, quirk_intel_pcie_pm);
+
++static void quirk_d3hot_delay(struct pci_dev *dev, unsigned int delay)
++{
++ if (dev->d3_delay >= delay)
++ return;
++
++ dev->d3_delay = delay;
++ pci_info(dev, "extending delay after power-on from D3hot to %d msec\n",
++ dev->d3_delay);
++}
++
+ static void quirk_radeon_pm(struct pci_dev *dev)
+ {
+ if (dev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+- dev->subsystem_device == 0x00e2) {
+- if (dev->d3_delay < 20) {
+- dev->d3_delay = 20;
+- pci_info(dev, "extending delay after power-on from D3 to %d msec\n",
+- dev->d3_delay);
+- }
+- }
++ dev->subsystem_device == 0x00e2)
++ quirk_d3hot_delay(dev, 20);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+
+--
+2.20.1
+
--- /dev/null
+From 6081f10120e7ceeb96e225c36883a59936cc1caf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 16:07:30 -0600
+Subject: PCI: Add nr_devfns parameter to pci_add_dma_alias()
+
+From: James Sewart <jamessewart@arista.com>
+
+[ Upstream commit 09298542cd891b43778db1f65aa3613aa5a562eb ]
+
+Add a "nr_devfns" parameter to pci_add_dma_alias() so it can be used to
+create DMA aliases for a range of devfns.
+
+[bhelgaas: incorporate nr_devfns fix from James, update
+quirk_pex_vca_alias() and setup_aliases()]
+Signed-off-by: James Sewart <jamessewart@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 7 ++-----
+ drivers/pci/pci.c | 22 +++++++++++++++++-----
+ drivers/pci/quirks.c | 23 +++++++++--------------
+ include/linux/pci.h | 2 +-
+ 4 files changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 454695b372c8c..8bd5d608a82c2 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -272,11 +272,8 @@ static struct pci_dev *setup_aliases(struct device *dev)
+ */
+ ivrs_alias = amd_iommu_alias_table[pci_dev_id(pdev)];
+ if (ivrs_alias != pci_dev_id(pdev) &&
+- PCI_BUS_NUM(ivrs_alias) == pdev->bus->number) {
+- pci_add_dma_alias(pdev, ivrs_alias & 0xff);
+- pci_info(pdev, "Added PCI DMA alias %02x.%d\n",
+- PCI_SLOT(ivrs_alias), PCI_FUNC(ivrs_alias));
+- }
++ PCI_BUS_NUM(ivrs_alias) == pdev->bus->number)
++ pci_add_dma_alias(pdev, ivrs_alias & 0xff, 1);
+
+ clone_aliases(pdev);
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index cbf3d3889874c..981ae16f935bc 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5875,7 +5875,8 @@ EXPORT_SYMBOL_GPL(pci_pr3_present);
+ /**
+ * pci_add_dma_alias - Add a DMA devfn alias for a device
+ * @dev: the PCI device for which alias is added
+- * @devfn: alias slot and function
++ * @devfn_from: alias slot and function
++ * @nr_devfns: number of subsequent devfns to alias
+ *
+ * This helper encodes an 8-bit devfn as a bit number in dma_alias_mask
+ * which is used to program permissible bus-devfn source addresses for DMA
+@@ -5891,8 +5892,13 @@ EXPORT_SYMBOL_GPL(pci_pr3_present);
+ * cannot be left as a userspace activity). DMA aliases should therefore
+ * be configured via quirks, such as the PCI fixup header quirk.
+ */
+-void pci_add_dma_alias(struct pci_dev *dev, u8 devfn)
++void pci_add_dma_alias(struct pci_dev *dev, u8 devfn_from, unsigned nr_devfns)
+ {
++ int devfn_to;
++
++ nr_devfns = min(nr_devfns, (unsigned) MAX_NR_DEVFNS - devfn_from);
++ devfn_to = devfn_from + nr_devfns - 1;
++
+ if (!dev->dma_alias_mask)
+ dev->dma_alias_mask = bitmap_zalloc(MAX_NR_DEVFNS, GFP_KERNEL);
+ if (!dev->dma_alias_mask) {
+@@ -5900,9 +5906,15 @@ void pci_add_dma_alias(struct pci_dev *dev, u8 devfn)
+ return;
+ }
+
+- set_bit(devfn, dev->dma_alias_mask);
+- pci_info(dev, "Enabling fixed DMA alias to %02x.%d\n",
+- PCI_SLOT(devfn), PCI_FUNC(devfn));
++ bitmap_set(dev->dma_alias_mask, devfn_from, nr_devfns);
++
++ if (nr_devfns == 1)
++ pci_info(dev, "Enabling fixed DMA alias to %02x.%d\n",
++ PCI_SLOT(devfn_from), PCI_FUNC(devfn_from));
++ else if (nr_devfns > 1)
++ pci_info(dev, "Enabling fixed DMA alias for devfn range from %02x.%d to %02x.%d\n",
++ PCI_SLOT(devfn_from), PCI_FUNC(devfn_from),
++ PCI_SLOT(devfn_to), PCI_FUNC(devfn_to));
+ }
+
+ bool pci_devs_are_dma_aliases(struct pci_dev *dev1, struct pci_dev *dev2)
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 7b6df2d8d6cde..67a9ad3734d18 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3927,7 +3927,7 @@ int pci_dev_specific_reset(struct pci_dev *dev, int probe)
+ static void quirk_dma_func0_alias(struct pci_dev *dev)
+ {
+ if (PCI_FUNC(dev->devfn) != 0)
+- pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 0));
++ pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 0), 1);
+ }
+
+ /*
+@@ -3941,7 +3941,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_RICOH, 0xe476, quirk_dma_func0_alias);
+ static void quirk_dma_func1_alias(struct pci_dev *dev)
+ {
+ if (PCI_FUNC(dev->devfn) != 1)
+- pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 1));
++ pci_add_dma_alias(dev, PCI_DEVFN(PCI_SLOT(dev->devfn), 1), 1);
+ }
+
+ /*
+@@ -4026,7 +4026,7 @@ static void quirk_fixed_dma_alias(struct pci_dev *dev)
+
+ id = pci_match_id(fixed_dma_alias_tbl, dev);
+ if (id)
+- pci_add_dma_alias(dev, id->driver_data);
++ pci_add_dma_alias(dev, id->driver_data, 1);
+ }
+
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ADAPTEC2, 0x0285, quirk_fixed_dma_alias);
+@@ -4068,9 +4068,9 @@ DECLARE_PCI_FIXUP_HEADER(0x8086, 0x244e, quirk_use_pcie_bridge_dma_alias);
+ */
+ static void quirk_mic_x200_dma_alias(struct pci_dev *pdev)
+ {
+- pci_add_dma_alias(pdev, PCI_DEVFN(0x10, 0x0));
+- pci_add_dma_alias(pdev, PCI_DEVFN(0x11, 0x0));
+- pci_add_dma_alias(pdev, PCI_DEVFN(0x12, 0x3));
++ pci_add_dma_alias(pdev, PCI_DEVFN(0x10, 0x0), 1);
++ pci_add_dma_alias(pdev, PCI_DEVFN(0x11, 0x0), 1);
++ pci_add_dma_alias(pdev, PCI_DEVFN(0x12, 0x3), 1);
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2260, quirk_mic_x200_dma_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2264, quirk_mic_x200_dma_alias);
+@@ -4094,13 +4094,8 @@ static void quirk_pex_vca_alias(struct pci_dev *pdev)
+ const unsigned int num_pci_slots = 0x20;
+ unsigned int slot;
+
+- for (slot = 0; slot < num_pci_slots; slot++) {
+- pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x0));
+- pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x1));
+- pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x2));
+- pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x3));
+- pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x4));
+- }
++ for (slot = 0; slot < num_pci_slots; slot++)
++ pci_add_dma_alias(pdev, PCI_DEVFN(slot, 0x0), 5);
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2954, quirk_pex_vca_alias);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2955, quirk_pex_vca_alias);
+@@ -5315,7 +5310,7 @@ static void quirk_switchtec_ntb_dma_alias(struct pci_dev *pdev)
+ pci_dbg(pdev,
+ "Aliasing Partition %d Proxy ID %02x.%d\n",
+ pp, PCI_SLOT(devfn), PCI_FUNC(devfn));
+- pci_add_dma_alias(pdev, devfn);
++ pci_add_dma_alias(pdev, devfn, 1);
+ }
+ }
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index be529d311122d..f39f22f9ee474 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -2324,7 +2324,7 @@ static inline struct eeh_dev *pci_dev_to_eeh_dev(struct pci_dev *pdev)
+ }
+ #endif
+
+-void pci_add_dma_alias(struct pci_dev *dev, u8 devfn);
++void pci_add_dma_alias(struct pci_dev *dev, u8 devfn_from, unsigned nr_devfns);
+ bool pci_devs_are_dma_aliases(struct pci_dev *dev1, struct pci_dev *dev2);
+ int pci_for_each_dma_alias(struct pci_dev *pdev,
+ int (*fn)(struct pci_dev *pdev,
+--
+2.20.1
+
--- /dev/null
+From be526a59ece634b69fefa039dd7fd83e427085bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 15:51:33 -0600
+Subject: PCI: Fix pci_add_dma_alias() bitmask size
+
+From: James Sewart <jamessewart@arista.com>
+
+[ Upstream commit f8bf2aeb651b3460a4b36fd7ba1ba1d31777d35c ]
+
+The number of possible devfns is 256, but pci_add_dma_alias() allocated a
+bitmap of size 255. Fix this off-by-one error.
+
+This fixes commits 338c3149a221 ("PCI: Add support for multiple DMA
+aliases") and c6635792737b ("PCI: Allocate dma_alias_mask with
+bitmap_zalloc()"), but I doubt it was possible to see a problem because
+it takes 4 64-bit longs (or 8 32-bit longs) to hold 255 bits, and
+bitmap_zalloc() doesn't save the 255-bit size anywhere.
+
+[bhelgaas: commit log, move #define to drivers/pci/pci.h, include loop
+limit fix from Qian Cai:
+https://lore.kernel.org/r/20191218170004.5297-1-cai@lca.pw]
+Signed-off-by: James Sewart <jamessewart@arista.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 2 +-
+ drivers/pci/pci.h | 3 +++
+ drivers/pci/search.c | 4 ++--
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index fcfaadc774eef..cbf3d3889874c 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -5894,7 +5894,7 @@ EXPORT_SYMBOL_GPL(pci_pr3_present);
+ void pci_add_dma_alias(struct pci_dev *dev, u8 devfn)
+ {
+ if (!dev->dma_alias_mask)
+- dev->dma_alias_mask = bitmap_zalloc(U8_MAX, GFP_KERNEL);
++ dev->dma_alias_mask = bitmap_zalloc(MAX_NR_DEVFNS, GFP_KERNEL);
+ if (!dev->dma_alias_mask) {
+ pci_warn(dev, "Unable to allocate DMA alias mask\n");
+ return;
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index 3f6947ee3324a..273d60cb0762d 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -4,6 +4,9 @@
+
+ #include <linux/pci.h>
+
++/* Number of possible devfns: 0.0 to 1f.7 inclusive */
++#define MAX_NR_DEVFNS 256
++
+ #define PCI_FIND_CAP_TTL 48
+
+ #define PCI_VSEC_ID_INTEL_TBT 0x1234 /* Thunderbolt */
+diff --git a/drivers/pci/search.c b/drivers/pci/search.c
+index bade14002fd8a..e4dbdef5aef05 100644
+--- a/drivers/pci/search.c
++++ b/drivers/pci/search.c
+@@ -41,9 +41,9 @@ int pci_for_each_dma_alias(struct pci_dev *pdev,
+ * DMA, iterate over that too.
+ */
+ if (unlikely(pdev->dma_alias_mask)) {
+- u8 devfn;
++ unsigned int devfn;
+
+- for_each_set_bit(devfn, pdev->dma_alias_mask, U8_MAX) {
++ for_each_set_bit(devfn, pdev->dma_alias_mask, MAX_NR_DEVFNS) {
+ ret = fn(pdev, PCI_DEVID(pdev->bus->number, devfn),
+ data);
+ if (ret)
+--
+2.20.1
+
--- /dev/null
+From fcf9e0abdf526d4083f3414ee6feca775896856c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 13:38:36 +0800
+Subject: PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
+
+From: Daniel Drake <drake@endlessm.com>
+
+[ Upstream commit 3030df209aa8cf831b9963829bd9f94900ee8032 ]
+
+On Asus UX434DA (AMD Ryzen7 3700U) and Asus X512DK (AMD Ryzen5 3500U), the
+XHCI controller fails to resume from runtime suspend or s2idle, and USB
+becomes unusable from that point.
+
+ xhci_hcd 0000:03:00.4: Refused to change power state, currently in D3
+ xhci_hcd 0000:03:00.4: enabling device (0000 -> 0002)
+ xhci_hcd 0000:03:00.4: WARN: xHC restore state timeout
+ xhci_hcd 0000:03:00.4: PCI post-resume error -110!
+ xhci_hcd 0000:03:00.4: HC died; cleaning up
+
+During suspend, a transition to D3cold is attempted, however the affected
+platforms do not seem to cut the power to the PCI device when in this
+state, so the device stays in D3hot.
+
+Upon resume, the D3hot-to-D0 transition is successful only if the D3 delay
+is increased to 20ms. The transition failure does not appear to be
+detectable as a CRS condition. Add a PCI quirk to increase the delay on the
+affected hardware.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=205587
+Link: http://lkml.kernel.org/r/CAD8Lp47Vh69gQjROYG69=waJgL7hs1PwnLonL9+27S_TcRhixA@mail.gmail.com
+Link: https://lore.kernel.org/r/20191127053836.31624-2-drake@endlessm.com
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 5c863af9452ec..7b6df2d8d6cde 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1889,6 +1889,22 @@ static void quirk_radeon_pm(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+
++/*
++ * Ryzen5/7 XHCI controllers fail upon resume from runtime suspend or s2idle.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=205587
++ *
++ * The kernel attempts to transition these devices to D3cold, but that seems
++ * to be ineffective on the platforms in question; the PCI device appears to
++ * remain on in D3hot state. The D3hot-to-D0 transition then requires an
++ * extended delay in order to succeed.
++ */
++static void quirk_ryzen_xhci_d3hot(struct pci_dev *dev)
++{
++ quirk_d3hot_delay(dev, 20);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e0, quirk_ryzen_xhci_d3hot);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e1, quirk_ryzen_xhci_d3hot);
++
+ #ifdef CONFIG_X86_IO_APIC
+ static int dmi_disable_ioapicreroute(const struct dmi_system_id *d)
+ {
+--
+2.20.1
+
--- /dev/null
+From 115bfad2119712b20bd881649445a69c7d805849 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 17:45:11 +0000
+Subject: PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in
+
+From: Wei Liu <wei.liu@kernel.org>
+
+[ Upstream commit 574f29036fce385e28617547955dd6911d375025 ]
+
+Previously quirk_paxc_bridge() was applied when the iproc driver was
+built-in, but not when it was compiled as a module.
+
+This happened because it was under #ifdef CONFIG_PCIE_IPROC_PLATFORM:
+PCIE_IPROC_PLATFORM=y causes CONFIG_PCIE_IPROC_PLATFORM to be defined, but
+PCIE_IPROC_PLATFORM=m causes CONFIG_PCIE_IPROC_PLATFORM_MODULE to be
+defined.
+
+Move quirk_paxc_bridge() to pcie-iproc.c and drop the #ifdef so the quirk
+is always applied, whether iproc is built-in or a module.
+
+[bhelgaas: commit log, move to pcie-iproc.c, not pcie-iproc-platform.c]
+Link: https://lore.kernel.org/r/20191211174511.89713-1-wei.liu@kernel.org
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 24 ++++++++++++++++++++++++
+ drivers/pci/quirks.c | 26 --------------------------
+ 2 files changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index 2d457bfdaf66e..933a4346ae5d6 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -1608,6 +1608,30 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802,
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804,
+ quirk_paxc_disable_msi_parsing);
+
++static void quirk_paxc_bridge(struct pci_dev *pdev)
++{
++ /*
++ * The PCI config space is shared with the PAXC root port and the first
++ * Ethernet device. So, we need to workaround this by telling the PCI
++ * code that the bridge is not an Ethernet device.
++ */
++ if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
++ pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
++
++ /*
++ * MPSS is not being set properly (as it is currently 0). This is
++ * because that area of the PCI config space is hard coded to zero, and
++ * is not modifiable by firmware. Set this to 2 (e.g., 512 byte MPS)
++ * so that the MPS can be set to the real max value.
++ */
++ pdev->pcie_mpss = 2;
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
++
+ MODULE_AUTHOR("Ray Jui <rjui@broadcom.com>");
+ MODULE_DESCRIPTION("Broadcom iPROC PCIe common driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 2f88b1ff7ada4..7afbce082d83e 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2381,32 +2381,6 @@ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_BROADCOM,
+ PCI_DEVICE_ID_TIGON3_5719,
+ quirk_brcm_5719_limit_mrrs);
+
+-#ifdef CONFIG_PCIE_IPROC_PLATFORM
+-static void quirk_paxc_bridge(struct pci_dev *pdev)
+-{
+- /*
+- * The PCI config space is shared with the PAXC root port and the first
+- * Ethernet device. So, we need to workaround this by telling the PCI
+- * code that the bridge is not an Ethernet device.
+- */
+- if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+- pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
+-
+- /*
+- * MPSS is not being set properly (as it is currently 0). This is
+- * because that area of the PCI config space is hard coded to zero, and
+- * is not modifiable by firmware. Set this to 2 (e.g., 512 byte MPS)
+- * so that the MPS can be set to the real max value.
+- */
+- pdev->pcie_mpss = 2;
+-}
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
+-#endif
+-
+ /*
+ * Originally in EDAC sources for i82875P: Intel tells BIOS developers to
+ * hide device 6 which configures the overflow device access containing the
+--
+2.20.1
+
--- /dev/null
+From 475869b9160685711beb4e4c62dbbe3b66481951 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 22:25:46 +0200
+Subject: perf/imx_ddr: Fix cpu hotplug state cleanup
+
+From: Leonard Crestez <leonard.crestez@nxp.com>
+
+[ Upstream commit 9ee68b314e9aa63ed11b98beb8a68810b8234dcf ]
+
+This driver allocates a dynamic cpu hotplug state but never releases it.
+If reloaded in a loop it will quickly trigger a WARN message:
+
+ "No more dynamic states available for CPU hotplug"
+
+Fix by calling cpuhp_remove_multi_state on remove like several other
+perf pmu drivers.
+
+Also fix the cleanup logic on probe error paths: add the missing
+cpuhp_remove_multi_state call and properly check the return value from
+cpuhp_state_add_instant_nocalls.
+
+Fixes: 9a66d36cc7ac ("drivers/perf: imx_ddr: Add DDR performance counter support to perf")
+Acked-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/fsl_imx8_ddr_perf.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
+index 2a3966d059e70..0e51baa48b149 100644
+--- a/drivers/perf/fsl_imx8_ddr_perf.c
++++ b/drivers/perf/fsl_imx8_ddr_perf.c
+@@ -572,13 +572,17 @@ static int ddr_perf_probe(struct platform_device *pdev)
+
+ if (ret < 0) {
+ dev_err(&pdev->dev, "cpuhp_setup_state_multi failed\n");
+- goto ddr_perf_err;
++ goto cpuhp_state_err;
+ }
+
+ pmu->cpuhp_state = ret;
+
+ /* Register the pmu instance for cpu hotplug */
+- cpuhp_state_add_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++ ret = cpuhp_state_add_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++ if (ret) {
++ dev_err(&pdev->dev, "Error %d registering hotplug\n", ret);
++ goto cpuhp_instance_err;
++ }
+
+ /* Request irq */
+ irq = of_irq_get(np, 0);
+@@ -612,9 +616,10 @@ static int ddr_perf_probe(struct platform_device *pdev)
+ return 0;
+
+ ddr_perf_err:
+- if (pmu->cpuhp_state)
+- cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
+-
++ cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++cpuhp_instance_err:
++ cpuhp_remove_multi_state(pmu->cpuhp_state);
++cpuhp_state_err:
+ ida_simple_remove(&ddr_ida, pmu->id);
+ dev_warn(&pdev->dev, "i.MX8 DDR Perf PMU failed (%d), disabled\n", ret);
+ return ret;
+@@ -625,6 +630,7 @@ static int ddr_perf_remove(struct platform_device *pdev)
+ struct ddr_pmu *pmu = platform_get_drvdata(pdev);
+
+ cpuhp_state_remove_instance_nocalls(pmu->cpuhp_state, &pmu->node);
++ cpuhp_remove_multi_state(pmu->cpuhp_state);
+ irq_set_affinity_hint(pmu->irq, NULL);
+
+ perf_pmu_unregister(&pmu->pmu);
+--
+2.20.1
+
--- /dev/null
+From ecce6c49315edcbf5cc37a551d2825e5c34d676f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 12:37:19 -0600
+Subject: perf/x86/amd: Constrain Large Increment per Cycle events
+
+From: Kim Phillips <kim.phillips@amd.com>
+
+[ Upstream commit 471af006a747f1c535c8a8c6c0973c320fe01b22 ]
+
+AMD Family 17h processors and above gain support for Large Increment
+per Cycle events. Unfortunately there is no CPUID or equivalent bit
+that indicates whether the feature exists or not, so we continue to
+determine eligibility based on a CPU family number comparison.
+
+For Large Increment per Cycle events, we add a f17h-and-compatibles
+get_event_constraints_f17h() that returns an even counter bitmask:
+Large Increment per Cycle events can only be placed on PMCs 0, 2,
+and 4 out of the currently available 0-5. The only currently
+public event that requires this feature to report valid counts
+is PMCx003 "Retired SSE/AVX Operations".
+
+Note that the CPU family logic in amd_core_pmu_init() is changed
+so as to be able to selectively add initialization for features
+available in ranges of backward-compatible CPU families. This
+Large Increment per Cycle feature is expected to be retained
+in future families.
+
+A side-effect of assigning a new get_constraints function for f17h
+disables calling the old (prior to f15h) amd_get_event_constraints
+implementation left enabled by commit e40ed1542dd7 ("perf/x86: Add perf
+support for AMD family-17h processors"), which is no longer
+necessary since those North Bridge event codes are obsoleted.
+
+Also fix a spelling mistake whilst in the area (calulating ->
+calculating).
+
+Fixes: e40ed1542dd7 ("perf/x86: Add perf support for AMD family-17h processors")
+Signed-off-by: Kim Phillips <kim.phillips@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20191114183720.19887-2-kim.phillips@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/events/amd/core.c | 91 ++++++++++++++++++++++++------------
+ arch/x86/events/perf_event.h | 2 +
+ 2 files changed, 63 insertions(+), 30 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index beffafd7dcc3f..3ea8056148d84 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -302,6 +302,25 @@ static inline int amd_pmu_addr_offset(int index, bool eventsel)
+ return offset;
+ }
+
++/*
++ * AMD64 events are detected based on their event codes.
++ */
++static inline unsigned int amd_get_event_code(struct hw_perf_event *hwc)
++{
++ return ((hwc->config >> 24) & 0x0f00) | (hwc->config & 0x00ff);
++}
++
++static inline bool amd_is_pair_event_code(struct hw_perf_event *hwc)
++{
++ if (!(x86_pmu.flags & PMU_FL_PAIR))
++ return false;
++
++ switch (amd_get_event_code(hwc)) {
++ case 0x003: return true; /* Retired SSE/AVX FLOPs */
++ default: return false;
++ }
++}
++
+ static int amd_core_hw_config(struct perf_event *event)
+ {
+ if (event->attr.exclude_host && event->attr.exclude_guest)
+@@ -320,14 +339,6 @@ static int amd_core_hw_config(struct perf_event *event)
+ return 0;
+ }
+
+-/*
+- * AMD64 events are detected based on their event codes.
+- */
+-static inline unsigned int amd_get_event_code(struct hw_perf_event *hwc)
+-{
+- return ((hwc->config >> 24) & 0x0f00) | (hwc->config & 0x00ff);
+-}
+-
+ static inline int amd_is_nb_event(struct hw_perf_event *hwc)
+ {
+ return (hwc->config & 0xe0) == 0xe0;
+@@ -865,6 +876,20 @@ amd_get_event_constraints_f15h(struct cpu_hw_events *cpuc, int idx,
+ }
+ }
+
++static struct event_constraint pair_constraint;
++
++static struct event_constraint *
++amd_get_event_constraints_f17h(struct cpu_hw_events *cpuc, int idx,
++ struct perf_event *event)
++{
++ struct hw_perf_event *hwc = &event->hw;
++
++ if (amd_is_pair_event_code(hwc))
++ return &pair_constraint;
++
++ return &unconstrained;
++}
++
+ static ssize_t amd_event_sysfs_show(char *page, u64 config)
+ {
+ u64 event = (config & ARCH_PERFMON_EVENTSEL_EVENT) |
+@@ -908,33 +933,15 @@ static __initconst const struct x86_pmu amd_pmu = {
+
+ static int __init amd_core_pmu_init(void)
+ {
++ u64 even_ctr_mask = 0ULL;
++ int i;
++
+ if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE))
+ return 0;
+
+- /* Avoid calulating the value each time in the NMI handler */
++ /* Avoid calculating the value each time in the NMI handler */
+ perf_nmi_window = msecs_to_jiffies(100);
+
+- switch (boot_cpu_data.x86) {
+- case 0x15:
+- pr_cont("Fam15h ");
+- x86_pmu.get_event_constraints = amd_get_event_constraints_f15h;
+- break;
+- case 0x17:
+- pr_cont("Fam17h ");
+- /*
+- * In family 17h, there are no event constraints in the PMC hardware.
+- * We fallback to using default amd_get_event_constraints.
+- */
+- break;
+- case 0x18:
+- pr_cont("Fam18h ");
+- /* Using default amd_get_event_constraints. */
+- break;
+- default:
+- pr_err("core perfctr but no constraints; unknown hardware!\n");
+- return -ENODEV;
+- }
+-
+ /*
+ * If core performance counter extensions exists, we must use
+ * MSR_F15H_PERF_CTL/MSR_F15H_PERF_CTR msrs. See also
+@@ -949,6 +956,30 @@ static int __init amd_core_pmu_init(void)
+ */
+ x86_pmu.amd_nb_constraints = 0;
+
++ if (boot_cpu_data.x86 == 0x15) {
++ pr_cont("Fam15h ");
++ x86_pmu.get_event_constraints = amd_get_event_constraints_f15h;
++ }
++ if (boot_cpu_data.x86 >= 0x17) {
++ pr_cont("Fam17h+ ");
++ /*
++ * Family 17h and compatibles have constraints for Large
++ * Increment per Cycle events: they may only be assigned an
++ * even numbered counter that has a consecutive adjacent odd
++ * numbered counter following it.
++ */
++ for (i = 0; i < x86_pmu.num_counters - 1; i += 2)
++ even_ctr_mask |= 1 << i;
++
++ pair_constraint = (struct event_constraint)
++ __EVENT_CONSTRAINT(0, even_ctr_mask, 0,
++ x86_pmu.num_counters / 2, 0,
++ PERF_X86_EVENT_PAIR);
++
++ x86_pmu.get_event_constraints = amd_get_event_constraints_f17h;
++ x86_pmu.flags |= PMU_FL_PAIR;
++ }
++
+ pr_cont("core perfctr, ");
+ return 0;
+ }
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index ecacfbf4ebc12..0ed910237c4d8 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -77,6 +77,7 @@ static inline bool constraint_match(struct event_constraint *c, u64 ecode)
+ #define PERF_X86_EVENT_AUTO_RELOAD 0x0200 /* use PEBS auto-reload */
+ #define PERF_X86_EVENT_LARGE_PEBS 0x0400 /* use large PEBS */
+ #define PERF_X86_EVENT_PEBS_VIA_PT 0x0800 /* use PT buffer for PEBS */
++#define PERF_X86_EVENT_PAIR 0x1000 /* Large Increment per Cycle */
+
+ struct amd_nb {
+ int nb_id; /* NorthBridge id */
+@@ -735,6 +736,7 @@ do { \
+ #define PMU_FL_EXCL_ENABLED 0x8 /* exclusive counter active */
+ #define PMU_FL_PEBS_ALL 0x10 /* all events are valid PEBS events */
+ #define PMU_FL_TFA 0x20 /* deal with TSX force abort */
++#define PMU_FL_PAIR 0x40 /* merge counters for large incr. events */
+
+ #define EVENT_VAR(_id) event_attr_##_id
+ #define EVENT_PTR(_id) &event_attr_##_id.attr.attr
+--
+2.20.1
+
--- /dev/null
+From df7aacbf1a921e2d92be3920489460e950a99b84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 00:04:47 +0100
+Subject: pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a23680594da7a9e2696dbcf4f023e9273e2fa40b ]
+
+Suspending Goodix touchscreens requires changing the interrupt pin to
+output before sending them a power-down command. Followed by wiggling
+the interrupt pin to wake the device up, after which it is put back
+in input mode.
+
+On Bay Trail devices with a Goodix touchscreen direct-irq mode is used
+in combination with listing the pin as a normal GpioIo resource.
+
+This works fine, until the goodix driver gets rmmod-ed and then insmod-ed
+again. In this case byt_gpio_disable_free() calls
+byt_gpio_clear_triggering() which clears the IRQ flags and after that the
+(direct) IRQ no longer triggers.
+
+This commit fixes this by adding a check for the BYT_DIRECT_IRQ_EN flag
+to byt_gpio_clear_triggering().
+
+Note that byt_gpio_clear_triggering() only gets called from
+byt_gpio_disable_free() for direct-irq enabled pins, as these are excluded
+from the irq_valid mask by byt_init_irq_valid_mask().
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 7d658e6627e7a..606fe216f902a 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -752,7 +752,13 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset)
+
+ raw_spin_lock_irqsave(&byt_lock, flags);
+ value = readl(reg);
+- value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
++ /* Do not clear direct-irq enabled IRQs (from gpio_disable_free) */
++ if (value & BYT_DIRECT_IRQ_EN)
++ /* nothing to do */ ;
++ else
++ value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
+ writel(value, reg);
+ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+--
+2.20.1
+
--- /dev/null
+From 2f88f3c2a60fdd2949029961cfc21cce6d07a11a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:48:09 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 55b1cb1f03ad5eea39897d0c74035e02deddcff2 ]
+
+pinmux_func_gpios[] contains a hole due to the missing function GPIO
+definition for the "CTX0&CTX1" signal, which is the logical "AND" of the
+two CAN outputs.
+
+Fix this by:
+ - Renaming CRX0_CRX1_MARK to CTX0_CTX1_MARK, as PJ2MD[2:0]=010
+ configures the combined "CTX0&CTX1" output signal,
+ - Renaming CRX0X1_MARK to CRX0_CRX1_MARK, as PJ3MD[1:0]=10 configures
+ the shared "CRX0/CRX1" input signal, which is fed to both CAN
+ inputs,
+ - Adding the missing function GPIO definition for "CTX0&CTX1" to
+ pinmux_func_gpios[],
+ - Moving all CAN enums next to each other.
+
+See SH7262 Group, SH7264 Group User's Manual: Hardware, Rev. 4.00:
+ [1] Figure 1.2 (3) (Pin Assignment for the SH7264 Group (1-Mbyte
+ Version),
+ [2] Figure 1.2 (4) Pin Assignment for the SH7264 Group (640-Kbyte
+ Version,
+ [3] Table 1.4 List of Pins,
+ [4] Figure 20.29 Connection Example when Using This Module as 1-Channel
+ Module (64 Mailboxes x 1 Channel),
+ [5] Table 32.10 Multiplexed Pins (Port J),
+ [6] Section 32.2.30 (3) Port J Control Register 0 (PJCR0).
+
+Note that the last 2 disagree about PJ2MD[2:0], which is probably the
+root cause of this bug. But considering [4], "CTx0&CTx1" in [5] must
+be correct, and "CRx0&CRx1" in [6] must be wrong.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191218194812.12741-4-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 4a95867deb8af..5a026601d4f9a 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -497,17 +497,15 @@ enum {
+ SD_WP_MARK, SD_CLK_MARK, SD_CMD_MARK,
+ CRX0_MARK, CRX1_MARK,
+ CTX0_MARK, CTX1_MARK,
++ CRX0_CRX1_MARK, CTX0_CTX1_MARK,
+
+ PWM1A_MARK, PWM1B_MARK, PWM1C_MARK, PWM1D_MARK,
+ PWM1E_MARK, PWM1F_MARK, PWM1G_MARK, PWM1H_MARK,
+ PWM2A_MARK, PWM2B_MARK, PWM2C_MARK, PWM2D_MARK,
+ PWM2E_MARK, PWM2F_MARK, PWM2G_MARK, PWM2H_MARK,
+ IERXD_MARK, IETXD_MARK,
+- CRX0_CRX1_MARK,
+ WDTOVF_MARK,
+
+- CRX0X1_MARK,
+-
+ /* DMAC */
+ TEND0_MARK, DACK0_MARK, DREQ0_MARK,
+ TEND1_MARK, DACK1_MARK, DREQ1_MARK,
+@@ -995,12 +993,12 @@ static const u16 pinmux_data[] = {
+
+ PINMUX_DATA(PJ3_DATA, PJ3MD_00),
+ PINMUX_DATA(CRX1_MARK, PJ3MD_01),
+- PINMUX_DATA(CRX0X1_MARK, PJ3MD_10),
++ PINMUX_DATA(CRX0_CRX1_MARK, PJ3MD_10),
+ PINMUX_DATA(IRQ1_PJ_MARK, PJ3MD_11),
+
+ PINMUX_DATA(PJ2_DATA, PJ2MD_000),
+ PINMUX_DATA(CTX1_MARK, PJ2MD_001),
+- PINMUX_DATA(CRX0_CRX1_MARK, PJ2MD_010),
++ PINMUX_DATA(CTX0_CTX1_MARK, PJ2MD_010),
+ PINMUX_DATA(CS2_MARK, PJ2MD_011),
+ PINMUX_DATA(SCK0_MARK, PJ2MD_100),
+ PINMUX_DATA(LCD_M_DISP_MARK, PJ2MD_101),
+@@ -1245,6 +1243,7 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ GPIO_FN(CTX1),
+ GPIO_FN(CRX1),
+ GPIO_FN(CTX0),
++ GPIO_FN(CTX0_CTX1),
+ GPIO_FN(CRX0),
+ GPIO_FN(CRX0_CRX1),
+
+--
+2.20.1
+
--- /dev/null
+From a61c76ae38b5f1592d2edf190bfbed352f788ddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:48:10 +0100
+Subject: pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 02aeb2f21530c98fc3ca51028eda742a3fafbd9f ]
+
+pinmux_func_gpios[] contains a hole due to the missing function GPIO
+definition for the "CTX0&CTX1" signal, which is the logical "AND" of the
+first two CAN outputs.
+
+A closer look reveals other issues:
+ - Some functionality is available on alternative pins, but the
+ PINMUX_DATA() entries is using the wrong marks,
+ - Several configurations are missing.
+
+Fix this by:
+ - Renaming CTX0CTX1CTX2_MARK, CRX0CRX1_PJ22_MARK, and
+ CRX0CRX1CRX2_PJ20_MARK to CTX0_CTX1_CTX2_MARK, CRX0_CRX1_PJ22_MARK,
+ resp. CRX0_CRX1_CRX2_PJ20_MARK for consistency with the
+ corresponding enum IDs,
+ - Adding all missing enum IDs and marks,
+ - Use the right (*_PJ2x) variants for alternative pins,
+ - Adding all missing configurations to pinmux_data[],
+ - Adding all missing function GPIO definitions to pinmux_func_gpios[].
+
+See SH7268 Group, SH7269 Group User’s Manual: Hardware, Rev. 2.00:
+ [1] Table 1.4 List of Pins
+ [2] Figure 23.29 Connection Example when Using Channels 0 and 1 as One
+ Channel (64 Mailboxes × 1 Channel) and Channel 2 as One Channel
+ (32 Mailboxes × 1 Channel),
+ [3] Figure 23.30 Connection Example when Using Channels 0, 1, and 2 as
+ One Channel (96 Mailboxes × 1 Channel),
+ [4] Table 48.3 Multiplexed Pins (Port B),
+ [5] Table 48.4 Multiplexed Pins (Port C),
+ [6] Table 48.10 Multiplexed Pins (Port J),
+ [7] Section 48.2.4 Port B Control Registers 0 to 5 (PBCR0 to PBCR5).
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191218194812.12741-5-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/include/cpu-sh2a/cpu/sh7269.h | 11 ++++++--
+ drivers/pinctrl/sh-pfc/pfc-sh7269.c | 39 ++++++++++++++++++---------
+ 2 files changed, 36 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7269.h b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+index d516e5d488180..b887cc402b712 100644
+--- a/arch/sh/include/cpu-sh2a/cpu/sh7269.h
++++ b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+@@ -78,8 +78,15 @@ enum {
+ GPIO_FN_WDTOVF,
+
+ /* CAN */
+- GPIO_FN_CTX1, GPIO_FN_CRX1, GPIO_FN_CTX0, GPIO_FN_CTX0_CTX1,
+- GPIO_FN_CRX0, GPIO_FN_CRX0_CRX1, GPIO_FN_CRX0_CRX1_CRX2,
++ GPIO_FN_CTX2, GPIO_FN_CRX2,
++ GPIO_FN_CTX1, GPIO_FN_CRX1,
++ GPIO_FN_CTX0, GPIO_FN_CRX0,
++ GPIO_FN_CTX0_CTX1, GPIO_FN_CRX0_CRX1,
++ GPIO_FN_CTX0_CTX1_CTX2, GPIO_FN_CRX0_CRX1_CRX2,
++ GPIO_FN_CTX2_PJ21, GPIO_FN_CRX2_PJ20,
++ GPIO_FN_CTX1_PJ23, GPIO_FN_CRX1_PJ22,
++ GPIO_FN_CTX0_CTX1_PJ23, GPIO_FN_CRX0_CRX1_PJ22,
++ GPIO_FN_CTX0_CTX1_CTX2_PJ21, GPIO_FN_CRX0_CRX1_CRX2_PJ20,
+
+ /* DMAC */
+ GPIO_FN_TEND0, GPIO_FN_DACK0, GPIO_FN_DREQ0,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index 6cbb18ef77dc0..d20974a55d93a 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -737,13 +737,12 @@ enum {
+ CRX0_MARK, CTX0_MARK,
+ CRX1_MARK, CTX1_MARK,
+ CRX2_MARK, CTX2_MARK,
+- CRX0_CRX1_MARK,
+- CRX0_CRX1_CRX2_MARK,
+- CTX0CTX1CTX2_MARK,
++ CRX0_CRX1_MARK, CTX0_CTX1_MARK,
++ CRX0_CRX1_CRX2_MARK, CTX0_CTX1_CTX2_MARK,
+ CRX1_PJ22_MARK, CTX1_PJ23_MARK,
+ CRX2_PJ20_MARK, CTX2_PJ21_MARK,
+- CRX0CRX1_PJ22_MARK,
+- CRX0CRX1CRX2_PJ20_MARK,
++ CRX0_CRX1_PJ22_MARK, CTX0_CTX1_PJ23_MARK,
++ CRX0_CRX1_CRX2_PJ20_MARK, CTX0_CTX1_CTX2_PJ21_MARK,
+
+ /* VDC */
+ DV_CLK_MARK,
+@@ -821,6 +820,7 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(CS3_MARK, PC8MD_001),
+ PINMUX_DATA(TXD7_MARK, PC8MD_010),
+ PINMUX_DATA(CTX1_MARK, PC8MD_011),
++ PINMUX_DATA(CTX0_CTX1_MARK, PC8MD_100),
+
+ PINMUX_DATA(PC7_DATA, PC7MD_000),
+ PINMUX_DATA(CKE_MARK, PC7MD_001),
+@@ -833,11 +833,12 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(CAS_MARK, PC6MD_001),
+ PINMUX_DATA(SCK7_MARK, PC6MD_010),
+ PINMUX_DATA(CTX0_MARK, PC6MD_011),
++ PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC6MD_100),
+
+ PINMUX_DATA(PC5_DATA, PC5MD_000),
+ PINMUX_DATA(RAS_MARK, PC5MD_001),
+ PINMUX_DATA(CRX0_MARK, PC5MD_011),
+- PINMUX_DATA(CTX0CTX1CTX2_MARK, PC5MD_100),
++ PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC5MD_100),
+ PINMUX_DATA(IRQ0_PC_MARK, PC5MD_101),
+
+ PINMUX_DATA(PC4_DATA, PC4MD_00),
+@@ -1289,30 +1290,32 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(LCD_DATA23_PJ23_MARK, PJ23MD_010),
+ PINMUX_DATA(LCD_TCON6_MARK, PJ23MD_011),
+ PINMUX_DATA(IRQ3_PJ_MARK, PJ23MD_100),
+- PINMUX_DATA(CTX1_MARK, PJ23MD_101),
++ PINMUX_DATA(CTX1_PJ23_MARK, PJ23MD_101),
++ PINMUX_DATA(CTX0_CTX1_PJ23_MARK, PJ23MD_110),
+
+ PINMUX_DATA(PJ22_DATA, PJ22MD_000),
+ PINMUX_DATA(DV_DATA22_MARK, PJ22MD_001),
+ PINMUX_DATA(LCD_DATA22_PJ22_MARK, PJ22MD_010),
+ PINMUX_DATA(LCD_TCON5_MARK, PJ22MD_011),
+ PINMUX_DATA(IRQ2_PJ_MARK, PJ22MD_100),
+- PINMUX_DATA(CRX1_MARK, PJ22MD_101),
+- PINMUX_DATA(CRX0_CRX1_MARK, PJ22MD_110),
++ PINMUX_DATA(CRX1_PJ22_MARK, PJ22MD_101),
++ PINMUX_DATA(CRX0_CRX1_PJ22_MARK, PJ22MD_110),
+
+ PINMUX_DATA(PJ21_DATA, PJ21MD_000),
+ PINMUX_DATA(DV_DATA21_MARK, PJ21MD_001),
+ PINMUX_DATA(LCD_DATA21_PJ21_MARK, PJ21MD_010),
+ PINMUX_DATA(LCD_TCON4_MARK, PJ21MD_011),
+ PINMUX_DATA(IRQ1_PJ_MARK, PJ21MD_100),
+- PINMUX_DATA(CTX2_MARK, PJ21MD_101),
++ PINMUX_DATA(CTX2_PJ21_MARK, PJ21MD_101),
++ PINMUX_DATA(CTX0_CTX1_CTX2_PJ21_MARK, PJ21MD_110),
+
+ PINMUX_DATA(PJ20_DATA, PJ20MD_000),
+ PINMUX_DATA(DV_DATA20_MARK, PJ20MD_001),
+ PINMUX_DATA(LCD_DATA20_PJ20_MARK, PJ20MD_010),
+ PINMUX_DATA(LCD_TCON3_MARK, PJ20MD_011),
+ PINMUX_DATA(IRQ0_PJ_MARK, PJ20MD_100),
+- PINMUX_DATA(CRX2_MARK, PJ20MD_101),
+- PINMUX_DATA(CRX0CRX1CRX2_PJ20_MARK, PJ20MD_110),
++ PINMUX_DATA(CRX2_PJ20_MARK, PJ20MD_101),
++ PINMUX_DATA(CRX0_CRX1_CRX2_PJ20_MARK, PJ20MD_110),
+
+ PINMUX_DATA(PJ19_DATA, PJ19MD_000),
+ PINMUX_DATA(DV_DATA19_MARK, PJ19MD_001),
+@@ -1663,12 +1666,24 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ GPIO_FN(WDTOVF),
+
+ /* CAN */
++ GPIO_FN(CTX2),
++ GPIO_FN(CRX2),
+ GPIO_FN(CTX1),
+ GPIO_FN(CRX1),
+ GPIO_FN(CTX0),
+ GPIO_FN(CRX0),
++ GPIO_FN(CTX0_CTX1),
+ GPIO_FN(CRX0_CRX1),
++ GPIO_FN(CTX0_CTX1_CTX2),
+ GPIO_FN(CRX0_CRX1_CRX2),
++ GPIO_FN(CTX2_PJ21),
++ GPIO_FN(CRX2_PJ20),
++ GPIO_FN(CTX1_PJ23),
++ GPIO_FN(CRX1_PJ22),
++ GPIO_FN(CTX0_CTX1_PJ23),
++ GPIO_FN(CRX0_CRX1_PJ22),
++ GPIO_FN(CTX0_CTX1_CTX2_PJ21),
++ GPIO_FN(CRX0_CRX1_CRX2_PJ20),
+
+ /* DMAC */
+ GPIO_FN(TEND0),
+--
+2.20.1
+
--- /dev/null
+From 719639ac920f54fb3cc2d80dfc0a906b2c6dc612 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 16:26:48 +0200
+Subject: PM / devfreq: exynos-ppmu: Fix excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit d4556f5e99d5f603913bac01adaff8670cb2d08b ]
+
+Putting a 'struct devfreq_event_dev' object on the stack is generally
+a bad idea and here it leads to a warnig about potential stack overflow:
+
+drivers/devfreq/event/exynos-ppmu.c:643:12: error: stack frame size of 1040 bytes in function 'exynos_ppmu_probe' [-Werror,-Wframe-larger-than=]
+
+There is no real need for the device structure, only the string inside
+it, so add an internal helper function that simply takes the string
+as its argument and remove the device structure.
+
+Fixes: 1dd62c66d345 ("PM / devfreq: events: extend events by type of counted data")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+[cw00.choi: Fix the issue from 'desc->name' to 'desc[j].name']
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/event/exynos-ppmu.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/devfreq/event/exynos-ppmu.c b/drivers/devfreq/event/exynos-ppmu.c
+index 87b42055e6bc9..c4873bb791f88 100644
+--- a/drivers/devfreq/event/exynos-ppmu.c
++++ b/drivers/devfreq/event/exynos-ppmu.c
+@@ -101,17 +101,22 @@ static struct __exynos_ppmu_events {
+ PPMU_EVENT(dmc1_1),
+ };
+
+-static int exynos_ppmu_find_ppmu_id(struct devfreq_event_dev *edev)
++static int __exynos_ppmu_find_ppmu_id(const char *edev_name)
+ {
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(ppmu_events); i++)
+- if (!strcmp(edev->desc->name, ppmu_events[i].name))
++ if (!strcmp(edev_name, ppmu_events[i].name))
+ return ppmu_events[i].id;
+
+ return -EINVAL;
+ }
+
++static int exynos_ppmu_find_ppmu_id(struct devfreq_event_dev *edev)
++{
++ return __exynos_ppmu_find_ppmu_id(edev->desc->name);
++}
++
+ /*
+ * The devfreq-event ops structure for PPMU v1.1
+ */
+@@ -556,13 +561,11 @@ static int of_get_devfreq_events(struct device_node *np,
+ * use default if not.
+ */
+ if (info->ppmu_type == EXYNOS_TYPE_PPMU_V2) {
+- struct devfreq_event_dev edev;
+ int id;
+ /* Not all registers take the same value for
+ * read+write data count.
+ */
+- edev.desc = &desc[j];
+- id = exynos_ppmu_find_ppmu_id(&edev);
++ id = __exynos_ppmu_find_ppmu_id(desc[j].name);
+
+ switch (id) {
+ case PPMU_PMNCNT0:
+--
+2.20.1
+
--- /dev/null
+From 3636ae6dc6f04ad0470b9cbbcc26a0a147908c17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:20:30 +0900
+Subject: PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC
+ dependency
+
+From: Chanwoo Choi <cw00.choi@samsung.com>
+
+[ Upstream commit eff5d31f7407fa9d31fb840106f1593399457298 ]
+
+To build test, add COMPILE_TEST depedency to both ARM_RK3399_DMC_DEVFREQ
+and DEVFREQ_EVENT_ROCKCHIP_DFI configuration. And ARM_RK3399_DMC_DEVFREQ
+used the SMCCC interface so that add HAVE_ARM_SMCCC dependency to prevent
+the build break.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/Kconfig | 3 ++-
+ drivers/devfreq/event/Kconfig | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig
+index af4a3ccb96b34..1433f2ba9d3b1 100644
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -118,7 +118,8 @@ config ARM_TEGRA20_DEVFREQ
+
+ config ARM_RK3399_DMC_DEVFREQ
+ tristate "ARM RK3399 DMC DEVFREQ Driver"
+- depends on ARCH_ROCKCHIP
++ depends on (ARCH_ROCKCHIP && HAVE_ARM_SMCCC) || \
++ (COMPILE_TEST && HAVE_ARM_SMCCC)
+ select DEVFREQ_EVENT_ROCKCHIP_DFI
+ select DEVFREQ_GOV_SIMPLE_ONDEMAND
+ select PM_DEVFREQ_EVENT
+diff --git a/drivers/devfreq/event/Kconfig b/drivers/devfreq/event/Kconfig
+index cef2cf5347ca7..a53e0a6ffdfeb 100644
+--- a/drivers/devfreq/event/Kconfig
++++ b/drivers/devfreq/event/Kconfig
+@@ -34,7 +34,7 @@ config DEVFREQ_EVENT_EXYNOS_PPMU
+
+ config DEVFREQ_EVENT_ROCKCHIP_DFI
+ tristate "ROCKCHIP DFI DEVFREQ event Driver"
+- depends on ARCH_ROCKCHIP
++ depends on ARCH_ROCKCHIP || COMPILE_TEST
+ help
+ This add the devfreq-event driver for Rockchip SoC. It provides DFI
+ (DDR Monitor Module) driver to count ddr load.
+--
+2.20.1
+
--- /dev/null
+From 374d06360b9842926e2ed29b3fb83c162b9d7c84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2020 12:03:35 -0500
+Subject: powerpc: Do not consider weak unresolved symbol relocations as bad
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit 43e76cd368fbb67e767da5363ffeaa3989993c8c ]
+
+Commit 8580ac9404f6 ("bpf: Process in-kernel BTF") introduced two weak
+symbols that may be unresolved at link time which result in an absolute
+relocation to 0. relocs_check.sh emits the following warning:
+
+"WARNING: 2 bad relocations
+c000000001a41478 R_PPC64_ADDR64 _binary__btf_vmlinux_bin_start
+c000000001a41480 R_PPC64_ADDR64 _binary__btf_vmlinux_bin_end"
+
+whereas those relocations are legitimate even for a relocatable kernel
+compiled with -pie option.
+
+relocs_check.sh already excluded some weak unresolved symbols explicitly:
+remove those hardcoded symbols and add some logic that parses the symbols
+using nm, retrieves all the weak unresolved symbols and excludes those from
+the list of the potential bad relocations.
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200118170335.21440-1-alex@ghiti.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile.postlink | 4 ++--
+ arch/powerpc/tools/relocs_check.sh | 20 ++++++++++++--------
+ 2 files changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/arch/powerpc/Makefile.postlink b/arch/powerpc/Makefile.postlink
+index 134f12f89b92b..2268396ff4bba 100644
+--- a/arch/powerpc/Makefile.postlink
++++ b/arch/powerpc/Makefile.postlink
+@@ -17,11 +17,11 @@ quiet_cmd_head_check = CHKHEAD $@
+ quiet_cmd_relocs_check = CHKREL $@
+ ifdef CONFIG_PPC_BOOK3S_64
+ cmd_relocs_check = \
+- $(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$@" ; \
++ $(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$(NM)" "$@" ; \
+ $(BASH) $(srctree)/arch/powerpc/tools/unrel_branch_check.sh "$(OBJDUMP)" "$@"
+ else
+ cmd_relocs_check = \
+- $(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$@"
++ $(CONFIG_SHELL) $(srctree)/arch/powerpc/tools/relocs_check.sh "$(OBJDUMP)" "$(NM)" "$@"
+ endif
+
+ # `@true` prevents complaint when there is nothing to be done
+diff --git a/arch/powerpc/tools/relocs_check.sh b/arch/powerpc/tools/relocs_check.sh
+index 7b9fe0a567cf3..014e00e74d2b6 100755
+--- a/arch/powerpc/tools/relocs_check.sh
++++ b/arch/powerpc/tools/relocs_check.sh
+@@ -10,14 +10,21 @@
+ # based on relocs_check.pl
+ # Copyright © 2009 IBM Corporation
+
+-if [ $# -lt 2 ]; then
+- echo "$0 [path to objdump] [path to vmlinux]" 1>&2
++if [ $# -lt 3 ]; then
++ echo "$0 [path to objdump] [path to nm] [path to vmlinux]" 1>&2
+ exit 1
+ fi
+
+-# Have Kbuild supply the path to objdump so we handle cross compilation.
++# Have Kbuild supply the path to objdump and nm so we handle cross compilation.
+ objdump="$1"
+-vmlinux="$2"
++nm="$2"
++vmlinux="$3"
++
++# Remove from the bad relocations those that match an undefined weak symbol
++# which will result in an absolute relocation to 0.
++# Weak unresolved symbols are of that form in nm output:
++# " w _binary__btf_vmlinux_bin_end"
++undef_weak_symbols=$($nm "$vmlinux" | awk '$1 ~ /w/ { print $2 }')
+
+ bad_relocs=$(
+ $objdump -R "$vmlinux" |
+@@ -26,8 +33,6 @@ $objdump -R "$vmlinux" |
+ # These relocations are okay
+ # On PPC64:
+ # R_PPC64_RELATIVE, R_PPC64_NONE
+- # R_PPC64_ADDR64 mach_<name>
+- # R_PPC64_ADDR64 __crc_<name>
+ # On PPC:
+ # R_PPC_RELATIVE, R_PPC_ADDR16_HI,
+ # R_PPC_ADDR16_HA,R_PPC_ADDR16_LO,
+@@ -39,8 +44,7 @@ R_PPC_ADDR16_HI
+ R_PPC_ADDR16_HA
+ R_PPC_RELATIVE
+ R_PPC_NONE' |
+- grep -E -v '\<R_PPC64_ADDR64[[:space:]]+mach_' |
+- grep -E -v '\<R_PPC64_ADDR64[[:space:]]+__crc_'
++ ([ "$undef_weak_symbols" ] && grep -F -w -v "$undef_weak_symbols" || cat)
+ )
+
+ if [ -z "$bad_relocs" ]; then
+--
+2.20.1
+
--- /dev/null
+From 68e7fe2655a17157c9f3b2915545c55987f61eb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 18:02:05 +1100
+Subject: powerpc/iov: Move VF pdev fixup into pcibios_fixup_iov()
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 965c94f309be58fbcc6c8d3e4f123376c5970d79 ]
+
+An ioda_pe for each VF is allocated in pnv_pci_sriov_enable() before
+the pci_dev for the VF is created. We need to set the pe->pdev pointer
+at some point after the pci_dev is created. Currently we do that in:
+
+pcibios_bus_add_device()
+ pnv_pci_dma_dev_setup() (via phb->ops.dma_dev_setup)
+ /* fixup is done here */
+ pnv_pci_ioda_dma_dev_setup() (via pnv_phb->dma_dev_setup)
+
+The fixup needs to be done before setting up DMA for for the VF's PE,
+but there's no real reason to delay it until this point. Move the
+fixup into pnv_pci_ioda_fixup_iov() so the ordering is:
+
+ pcibios_add_device()
+ pnv_pci_ioda_fixup_iov() (via ppc_md.pcibios_fixup_sriov)
+
+ pcibios_bus_add_device()
+ ...
+
+This isn't strictly required, but it's a slightly more logical place
+to do the fixup and it simplifies pnv_pci_dma_dev_setup().
+
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200110070207.439-4-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/pci-ioda.c | 29 +++++++++++++++++++----
+ arch/powerpc/platforms/powernv/pci.c | 14 -----------
+ 2 files changed, 25 insertions(+), 18 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 59de6a5bc41c2..058223233088e 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -2900,9 +2900,6 @@ static void pnv_pci_ioda_fixup_iov_resources(struct pci_dev *pdev)
+ struct pci_dn *pdn;
+ int mul, total_vfs;
+
+- if (!pdev->is_physfn || pci_dev_is_added(pdev))
+- return;
+-
+ pdn = pci_get_pdn(pdev);
+ pdn->vfs_expanded = 0;
+ pdn->m64_single_mode = false;
+@@ -2977,6 +2974,30 @@ truncate_iov:
+ res->end = res->start - 1;
+ }
+ }
++
++static void pnv_pci_ioda_fixup_iov(struct pci_dev *pdev)
++{
++ if (WARN_ON(pci_dev_is_added(pdev)))
++ return;
++
++ if (pdev->is_virtfn) {
++ struct pnv_ioda_pe *pe = pnv_ioda_get_pe(pdev);
++
++ /*
++ * VF PEs are single-device PEs so their pdev pointer needs to
++ * be set. The pdev doesn't exist when the PE is allocated (in
++ * (pcibios_sriov_enable()) so we fix it up here.
++ */
++ pe->pdev = pdev;
++ WARN_ON(!(pe->flags & PNV_IODA_PE_VF));
++ } else if (pdev->is_physfn) {
++ /*
++ * For PFs adjust their allocated IOV resources to match what
++ * the PHB can support using it's M64 BAR table.
++ */
++ pnv_pci_ioda_fixup_iov_resources(pdev);
++ }
++}
+ #endif /* CONFIG_PCI_IOV */
+
+ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,
+@@ -3873,7 +3894,7 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
+ ppc_md.pcibios_default_alignment = pnv_pci_default_alignment;
+
+ #ifdef CONFIG_PCI_IOV
+- ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov_resources;
++ ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov;
+ ppc_md.pcibios_iov_resource_alignment = pnv_pci_iov_resource_alignment;
+ ppc_md.pcibios_sriov_enable = pnv_pcibios_sriov_enable;
+ ppc_md.pcibios_sriov_disable = pnv_pcibios_sriov_disable;
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index e8e58a2cccddf..8307e1f4086cb 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -814,20 +814,6 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
+ {
+ struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+ struct pnv_phb *phb = hose->private_data;
+-#ifdef CONFIG_PCI_IOV
+- struct pnv_ioda_pe *pe;
+-
+- /* Fix the VF pdn PE number */
+- if (pdev->is_virtfn) {
+- list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+- if (pe->rid == ((pdev->bus->number << 8) |
+- (pdev->devfn & 0xff))) {
+- pe->pdev = pdev;
+- break;
+- }
+- }
+- }
+-#endif /* CONFIG_PCI_IOV */
+
+ if (phb && phb->dma_dev_setup)
+ phb->dma_dev_setup(phb, pdev);
+--
+2.20.1
+
--- /dev/null
+From c3442b24208dbda155a809701ee8244770737c56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 07:54:22 +0000
+Subject: powerpc/mm: Don't log user reads to 0xffffffff
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 0f9aee0cb9da7db7d96f63cfa2dc5e4f1bffeb87 ]
+
+Running vdsotest leaves many times the following log:
+
+ [ 79.629901] vdsotest[396]: User access of kernel address (ffffffff) - exploit attempt? (uid: 0)
+
+A pointer set to (-1) is likely a programming error similar to
+a NULL pointer and is not worth logging as an exploit attempt.
+
+Don't log user accesses to 0xffffffff.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/0728849e826ba16f1fbd6fa7f5c6cc87bd64e097.1577087627.git.christophe.leroy@c-s.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 9298905cfe74f..881a026a603a6 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -354,6 +354,9 @@ static void sanity_check_fault(bool is_write, bool is_user,
+ * Userspace trying to access kernel address, we get PROTFAULT for that.
+ */
+ if (is_user && address >= TASK_SIZE) {
++ if ((long)address == -1)
++ return;
++
+ pr_crit_ratelimited("%s[%d]: User access of kernel address (%lx) - exploit attempt? (uid: %d)\n",
+ current->comm, current->pid, address,
+ from_kuid(&init_user_ns, current_uid()));
+--
+2.20.1
+
--- /dev/null
+From 4d0b531585b5ee9bd4e0321a3f47d3cf9f71cd94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 19:54:22 +1100
+Subject: powerpc/powernv/iov: Ensure the pdn for VFs always contains a valid
+ PE number
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 3b5b9997b331e77ce967eba2c4bc80dc3134a7fe ]
+
+On pseries there is a bug with adding hotplugged devices to an IOMMU
+group. For a number of dumb reasons fixing that bug first requires
+re-working how VFs are configured on PowerNV. For background, on
+PowerNV we use the pcibios_sriov_enable() hook to do two things:
+
+ 1. Create a pci_dn structure for each of the VFs, and
+ 2. Configure the PHB's internal BARs so the MMIO range for each VF
+ maps to a unique PE.
+
+Roughly speaking a PE is the hardware counterpart to a Linux IOMMU
+group since all the devices in a PE share the same IOMMU table. A PE
+also defines the set of devices that should be isolated in response to
+a PCI error (i.e. bad DMA, UR/CA, AER events, etc). When isolated all
+MMIO and DMA traffic to and from devicein the PE is blocked by the
+root complex until the PE is recovered by the OS.
+
+The requirement to block MMIO causes a giant headache because the P8
+PHB generally uses a fixed mapping between MMIO addresses and PEs. As
+a result we need to delay configuring the IOMMU groups for device
+until after MMIO resources are assigned. For physical devices (i.e.
+non-VFs) the PE assignment is done in pcibios_setup_bridge() which is
+called immediately after the MMIO resources for downstream
+devices (and the bridge's windows) are assigned. For VFs the setup is
+more complicated because:
+
+ a) pcibios_setup_bridge() is not called again when VFs are activated, and
+ b) The pci_dev for VFs are created by generic code which runs after
+ pcibios_sriov_enable() is called.
+
+The work around for this is a two step process:
+
+ 1. A fixup in pcibios_add_device() is used to initialised the cached
+ pe_number in pci_dn, then
+ 2. A bus notifier then adds the device to the IOMMU group for the PE
+ specified in pci_dn->pe_number.
+
+A side effect fixing the pseries bug mentioned in the first paragraph
+is moving the fixup out of pcibios_add_device() and into
+pcibios_bus_add_device(), which is called much later. This results in
+step 2. failing because pci_dn->pe_number won't be initialised when
+the bus notifier is run.
+
+We can fix this by removing the need for the fixup. The PE for a VF is
+known before the VF is even scanned so we can initialise
+pci_dn->pe_number pcibios_sriov_enable() instead. Unfortunately,
+moving the initialisation causes two problems:
+
+ 1. We trip the WARN_ON() in the current fixup code, and
+ 2. The EEH core clears pdn->pe_number when recovering a VF and
+ relies on the fixup to correctly re-set it.
+
+The only justification for either of these is a comment in
+eeh_rmv_device() suggesting that pdn->pe_number *must* be set to
+IODA_INVALID_PE in order for the VF to be scanned. However, this
+comment appears to have no basis in reality. Both bugs can be fixed by
+just deleting the code.
+
+Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191028085424.12006-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 6 ------
+ arch/powerpc/platforms/powernv/pci-ioda.c | 19 +++++++++++++++----
+ arch/powerpc/platforms/powernv/pci.c | 4 ----
+ 3 files changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index c031be8d41ffd..2fb166928e91b 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -541,12 +541,6 @@ static void eeh_rmv_device(struct eeh_dev *edev, void *userdata)
+
+ pci_iov_remove_virtfn(edev->physfn, pdn->vf_index);
+ edev->pdev = NULL;
+-
+- /*
+- * We have to set the VF PE number to invalid one, which is
+- * required to plug the VF successfully.
+- */
+- pdn->pe_number = IODA_INVALID_PE;
+ #endif
+ if (rmv_data)
+ list_add(&edev->rmv_entry, &rmv_data->removed_vf_list);
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index c28d0d9b7ee0f..59de6a5bc41c2 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -1558,6 +1558,10 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+
+ /* Reserve PE for each VF */
+ for (vf_index = 0; vf_index < num_vfs; vf_index++) {
++ int vf_devfn = pci_iov_virtfn_devfn(pdev, vf_index);
++ int vf_bus = pci_iov_virtfn_bus(pdev, vf_index);
++ struct pci_dn *vf_pdn;
++
+ if (pdn->m64_single_mode)
+ pe_num = pdn->pe_num_map[vf_index];
+ else
+@@ -1570,13 +1574,11 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ pe->pbus = NULL;
+ pe->parent_dev = pdev;
+ pe->mve_number = -1;
+- pe->rid = (pci_iov_virtfn_bus(pdev, vf_index) << 8) |
+- pci_iov_virtfn_devfn(pdev, vf_index);
++ pe->rid = (vf_bus << 8) | vf_devfn;
+
+ pe_info(pe, "VF %04d:%02d:%02d.%d associated with PE#%x\n",
+ hose->global_number, pdev->bus->number,
+- PCI_SLOT(pci_iov_virtfn_devfn(pdev, vf_index)),
+- PCI_FUNC(pci_iov_virtfn_devfn(pdev, vf_index)), pe_num);
++ PCI_SLOT(vf_devfn), PCI_FUNC(vf_devfn), pe_num);
+
+ if (pnv_ioda_configure_pe(phb, pe)) {
+ /* XXX What do we do here ? */
+@@ -1590,6 +1592,15 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ list_add_tail(&pe->list, &phb->ioda.pe_list);
+ mutex_unlock(&phb->ioda.pe_list_mutex);
+
++ /* associate this pe to it's pdn */
++ list_for_each_entry(vf_pdn, &pdn->parent->child_list, list) {
++ if (vf_pdn->busno == vf_bus &&
++ vf_pdn->devfn == vf_devfn) {
++ vf_pdn->pe_number = pe_num;
++ break;
++ }
++ }
++
+ pnv_pci_ioda2_setup_dma_pe(phb, pe);
+ #ifdef CONFIG_IOMMU_API
+ iommu_register_group(&pe->table_group,
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index c0bea75ac27bf..e8e58a2cccddf 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -816,16 +816,12 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
+ struct pnv_phb *phb = hose->private_data;
+ #ifdef CONFIG_PCI_IOV
+ struct pnv_ioda_pe *pe;
+- struct pci_dn *pdn;
+
+ /* Fix the VF pdn PE number */
+ if (pdev->is_virtfn) {
+- pdn = pci_get_pdn(pdev);
+- WARN_ON(pdn->pe_number != IODA_INVALID_PE);
+ list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+ if (pe->rid == ((pdev->bus->number << 8) |
+ (pdev->devfn & 0xff))) {
+- pdn->pe_number = pe->pe_number;
+ pe->pdev = pdev;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 340781107509622261a676247f1502828309b79d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 08:53:59 -0600
+Subject: powerpc/pseries/lparcfg: Fix display of Maximum Memory
+
+From: Michael Bringmann <mwb@linux.ibm.com>
+
+[ Upstream commit f1dbc1c5c70d0d4c60b5d467ba941fba167c12f6 ]
+
+Correct overflow problem in calculation and display of Maximum Memory
+value to syscfg.
+
+Signed-off-by: Michael Bringmann <mwb@linux.ibm.com>
+[mpe: Only n_lmbs needs casting to unsigned long]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/5577aef8-1d5a-ca95-ff0a-9c7b5977e5bf@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/lparcfg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
+index e33e8bc4b69bd..38c306551f76b 100644
+--- a/arch/powerpc/platforms/pseries/lparcfg.c
++++ b/arch/powerpc/platforms/pseries/lparcfg.c
+@@ -435,10 +435,10 @@ static void maxmem_data(struct seq_file *m)
+ {
+ unsigned long maxmem = 0;
+
+- maxmem += drmem_info->n_lmbs * drmem_info->lmb_size;
++ maxmem += (unsigned long)drmem_info->n_lmbs * drmem_info->lmb_size;
+ maxmem += hugetlb_total_pages() * PAGE_SIZE;
+
+- seq_printf(m, "MaxMem=%ld\n", maxmem);
++ seq_printf(m, "MaxMem=%lu\n", maxmem);
+ }
+
+ static int pseries_lparcfg_data(struct seq_file *m, void *v)
+--
+2.20.1
+
--- /dev/null
+From 85f83e48729185fd48f495969557349a8151fba1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 16:26:53 +1000
+Subject: powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 1fb4124ca9d456656a324f1ee29b7bf942f59ac8 ]
+
+When disabling virtual functions on an SR-IOV adapter we currently do not
+correctly remove the EEH state for the now-dead virtual functions. When
+removing the pci_dn that was created for the VF when SR-IOV was enabled
+we free the corresponding eeh_dev without removing it from the child device
+list of the eeh_pe that contained it. This can result in crashes due to the
+use-after-free.
+
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Tested-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190821062655.19735-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/pci_dn.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c
+index 9524009ca1ae4..d876eda926094 100644
+--- a/arch/powerpc/kernel/pci_dn.c
++++ b/arch/powerpc/kernel/pci_dn.c
+@@ -244,9 +244,22 @@ void remove_dev_pci_data(struct pci_dev *pdev)
+ continue;
+
+ #ifdef CONFIG_EEH
+- /* Release EEH device for the VF */
++ /*
++ * Release EEH state for this VF. The PCI core
++ * has already torn down the pci_dev for this VF, but
++ * we're responsible to removing the eeh_dev since it
++ * has the same lifetime as the pci_dn that spawned it.
++ */
+ edev = pdn_to_eeh_dev(pdn);
+ if (edev) {
++ /*
++ * We allocate pci_dn's for the totalvfs count,
++ * but only only the vfs that were activated
++ * have a configured PE.
++ */
++ if (edev->pe)
++ eeh_rmv_from_parent_pe(edev);
++
+ pdn->edev = NULL;
+ kfree(edev);
+ }
+--
+2.20.1
+
--- /dev/null
+From 90ac2d0fc9046a75338987c60fb0fafee88cb104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 12:59:22 +0106
+Subject: printk: fix exclusive_console replaying
+
+From: John Ogness <john.ogness@linutronix.de>
+
+[ Upstream commit def97da136515cb289a14729292c193e0a93bc64 ]
+
+Commit f92b070f2dc8 ("printk: Do not miss new messages when replaying
+the log") introduced a new variable @exclusive_console_stop_seq to
+store when an exclusive console should stop printing. It should be
+set to the @console_seq value at registration. However, @console_seq
+is previously set to @syslog_seq so that the exclusive console knows
+where to begin. This results in the exclusive console immediately
+reactivating all the other consoles and thus repeating the messages
+for those consoles.
+
+Set @console_seq after @exclusive_console_stop_seq has stored the
+current @console_seq value.
+
+Fixes: f92b070f2dc8 ("printk: Do not miss new messages when replaying the log")
+Link: http://lkml.kernel.org/r/20191219115322.31160-1-john.ogness@linutronix.de
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: John Ogness <john.ogness@linutronix.de>
+Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/printk/printk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index ca65327a6de8c..c0a5b56aea4e8 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2770,8 +2770,6 @@ void register_console(struct console *newcon)
+ * for us.
+ */
+ logbuf_lock_irqsave(flags);
+- console_seq = syslog_seq;
+- console_idx = syslog_idx;
+ /*
+ * We're about to replay the log buffer. Only do this to the
+ * just-registered console to avoid excessive message spam to
+@@ -2783,6 +2781,8 @@ void register_console(struct console *newcon)
+ */
+ exclusive_console = newcon;
+ exclusive_console_stop_seq = console_seq;
++ console_seq = syslog_seq;
++ console_idx = syslog_idx;
+ logbuf_unlock_irqrestore(flags);
+ }
+ console_unlock();
+--
+2.20.1
+
--- /dev/null
+From 6fbd705b7fe25d9ceb9578c8824ac417a6422744 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 10:03:54 +0100
+Subject: pwm: omap-dmtimer: Remove PWM chip in .remove before making it
+ unfunctional
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 43efdc8f0e6d7088ec61bd55a73bf853f002d043 ]
+
+In the old code (e.g.) mutex_destroy() was called before
+pwmchip_remove(). Between these two calls it is possible that a PWM
+callback is used which tries to grab the mutex.
+
+Fixes: 6604c6556db9 ("pwm: Add PWM driver for OMAP using dual-mode timers")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-omap-dmtimer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index 6cfeb0e1cc679..e36fcad668a68 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -361,6 +361,11 @@ put:
+ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+ {
+ struct pwm_omap_dmtimer_chip *omap = platform_get_drvdata(pdev);
++ int ret;
++
++ ret = pwmchip_remove(&omap->chip);
++ if (ret)
++ return ret;
+
+ if (pm_runtime_active(&omap->dm_timer_pdev->dev))
+ omap->pdata->stop(omap->dm_timer);
+@@ -369,7 +374,7 @@ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+
+ mutex_destroy(&omap->mutex);
+
+- return pwmchip_remove(&omap->chip);
++ return 0;
+ }
+
+ static const struct of_device_id pwm_omap_dmtimer_of_match[] = {
+--
+2.20.1
+
--- /dev/null
+From ec80be25ce80bc005a6438b2128bfa6a32bec180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 10:03:55 +0100
+Subject: pwm: omap-dmtimer: Simplify error handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit c4cf7aa57eb83b108d2d9c6c37c143388fee2a4d ]
+
+Instead of doing error handling in the middle of ->probe(), move error
+handling and freeing the reference to timer to the end.
+
+This fixes a resource leak as dm_timer wasn't freed when allocating
+*omap failed.
+
+Implementation note: The put: label was never reached without a goto and
+ret being unequal to 0, so the removed return statement is fine.
+
+Fixes: 6604c6556db9 ("pwm: Add PWM driver for OMAP using dual-mode timers")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-omap-dmtimer.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index 00772fc534906..6cfeb0e1cc679 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -298,15 +298,10 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+ goto put;
+ }
+
+-put:
+- of_node_put(timer);
+- if (ret < 0)
+- return ret;
+-
+ omap = devm_kzalloc(&pdev->dev, sizeof(*omap), GFP_KERNEL);
+ if (!omap) {
+- pdata->free(dm_timer);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto err_alloc_omap;
+ }
+
+ omap->pdata = pdata;
+@@ -339,13 +334,28 @@ put:
+ ret = pwmchip_add(&omap->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register PWM\n");
+- omap->pdata->free(omap->dm_timer);
+- return ret;
++ goto err_pwmchip_add;
+ }
+
++ of_node_put(timer);
++
+ platform_set_drvdata(pdev, omap);
+
+ return 0;
++
++err_pwmchip_add:
++
++ /*
++ * *omap is allocated using devm_kzalloc,
++ * so no free necessary here
++ */
++err_alloc_omap:
++
++ pdata->free(dm_timer);
++put:
++ of_node_put(timer);
++
++ return ret;
+ }
+
+ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 772ac0be9d9f3fae5f7475ad4faf6c24e2794e7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 19:51:43 +0800
+Subject: pwm: Remove set but not set variable 'pwm'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit 9871abffc81048e20f02e15d6aa4558a44ad53ea ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+ drivers/pwm/pwm-pca9685.c: In function ‘pca9685_pwm_gpio_free’:
+ drivers/pwm/pwm-pca9685.c:162:21: warning: variable ‘pwm’ set but not used [-Wunused-but-set-variable]
+
+It is never used, and so can be removed. In that case, hold and release
+the lock 'pca->lock' can be removed since nothing will be done between
+them.
+
+Fixes: e926b12c611c ("pwm: Clear chip_data in pwm_put()")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-pca9685.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 168684b02ebce..b07bdca3d510d 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -159,13 +159,9 @@ static void pca9685_pwm_gpio_set(struct gpio_chip *gpio, unsigned int offset,
+ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset)
+ {
+ struct pca9685 *pca = gpiochip_get_data(gpio);
+- struct pwm_device *pwm;
+
+ pca9685_pwm_gpio_set(gpio, offset, 0);
+ pm_runtime_put(pca->chip.dev);
+- mutex_lock(&pca->lock);
+- pwm = &pca->chip.pwms[offset];
+- mutex_unlock(&pca->lock);
+ }
+
+ static int pca9685_pwm_gpio_get_direction(struct gpio_chip *chip,
+--
+2.20.1
+
--- /dev/null
+From dddbae68414c444eafc8e89a4b3b47989706dbb9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2019 12:00:24 +0200
+Subject: pxa168fb: Fix the function used to release some memory in an error
+ handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3c911fe799d1c338d94b78e7182ad452c37af897 ]
+
+In the probe function, some resources are allocated using 'dma_alloc_wc()',
+they should be released with 'dma_free_wc()', not 'dma_free_coherent()'.
+
+We already use 'dma_free_wc()' in the remove function, but not in the
+error handling path of the probe function.
+
+Also, remove a useless 'PAGE_ALIGN()'. 'info->fix.smem_len' is already
+PAGE_ALIGNed.
+
+Fixes: 638772c7553f ("fb: add support of LCD display controller on pxa168/910 (base layer)")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Lubomir Rintel <lkundrak@v3.sk>
+CC: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190831100024.3248-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/pxa168fb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c
+index 1410f476e135d..1fc50fc0694bc 100644
+--- a/drivers/video/fbdev/pxa168fb.c
++++ b/drivers/video/fbdev/pxa168fb.c
+@@ -766,8 +766,8 @@ failed_free_cmap:
+ failed_free_clk:
+ clk_disable_unprepare(fbi->clk);
+ failed_free_fbmem:
+- dma_free_coherent(fbi->dev, info->fix.smem_len,
+- info->screen_base, fbi->fb_start_dma);
++ dma_free_wc(fbi->dev, info->fix.smem_len,
++ info->screen_base, fbi->fb_start_dma);
+ failed_free_info:
+ kfree(info);
+
+@@ -801,7 +801,7 @@ static int pxa168fb_remove(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+
+- dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len),
++ dma_free_wc(fbi->dev, info->fix.smem_len,
+ info->screen_base, info->fix.smem_start);
+
+ clk_disable_unprepare(fbi->clk);
+--
+2.20.1
+
--- /dev/null
+From cb586a0b49b8367ead6e30357482dbfd0635ddd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 16:53:37 +0100
+Subject: r8169: check that Realtek PHY driver module is loaded
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit f325937735498afb054a0195291bbf68d0b60be5 ]
+
+Some users complained about problems with r8169 and it turned out that
+the generic PHY driver was used instead instead of the dedicated one.
+In all cases reason was that r8169.ko was in initramfs, but realtek.ko
+not. Manually adding realtek.ko to initramfs fixed the issues.
+Root cause seems to be that tools like dracut and genkernel don't
+consider softdeps. Add a check for loaded Realtek PHY driver module
+and provide the user with a hint if it's not loaded.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
+index 5ae0b5663d540..a2cef6a004e73 100644
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -7064,6 +7064,15 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int chipset, region;
+ int jumbo_max, rc;
+
++ /* Some tools for creating an initramfs don't consider softdeps, then
++ * r8169.ko may be in initramfs, but realtek.ko not. Then the generic
++ * PHY driver is used that doesn't work with most chip versions.
++ */
++ if (!driver_find("RTL8201CP Ethernet", &mdio_bus_type)) {
++ dev_err(&pdev->dev, "realtek.ko not loaded, maybe it needs to be added to initramfs?\n");
++ return -ENOENT;
++ }
++
+ dev = devm_alloc_etherdev(&pdev->dev, sizeof (*tp));
+ if (!dev)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From fa4103ccc3071eff3eeceab6fe6708375b42b613 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 17:09:52 +0100
+Subject: radeon: insert 10ms sleep in dce5_crtc_load_lut
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit ec3d65082d7dabad6fa8f66a8ef166f2d522d6b2 ]
+
+Per at least one tester this is enough magic to recover the regression
+introduced for some people (but not all) in
+
+commit b8e2b0199cc377617dc238f5106352c06dcd3fa2
+Author: Peter Rosin <peda@axentia.se>
+Date: Tue Jul 4 12:36:57 2017 +0200
+
+ drm/fb-helper: factor out pseudo-palette
+
+which for radeon had the side-effect of refactoring out a seemingly
+redudant writing of the color palette.
+
+10ms in a fairly slow modeset path feels like an acceptable form of
+duct-tape, so maybe worth a shot and see what sticks.
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Michel Dänzer <michel.daenzer@amd.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=198123
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index e81b01f8db90e..0826efd9b5f51 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -127,6 +127,8 @@ static void dce5_crtc_load_lut(struct drm_crtc *crtc)
+
+ DRM_DEBUG_KMS("%d\n", radeon_crtc->crtc_id);
+
++ msleep(10);
++
+ WREG32(NI_INPUT_CSC_CONTROL + radeon_crtc->crtc_offset,
+ (NI_INPUT_CSC_GRPH_MODE(NI_INPUT_CSC_BYPASS) |
+ NI_INPUT_CSC_OVL_MODE(NI_INPUT_CSC_BYPASS)));
+--
+2.20.1
+
--- /dev/null
+From 98c83327d85dfe0df25b41fdc614c462f7e2a6d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 10:21:26 +0800
+Subject: raid6/test: fix a compilation error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+
+[ Upstream commit 6b8651aac1dca6140dd7fb4c9fec2736ed3f6223 ]
+
+The compilation error is redeclaration showed as following:
+
+ In file included from ../../../include/linux/limits.h:6,
+ from /usr/include/x86_64-linux-gnu/bits/local_lim.h:38,
+ from /usr/include/x86_64-linux-gnu/bits/posix1_lim.h:161,
+ from /usr/include/limits.h:183,
+ from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/limits.h:194,
+ from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/syslimits.h:7,
+ from /usr/lib/gcc/x86_64-linux-gnu/8/include-fixed/limits.h:34,
+ from ../../../include/linux/raid/pq.h:30,
+ from algos.c:14:
+ ../../../include/linux/types.h:114:15: error: conflicting types for ‘int64_t’
+ typedef s64 int64_t;
+ ^~~~~~~
+ In file included from /usr/include/stdint.h:34,
+ from /usr/lib/gcc/x86_64-linux-gnu/8/include/stdint.h:9,
+ from /usr/include/inttypes.h:27,
+ from ../../../include/linux/raid/pq.h:29,
+ from algos.c:14:
+ /usr/include/x86_64-linux-gnu/bits/stdint-intn.h:27:19: note: previous \
+ declaration of ‘int64_t’ was here
+ typedef __int64_t int64_t;
+
+Fixes: 54d50897d544 ("linux/kernel.h: split *_MAX and *_MIN macros into <linux/limits.h>")
+Signed-off-by: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/raid/pq.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h
+index 0832c9b66852e..0b6e7ad9cd2a8 100644
+--- a/include/linux/raid/pq.h
++++ b/include/linux/raid/pq.h
+@@ -27,7 +27,6 @@ extern const char raid6_empty_zero_page[PAGE_SIZE];
+
+ #include <errno.h>
+ #include <inttypes.h>
+-#include <limits.h>
+ #include <stddef.h>
+ #include <sys/mman.h>
+ #include <sys/time.h>
+--
+2.20.1
+
--- /dev/null
+From bb0990b48e5bcd7506fe405aec9f34876dbcb7d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 10:21:27 +0800
+Subject: raid6/test: fix a compilation warning
+
+From: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+
+[ Upstream commit 5e5ac01c2b8802921fee680518a986011cb59820 ]
+
+The compilation warning is redefination showed as following:
+
+ In file included from tables.c:2:
+ ../../../include/linux/export.h:180: warning: "EXPORT_SYMBOL" redefined
+ #define EXPORT_SYMBOL(sym) __EXPORT_SYMBOL(sym, "")
+
+ In file included from tables.c:1:
+ ../../../include/linux/raid/pq.h:61: note: this is the location of the previous definition
+ #define EXPORT_SYMBOL(sym)
+
+Fixes: 69a94abb82ee ("export.h, genksyms: do not make genksyms calculate CRC of trimmed symbols")
+Signed-off-by: Zhengyuan Liu <liuzhengyuan@kylinos.cn>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/raid/pq.h | 2 ++
+ lib/raid6/mktables.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/raid/pq.h b/include/linux/raid/pq.h
+index 0b6e7ad9cd2a8..e0ddb47f44020 100644
+--- a/include/linux/raid/pq.h
++++ b/include/linux/raid/pq.h
+@@ -58,7 +58,9 @@ extern const char raid6_empty_zero_page[PAGE_SIZE];
+ #define enable_kernel_altivec()
+ #define disable_kernel_altivec()
+
++#undef EXPORT_SYMBOL
+ #define EXPORT_SYMBOL(sym)
++#undef EXPORT_SYMBOL_GPL
+ #define EXPORT_SYMBOL_GPL(sym)
+ #define MODULE_LICENSE(licence)
+ #define MODULE_DESCRIPTION(desc)
+diff --git a/lib/raid6/mktables.c b/lib/raid6/mktables.c
+index 9c485df1308fb..f02e10fa62381 100644
+--- a/lib/raid6/mktables.c
++++ b/lib/raid6/mktables.c
+@@ -56,8 +56,8 @@ int main(int argc, char *argv[])
+ uint8_t v;
+ uint8_t exptbl[256], invtbl[256];
+
+- printf("#include <linux/raid/pq.h>\n");
+ printf("#include <linux/export.h>\n");
++ printf("#include <linux/raid/pq.h>\n");
+
+ /* Compute multiplication table */
+ printf("\nconst u8 __attribute__((aligned(256)))\n"
+--
+2.20.1
+
--- /dev/null
+From 6d7f1ef157a024d5ece7cb6d1dd51317331d4880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 22:01:04 +0100
+Subject: rbd: work around -Wuninitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a55e601b2f02df5db7070e9a37bd655c9c576a52 ]
+
+gcc -O3 warns about a dummy variable that is passed
+down into rbd_img_fill_nodata without being initialized:
+
+drivers/block/rbd.c: In function 'rbd_img_fill_nodata':
+drivers/block/rbd.c:2573:13: error: 'dummy' is used uninitialized in this function [-Werror=uninitialized]
+ fctx->iter = *fctx->pos;
+
+Since this is a dummy, I assume the warning is harmless, but
+it's better to initialize it anyway and avoid the warning.
+
+Fixes: mmtom ("init/Kconfig: enable -O3 for all arches")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rbd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 13527a0b4e448..a67315786db47 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2739,7 +2739,7 @@ static int rbd_img_fill_nodata(struct rbd_img_request *img_req,
+ u64 off, u64 len)
+ {
+ struct ceph_file_extent ex = { off, len };
+- union rbd_img_fill_iter dummy;
++ union rbd_img_fill_iter dummy = {};
+ struct rbd_img_fill_ctx fctx = {
+ .pos_type = OBJ_REQUEST_NODATA,
+ .pos = &dummy,
+--
+2.20.1
+
--- /dev/null
+From 769c8fdbfbf981b82ae45351bbc9afce0d3c643a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:57:43 +0200
+Subject: rcu: Fix data-race due to atomic_t copy-by-value
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 6cf539a87a61a4fbc43f625267dbcbcf283872ed ]
+
+This fixes a data-race where `atomic_t dynticks` is copied by value. The
+copy is performed non-atomically, resulting in a data-race if `dynticks`
+is updated concurrently.
+
+This data-race was found with KCSAN:
+==================================================================
+BUG: KCSAN: data-race in dyntick_save_progress_counter / rcu_irq_enter
+
+write to 0xffff989dbdbe98e0 of 4 bytes by task 10 on cpu 3:
+ atomic_add_return include/asm-generic/atomic-instrumented.h:78 [inline]
+ rcu_dynticks_snap kernel/rcu/tree.c:310 [inline]
+ dyntick_save_progress_counter+0x43/0x1b0 kernel/rcu/tree.c:984
+ force_qs_rnp+0x183/0x200 kernel/rcu/tree.c:2286
+ rcu_gp_fqs kernel/rcu/tree.c:1601 [inline]
+ rcu_gp_fqs_loop+0x71/0x880 kernel/rcu/tree.c:1653
+ rcu_gp_kthread+0x22c/0x3b0 kernel/rcu/tree.c:1799
+ kthread+0x1b5/0x200 kernel/kthread.c:255
+ <snip>
+
+read to 0xffff989dbdbe98e0 of 4 bytes by task 154 on cpu 7:
+ rcu_nmi_enter_common kernel/rcu/tree.c:828 [inline]
+ rcu_irq_enter+0xda/0x240 kernel/rcu/tree.c:870
+ irq_enter+0x5/0x50 kernel/softirq.c:347
+ <snip>
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 7 PID: 154 Comm: kworker/7:1H Not tainted 5.3.0+ #5
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
+Workqueue: kblockd blk_mq_run_work_fn
+==================================================================
+
+Signed-off-by: Marco Elver <elver@google.com>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Josh Triplett <josh@joshtriplett.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Joel Fernandes <joel@joelfernandes.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Dmitry Vyukov <dvyukov@google.com>
+Cc: rcu@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/rcu.h | 4 ++--
+ kernel/rcu/tree.c | 11 ++++++-----
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/include/trace/events/rcu.h b/include/trace/events/rcu.h
+index 694bd040cf51a..fdd31c5fd1265 100644
+--- a/include/trace/events/rcu.h
++++ b/include/trace/events/rcu.h
+@@ -442,7 +442,7 @@ TRACE_EVENT_RCU(rcu_fqs,
+ */
+ TRACE_EVENT_RCU(rcu_dyntick,
+
+- TP_PROTO(const char *polarity, long oldnesting, long newnesting, atomic_t dynticks),
++ TP_PROTO(const char *polarity, long oldnesting, long newnesting, int dynticks),
+
+ TP_ARGS(polarity, oldnesting, newnesting, dynticks),
+
+@@ -457,7 +457,7 @@ TRACE_EVENT_RCU(rcu_dyntick,
+ __entry->polarity = polarity;
+ __entry->oldnesting = oldnesting;
+ __entry->newnesting = newnesting;
+- __entry->dynticks = atomic_read(&dynticks);
++ __entry->dynticks = dynticks;
+ ),
+
+ TP_printk("%s %lx %lx %#3x", __entry->polarity,
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index 81105141b6a82..62e59596a30a0 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -576,7 +576,7 @@ static void rcu_eqs_enter(bool user)
+ }
+
+ lockdep_assert_irqs_disabled();
+- trace_rcu_dyntick(TPS("Start"), rdp->dynticks_nesting, 0, rdp->dynticks);
++ trace_rcu_dyntick(TPS("Start"), rdp->dynticks_nesting, 0, atomic_read(&rdp->dynticks));
+ WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) && !user && !is_idle_task(current));
+ rdp = this_cpu_ptr(&rcu_data);
+ do_nocb_deferred_wakeup(rdp);
+@@ -649,14 +649,15 @@ static __always_inline void rcu_nmi_exit_common(bool irq)
+ * leave it in non-RCU-idle state.
+ */
+ if (rdp->dynticks_nmi_nesting != 1) {
+- trace_rcu_dyntick(TPS("--="), rdp->dynticks_nmi_nesting, rdp->dynticks_nmi_nesting - 2, rdp->dynticks);
++ trace_rcu_dyntick(TPS("--="), rdp->dynticks_nmi_nesting, rdp->dynticks_nmi_nesting - 2,
++ atomic_read(&rdp->dynticks));
+ WRITE_ONCE(rdp->dynticks_nmi_nesting, /* No store tearing. */
+ rdp->dynticks_nmi_nesting - 2);
+ return;
+ }
+
+ /* This NMI interrupted an RCU-idle CPU, restore RCU-idleness. */
+- trace_rcu_dyntick(TPS("Startirq"), rdp->dynticks_nmi_nesting, 0, rdp->dynticks);
++ trace_rcu_dyntick(TPS("Startirq"), rdp->dynticks_nmi_nesting, 0, atomic_read(&rdp->dynticks));
+ WRITE_ONCE(rdp->dynticks_nmi_nesting, 0); /* Avoid store tearing. */
+
+ if (irq)
+@@ -743,7 +744,7 @@ static void rcu_eqs_exit(bool user)
+ rcu_dynticks_task_exit();
+ rcu_dynticks_eqs_exit();
+ rcu_cleanup_after_idle();
+- trace_rcu_dyntick(TPS("End"), rdp->dynticks_nesting, 1, rdp->dynticks);
++ trace_rcu_dyntick(TPS("End"), rdp->dynticks_nesting, 1, atomic_read(&rdp->dynticks));
+ WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) && !user && !is_idle_task(current));
+ WRITE_ONCE(rdp->dynticks_nesting, 1);
+ WARN_ON_ONCE(rdp->dynticks_nmi_nesting);
+@@ -827,7 +828,7 @@ static __always_inline void rcu_nmi_enter_common(bool irq)
+ }
+ trace_rcu_dyntick(incby == 1 ? TPS("Endirq") : TPS("++="),
+ rdp->dynticks_nmi_nesting,
+- rdp->dynticks_nmi_nesting + incby, rdp->dynticks);
++ rdp->dynticks_nmi_nesting + incby, atomic_read(&rdp->dynticks));
+ WRITE_ONCE(rdp->dynticks_nmi_nesting, /* Prevent store tearing. */
+ rdp->dynticks_nmi_nesting + incby);
+ barrier();
+--
+2.20.1
+
--- /dev/null
+From cf62963e118eebaf7643e1cdc789dcc2f917598c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 03:17:07 +0000
+Subject: rcu: Fix missed wakeup of exp_wq waiters
+
+From: Neeraj Upadhyay <neeraju@codeaurora.org>
+
+[ Upstream commit fd6bc19d7676a060a171d1cf3dcbf6fd797eb05f ]
+
+Tasks waiting within exp_funnel_lock() for an expedited grace period to
+elapse can be starved due to the following sequence of events:
+
+1. Tasks A and B both attempt to start an expedited grace
+ period at about the same time. This grace period will have
+ completed when the lower four bits of the rcu_state structure's
+ ->expedited_sequence field are 0b'0100', for example, when the
+ initial value of this counter is zero. Task A wins, and thus
+ does the actual work of starting the grace period, including
+ acquiring the rcu_state structure's .exp_mutex and sets the
+ counter to 0b'0001'.
+
+2. Because task B lost the race to start the grace period, it
+ waits on ->expedited_sequence to reach 0b'0100' inside of
+ exp_funnel_lock(). This task therefore blocks on the rcu_node
+ structure's ->exp_wq[1] field, keeping in mind that the
+ end-of-grace-period value of ->expedited_sequence (0b'0100')
+ is shifted down two bits before indexing the ->exp_wq[] field.
+
+3. Task C attempts to start another expedited grace period,
+ but blocks on ->exp_mutex, which is still held by Task A.
+
+4. The aforementioned expedited grace period completes, so that
+ ->expedited_sequence now has the value 0b'0100'. A kworker task
+ therefore acquires the rcu_state structure's ->exp_wake_mutex
+ and starts awakening any tasks waiting for this grace period.
+
+5. One of the first tasks awakened happens to be Task A. Task A
+ therefore releases the rcu_state structure's ->exp_mutex,
+ which allows Task C to start the next expedited grace period,
+ which causes the lower four bits of the rcu_state structure's
+ ->expedited_sequence field to become 0b'0101'.
+
+6. Task C's expedited grace period completes, so that the lower four
+ bits of the rcu_state structure's ->expedited_sequence field now
+ become 0b'1000'.
+
+7. The kworker task from step 4 above continues its wakeups.
+ Unfortunately, the wake_up_all() refetches the rcu_state
+ structure's .expedited_sequence field:
+
+ wake_up_all(&rnp->exp_wq[rcu_seq_ctr(rcu_state.expedited_sequence) & 0x3]);
+
+ This results in the wakeup being applied to the rcu_node
+ structure's ->exp_wq[2] field, which is unfortunate given that
+ Task B is instead waiting on ->exp_wq[1].
+
+On a busy system, no harm is done (or at least no permanent harm is done).
+Some later expedited grace period will redo the wakeup. But on a quiet
+system, such as many embedded systems, it might be a good long time before
+there was another expedited grace period. On such embedded systems,
+this situation could therefore result in a system hang.
+
+This issue manifested as DPM device timeout during suspend (which
+usually qualifies as a quiet time) due to a SCSI device being stuck in
+_synchronize_rcu_expedited(), with the following stack trace:
+
+ schedule()
+ synchronize_rcu_expedited()
+ synchronize_rcu()
+ scsi_device_quiesce()
+ scsi_bus_suspend()
+ dpm_run_callback()
+ __device_suspend()
+
+This commit therefore prevents such delays, timeouts, and hangs by
+making rcu_exp_wait_wake() use its "s" argument consistently instead of
+refetching from rcu_state.expedited_sequence.
+
+Fixes: 3b5f668e715b ("rcu: Overlap wakeups with next expedited grace period")
+Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_exp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h
+index 69c5aa64fcfd6..f504ac8317797 100644
+--- a/kernel/rcu/tree_exp.h
++++ b/kernel/rcu/tree_exp.h
+@@ -558,7 +558,7 @@ static void rcu_exp_wait_wake(unsigned long s)
+ spin_unlock(&rnp->exp_lock);
+ }
+ smp_mb(); /* All above changes before wakeup. */
+- wake_up_all(&rnp->exp_wq[rcu_seq_ctr(rcu_state.expedited_sequence) & 0x3]);
++ wake_up_all(&rnp->exp_wq[rcu_seq_ctr(s) & 0x3]);
+ }
+ trace_rcu_exp_grace_period(rcu_state.name, s, TPS("endwake"));
+ mutex_unlock(&rcu_state.exp_wake_mutex);
+--
+2.20.1
+
--- /dev/null
+From 0c65d81f5277f2b1cf9e24f04fbda882883d2f68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 19:49:10 +0000
+Subject: rcu/nocb: Fix dump_tree hierarchy print always active
+
+From: Stefan Reiter <stefan@pimaker.at>
+
+[ Upstream commit 610dea36d3083a977e4f156206cbe1eaa2a532f0 ]
+
+Commit 18cd8c93e69e ("rcu/nocb: Print gp/cb kthread hierarchy if
+dump_tree") added print statements to rcu_organize_nocb_kthreads for
+debugging, but incorrectly guarded them, causing the function to always
+spew out its message.
+
+This patch fixes it by guarding both pr_alert statements with dump_tree,
+while also changing the second pr_alert to a pr_cont, to print the
+hierarchy in a single line (assuming that's how it was supposed to
+work).
+
+Fixes: 18cd8c93e69e ("rcu/nocb: Print gp/cb kthread hierarchy if dump_tree")
+Signed-off-by: Stefan Reiter <stefan@pimaker.at>
+[ paulmck: Make single-nocbs-CPU GP kthreads look less erroneous. ]
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_plugin.h | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index f849e7429816f..f7118842a2b88 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -2322,6 +2322,8 @@ static void __init rcu_organize_nocb_kthreads(void)
+ {
+ int cpu;
+ bool firsttime = true;
++ bool gotnocbs = false;
++ bool gotnocbscbs = true;
+ int ls = rcu_nocb_gp_stride;
+ int nl = 0; /* Next GP kthread. */
+ struct rcu_data *rdp;
+@@ -2344,21 +2346,31 @@ static void __init rcu_organize_nocb_kthreads(void)
+ rdp = per_cpu_ptr(&rcu_data, cpu);
+ if (rdp->cpu >= nl) {
+ /* New GP kthread, set up for CBs & next GP. */
++ gotnocbs = true;
+ nl = DIV_ROUND_UP(rdp->cpu + 1, ls) * ls;
+ rdp->nocb_gp_rdp = rdp;
+ rdp_gp = rdp;
+- if (!firsttime && dump_tree)
+- pr_cont("\n");
+- firsttime = false;
+- pr_alert("%s: No-CB GP kthread CPU %d:", __func__, cpu);
++ if (dump_tree) {
++ if (!firsttime)
++ pr_cont("%s\n", gotnocbscbs
++ ? "" : " (self only)");
++ gotnocbscbs = false;
++ firsttime = false;
++ pr_alert("%s: No-CB GP kthread CPU %d:",
++ __func__, cpu);
++ }
+ } else {
+ /* Another CB kthread, link to previous GP kthread. */
++ gotnocbscbs = true;
+ rdp->nocb_gp_rdp = rdp_gp;
+ rdp_prev->nocb_next_cb_rdp = rdp;
+- pr_alert(" %d", cpu);
++ if (dump_tree)
++ pr_cont(" %d", cpu);
+ }
+ rdp_prev = rdp;
+ }
++ if (gotnocbs && dump_tree)
++ pr_cont("%s\n", gotnocbscbs ? "" : " (self only)");
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 24739d67fe97644bb1b5719f598272fd37628355 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 09:42:13 -0800
+Subject: rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 860c8802ace14c646864795e057349c9fb2d60ad ]
+
+Eric Dumazet supplied a KCSAN report of a bug that forces use
+of hlist_unhashed_lockless() from sk_unhashed():
+
+------------------------------------------------------------------------
+
+BUG: KCSAN: data-race in inet_unhash / inet_unhash
+
+write to 0xffff8880a69a0170 of 8 bytes by interrupt on cpu 1:
+ __hlist_nulls_del include/linux/list_nulls.h:88 [inline]
+ hlist_nulls_del_init_rcu include/linux/rculist_nulls.h:36 [inline]
+ __sk_nulls_del_node_init_rcu include/net/sock.h:676 [inline]
+ inet_unhash+0x38f/0x4a0 net/ipv4/inet_hashtables.c:612
+ tcp_set_state+0xfa/0x3e0 net/ipv4/tcp.c:2249
+ tcp_done+0x93/0x1e0 net/ipv4/tcp.c:3854
+ tcp_write_err+0x7e/0xc0 net/ipv4/tcp_timer.c:56
+ tcp_retransmit_timer+0x9b8/0x16d0 net/ipv4/tcp_timer.c:479
+ tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:599
+ tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:619
+ call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
+ expire_timers kernel/time/timer.c:1449 [inline]
+ __run_timers kernel/time/timer.c:1773 [inline]
+ __run_timers kernel/time/timer.c:1740 [inline]
+ run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
+ __do_softirq+0x115/0x33f kernel/softirq.c:292
+ invoke_softirq kernel/softirq.c:373 [inline]
+ irq_exit+0xbb/0xe0 kernel/softirq.c:413
+ exiting_irq arch/x86/include/asm/apic.h:536 [inline]
+ smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
+ apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
+ native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
+ arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
+ default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
+ cpuidle_idle_call kernel/sched/idle.c:154 [inline]
+ do_idle+0x1af/0x280 kernel/sched/idle.c:263
+ cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355
+ start_secondary+0x208/0x260 arch/x86/kernel/smpboot.c:264
+ secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
+
+read to 0xffff8880a69a0170 of 8 bytes by interrupt on cpu 0:
+ sk_unhashed include/net/sock.h:607 [inline]
+ inet_unhash+0x3d/0x4a0 net/ipv4/inet_hashtables.c:592
+ tcp_set_state+0xfa/0x3e0 net/ipv4/tcp.c:2249
+ tcp_done+0x93/0x1e0 net/ipv4/tcp.c:3854
+ tcp_write_err+0x7e/0xc0 net/ipv4/tcp_timer.c:56
+ tcp_retransmit_timer+0x9b8/0x16d0 net/ipv4/tcp_timer.c:479
+ tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:599
+ tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:619
+ call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
+ expire_timers kernel/time/timer.c:1449 [inline]
+ __run_timers kernel/time/timer.c:1773 [inline]
+ __run_timers kernel/time/timer.c:1740 [inline]
+ run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
+ __do_softirq+0x115/0x33f kernel/softirq.c:292
+ invoke_softirq kernel/softirq.c:373 [inline]
+ irq_exit+0xbb/0xe0 kernel/softirq.c:413
+ exiting_irq arch/x86/include/asm/apic.h:536 [inline]
+ smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
+ apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
+ native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
+ arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
+ default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
+ cpuidle_idle_call kernel/sched/idle.c:154 [inline]
+ do_idle+0x1af/0x280 kernel/sched/idle.c:263
+ cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355
+ rest_init+0xec/0xf6 init/main.c:452
+ arch_call_rest_init+0x17/0x37
+ start_kernel+0x838/0x85e init/main.c:786
+ x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
+ x86_64_start_kernel+0x72/0x76 arch/x86/kernel/head64.c:471
+ secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine,
+BIOS Google 01/01/2011
+
+------------------------------------------------------------------------
+
+This commit therefore replaces C-language assignments with WRITE_ONCE()
+in include/linux/list_nulls.h and include/linux/rculist_nulls.h.
+
+Reported-by: Eric Dumazet <edumazet@google.com> # For KCSAN
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/list_nulls.h | 8 ++++----
+ include/linux/rculist_nulls.h | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
+index 3ef96743db8da..1ecd35664e0d3 100644
+--- a/include/linux/list_nulls.h
++++ b/include/linux/list_nulls.h
+@@ -72,10 +72,10 @@ static inline void hlist_nulls_add_head(struct hlist_nulls_node *n,
+ struct hlist_nulls_node *first = h->first;
+
+ n->next = first;
+- n->pprev = &h->first;
++ WRITE_ONCE(n->pprev, &h->first);
+ h->first = n;
+ if (!is_a_nulls(first))
+- first->pprev = &n->next;
++ WRITE_ONCE(first->pprev, &n->next);
+ }
+
+ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+@@ -85,13 +85,13 @@ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+
+ WRITE_ONCE(*pprev, next);
+ if (!is_a_nulls(next))
+- next->pprev = pprev;
++ WRITE_ONCE(next->pprev, pprev);
+ }
+
+ static inline void hlist_nulls_del(struct hlist_nulls_node *n)
+ {
+ __hlist_nulls_del(n);
+- n->pprev = LIST_POISON2;
++ WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+
+ /**
+diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
+index 61974c4c566be..90f2e2232c6d7 100644
+--- a/include/linux/rculist_nulls.h
++++ b/include/linux/rculist_nulls.h
+@@ -34,7 +34,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ {
+ if (!hlist_nulls_unhashed(n)) {
+ __hlist_nulls_del(n);
+- n->pprev = NULL;
++ WRITE_ONCE(n->pprev, NULL);
+ }
+ }
+
+@@ -66,7 +66,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ static inline void hlist_nulls_del_rcu(struct hlist_nulls_node *n)
+ {
+ __hlist_nulls_del(n);
+- n->pprev = LIST_POISON2;
++ WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+
+ /**
+@@ -94,10 +94,10 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
+ struct hlist_nulls_node *first = h->first;
+
+ n->next = first;
+- n->pprev = &h->first;
++ WRITE_ONCE(n->pprev, &h->first);
+ rcu_assign_pointer(hlist_nulls_first_rcu(h), n);
+ if (!is_a_nulls(first))
+- first->pprev = &n->next;
++ WRITE_ONCE(first->pprev, &n->next);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 11d58bacba15d996d7a8da7ca0c3721f5a50919c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 20:21:10 +0800
+Subject: RDMA/hns: Avoid printing address of mtt page
+
+From: Wenpeng Liang <liangwenpeng@huawei.com>
+
+[ Upstream commit eca44507c3e908b7362696a4d6a11d90371334c6 ]
+
+Address of a page shouldn't be printed in case of security issues.
+
+Link: https://lore.kernel.org/r/1578313276-29080-2-git-send-email-liweihang@huawei.com
+Signed-off-by: Wenpeng Liang <liangwenpeng@huawei.com>
+Signed-off-by: Weihang Li <liweihang@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 5f8416ba09a94..702b59f0dab91 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -1062,8 +1062,8 @@ int hns_roce_ib_umem_write_mtt(struct hns_roce_dev *hr_dev,
+ if (!(npage % (1 << (mtt->page_shift - PAGE_SHIFT)))) {
+ if (page_addr & ((1 << mtt->page_shift) - 1)) {
+ dev_err(dev,
+- "page_addr 0x%llx is not page_shift %d alignment!\n",
+- page_addr, mtt->page_shift);
++ "page_addr is not page_shift %d alignment!\n",
++ mtt->page_shift);
+ ret = -EINVAL;
+ goto out;
+ }
+--
+2.20.1
+
--- /dev/null
+From 95fd691713e3ef557dc1d91d4461e10cb3d61be0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 14:43:35 +0200
+Subject: RDMA/mlx5: Don't fake udata for kernel path
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 4835709176e8ccf6561abc9f5c405293e008095f ]
+
+Kernel paths must not set udata and provide NULL pointer,
+instead of faking zeroed udata struct.
+
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/main.c | 34 +++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index e1cfbedefcbc9..9a918db9e8db4 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -829,6 +829,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ struct ib_device_attr *props,
+ struct ib_udata *uhw)
+ {
++ size_t uhw_outlen = (uhw) ? uhw->outlen : 0;
+ struct mlx5_ib_dev *dev = to_mdev(ibdev);
+ struct mlx5_core_dev *mdev = dev->mdev;
+ int err = -ENOMEM;
+@@ -842,12 +843,12 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ u64 max_tso;
+
+ resp_len = sizeof(resp.comp_mask) + sizeof(resp.response_length);
+- if (uhw->outlen && uhw->outlen < resp_len)
++ if (uhw_outlen && uhw_outlen < resp_len)
+ return -EINVAL;
+ else
+ resp.response_length = resp_len;
+
+- if (uhw->inlen && !ib_is_udata_cleared(uhw, 0, uhw->inlen))
++ if (uhw && uhw->inlen && !ib_is_udata_cleared(uhw, 0, uhw->inlen))
+ return -EINVAL;
+
+ memset(props, 0, sizeof(*props));
+@@ -911,7 +912,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ props->raw_packet_caps |=
+ IB_RAW_PACKET_CAP_CVLAN_STRIPPING;
+
+- if (field_avail(typeof(resp), tso_caps, uhw->outlen)) {
++ if (field_avail(typeof(resp), tso_caps, uhw_outlen)) {
+ max_tso = MLX5_CAP_ETH(mdev, max_lso_cap);
+ if (max_tso) {
+ resp.tso_caps.max_tso = 1 << max_tso;
+@@ -921,7 +922,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ }
+ }
+
+- if (field_avail(typeof(resp), rss_caps, uhw->outlen)) {
++ if (field_avail(typeof(resp), rss_caps, uhw_outlen)) {
+ resp.rss_caps.rx_hash_function =
+ MLX5_RX_HASH_FUNC_TOEPLITZ;
+ resp.rss_caps.rx_hash_fields_mask =
+@@ -941,9 +942,9 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ resp.response_length += sizeof(resp.rss_caps);
+ }
+ } else {
+- if (field_avail(typeof(resp), tso_caps, uhw->outlen))
++ if (field_avail(typeof(resp), tso_caps, uhw_outlen))
+ resp.response_length += sizeof(resp.tso_caps);
+- if (field_avail(typeof(resp), rss_caps, uhw->outlen))
++ if (field_avail(typeof(resp), rss_caps, uhw_outlen))
+ resp.response_length += sizeof(resp.rss_caps);
+ }
+
+@@ -1066,7 +1067,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ MLX5_MAX_CQ_PERIOD;
+ }
+
+- if (field_avail(typeof(resp), cqe_comp_caps, uhw->outlen)) {
++ if (field_avail(typeof(resp), cqe_comp_caps, uhw_outlen)) {
+ resp.response_length += sizeof(resp.cqe_comp_caps);
+
+ if (MLX5_CAP_GEN(dev->mdev, cqe_compression)) {
+@@ -1084,7 +1085,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ }
+ }
+
+- if (field_avail(typeof(resp), packet_pacing_caps, uhw->outlen) &&
++ if (field_avail(typeof(resp), packet_pacing_caps, uhw_outlen) &&
+ raw_support) {
+ if (MLX5_CAP_QOS(mdev, packet_pacing) &&
+ MLX5_CAP_GEN(mdev, qos)) {
+@@ -1103,7 +1104,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ }
+
+ if (field_avail(typeof(resp), mlx5_ib_support_multi_pkt_send_wqes,
+- uhw->outlen)) {
++ uhw_outlen)) {
+ if (MLX5_CAP_ETH(mdev, multi_pkt_send_wqe))
+ resp.mlx5_ib_support_multi_pkt_send_wqes =
+ MLX5_IB_ALLOW_MPW;
+@@ -1116,7 +1117,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ sizeof(resp.mlx5_ib_support_multi_pkt_send_wqes);
+ }
+
+- if (field_avail(typeof(resp), flags, uhw->outlen)) {
++ if (field_avail(typeof(resp), flags, uhw_outlen)) {
+ resp.response_length += sizeof(resp.flags);
+
+ if (MLX5_CAP_GEN(mdev, cqe_compression_128))
+@@ -1132,8 +1133,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ resp.flags |= MLX5_IB_QUERY_DEV_RESP_FLAGS_SCAT2CQE_DCT;
+ }
+
+- if (field_avail(typeof(resp), sw_parsing_caps,
+- uhw->outlen)) {
++ if (field_avail(typeof(resp), sw_parsing_caps, uhw_outlen)) {
+ resp.response_length += sizeof(resp.sw_parsing_caps);
+ if (MLX5_CAP_ETH(mdev, swp)) {
+ resp.sw_parsing_caps.sw_parsing_offloads |=
+@@ -1153,7 +1153,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ }
+ }
+
+- if (field_avail(typeof(resp), striding_rq_caps, uhw->outlen) &&
++ if (field_avail(typeof(resp), striding_rq_caps, uhw_outlen) &&
+ raw_support) {
+ resp.response_length += sizeof(resp.striding_rq_caps);
+ if (MLX5_CAP_GEN(mdev, striding_rq)) {
+@@ -1170,8 +1170,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ }
+ }
+
+- if (field_avail(typeof(resp), tunnel_offloads_caps,
+- uhw->outlen)) {
++ if (field_avail(typeof(resp), tunnel_offloads_caps, uhw_outlen)) {
+ resp.response_length += sizeof(resp.tunnel_offloads_caps);
+ if (MLX5_CAP_ETH(mdev, tunnel_stateless_vxlan))
+ resp.tunnel_offloads_caps |=
+@@ -1192,7 +1191,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev,
+ MLX5_IB_TUNNELED_OFFLOADS_MPLS_UDP;
+ }
+
+- if (uhw->outlen) {
++ if (uhw_outlen) {
+ err = ib_copy_to_udata(uhw, &resp, resp.response_length);
+
+ if (err)
+@@ -4738,7 +4737,6 @@ static int __get_port_caps(struct mlx5_ib_dev *dev, u8 port)
+ struct ib_device_attr *dprops = NULL;
+ struct ib_port_attr *pprops = NULL;
+ int err = -ENOMEM;
+- struct ib_udata uhw = {.inlen = 0, .outlen = 0};
+
+ pprops = kzalloc(sizeof(*pprops), GFP_KERNEL);
+ if (!pprops)
+@@ -4748,7 +4746,7 @@ static int __get_port_caps(struct mlx5_ib_dev *dev, u8 port)
+ if (!dprops)
+ goto out;
+
+- err = mlx5_ib_query_device(&dev->ib_dev, dprops, &uhw);
++ err = mlx5_ib_query_device(&dev->ib_dev, dprops, NULL);
+ if (err) {
+ mlx5_ib_warn(dev, "query_device failed %d\n", err);
+ goto out;
+--
+2.20.1
+
--- /dev/null
+From e518fe6126d52eef38c35f27396bce7d1f6cb1cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2019 19:36:13 +0800
+Subject: RDMA/rxe: Fix error type of mmap_offset
+
+From: Jiewei Ke <kejiewei.cn@gmail.com>
+
+[ Upstream commit 6ca18d8927d468c763571f78c9a7387a69ffa020 ]
+
+The type of mmap_offset should be u64 instead of int to match the type of
+mminfo.offset. If otherwise, after we create several thousands of CQs, it
+will run into overflow issues.
+
+Link: https://lore.kernel.org/r/20191227113613.5020-1-kejiewei.cn@gmail.com
+Signed-off-by: Jiewei Ke <kejiewei.cn@gmail.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 5c4b2239129cc..b0a02d4c8b933 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -407,7 +407,7 @@ struct rxe_dev {
+ struct list_head pending_mmaps;
+
+ spinlock_t mmap_offset_lock; /* guard mmap_offset */
+- int mmap_offset;
++ u64 mmap_offset;
+
+ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS];
+
+--
+2.20.1
+
--- /dev/null
+From 5675fbf51e6c7cc9574e1b82dd2917f3861a9c0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 14:33:10 +0000
+Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ]
+
+After device disassociation the uapi_objects are destroyed and freed,
+however it is still possible that core code can be holding a kref on the
+uobject. When it finally goes to uverbs_uobject_free() via the kref_put()
+it can trigger a use-after-free on the uapi_object.
+
+Since needs_kfree_rcu is a micro optimization that only benefits file
+uobjects, just get rid of it. There is no harm in using kfree_rcu even if
+it isn't required, and the number of involved objects is small.
+
+Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca
+Signed-off-by: Michael Guralnik <michaelgur@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/rdma_core.c | 23 +----------------------
+ include/rdma/uverbs_types.h | 1 -
+ 2 files changed, 1 insertion(+), 23 deletions(-)
+
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index ccf4d069c25c9..7dd9bd1e4d118 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject)
+
+ static void uverbs_uobject_free(struct kref *ref)
+ {
+- struct ib_uobject *uobj =
+- container_of(ref, struct ib_uobject, ref);
+-
+- if (uobj->uapi_object->type_class->needs_kfree_rcu)
+- kfree_rcu(uobj, rcu);
+- else
+- kfree(uobj);
++ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu);
+ }
+
+ void uverbs_uobject_put(struct ib_uobject *uobject)
+@@ -744,20 +738,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = {
+ .lookup_put = lookup_put_idr_uobject,
+ .destroy_hw = destroy_hw_idr_uobject,
+ .remove_handle = remove_handle_idr_uobject,
+- /*
+- * When we destroy an object, we first just lock it for WRITE and
+- * actually DESTROY it in the finalize stage. So, the problematic
+- * scenario is when we just started the finalize stage of the
+- * destruction (nothing was executed yet). Now, the other thread
+- * fetched the object for READ access, but it didn't lock it yet.
+- * The DESTROY thread continues and starts destroying the object.
+- * When the other thread continue - without the RCU, it would
+- * access freed memory. However, the rcu_read_lock delays the free
+- * until the rcu_read_lock of the READ operation quits. Since the
+- * exclusive lock of the object is still taken by the DESTROY flow, the
+- * READ operation will get -EBUSY and it'll just bail out.
+- */
+- .needs_kfree_rcu = true,
+ };
+ EXPORT_SYMBOL(uverbs_idr_class);
+
+@@ -919,7 +899,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = {
+ .lookup_put = lookup_put_fd_uobject,
+ .destroy_hw = destroy_hw_fd_uobject,
+ .remove_handle = remove_handle_fd_uobject,
+- .needs_kfree_rcu = false,
+ };
+ EXPORT_SYMBOL(uverbs_fd_class);
+
+diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h
+index d57a5ba00c743..0b0f5a5f392de 100644
+--- a/include/rdma/uverbs_types.h
++++ b/include/rdma/uverbs_types.h
+@@ -98,7 +98,6 @@ struct uverbs_obj_type_class {
+ enum rdma_remove_reason why,
+ struct uverbs_attr_bundle *attrs);
+ void (*remove_handle)(struct ib_uobject *uobj);
+- u8 needs_kfree_rcu;
+ };
+
+ struct uverbs_obj_type {
+--
+2.20.1
+
--- /dev/null
+From d4ae3cdaae7fd731e13f4f4a67b5f47f66f8d883 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 13:39:21 +0100
+Subject: regulator: core: Fix exported symbols to the exported GPL version
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit 3d7610e8da993539346dce6f7c909fd3d56bf4d5 ]
+
+Change the exported symbols introduced by commit e9153311491da
+("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
+from EXPORT_SYMBOL() to EXPORT_SYMBOL_GPL(), like is used for all the core
+parts.
+
+Fixes: e9153311491da ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
+Reported-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20200120123921.1204339-1-enric.balletbo@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index c6fa0f4451aeb..0011bdc15afbb 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3462,7 +3462,7 @@ int regulator_set_voltage_rdev(struct regulator_dev *rdev, int min_uV,
+ out:
+ return ret;
+ }
+-EXPORT_SYMBOL(regulator_set_voltage_rdev);
++EXPORT_SYMBOL_GPL(regulator_set_voltage_rdev);
+
+ static int regulator_limit_voltage_step(struct regulator_dev *rdev,
+ int *current_uV, int *min_uV)
+@@ -4027,7 +4027,7 @@ int regulator_get_voltage_rdev(struct regulator_dev *rdev)
+ return ret;
+ return ret - rdev->constraints->uV_offset;
+ }
+-EXPORT_SYMBOL(regulator_get_voltage_rdev);
++EXPORT_SYMBOL_GPL(regulator_get_voltage_rdev);
+
+ /**
+ * regulator_get_voltage - get regulator output voltage
+--
+2.20.1
+
--- /dev/null
+From daf28355d4a70b1086e0ff0f8a6c3a62f691ae2f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 17:47:09 +0100
+Subject: regulator: rk808: Lower log level on optional GPIOs being not
+ available
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit b8a039d37792067c1a380dc710361905724b9b2f ]
+
+RK808 can leverage a couple of GPIOs to tweak the ramp rate during DVS
+(Dynamic Voltage Scaling). These GPIOs are entirely optional but a
+dev_warn() appeared when cleaning this driver to use a more up-to-date
+gpiod API. At least reduce the log level to 'info' as it is totally
+fine to not populate these GPIO on a hardware design.
+
+This change is trivial but it is worth not polluting the logs during
+bringup phase by having real warnings and errors sorted out
+correctly.
+
+Fixes: a13eaf02e2d6 ("regulator: rk808: make better use of the gpiod API")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20191203164709.11127-1-miquel.raynal@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rk808-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
+index 61bd5ef0806c2..97c846c19c2f6 100644
+--- a/drivers/regulator/rk808-regulator.c
++++ b/drivers/regulator/rk808-regulator.c
+@@ -1297,7 +1297,7 @@ static int rk808_regulator_dt_parse_pdata(struct device *dev,
+ }
+
+ if (!pdata->dvs_gpio[i]) {
+- dev_warn(dev, "there is no dvs%d gpio\n", i);
++ dev_info(dev, "there is no dvs%d gpio\n", i);
+ continue;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From cca56efcfb39f268f660844c1d229a081878b299 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 10:45:43 +0100
+Subject: regulator: vctrl-regulator: Avoid deadlock getting and setting the
+ voltage
+
+From: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+
+[ Upstream commit e9153311491da9d9863ead9888a1613531cb4a1b ]
+
+`cat /sys/kernel/debug/regulator/regulator_summary` ends on a deadlock
+when you have a voltage controlled regulator (vctrl).
+
+The problem is that the vctrl_get_voltage() and vctrl_set_voltage() calls the
+regulator_get_voltage() and regulator_set_voltage() and that will try to lock
+again the dependent regulators (the regulator supplying the control voltage).
+
+Fix the issue by exporting the unlocked version of the regulator_get_voltage()
+and regulator_set_voltage() API so drivers that need it, like the voltage
+controlled regulator driver can use it.
+
+Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
+Reported-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Link: https://lore.kernel.org/r/20200116094543.2847321-1-enric.balletbo@collabora.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/core.c | 2 ++
+ drivers/regulator/vctrl-regulator.c | 38 +++++++++++++++++------------
+ 2 files changed, 25 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 1dba0bdf37623..c6fa0f4451aeb 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3462,6 +3462,7 @@ int regulator_set_voltage_rdev(struct regulator_dev *rdev, int min_uV,
+ out:
+ return ret;
+ }
++EXPORT_SYMBOL(regulator_set_voltage_rdev);
+
+ static int regulator_limit_voltage_step(struct regulator_dev *rdev,
+ int *current_uV, int *min_uV)
+@@ -4026,6 +4027,7 @@ int regulator_get_voltage_rdev(struct regulator_dev *rdev)
+ return ret;
+ return ret - rdev->constraints->uV_offset;
+ }
++EXPORT_SYMBOL(regulator_get_voltage_rdev);
+
+ /**
+ * regulator_get_voltage - get regulator output voltage
+diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c
+index 9a9ee81881098..cbadb1c996790 100644
+--- a/drivers/regulator/vctrl-regulator.c
++++ b/drivers/regulator/vctrl-regulator.c
+@@ -11,10 +11,13 @@
+ #include <linux/module.h>
+ #include <linux/of.h>
+ #include <linux/of_device.h>
++#include <linux/regulator/coupler.h>
+ #include <linux/regulator/driver.h>
+ #include <linux/regulator/of_regulator.h>
+ #include <linux/sort.h>
+
++#include "internal.h"
++
+ struct vctrl_voltage_range {
+ int min_uV;
+ int max_uV;
+@@ -79,7 +82,7 @@ static int vctrl_calc_output_voltage(struct vctrl_data *vctrl, int ctrl_uV)
+ static int vctrl_get_voltage(struct regulator_dev *rdev)
+ {
+ struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+- int ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
++ int ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
+
+ return vctrl_calc_output_voltage(vctrl, ctrl_uV);
+ }
+@@ -90,16 +93,16 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+ {
+ struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
+ struct regulator *ctrl_reg = vctrl->ctrl_reg;
+- int orig_ctrl_uV = regulator_get_voltage(ctrl_reg);
++ int orig_ctrl_uV = regulator_get_voltage_rdev(ctrl_reg->rdev);
+ int uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV);
+ int ret;
+
+ if (req_min_uV >= uV || !vctrl->ovp_threshold)
+ /* voltage rising or no OVP */
+- return regulator_set_voltage(
+- ctrl_reg,
++ return regulator_set_voltage_rdev(ctrl_reg->rdev,
+ vctrl_calc_ctrl_voltage(vctrl, req_min_uV),
+- vctrl_calc_ctrl_voltage(vctrl, req_max_uV));
++ vctrl_calc_ctrl_voltage(vctrl, req_max_uV),
++ PM_SUSPEND_ON);
+
+ while (uV > req_min_uV) {
+ int max_drop_uV = (uV * vctrl->ovp_threshold) / 100;
+@@ -114,9 +117,10 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+ next_uV = max_t(int, req_min_uV, uV - max_drop_uV);
+ next_ctrl_uV = vctrl_calc_ctrl_voltage(vctrl, next_uV);
+
+- ret = regulator_set_voltage(ctrl_reg,
++ ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
++ next_ctrl_uV,
+ next_ctrl_uV,
+- next_ctrl_uV);
++ PM_SUSPEND_ON);
+ if (ret)
+ goto err;
+
+@@ -130,7 +134,8 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
+
+ err:
+ /* Try to go back to original voltage */
+- regulator_set_voltage(ctrl_reg, orig_ctrl_uV, orig_ctrl_uV);
++ regulator_set_voltage_rdev(ctrl_reg->rdev, orig_ctrl_uV, orig_ctrl_uV,
++ PM_SUSPEND_ON);
+
+ return ret;
+ }
+@@ -155,9 +160,10 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+
+ if (selector >= vctrl->sel || !vctrl->ovp_threshold) {
+ /* voltage rising or no OVP */
+- ret = regulator_set_voltage(ctrl_reg,
++ ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
++ vctrl->vtable[selector].ctrl,
+ vctrl->vtable[selector].ctrl,
+- vctrl->vtable[selector].ctrl);
++ PM_SUSPEND_ON);
+ if (!ret)
+ vctrl->sel = selector;
+
+@@ -173,9 +179,10 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ else
+ next_sel = vctrl->vtable[vctrl->sel].ovp_min_sel;
+
+- ret = regulator_set_voltage(ctrl_reg,
++ ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
+ vctrl->vtable[next_sel].ctrl,
+- vctrl->vtable[next_sel].ctrl);
++ vctrl->vtable[next_sel].ctrl,
++ PM_SUSPEND_ON);
+ if (ret) {
+ dev_err(&rdev->dev,
+ "failed to set control voltage to %duV\n",
+@@ -195,9 +202,10 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
+ err:
+ if (vctrl->sel != orig_sel) {
+ /* Try to go back to original voltage */
+- if (!regulator_set_voltage(ctrl_reg,
++ if (!regulator_set_voltage_rdev(ctrl_reg->rdev,
++ vctrl->vtable[orig_sel].ctrl,
+ vctrl->vtable[orig_sel].ctrl,
+- vctrl->vtable[orig_sel].ctrl))
++ PM_SUSPEND_ON))
+ vctrl->sel = orig_sel;
+ else
+ dev_warn(&rdev->dev,
+@@ -482,7 +490,7 @@ static int vctrl_probe(struct platform_device *pdev)
+ if (ret)
+ return ret;
+
+- ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
++ ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
+ if (ctrl_uV < 0) {
+ dev_err(&pdev->dev, "failed to get control voltage\n");
+ return ctrl_uV;
+--
+2.20.1
+
--- /dev/null
+From ea8d10253cffb38b7433d969975f21ec4b272ad3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:35:58 +0100
+Subject: reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 4d5c1adaf893b8aa52525d2b81995e949bcb3239 ]
+
+When we fail to allocate string for journal device name we jump to
+'error' label which tries to unlock reiserfs write lock which is not
+held. Jump to 'error_unlocked' instead.
+
+Fixes: f32485be8397 ("reiserfs: delay reiserfs lock until journal initialization")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index d127af64283e3..a6bce5b1fb1dc 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1948,7 +1948,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
+ if (!sbi->s_jdev) {
+ SWARN(silent, s, "", "Cannot allocate memory for "
+ "journal device name");
+- goto error;
++ goto error_unlocked;
+ }
+ }
+ #ifdef CONFIG_QUOTA
+--
+2.20.1
+
--- /dev/null
+From f93e28ecccb58b94219171deb924d39048c527a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:17:26 -0800
+Subject: reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit aacee5446a2a1aa35d0a49dab289552578657fb4 ]
+
+The variable inode may be NULL in reiserfs_insert_item(), but there is
+no check before accessing the member of inode.
+
+Fix this by adding NULL pointer check before calling reiserfs_debug().
+
+Link: http://lkml.kernel.org/r/79c5135d-ff25-1cc9-4e99-9f572b88cc00@huawei.com
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Cc: zhengbin <zhengbin13@huawei.com>
+Cc: Hu Shiyuan <hushiyuan@huawei.com>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Jan Kara <jack@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/stree.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
+index da9ebe33882b7..bb4973aefbb18 100644
+--- a/fs/reiserfs/stree.c
++++ b/fs/reiserfs/stree.c
+@@ -2246,7 +2246,8 @@ error_out:
+ /* also releases the path */
+ unfix_nodes(&s_ins_balance);
+ #ifdef REISERQUOTA_DEBUG
+- reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
++ if (inode)
++ reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
+ "reiserquota insert_item(): freeing %u id=%u type=%c",
+ quota_bytes, inode->i_uid, head2type(ih));
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 2a44ad41f81da615c7887f1e83b1feb43b5d816e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 May 2019 17:52:23 -0500
+Subject: remoteproc: Initialize rproc_class before use
+
+From: Brandon Maier <brandon.maier@rockwellcollins.com>
+
+[ Upstream commit a8f40111d184098cd2b3dc0c7170c42250a5fa09 ]
+
+The remoteproc_core and remoteproc drivers all initialize with module_init().
+However remoteproc drivers need the rproc_class during their probe. If one of
+the remoteproc drivers runs init and gets through probe before
+remoteproc_init() runs, a NULL pointer access of rproc_class's `glue_dirs`
+spinlock occurs.
+
+> Unable to handle kernel NULL pointer dereference at virtual address 000000dc
+> pgd = c0004000
+> [000000dc] *pgd=00000000
+> Internal error: Oops: 5 [#1] PREEMPT ARM
+> Modules linked in:
+> CPU: 0 PID: 1 Comm: swapper Tainted: G W 4.14.106-rt56 #1
+> Hardware name: Generic OMAP36xx (Flattened Device Tree)
+> task: c6050000 task.stack: c604a000
+> PC is at rt_spin_lock+0x40/0x6c
+> LR is at rt_spin_lock+0x28/0x6c
+> pc : [<c0523c90>] lr : [<c0523c78>] psr: 60000013
+> sp : c604bdc0 ip : 00000000 fp : 00000000
+> r10: 00000000 r9 : c61c7c10 r8 : c6269c20
+> r7 : c0905888 r6 : c6269c20 r5 : 00000000 r4 : 000000d4
+> r3 : 000000dc r2 : c6050000 r1 : 00000002 r0 : 000000d4
+> Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+...
+> [<c0523c90>] (rt_spin_lock) from [<c03b65a4>] (get_device_parent+0x54/0x17c)
+> [<c03b65a4>] (get_device_parent) from [<c03b6bec>] (device_add+0xe0/0x5b4)
+> [<c03b6bec>] (device_add) from [<c042adf4>] (rproc_add+0x18/0xd8)
+> [<c042adf4>] (rproc_add) from [<c01110e4>] (my_rproc_probe+0x158/0x204)
+> [<c01110e4>] (my_rproc_probe) from [<c03bb6b8>] (platform_drv_probe+0x34/0x70)
+> [<c03bb6b8>] (platform_drv_probe) from [<c03b9dd4>] (driver_probe_device+0x2c8/0x420)
+> [<c03b9dd4>] (driver_probe_device) from [<c03ba02c>] (__driver_attach+0x100/0x11c)
+> [<c03ba02c>] (__driver_attach) from [<c03b7d08>] (bus_for_each_dev+0x7c/0xc0)
+> [<c03b7d08>] (bus_for_each_dev) from [<c03b910c>] (bus_add_driver+0x1cc/0x264)
+> [<c03b910c>] (bus_add_driver) from [<c03ba714>] (driver_register+0x78/0xf8)
+> [<c03ba714>] (driver_register) from [<c010181c>] (do_one_initcall+0x100/0x190)
+> [<c010181c>] (do_one_initcall) from [<c0800de8>] (kernel_init_freeable+0x130/0x1d0)
+> [<c0800de8>] (kernel_init_freeable) from [<c051eee8>] (kernel_init+0x8/0x114)
+> [<c051eee8>] (kernel_init) from [<c01175b0>] (ret_from_fork+0x14/0x24)
+> Code: e2843008 e3c2203f f5d3f000 e5922010 (e193cf9f)
+> ---[ end trace 0000000000000002 ]---
+
+Signed-off-by: Brandon Maier <brandon.maier@rockwellcollins.com>
+Link: https://lore.kernel.org/r/20190530225223.136420-1-brandon.maier@rockwellcollins.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/remoteproc_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index 3c5fbbbfb0f17..b542debbc6f03 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -2224,7 +2224,7 @@ static int __init remoteproc_init(void)
+
+ return 0;
+ }
+-module_init(remoteproc_init);
++subsys_initcall(remoteproc_init);
+
+ static void __exit remoteproc_exit(void)
+ {
+--
+2.20.1
+
--- /dev/null
+From 902390f7bfe4811cf04ff6e6c11bbcc943d057b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 13:19:19 +0900
+Subject: reset: uniphier: Add SCSSI reset control for each channel
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit f4aec227e985e31d2fdc5608daf48e3de19157b7 ]
+
+SCSSI has reset controls for each channel in the SoCs newer than Pro4,
+so this adds missing reset controls for channel 1, 2 and 3. And more, this
+moves MCSSI reset ID after SCSSI.
+
+Fixes: 6b39fd590aeb ("reset: uniphier: add reset control support for SPI")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-uniphier.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/reset/reset-uniphier.c b/drivers/reset/reset-uniphier.c
+index 74e589f5dd6a6..279e535bf5d80 100644
+--- a/drivers/reset/reset-uniphier.c
++++ b/drivers/reset/reset-uniphier.c
+@@ -193,8 +193,8 @@ static const struct uniphier_reset_data uniphier_pro5_sd_reset_data[] = {
+ #define UNIPHIER_PERI_RESET_FI2C(id, ch) \
+ UNIPHIER_RESETX((id), 0x114, 24 + (ch))
+
+-#define UNIPHIER_PERI_RESET_SCSSI(id) \
+- UNIPHIER_RESETX((id), 0x110, 17)
++#define UNIPHIER_PERI_RESET_SCSSI(id, ch) \
++ UNIPHIER_RESETX((id), 0x110, 17 + (ch))
+
+ #define UNIPHIER_PERI_RESET_MCSSI(id) \
+ UNIPHIER_RESETX((id), 0x114, 14)
+@@ -209,7 +209,7 @@ static const struct uniphier_reset_data uniphier_ld4_peri_reset_data[] = {
+ UNIPHIER_PERI_RESET_I2C(6, 2),
+ UNIPHIER_PERI_RESET_I2C(7, 3),
+ UNIPHIER_PERI_RESET_I2C(8, 4),
+- UNIPHIER_PERI_RESET_SCSSI(11),
++ UNIPHIER_PERI_RESET_SCSSI(11, 0),
+ UNIPHIER_RESET_END,
+ };
+
+@@ -225,8 +225,11 @@ static const struct uniphier_reset_data uniphier_pro4_peri_reset_data[] = {
+ UNIPHIER_PERI_RESET_FI2C(8, 4),
+ UNIPHIER_PERI_RESET_FI2C(9, 5),
+ UNIPHIER_PERI_RESET_FI2C(10, 6),
+- UNIPHIER_PERI_RESET_SCSSI(11),
+- UNIPHIER_PERI_RESET_MCSSI(12),
++ UNIPHIER_PERI_RESET_SCSSI(11, 0),
++ UNIPHIER_PERI_RESET_SCSSI(12, 1),
++ UNIPHIER_PERI_RESET_SCSSI(13, 2),
++ UNIPHIER_PERI_RESET_SCSSI(14, 3),
++ UNIPHIER_PERI_RESET_MCSSI(15),
+ UNIPHIER_RESET_END,
+ };
+
+--
+2.20.1
+
--- /dev/null
+From e01ff2d350c69f0a29944fae29e8916e24a29522 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 10:20:32 -0800
+Subject: Revert "nfp: abm: fix memory leak in nfp_abm_u32_knode_replace"
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 1d1997db870f4058676439ef7014390ba9e24eb2 ]
+
+This reverts commit 78beef629fd9 ("nfp: abm: fix memory leak in
+nfp_abm_u32_knode_replace").
+
+The quoted commit does not fix anything and resulted in a bogus
+CVE-2019-19076.
+
+If match is NULL then it is known there is no matching entry in
+list, hence, calling nfp_abm_u32_knode_delete() is pointless.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: John Hurley <john.hurley@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/netronome/nfp/abm/cls.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/abm/cls.c b/drivers/net/ethernet/netronome/nfp/abm/cls.c
+index 9f8a1f69c0c4c..23ebddfb95325 100644
+--- a/drivers/net/ethernet/netronome/nfp/abm/cls.c
++++ b/drivers/net/ethernet/netronome/nfp/abm/cls.c
+@@ -176,10 +176,8 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
+ u8 mask, val;
+ int err;
+
+- if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack)) {
+- err = -EOPNOTSUPP;
++ if (!nfp_abm_u32_check_knode(alink->abm, knode, proto, extack))
+ goto err_delete;
+- }
+
+ tos_off = proto == htons(ETH_P_IP) ? 16 : 20;
+
+@@ -200,18 +198,14 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
+ if ((iter->val & cmask) == (val & cmask) &&
+ iter->band != knode->res->classid) {
+ NL_SET_ERR_MSG_MOD(extack, "conflict with already offloaded filter");
+- err = -EOPNOTSUPP;
+ goto err_delete;
+ }
+ }
+
+ if (!match) {
+ match = kzalloc(sizeof(*match), GFP_KERNEL);
+- if (!match) {
+- err = -ENOMEM;
+- goto err_delete;
+- }
+-
++ if (!match)
++ return -ENOMEM;
+ list_add(&match->list, &alink->dscp_map);
+ }
+ match->handle = knode->handle;
+@@ -227,7 +221,7 @@ nfp_abm_u32_knode_replace(struct nfp_abm_link *alink,
+
+ err_delete:
+ nfp_abm_u32_knode_delete(alink, knode);
+- return err;
++ return -EOPNOTSUPP;
+ }
+
+ static int nfp_abm_setup_tc_block_cb(enum tc_setup_type type,
+--
+2.20.1
+
--- /dev/null
+From 42d416c18494f0e9206a94ab0f4a677f7f8c4d41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 18:13:49 +0100
+Subject: rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 34719de919af07682861cb0fa2bcf64da33ecf44 ]
+
+Merely enabling I2C and RTC selects REGMAP_I2C and REGMAP_SPI, even when
+no driver needs it. While the former can be moduler, the latter cannot,
+and thus becomes built-in.
+
+Fix this by moving the select statements for REGMAP_I2C and REGMAP_SPI
+from the RTC_I2C_AND_SPI helper to the individual drivers that depend on
+it.
+
+Note that the comment for RTC_I2C_AND_SPI refers to SND_SOC_I2C_AND_SPI
+for more information, but the latter does not select REGMAP_{I2C,SPI}
+itself, and defers that to the individual drivers, too.
+
+Fixes: 080481f54ef62121 ("rtc: merge ds3232 and ds3234")
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: kbuild test robot <lkp@intel.com>
+Link: https://lore.kernel.org/r/20200112171349.22268-1-geert@linux-m68k.org
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/Kconfig | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
+index 1adf9f8156522..5efc6af539c0d 100644
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -859,14 +859,14 @@ config RTC_I2C_AND_SPI
+ default m if I2C=m
+ default y if I2C=y
+ default y if SPI_MASTER=y
+- select REGMAP_I2C if I2C
+- select REGMAP_SPI if SPI_MASTER
+
+ comment "SPI and I2C RTC drivers"
+
+ config RTC_DRV_DS3232
+ tristate "Dallas/Maxim DS3232/DS3234"
+ depends on RTC_I2C_AND_SPI
++ select REGMAP_I2C if I2C
++ select REGMAP_SPI if SPI_MASTER
+ help
+ If you say yes here you get support for Dallas Semiconductor
+ DS3232 and DS3234 real-time clock chips. If an interrupt is associated
+@@ -886,6 +886,8 @@ config RTC_DRV_DS3232_HWMON
+ config RTC_DRV_PCF2127
+ tristate "NXP PCF2127"
+ depends on RTC_I2C_AND_SPI
++ select REGMAP_I2C if I2C
++ select REGMAP_SPI if SPI_MASTER
+ select WATCHDOG_CORE if WATCHDOG
+ help
+ If you say yes here you get support for the NXP PCF2127/29 RTC
+@@ -902,6 +904,8 @@ config RTC_DRV_PCF2127
+ config RTC_DRV_RV3029C2
+ tristate "Micro Crystal RV3029/3049"
+ depends on RTC_I2C_AND_SPI
++ select REGMAP_I2C if I2C
++ select REGMAP_SPI if SPI_MASTER
+ help
+ If you say yes here you get support for the Micro Crystal
+ RV3029 and RV3049 RTC chips.
+--
+2.20.1
+
--- /dev/null
+From 5f7c5d00db92489a8e065700611db40af3594b05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:29 +0700
+Subject: rtlwifi: rtl_pci: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit cb775c88da5d48a85d99d95219f637b6fad2e0e9 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index f88d26535978d..25335bd2873b6 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -1061,13 +1061,15 @@ done:
+ return ret;
+ }
+
+-static void _rtl_pci_irq_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_irq_tasklet(unsigned long data)
+ {
++ struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ _rtl_pci_tx_chk_waitq(hw);
+ }
+
+-static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_prepare_bcn_tasklet(unsigned long data)
+ {
++ struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+@@ -1193,10 +1195,10 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
+
+ /*task */
+ tasklet_init(&rtlpriv->works.irq_tasklet,
+- (void (*)(unsigned long))_rtl_pci_irq_tasklet,
++ _rtl_pci_irq_tasklet,
+ (unsigned long)hw);
+ tasklet_init(&rtlpriv->works.irq_prepare_bcn_tasklet,
+- (void (*)(unsigned long))_rtl_pci_prepare_bcn_tasklet,
++ _rtl_pci_prepare_bcn_tasklet,
+ (unsigned long)hw);
+ INIT_WORK(&rtlpriv->works.lps_change_work,
+ rtl_lps_change_work_callback);
+--
+2.20.1
+
--- /dev/null
+From e60719c705ecea0ebf397365c60f9ae9807aff92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:08:07 +0800
+Subject: rtw88: fix potential NULL skb access in TX ISR
+
+From: Yan-Hsuan Chuang <yhchuang@realtek.com>
+
+[ Upstream commit f4f84ff8377d4cedf18317747bc407b2cf657d0f ]
+
+Sometimes the TX queue may be empty and we could possible
+dequeue a NULL pointer, crash the kernel. If the skb is NULL
+then there is nothing to do, just leave the ISR.
+
+And the TX queue should not be empty here, so print an error
+to see if there is anything wrong for DMA ring.
+
+Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
+index d90928be663b9..77a2bdee50fa7 100644
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -762,6 +762,11 @@ static void rtw_pci_tx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci,
+
+ while (count--) {
+ skb = skb_dequeue(&ring->queue);
++ if (!skb) {
++ rtw_err(rtwdev, "failed to dequeue %d skb TX queue %d, BD=0x%08x, rp %d -> %d\n",
++ count, hw_queue, bd_idx, ring->r.rp, cur_rp);
++ break;
++ }
+ tx_data = rtw_pci_get_tx_data(skb);
+ pci_unmap_single(rtwpci->pdev, tx_data->dma, skb->len,
+ PCI_DMA_TODEVICE);
+--
+2.20.1
+
--- /dev/null
+From 1326a24aeb5bd6f880de324d708b8a6167f8f4c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 17:21:46 +0800
+Subject: rtw88: fix rate mask for 1SS chip
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+[ Upstream commit 35a68fa5f96a80797e11b6952a47c5a84939a7bf ]
+
+The rate mask is used to tell firmware the supported rate depends on
+negotiation. We loop 2 times for all VHT/HT 2SS rate mask first, and then
+only keep the part according to chip's NSS.
+
+This commit fixes the logic error of '&' operations for VHT/HT rate, and
+we should run this logic before adding legacy rate.
+
+To access HT MCS map, index 0/1 represent MCS 0-7/8-15 respectively. Use
+NL80211_BAND_xxx is incorrect, so fix it as well.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Reviewed-by: Chris Chiu <chiu@endlessm.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c
+index 806af37192bc2..88e2252bf8a2b 100644
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -556,8 +556,8 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ if (sta->vht_cap.cap & IEEE80211_VHT_CAP_SHORT_GI_80)
+ is_support_sgi = true;
+ } else if (sta->ht_cap.ht_supported) {
+- ra_mask |= (sta->ht_cap.mcs.rx_mask[NL80211_BAND_5GHZ] << 20) |
+- (sta->ht_cap.mcs.rx_mask[NL80211_BAND_2GHZ] << 12);
++ ra_mask |= (sta->ht_cap.mcs.rx_mask[1] << 20) |
++ (sta->ht_cap.mcs.rx_mask[0] << 12);
+ if (sta->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC)
+ stbc_en = HT_STBC_EN;
+ if (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING)
+@@ -567,6 +567,9 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ is_support_sgi = true;
+ }
+
++ if (efuse->hw_cap.nss == 1)
++ ra_mask &= RA_MASK_VHT_RATES_1SS | RA_MASK_HT_RATES_1SS;
++
+ if (hal->current_band_type == RTW_BAND_5G) {
+ ra_mask |= (u64)sta->supp_rates[NL80211_BAND_5GHZ] << 4;
+ if (sta->vht_cap.vht_supported) {
+@@ -600,11 +603,6 @@ void rtw_update_sta_info(struct rtw_dev *rtwdev, struct rtw_sta_info *si)
+ wireless_set = 0;
+ }
+
+- if (efuse->hw_cap.nss == 1) {
+- ra_mask &= RA_MASK_VHT_RATES_1SS;
+- ra_mask &= RA_MASK_HT_RATES_1SS;
+- }
+-
+ switch (sta->bandwidth) {
+ case IEEE80211_STA_RX_BW_80:
+ bw_mode = RTW_CHANNEL_WIDTH_80;
+--
+2.20.1
+
--- /dev/null
+From 0ef6d01012d9c10b6dd62c26b3e1c82ecf58fabb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 14:46:00 +0100
+Subject: s390: adjust -mpacked-stack support check for clang 10
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 253b3c4b2920e07ce9e2b18800b9b65245e2fafa ]
+
+clang 10 introduces -mpacked-stack compiler option implementation. At the
+same time currently it does not support a combination of -mpacked-stack
+and -mbackchain. This leads to the following build error:
+
+clang: error: unsupported option '-mpacked-stack with -mbackchain' for
+target 's390x-ibm-linux'
+
+If/when clang adds support for a combination of -mpacked-stack and
+-mbackchain it would also require -msoft-float (like gcc does). According
+to Ulrich Weigand "stack slot assigned to the kernel backchain overlaps
+the stack slot assigned to the FPR varargs (both are required to be
+placed immediately after the saved r15 slot if present)."
+
+Extend -mpacked-stack compiler option support check to include all 3
+options -mpacked-stack -mbackchain -msoft-float which must present to
+support -mpacked-stack with -mbackchain.
+
+Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index 478b645b20ddb..9ce1baeac2b25 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -69,7 +69,7 @@ cflags-y += -Wa,-I$(srctree)/arch/$(ARCH)/include
+ #
+ cflags-$(CONFIG_FRAME_POINTER) += -fno-optimize-sibling-calls
+
+-ifeq ($(call cc-option-yn,-mpacked-stack),y)
++ifeq ($(call cc-option-yn,-mpacked-stack -mbackchain -msoft-float),y)
+ cflags-$(CONFIG_PACK_STACK) += -mpacked-stack -D__PACK_STACK
+ aflags-$(CONFIG_PACK_STACK) += -D__PACK_STACK
+ endif
+--
+2.20.1
+
--- /dev/null
+From a6787bde0597c8c6be92047595b9ee075d7f301e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 14:33:39 +0100
+Subject: s390/ftrace: generate traced function stack frame
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 45f7a0da600d3c409b5ad8d5ddddacd98ddc8840 ]
+
+Currently backtrace from ftraced function does not contain ftraced
+function itself. e.g. for "path_openat":
+
+arch_stack_walk+0x15c/0x2d8
+stack_trace_save+0x50/0x68
+stack_trace_call+0x15e/0x3d8
+ftrace_graph_caller+0x0/0x1c <-- ftrace code
+do_filp_open+0x7c/0xe8 <-- ftraced function caller
+do_open_execat+0x76/0x1b8
+open_exec+0x52/0x78
+load_elf_binary+0x180/0x1160
+search_binary_handler+0x8e/0x288
+load_script+0x2a8/0x2b8
+search_binary_handler+0x8e/0x288
+__do_execve_file.isra.39+0x6fa/0xb40
+__s390x_sys_execve+0x56/0x68
+system_call+0xdc/0x2d8
+
+Ftraced function is expected in the backtrace by ftrace kselftests, which
+are now failing. It would also be nice to have it for clarity reasons.
+
+"ftrace_caller" itself is called without stack frame allocated for it
+and does not store its caller (ftraced function). Instead it simply
+allocates a stack frame for "ftrace_trace_function" and sets backchain
+to point to ftraced function stack frame (which contains ftraced function
+caller in saved r14).
+
+To fix this issue make "ftrace_caller" allocate a stack frame
+for itself just to store ftraced function for the stack unwinder.
+As a result backtrace looks like the following:
+
+arch_stack_walk+0x15c/0x2d8
+stack_trace_save+0x50/0x68
+stack_trace_call+0x15e/0x3d8
+ftrace_graph_caller+0x0/0x1c <-- ftrace code
+path_openat+0x6/0xd60 <-- ftraced function
+do_filp_open+0x7c/0xe8 <-- ftraced function caller
+do_open_execat+0x76/0x1b8
+open_exec+0x52/0x78
+load_elf_binary+0x180/0x1160
+search_binary_handler+0x8e/0x288
+load_script+0x2a8/0x2b8
+search_binary_handler+0x8e/0x288
+__do_execve_file.isra.39+0x6fa/0xb40
+__s390x_sys_execve+0x56/0x68
+system_call+0xdc/0x2d8
+
+Reported-by: Sven Schnelle <sven.schnelle@ibm.com>
+Tested-by: Sven Schnelle <sven.schnelle@ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/mcount.S | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
+index 9e1660a6b9db6..3431b2d5e3346 100644
+--- a/arch/s390/kernel/mcount.S
++++ b/arch/s390/kernel/mcount.S
+@@ -26,6 +26,12 @@ ENDPROC(ftrace_stub)
+ #define STACK_PTREGS (STACK_FRAME_OVERHEAD)
+ #define STACK_PTREGS_GPRS (STACK_PTREGS + __PT_GPRS)
+ #define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
++#ifdef __PACK_STACK
++/* allocate just enough for r14, r15 and backchain */
++#define TRACED_FUNC_FRAME_SIZE 24
++#else
++#define TRACED_FUNC_FRAME_SIZE STACK_FRAME_OVERHEAD
++#endif
+
+ ENTRY(_mcount)
+ BR_EX %r14
+@@ -39,9 +45,16 @@ ENTRY(ftrace_caller)
+ #if !(defined(CC_USING_HOTPATCH) || defined(CC_USING_NOP_MCOUNT))
+ aghi %r0,MCOUNT_RETURN_FIXUP
+ #endif
+- aghi %r15,-STACK_FRAME_SIZE
++ # allocate stack frame for ftrace_caller to contain traced function
++ aghi %r15,-TRACED_FUNC_FRAME_SIZE
+ stg %r1,__SF_BACKCHAIN(%r15)
++ stg %r0,(__SF_GPRS+8*8)(%r15)
++ stg %r15,(__SF_GPRS+9*8)(%r15)
++ # allocate pt_regs and stack frame for ftrace_trace_function
++ aghi %r15,-STACK_FRAME_SIZE
+ stg %r1,(STACK_PTREGS_GPRS+15*8)(%r15)
++ aghi %r1,-TRACED_FUNC_FRAME_SIZE
++ stg %r1,__SF_BACKCHAIN(%r15)
+ stg %r0,(STACK_PTREGS_PSW+8)(%r15)
+ stmg %r2,%r14,(STACK_PTREGS_GPRS+2*8)(%r15)
+ #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
+--
+2.20.1
+
--- /dev/null
+From bddfed102cbf2b19f0d9379d9e2e7aa24fb442e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 09:16:59 +0100
+Subject: s390/pci: Fix possible deadlock in recover_store()
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 576c75e36c689bec6a940e807bae27291ab0c0de ]
+
+With zpci_disable() working, lockdep detected a potential deadlock
+(lockdep output at the end).
+
+The deadlock is between recovering a PCI function via the
+
+/sys/bus/pci/devices/<dev>/recover
+
+attribute vs powering it off via
+
+/sys/bus/pci/slots/<slot>/power.
+
+The fix is analogous to the changes in commit 0ee223b2e1f6 ("scsi: core:
+Avoid that SCSI device removal through sysfs triggers a deadlock")
+that fixed a potential deadlock on removing a SCSI device via sysfs.
+
+[ 204.830107] ======================================================
+[ 204.830109] WARNING: possible circular locking dependency detected
+[ 204.830111] 5.5.0-rc2-06072-gbc03ecc9a672 #6 Tainted: G W
+[ 204.830112] ------------------------------------------------------
+[ 204.830113] bash/1034 is trying to acquire lock:
+[ 204.830115] 0000000192a1a610 (kn->count#200){++++}, at: kernfs_remove_by_name_ns+0x5c/0xa8
+[ 204.830122]
+ but task is already holding lock:
+[ 204.830123] 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48
+[ 204.830128]
+ which lock already depends on the new lock.
+
+[ 204.830129]
+ the existing dependency chain (in reverse order) is:
+[ 204.830130]
+ -> #1 (pci_rescan_remove_lock){+.+.}:
+[ 204.830134] validate_chain+0x93a/0xd08
+[ 204.830136] __lock_acquire+0x4ae/0x9d0
+[ 204.830137] lock_acquire+0x114/0x280
+[ 204.830140] __mutex_lock+0xa2/0x960
+[ 204.830142] mutex_lock_nested+0x32/0x40
+[ 204.830145] recover_store+0x4c/0xa8
+[ 204.830147] kernfs_fop_write+0xe6/0x218
+[ 204.830151] vfs_write+0xb0/0x1b8
+[ 204.830152] ksys_write+0x6c/0xf8
+[ 204.830154] system_call+0xd8/0x2d8
+[ 204.830155]
+ -> #0 (kn->count#200){++++}:
+[ 204.830187] check_noncircular+0x1e6/0x240
+[ 204.830189] check_prev_add+0xfc/0xdb0
+[ 204.830190] validate_chain+0x93a/0xd08
+[ 204.830192] __lock_acquire+0x4ae/0x9d0
+[ 204.830193] lock_acquire+0x114/0x280
+[ 204.830194] __kernfs_remove.part.0+0x2e4/0x360
+[ 204.830196] kernfs_remove_by_name_ns+0x5c/0xa8
+[ 204.830198] remove_files.isra.0+0x4c/0x98
+[ 204.830199] sysfs_remove_group+0x66/0xc8
+[ 204.830201] sysfs_remove_groups+0x46/0x68
+[ 204.830204] device_remove_attrs+0x52/0x90
+[ 204.830207] device_del+0x182/0x418
+[ 204.830208] pci_remove_bus_device+0x8a/0x130
+[ 204.830210] pci_stop_and_remove_bus_device_locked+0x3a/0x48
+[ 204.830212] disable_slot+0x68/0x100
+[ 204.830213] power_write_file+0x7c/0x130
+[ 204.830215] kernfs_fop_write+0xe6/0x218
+[ 204.830217] vfs_write+0xb0/0x1b8
+[ 204.830218] ksys_write+0x6c/0xf8
+[ 204.830220] system_call+0xd8/0x2d8
+[ 204.830221]
+ other info that might help us debug this:
+
+[ 204.830223] Possible unsafe locking scenario:
+
+[ 204.830224] CPU0 CPU1
+[ 204.830225] ---- ----
+[ 204.830226] lock(pci_rescan_remove_lock);
+[ 204.830227] lock(kn->count#200);
+[ 204.830229] lock(pci_rescan_remove_lock);
+[ 204.830231] lock(kn->count#200);
+[ 204.830233]
+ *** DEADLOCK ***
+
+[ 204.830234] 4 locks held by bash/1034:
+[ 204.830235] #0: 00000001b6fbc498 (sb_writers#4){.+.+}, at: vfs_write+0x158/0x1b8
+[ 204.830239] #1: 000000018c9f5090 (&of->mutex){+.+.}, at: kernfs_fop_write+0xaa/0x218
+[ 204.830242] #2: 00000001f7da0810 (kn->count#235){.+.+}, at: kernfs_fop_write+0xb6/0x218
+[ 204.830245] #3: 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48
+[ 204.830248]
+ stack backtrace:
+[ 204.830250] CPU: 2 PID: 1034 Comm: bash Tainted: G W 5.5.0-rc2-06072-gbc03ecc9a672 #6
+[ 204.830252] Hardware name: IBM 8561 T01 703 (LPAR)
+[ 204.830253] Call Trace:
+[ 204.830257] [<00000000c05e10c0>] show_stack+0x88/0xf0
+[ 204.830260] [<00000000c112dca4>] dump_stack+0xa4/0xe0
+[ 204.830261] [<00000000c0694c06>] check_noncircular+0x1e6/0x240
+[ 204.830263] [<00000000c0695bec>] check_prev_add+0xfc/0xdb0
+[ 204.830264] [<00000000c06971da>] validate_chain+0x93a/0xd08
+[ 204.830266] [<00000000c06994c6>] __lock_acquire+0x4ae/0x9d0
+[ 204.830267] [<00000000c069867c>] lock_acquire+0x114/0x280
+[ 204.830269] [<00000000c09ca15c>] __kernfs_remove.part.0+0x2e4/0x360
+[ 204.830270] [<00000000c09cb5c4>] kernfs_remove_by_name_ns+0x5c/0xa8
+[ 204.830272] [<00000000c09cee14>] remove_files.isra.0+0x4c/0x98
+[ 204.830274] [<00000000c09cf2ae>] sysfs_remove_group+0x66/0xc8
+[ 204.830276] [<00000000c09cf356>] sysfs_remove_groups+0x46/0x68
+[ 204.830278] [<00000000c0e3dfe2>] device_remove_attrs+0x52/0x90
+[ 204.830280] [<00000000c0e40382>] device_del+0x182/0x418
+[ 204.830281] [<00000000c0dcfd7a>] pci_remove_bus_device+0x8a/0x130
+[ 204.830283] [<00000000c0dcfe92>] pci_stop_and_remove_bus_device_locked+0x3a/0x48
+[ 204.830285] [<00000000c0de7190>] disable_slot+0x68/0x100
+[ 204.830286] [<00000000c0de6514>] power_write_file+0x7c/0x130
+[ 204.830288] [<00000000c09cc846>] kernfs_fop_write+0xe6/0x218
+[ 204.830290] [<00000000c08f3480>] vfs_write+0xb0/0x1b8
+[ 204.830291] [<00000000c08f378c>] ksys_write+0x6c/0xf8
+[ 204.830293] [<00000000c1154374>] system_call+0xd8/0x2d8
+[ 204.830294] INFO: lockdep is turned off.
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_sysfs.c | 63 ++++++++++++++++++++++++++-------------
+ 1 file changed, 42 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
+index a433ba01a3175..215f17437a4f6 100644
+--- a/arch/s390/pci/pci_sysfs.c
++++ b/arch/s390/pci/pci_sysfs.c
+@@ -13,6 +13,8 @@
+ #include <linux/stat.h>
+ #include <linux/pci.h>
+
++#include "../../../drivers/pci/pci.h"
++
+ #include <asm/sclp.h>
+
+ #define zpci_attr(name, fmt, member) \
+@@ -49,31 +51,50 @@ static DEVICE_ATTR_RO(mio_enabled);
+ static ssize_t recover_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
++ struct kernfs_node *kn;
+ struct pci_dev *pdev = to_pci_dev(dev);
+ struct zpci_dev *zdev = to_zpci(pdev);
+- int ret;
+-
+- if (!device_remove_file_self(dev, attr))
+- return count;
+-
++ int ret = 0;
++
++ /* Can't use device_remove_self() here as that would lead us to lock
++ * the pci_rescan_remove_lock while holding the device' kernfs lock.
++ * This would create a possible deadlock with disable_slot() which is
++ * not directly protected by the device' kernfs lock but takes it
++ * during the device removal which happens under
++ * pci_rescan_remove_lock.
++ *
++ * This is analogous to sdev_store_delete() in
++ * drivers/scsi/scsi_sysfs.c
++ */
++ kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
++ WARN_ON_ONCE(!kn);
++ /* device_remove_file() serializes concurrent calls ignoring all but
++ * the first
++ */
++ device_remove_file(dev, attr);
++
++ /* A concurrent call to recover_store() may slip between
++ * sysfs_break_active_protection() and the sysfs file removal.
++ * Once it unblocks from pci_lock_rescan_remove() the original pdev
++ * will already be removed.
++ */
+ pci_lock_rescan_remove();
+- pci_stop_and_remove_bus_device(pdev);
+- ret = zpci_disable_device(zdev);
+- if (ret)
+- goto error;
+-
+- ret = zpci_enable_device(zdev);
+- if (ret)
+- goto error;
+-
+- pci_rescan_bus(zdev->bus);
++ if (pci_dev_is_added(pdev)) {
++ pci_stop_and_remove_bus_device(pdev);
++ ret = zpci_disable_device(zdev);
++ if (ret)
++ goto out;
++
++ ret = zpci_enable_device(zdev);
++ if (ret)
++ goto out;
++ pci_rescan_bus(zdev->bus);
++ }
++out:
+ pci_unlock_rescan_remove();
+-
+- return count;
+-
+-error:
+- pci_unlock_rescan_remove();
+- return ret;
++ if (kn)
++ sysfs_unbreak_active_protection(kn);
++ return ret ? ret : count;
+ }
+ static DEVICE_ATTR_WO(recover);
+
+--
+2.20.1
+
--- /dev/null
+From f229e817225d7cec6422c264739f8032cc655285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 09:34:46 +0100
+Subject: s390/pci: Recover handle in clp_set_pci_fn()
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 17cdec960cf776b20b1fb08c622221babe591d51 ]
+
+When we try to recover a PCI function using
+
+ echo 1 > /sys/bus/pci/devices/<id>/recover
+
+or manually with
+
+ echo 1 > /sys/bus/pci/devices/<id>/remove
+ echo 0 > /sys/bus/pci/slots/<slot>/power
+ echo 1 > /sys/bus/pci/slots/<slot>/power
+
+clp_disable_fn() / clp_enable_fn() call clp_set_pci_fn() to first
+disable and then reenable the function.
+
+When the function is already in the requested state we may be left with
+an invalid function handle.
+
+To get a new valid handle we do a clp_list_pci() call. For this we need
+both the function ID and function handle in clp_set_pci_fn() so pass the
+zdev and get both.
+
+To simplify things also pull setting the refreshed function handle into
+clp_set_pci_fn()
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/pci.h | 2 +-
+ arch/s390/pci/pci.c | 2 +-
+ arch/s390/pci/pci_clp.c | 48 ++++++++++++++++++++++---------------
+ 3 files changed, 31 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
+index a2399eff84ca4..6087a4e9b2bfa 100644
+--- a/arch/s390/include/asm/pci.h
++++ b/arch/s390/include/asm/pci.h
+@@ -183,7 +183,7 @@ void zpci_remove_reserved_devices(void);
+ /* CLP */
+ int clp_scan_pci_devices(void);
+ int clp_rescan_pci_devices(void);
+-int clp_rescan_pci_devices_simple(void);
++int clp_rescan_pci_devices_simple(u32 *fid);
+ int clp_add_pci_device(u32, u32, int);
+ int clp_enable_fh(struct zpci_dev *, u8);
+ int clp_disable_fh(struct zpci_dev *);
+diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
+index c7fea9bea8cb5..5b24fcc9c361d 100644
+--- a/arch/s390/pci/pci.c
++++ b/arch/s390/pci/pci.c
+@@ -934,5 +934,5 @@ subsys_initcall_sync(pci_base_init);
+ void zpci_rescan(void)
+ {
+ if (zpci_is_enabled())
+- clp_rescan_pci_devices_simple();
++ clp_rescan_pci_devices_simple(NULL);
+ }
+diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
+index e585a62d65300..281e0dd4c614e 100644
+--- a/arch/s390/pci/pci_clp.c
++++ b/arch/s390/pci/pci_clp.c
+@@ -240,12 +240,14 @@ error:
+ }
+
+ /*
+- * Enable/Disable a given PCI function defined by its function handle.
++ * Enable/Disable a given PCI function and update its function handle if
++ * necessary
+ */
+-static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
++static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command)
+ {
+ struct clp_req_rsp_set_pci *rrb;
+ int rc, retries = 100;
++ u32 fid = zdev->fid;
+
+ rrb = clp_alloc_block(GFP_KERNEL);
+ if (!rrb)
+@@ -256,7 +258,7 @@ static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
+ rrb->request.hdr.len = sizeof(rrb->request);
+ rrb->request.hdr.cmd = CLP_SET_PCI_FN;
+ rrb->response.hdr.len = sizeof(rrb->response);
+- rrb->request.fh = *fh;
++ rrb->request.fh = zdev->fh;
+ rrb->request.oc = command;
+ rrb->request.ndas = nr_dma_as;
+
+@@ -269,12 +271,17 @@ static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
+ }
+ } while (rrb->response.hdr.rsp == CLP_RC_SETPCIFN_BUSY);
+
+- if (!rc && rrb->response.hdr.rsp == CLP_RC_OK)
+- *fh = rrb->response.fh;
+- else {
++ if (rc || rrb->response.hdr.rsp != CLP_RC_OK) {
+ zpci_err("Set PCI FN:\n");
+ zpci_err_clp(rrb->response.hdr.rsp, rc);
+- rc = -EIO;
++ }
++
++ if (!rc && rrb->response.hdr.rsp == CLP_RC_OK) {
++ zdev->fh = rrb->response.fh;
++ } else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY &&
++ rrb->response.fh == 0) {
++ /* Function is already in desired state - update handle */
++ rc = clp_rescan_pci_devices_simple(&fid);
+ }
+ clp_free_block(rrb);
+ return rc;
+@@ -282,18 +289,17 @@ static int clp_set_pci_fn(u32 *fh, u8 nr_dma_as, u8 command)
+
+ int clp_enable_fh(struct zpci_dev *zdev, u8 nr_dma_as)
+ {
+- u32 fh = zdev->fh;
+ int rc;
+
+- rc = clp_set_pci_fn(&fh, nr_dma_as, CLP_SET_ENABLE_PCI_FN);
+- zpci_dbg(3, "ena fid:%x, fh:%x, rc:%d\n", zdev->fid, fh, rc);
++ rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_PCI_FN);
++ zpci_dbg(3, "ena fid:%x, fh:%x, rc:%d\n", zdev->fid, zdev->fh, rc);
+ if (rc)
+ goto out;
+
+- zdev->fh = fh;
+ if (zpci_use_mio(zdev)) {
+- rc = clp_set_pci_fn(&fh, nr_dma_as, CLP_SET_ENABLE_MIO);
+- zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n", zdev->fid, fh, rc);
++ rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_MIO);
++ zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n",
++ zdev->fid, zdev->fh, rc);
+ if (rc)
+ clp_disable_fh(zdev);
+ }
+@@ -309,11 +315,8 @@ int clp_disable_fh(struct zpci_dev *zdev)
+ if (!zdev_enabled(zdev))
+ return 0;
+
+- rc = clp_set_pci_fn(&fh, 0, CLP_SET_DISABLE_PCI_FN);
++ rc = clp_set_pci_fn(zdev, 0, CLP_SET_DISABLE_PCI_FN);
+ zpci_dbg(3, "dis fid:%x, fh:%x, rc:%d\n", zdev->fid, fh, rc);
+- if (!rc)
+- zdev->fh = fh;
+-
+ return rc;
+ }
+
+@@ -370,10 +373,14 @@ static void __clp_add(struct clp_fh_list_entry *entry, void *data)
+ static void __clp_update(struct clp_fh_list_entry *entry, void *data)
+ {
+ struct zpci_dev *zdev;
++ u32 *fid = data;
+
+ if (!entry->vendor_id)
+ return;
+
++ if (fid && *fid != entry->fid)
++ return;
++
+ zdev = get_zdev_by_fid(entry->fid);
+ if (!zdev)
+ return;
+@@ -413,7 +420,10 @@ int clp_rescan_pci_devices(void)
+ return rc;
+ }
+
+-int clp_rescan_pci_devices_simple(void)
++/* Rescan PCI functions and refresh function handles. If fid is non-NULL only
++ * refresh the handle of the function matching @fid
++ */
++int clp_rescan_pci_devices_simple(u32 *fid)
+ {
+ struct clp_req_rsp_list_pci *rrb;
+ int rc;
+@@ -422,7 +432,7 @@ int clp_rescan_pci_devices_simple(void)
+ if (!rrb)
+ return -ENOMEM;
+
+- rc = clp_list_pci(rrb, NULL, __clp_update);
++ rc = clp_list_pci(rrb, fid, __clp_update);
+
+ clp_free_block(rrb);
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 32e4693ce61166c4af839b2e9928c7f1f8b66e8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:38:19 +0100
+Subject: samples/bpf: Set -fno-stack-protector when building BPF programs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 450278977acbf494a20367c22fbb38729772d1fc ]
+
+It seems Clang can in some cases turn on stack protection by default, which
+doesn't work with BPF. This was reported once before[0], but it seems the
+flag to explicitly turn off the stack protector wasn't added to the
+Makefile, so do that now.
+
+The symptom of this is compile errors like the following:
+
+error: <unknown>:0:0: in function bpf_prog1 i32 (%struct.__sk_buff*): A call to built-in function '__stack_chk_fail' is not supported.
+
+[0] https://www.spinics.net/lists/netdev/msg556400.html
+
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Link: https://lore.kernel.org/bpf/20191216103819.359535-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index e7ad48c605e0f..6d1df7117e117 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -219,6 +219,7 @@ BTF_LLVM_PROBE := $(shell echo "int main() { return 0; }" | \
+ readelf -S ./llvm_btf_verify.o | grep BTF; \
+ /bin/rm -f ./llvm_btf_verify.o)
+
++BPF_EXTRA_CFLAGS += -fno-stack-protector
+ ifneq ($(BTF_LLVM_PROBE),)
+ EXTRA_CFLAGS += -g
+ else
+--
+2.20.1
+
--- /dev/null
+From 0f05ff60e5f4ada6a7c2c64a1ca3a3e02df8fbff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Dec 2019 15:44:04 +0800
+Subject: sched/core: Fix size of rq::uclamp initialization
+
+From: Li Guanglei <guanglei.li@unisoc.com>
+
+[ Upstream commit dcd6dffb0a75741471297724640733fa4e958d72 ]
+
+rq::uclamp is an array of struct uclamp_rq, make sure we clear the
+whole thing.
+
+Fixes: 69842cba9ace ("sched/uclamp: Add CPU's clamp buckets refcountinga")
+Signed-off-by: Li Guanglei <guanglei.li@unisoc.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Qais Yousef <qais.yousef@arm.com>
+Link: https://lkml.kernel.org/r/1577259844-12677-1-git-send-email-guangleix.li@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index dfaefb175ba05..e6c65725b7ce0 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1252,7 +1252,8 @@ static void __init init_uclamp(void)
+ mutex_init(&uclamp_mutex);
+
+ for_each_possible_cpu(cpu) {
+- memset(&cpu_rq(cpu)->uclamp, 0, sizeof(struct uclamp_rq));
++ memset(&cpu_rq(cpu)->uclamp, 0,
++ sizeof(struct uclamp_rq)*UCLAMP_CNT);
+ cpu_rq(cpu)->uclamp_flags = 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 489f55de3c22c387a2bce6e91d397956db93422a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 16:09:15 +0000
+Subject: sched/topology: Assert non-NUMA topology masks don't (partially)
+ overlap
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Valentin Schneider <valentin.schneider@arm.com>
+
+[ Upstream commit ccf74128d66ce937876184ad55db2e0276af08d3 ]
+
+topology.c::get_group() relies on the assumption that non-NUMA domains do
+not partially overlap. Zeng Tao pointed out in [1] that such topology
+descriptions, while completely bogus, can end up being exposed to the
+scheduler.
+
+In his example (8 CPUs, 2-node system), we end up with:
+ MC span for CPU3 == 3-7
+ MC span for CPU4 == 4-7
+
+The first pass through get_group(3, sdd@MC) will result in the following
+sched_group list:
+
+ 3 -> 4 -> 5 -> 6 -> 7
+ ^ /
+ `----------------'
+
+And a later pass through get_group(4, sdd@MC) will "corrupt" that to:
+
+ 3 -> 4 -> 5 -> 6 -> 7
+ ^ /
+ `-----------'
+
+which will completely break things like 'while (sg != sd->groups)' when
+using CPU3's base sched_domain.
+
+There already are some architecture-specific checks in place such as
+x86/kernel/smpboot.c::topology.sane(), but this is something we can detect
+in the core scheduler, so it seems worthwhile to do so.
+
+Warn and abort the construction of the sched domains if such a broken
+topology description is detected. Note that this is somewhat
+expensive (O(t.c²), 't' non-NUMA topology levels and 'c' CPUs) and could be
+gated under SCHED_DEBUG if deemed necessary.
+
+Testing
+=======
+
+Dietmar managed to reproduce this using the following qemu incantation:
+
+ $ qemu-system-aarch64 -kernel ./Image -hda ./qemu-image-aarch64.img \
+ -append 'root=/dev/vda console=ttyAMA0 loglevel=8 sched_debug' -smp \
+ cores=8 --nographic -m 512 -cpu cortex-a53 -machine virt -numa \
+ node,cpus=0-2,nodeid=0 -numa node,cpus=3-7,nodeid=1
+
+alongside the following drivers/base/arch_topology.c hack (AIUI wouldn't be
+needed if '-smp cores=X, sockets=Y' would work with qemu):
+
+8<---
+@@ -465,6 +465,9 @@ void update_siblings_masks(unsigned int cpuid)
+ if (cpuid_topo->package_id != cpu_topo->package_id)
+ continue;
+
++ if ((cpu < 4 && cpuid > 3) || (cpu > 3 && cpuid < 4))
++ continue;
++
+ cpumask_set_cpu(cpuid, &cpu_topo->core_sibling);
+ cpumask_set_cpu(cpu, &cpuid_topo->core_sibling);
+
+8<---
+
+[1]: https://lkml.kernel.org/r/1577088979-8545-1-git-send-email-prime.zeng@hisilicon.com
+
+Reported-by: Zeng Tao <prime.zeng@hisilicon.com>
+Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20200115160915.22575-1-valentin.schneider@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/topology.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
+index 49b835f1305f8..1fa1e13a59446 100644
+--- a/kernel/sched/topology.c
++++ b/kernel/sched/topology.c
+@@ -1882,6 +1882,42 @@ static struct sched_domain *build_sched_domain(struct sched_domain_topology_leve
+ return sd;
+ }
+
++/*
++ * Ensure topology masks are sane, i.e. there are no conflicts (overlaps) for
++ * any two given CPUs at this (non-NUMA) topology level.
++ */
++static bool topology_span_sane(struct sched_domain_topology_level *tl,
++ const struct cpumask *cpu_map, int cpu)
++{
++ int i;
++
++ /* NUMA levels are allowed to overlap */
++ if (tl->flags & SDTL_OVERLAP)
++ return true;
++
++ /*
++ * Non-NUMA levels cannot partially overlap - they must be either
++ * completely equal or completely disjoint. Otherwise we can end up
++ * breaking the sched_group lists - i.e. a later get_group() pass
++ * breaks the linking done for an earlier span.
++ */
++ for_each_cpu(i, cpu_map) {
++ if (i == cpu)
++ continue;
++ /*
++ * We should 'and' all those masks with 'cpu_map' to exactly
++ * match the topology we're about to build, but that can only
++ * remove CPUs, which only lessens our ability to detect
++ * overlaps
++ */
++ if (!cpumask_equal(tl->mask(cpu), tl->mask(i)) &&
++ cpumask_intersects(tl->mask(cpu), tl->mask(i)))
++ return false;
++ }
++
++ return true;
++}
++
+ /*
+ * Find the sched_domain_topology_level where all CPU capacities are visible
+ * for all CPUs.
+@@ -1978,6 +2014,9 @@ build_sched_domains(const struct cpumask *cpu_map, struct sched_domain_attr *att
+ has_asym = true;
+ }
+
++ if (WARN_ON(!topology_span_sane(tl, cpu_map, i)))
++ goto error;
++
+ sd = build_sched_domain(tl, cpu_map, attr, sd, dflags, i);
+
+ if (tl == sched_domain_topology)
+--
+2.20.1
+
--- /dev/null
+From 40e18af225e632c1564cb1ff7d47feb2155b2509 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:42:20 -0700
+Subject: scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4dbc96ad65c45cdd4e895ed7ae4c151b780790c5 ]
+
+Clang warns:
+
+../drivers/scsi/aic7xxx/aic7xxx_core.c:2317:5: warning: misleading
+indentation; statement is not part of the previous 'if'
+[-Wmisleading-indentation]
+ if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
+ ^
+../drivers/scsi/aic7xxx/aic7xxx_core.c:2310:4: note: previous statement
+is here
+ if (syncrate == &ahc_syncrates[maxsync])
+ ^
+1 warning generated.
+
+This warning occurs because there is a space amongst the tabs on this
+line. Remove it so that the indentation is consistent with the Linux kernel
+coding style and clang no longer warns.
+
+This has been a problem since the beginning of git history hence no fixes
+tag.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/817
+Link: https://lore.kernel.org/r/20191218014220.52746-1-natechancellor@gmail.com
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/aic7xxx/aic7xxx_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
+index a9d40d3b90efc..4190a025381a5 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
++++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
+@@ -2314,7 +2314,7 @@ ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
+ * At some speeds, we only support
+ * ST transfers.
+ */
+- if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
++ if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
+ *ppr_options &= ~MSG_EXT_PPR_DT_REQ;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 08b223bcb1200113fc3aa841ad91ed670469dfee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 15:31:48 -0500
+Subject: scsi: iscsi: Don't destroy session if there are outstanding
+ connections
+
+From: Nick Black <nlb@google.com>
+
+[ Upstream commit 54155ed4199c7aa3fd20866648024ab63c96d579 ]
+
+A faulty userspace that calls destroy_session() before destroying the
+connections can trigger the failure. This patch prevents the issue by
+refusing to destroy the session if there are outstanding connections.
+
+------------[ cut here ]------------
+kernel BUG at mm/slub.c:306!
+invalid opcode: 0000 [#1] SMP PTI
+CPU: 1 PID: 1224 Comm: iscsid Not tainted 5.4.0-rc2.iscsi+ #7
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
+RIP: 0010:__slab_free+0x181/0x350
+[...]
+[ 1209.686056] RSP: 0018:ffffa93d4074fae0 EFLAGS: 00010246
+[ 1209.686694] RAX: ffff934efa5ad800 RBX: 000000008010000a RCX: ffff934efa5ad800
+[ 1209.687651] RDX: ffff934efa5ad800 RSI: ffffeb4041e96b00 RDI: ffff934efd402c40
+[ 1209.688582] RBP: ffffa93d4074fb80 R08: 0000000000000001 R09: ffffffffbb5dfa26
+[ 1209.689425] R10: ffff934efa5ad800 R11: 0000000000000001 R12: ffffeb4041e96b00
+[ 1209.690285] R13: ffff934efa5ad800 R14: ffff934efd402c40 R15: 0000000000000000
+[ 1209.691213] FS: 00007f7945dfb540(0000) GS:ffff934efda80000(0000) knlGS:0000000000000000
+[ 1209.692316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1209.693013] CR2: 000055877fd3da80 CR3: 0000000077384000 CR4: 00000000000006e0
+[ 1209.693897] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1209.694773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 1209.695631] Call Trace:
+[ 1209.695957] ? __wake_up_common_lock+0x8a/0xc0
+[ 1209.696712] iscsi_pool_free+0x26/0x40
+[ 1209.697263] iscsi_session_teardown+0x2f/0xf0
+[ 1209.698117] iscsi_sw_tcp_session_destroy+0x45/0x60
+[ 1209.698831] iscsi_if_rx+0xd88/0x14e0
+[ 1209.699370] netlink_unicast+0x16f/0x200
+[ 1209.699932] netlink_sendmsg+0x21a/0x3e0
+[ 1209.700446] sock_sendmsg+0x4f/0x60
+[ 1209.700902] ___sys_sendmsg+0x2ae/0x320
+[ 1209.701451] ? cp_new_stat+0x150/0x180
+[ 1209.701922] __sys_sendmsg+0x59/0xa0
+[ 1209.702357] do_syscall_64+0x52/0x160
+[ 1209.702812] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 1209.703419] RIP: 0033:0x7f7946433914
+[...]
+[ 1209.706084] RSP: 002b:00007fffb99f2378 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 1209.706994] RAX: ffffffffffffffda RBX: 000055bc869eac20 RCX: 00007f7946433914
+[ 1209.708082] RDX: 0000000000000000 RSI: 00007fffb99f2390 RDI: 0000000000000005
+[ 1209.709120] RBP: 00007fffb99f2390 R08: 000055bc84fe9320 R09: 00007fffb99f1f07
+[ 1209.710110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000038
+[ 1209.711085] R13: 000055bc8502306e R14: 0000000000000000 R15: 0000000000000000
+ Modules linked in:
+ ---[ end trace a2d933ede7f730d8 ]---
+
+Link: https://lore.kernel.org/r/20191226203148.2172200-1-krisman@collabora.com
+Signed-off-by: Nick Black <nlb@google.com>
+Co-developed-by: Salman Qazi <sqazi@google.com>
+Signed-off-by: Salman Qazi <sqazi@google.com>
+Co-developed-by: Junho Ryu <jayr@google.com>
+Signed-off-by: Junho Ryu <jayr@google.com>
+Co-developed-by: Khazhismel Kumykov <khazhy@google.com>
+Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
+Co-developed-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/iscsi_tcp.c | 4 ++++
+ drivers/scsi/scsi_transport_iscsi.c | 26 +++++++++++++++++++++++---
+ 2 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 0bc63a7ab41c8..b5dd1caae5e92 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -887,6 +887,10 @@ free_host:
+ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session)
+ {
+ struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
++ struct iscsi_session *session = cls_session->dd_data;
++
++ if (WARN_ON_ONCE(session->leadconn))
++ return;
+
+ iscsi_tcp_r2tpool_free(cls_session->dd_data);
+ iscsi_session_teardown(cls_session);
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index ed8d9709b9b96..271afea654e2b 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2947,6 +2947,24 @@ iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ return err;
+ }
+
++static int iscsi_session_has_conns(int sid)
++{
++ struct iscsi_cls_conn *conn;
++ unsigned long flags;
++ int found = 0;
++
++ spin_lock_irqsave(&connlock, flags);
++ list_for_each_entry(conn, &connlist, conn_list) {
++ if (iscsi_conn_get_sid(conn) == sid) {
++ found = 1;
++ break;
++ }
++ }
++ spin_unlock_irqrestore(&connlock, flags);
++
++ return found;
++}
++
+ static int
+ iscsi_set_iface_params(struct iscsi_transport *transport,
+ struct iscsi_uevent *ev, uint32_t len)
+@@ -3524,10 +3542,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ break;
+ case ISCSI_UEVENT_DESTROY_SESSION:
+ session = iscsi_session_lookup(ev->u.d_session.sid);
+- if (session)
+- transport->destroy_session(session);
+- else
++ if (!session)
+ err = -EINVAL;
++ else if (iscsi_session_has_conns(ev->u.d_session.sid))
++ err = -EBUSY;
++ else
++ transport->destroy_session(session);
+ break;
+ case ISCSI_UEVENT_UNBIND_SESSION:
+ session = iscsi_session_lookup(ev->u.d_session.sid);
+--
+2.20.1
+
--- /dev/null
+From a929f9646af9d16df180a74fd808cf1f66b96e60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 15:58:00 -0800
+Subject: scsi: lpfc: Fix: Rework setting of fdmi symbolic node name
+ registration
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit df9166bfa7750bade5737ffc91fbd432e0354442 ]
+
+This patch reworks the fdmi symbolic node name data for the following two
+issues:
+
+ - Correcting extraneous periods following the DV and HN fdmi data fields.
+
+ - Avoiding buffer overflow issues when formatting the data.
+
+The fix to the fist issue is to just remove the characters.
+
+The fix to the second issue has all data being staged in temporary storage
+before being moved to the real buffer.
+
+Link: https://lore.kernel.org/r/20191218235808.31922-3-jsmart2021@gmail.com
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_ct.c | 42 +++++++++++++++++++------------------
+ 1 file changed, 22 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index f883fac2d2b1d..f81d1453eefbd 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -1477,33 +1477,35 @@ int
+ lpfc_vport_symbolic_node_name(struct lpfc_vport *vport, char *symbol,
+ size_t size)
+ {
+- char fwrev[FW_REV_STR_SIZE];
+- int n;
++ char fwrev[FW_REV_STR_SIZE] = {0};
++ char tmp[MAXHOSTNAMELEN] = {0};
+
+- lpfc_decode_firmware_rev(vport->phba, fwrev, 0);
++ memset(symbol, 0, size);
+
+- n = scnprintf(symbol, size, "Emulex %s", vport->phba->ModelName);
+- if (size < n)
+- return n;
++ scnprintf(tmp, sizeof(tmp), "Emulex %s", vport->phba->ModelName);
++ if (strlcat(symbol, tmp, size) >= size)
++ goto buffer_done;
+
+- n += scnprintf(symbol + n, size - n, " FV%s", fwrev);
+- if (size < n)
+- return n;
++ lpfc_decode_firmware_rev(vport->phba, fwrev, 0);
++ scnprintf(tmp, sizeof(tmp), " FV%s", fwrev);
++ if (strlcat(symbol, tmp, size) >= size)
++ goto buffer_done;
+
+- n += scnprintf(symbol + n, size - n, " DV%s.",
+- lpfc_release_version);
+- if (size < n)
+- return n;
++ scnprintf(tmp, sizeof(tmp), " DV%s", lpfc_release_version);
++ if (strlcat(symbol, tmp, size) >= size)
++ goto buffer_done;
+
+- n += scnprintf(symbol + n, size - n, " HN:%s.",
+- init_utsname()->nodename);
+- if (size < n)
+- return n;
++ scnprintf(tmp, sizeof(tmp), " HN:%s", init_utsname()->nodename);
++ if (strlcat(symbol, tmp, size) >= size)
++ goto buffer_done;
+
+ /* Note :- OS name is "Linux" */
+- n += scnprintf(symbol + n, size - n, " OS:%s",
+- init_utsname()->sysname);
+- return n;
++ scnprintf(tmp, sizeof(tmp), " OS:%s", init_utsname()->sysname);
++ strlcat(symbol, tmp, size);
++
++buffer_done:
++ return strnlen(symbol, size);
++
+ }
+
+ static uint32_t
+--
+2.20.1
+
--- /dev/null
+From 916930ec7d45f971a1d9b569c33a007b0cbe326b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 22:53:33 -0800
+Subject: scsi: ufs: Complete pending requests in host reset and restore path
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 2df74b6985b51e77756e2e8faa16c45ca3ba53c5 ]
+
+In UFS host reset and restore path, before probe, we stop and start the
+host controller once. After host controller is stopped, the pending
+requests, if any, are cleared from the doorbell, but no completion IRQ
+would be raised due to the hba is stopped. These pending requests shall be
+completed along with the first NOP_OUT command (as it is the first command
+which can raise a transfer completion IRQ) sent during probe. Since the
+OCSs of these pending requests are not SUCCESS (because they are not yet
+literally finished), their UPIUs shall be dumped. When there are multiple
+pending requests, the UPIU dump can be overwhelming and may lead to
+stability issues because it is in atomic context. Therefore, before probe,
+complete these pending requests right after host controller is stopped and
+silence the UPIU dump from them.
+
+Link: https://lore.kernel.org/r/1574751214-8321-5-git-send-email-cang@qti.qualcomm.com
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Tested-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 24 ++++++++++--------------
+ drivers/scsi/ufs/ufshcd.h | 2 ++
+ 2 files changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index b0d6978d78bf8..6b5ec4bbcdb02 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4788,7 +4788,7 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ break;
+ } /* end of switch */
+
+- if (host_byte(result) != DID_OK)
++ if ((host_byte(result) != DID_OK) && !hba->silence_err_logs)
+ ufshcd_print_trs(hba, 1 << lrbp->task_tag, true);
+ return result;
+ }
+@@ -5321,8 +5321,8 @@ static void ufshcd_err_handler(struct work_struct *work)
+
+ /*
+ * if host reset is required then skip clearing the pending
+- * transfers forcefully because they will automatically get
+- * cleared after link startup.
++ * transfers forcefully because they will get cleared during
++ * host reset and restore
+ */
+ if (needs_reset)
+ goto skip_pending_xfer_clear;
+@@ -6205,9 +6205,15 @@ static int ufshcd_host_reset_and_restore(struct ufs_hba *hba)
+ int err;
+ unsigned long flags;
+
+- /* Reset the host controller */
++ /*
++ * Stop the host controller and complete the requests
++ * cleared by h/w
++ */
+ spin_lock_irqsave(hba->host->host_lock, flags);
+ ufshcd_hba_stop(hba, false);
++ hba->silence_err_logs = true;
++ ufshcd_complete_requests(hba);
++ hba->silence_err_logs = false;
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+ /* scale up clocks to max frequency before full reinitialization */
+@@ -6241,7 +6247,6 @@ out:
+ static int ufshcd_reset_and_restore(struct ufs_hba *hba)
+ {
+ int err = 0;
+- unsigned long flags;
+ int retries = MAX_HOST_RESET_RETRIES;
+
+ do {
+@@ -6251,15 +6256,6 @@ static int ufshcd_reset_and_restore(struct ufs_hba *hba)
+ err = ufshcd_host_reset_and_restore(hba);
+ } while (err && --retries);
+
+- /*
+- * After reset the door-bell might be cleared, complete
+- * outstanding requests in s/w here.
+- */
+- spin_lock_irqsave(hba->host->host_lock, flags);
+- ufshcd_transfer_req_compl(hba);
+- ufshcd_tmc_handler(hba);
+- spin_unlock_irqrestore(hba->host->host_lock, flags);
+-
+ return err;
+ }
+
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 52c9676a12425..089013b758a19 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -513,6 +513,7 @@ struct ufs_stats {
+ * @uic_error: UFS interconnect layer error status
+ * @saved_err: sticky error mask
+ * @saved_uic_err: sticky UIC error mask
++ * @silence_err_logs: flag to silence error logs
+ * @dev_cmd: ufs device management command information
+ * @last_dme_cmd_tstamp: time stamp of the last completed DME command
+ * @auto_bkops_enabled: to track whether bkops is enabled in device
+@@ -670,6 +671,7 @@ struct ufs_hba {
+ u32 saved_err;
+ u32 saved_uic_err;
+ struct ufs_stats ufs_stats;
++ bool silence_err_logs;
+
+ /* Device management request data */
+ struct ufs_dev_cmd dev_cmd;
+--
+2.20.1
+
--- /dev/null
+From b7f1b15112aaaf9d6fcbfd30eb02212f0aa03f56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 15:11:47 +0800
+Subject: scsi: ufs-mediatek: add apply_dev_quirks variant operation
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit ea92c32bd336efba89c5b09cf609e6e26e963796 ]
+
+Add vendor-specific variant callback "apply_dev_quirks" to MediaTek UFS
+driver.
+
+Cc: Alim Akhtar <alim.akhtar@samsung.com>
+Cc: Asutosh Das <asutoshd@codeaurora.org>
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Bean Huo <beanhuo@micron.com>
+Cc: Can Guo <cang@codeaurora.org>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/1578726707-6596-3-git-send-email-stanley.chu@mediatek.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-mediatek.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c
+index 0f6ff33ce52ee..d4a8be5ffd528 100644
+--- a/drivers/scsi/ufs/ufs-mediatek.c
++++ b/drivers/scsi/ufs/ufs-mediatek.c
+@@ -13,6 +13,7 @@
+
+ #include "ufshcd.h"
+ #include "ufshcd-pltfrm.h"
++#include "ufs_quirks.h"
+ #include "unipro.h"
+ #include "ufs-mediatek.h"
+
+@@ -286,6 +287,15 @@ static int ufs_mtk_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op)
+ return 0;
+ }
+
++static int ufs_mtk_apply_dev_quirks(struct ufs_hba *hba,
++ struct ufs_dev_desc *card)
++{
++ if (card->wmanufacturerid == UFS_VENDOR_SAMSUNG)
++ ufshcd_dme_set(hba, UIC_ARG_MIB(PA_TACTIVATE), 6);
++
++ return 0;
++}
++
+ /**
+ * struct ufs_hba_mtk_vops - UFS MTK specific variant operations
+ *
+@@ -298,6 +308,7 @@ static struct ufs_hba_variant_ops ufs_hba_mtk_vops = {
+ .setup_clocks = ufs_mtk_setup_clocks,
+ .link_startup_notify = ufs_mtk_link_startup_notify,
+ .pwr_change_notify = ufs_mtk_pwr_change_notify,
++ .apply_dev_quirks = ufs_mtk_apply_dev_quirks,
+ .suspend = ufs_mtk_suspend,
+ .resume = ufs_mtk_resume,
+ };
+--
+2.20.1
+
--- /dev/null
+From 3f06fe5e1ea7978d82bf464af29e8d63334926f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 15:11:46 +0800
+Subject: scsi: ufs: pass device information to apply_dev_quirks
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit c40ad6b7fcd35bc4d36db820c7737e1aa18d5d41 ]
+
+Pass UFS device information to vendor-specific variant callback
+"apply_dev_quirks" because some platform vendors need to know such
+information to apply special handling or quirks in specific devices.
+
+At the same time, modify existing vendor implementations according to the
+new interface for those vendor drivers which will be built-in or built as a
+module alone with UFS core driver.
+
+[mkp: clarified commit desc]
+
+Cc: Alim Akhtar <alim.akhtar@samsung.com>
+Cc: Asutosh Das <asutoshd@codeaurora.org>
+Cc: Avri Altman <avri.altman@wdc.com>
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Bean Huo <beanhuo@micron.com>
+Cc: Can Guo <cang@codeaurora.org>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Link: https://lore.kernel.org/r/1578726707-6596-2-git-send-email-stanley.chu@mediatek.com
+Reviewed-by: Avri Altman <avri.altman@wdc.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufs-qcom.c | 3 ++-
+ drivers/scsi/ufs/ufshcd.c | 8 ++++----
+ drivers/scsi/ufs/ufshcd.h | 7 ++++---
+ 3 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
+index a5b71487a2065..411ef60b2c145 100644
+--- a/drivers/scsi/ufs/ufs-qcom.c
++++ b/drivers/scsi/ufs/ufs-qcom.c
+@@ -905,7 +905,8 @@ out:
+ return err;
+ }
+
+-static int ufs_qcom_apply_dev_quirks(struct ufs_hba *hba)
++static int ufs_qcom_apply_dev_quirks(struct ufs_hba *hba,
++ struct ufs_dev_desc *card)
+ {
+ int err = 0;
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 6b5ec4bbcdb02..d9ea0ae4f374f 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6721,7 +6721,8 @@ out:
+ return ret;
+ }
+
+-static void ufshcd_tune_unipro_params(struct ufs_hba *hba)
++static void ufshcd_tune_unipro_params(struct ufs_hba *hba,
++ struct ufs_dev_desc *card)
+ {
+ if (ufshcd_is_unipro_pa_params_tuning_req(hba)) {
+ ufshcd_tune_pa_tactivate(hba);
+@@ -6735,7 +6736,7 @@ static void ufshcd_tune_unipro_params(struct ufs_hba *hba)
+ if (hba->dev_quirks & UFS_DEVICE_QUIRK_HOST_PA_TACTIVATE)
+ ufshcd_quirk_tune_host_pa_tactivate(hba);
+
+- ufshcd_vops_apply_dev_quirks(hba);
++ ufshcd_vops_apply_dev_quirks(hba, card);
+ }
+
+ static void ufshcd_clear_dbg_ufs_stats(struct ufs_hba *hba)
+@@ -6898,10 +6899,9 @@ static int ufshcd_probe_hba(struct ufs_hba *hba)
+ }
+
+ ufs_fixup_device_setup(hba, &card);
++ ufshcd_tune_unipro_params(hba, &card);
+ ufs_put_device_desc(&card);
+
+- ufshcd_tune_unipro_params(hba);
+-
+ /* UFS device is also active now */
+ ufshcd_set_ufs_dev_active(hba);
+ ufshcd_force_reset_auto_bkops(hba);
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 089013b758a19..5260e594e0b95 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -322,7 +322,7 @@ struct ufs_hba_variant_ops {
+ void (*setup_task_mgmt)(struct ufs_hba *, int, u8);
+ void (*hibern8_notify)(struct ufs_hba *, enum uic_cmd_dme,
+ enum ufs_notify_change_status);
+- int (*apply_dev_quirks)(struct ufs_hba *);
++ int (*apply_dev_quirks)(struct ufs_hba *, struct ufs_dev_desc *);
+ int (*suspend)(struct ufs_hba *, enum ufs_pm_op);
+ int (*resume)(struct ufs_hba *, enum ufs_pm_op);
+ void (*dbg_register_dump)(struct ufs_hba *hba);
+@@ -1047,10 +1047,11 @@ static inline void ufshcd_vops_hibern8_notify(struct ufs_hba *hba,
+ return hba->vops->hibern8_notify(hba, cmd, status);
+ }
+
+-static inline int ufshcd_vops_apply_dev_quirks(struct ufs_hba *hba)
++static inline int ufshcd_vops_apply_dev_quirks(struct ufs_hba *hba,
++ struct ufs_dev_desc *card)
+ {
+ if (hba->vops && hba->vops->apply_dev_quirks)
+- return hba->vops->apply_dev_quirks(hba);
++ return hba->vops->apply_dev_quirks(hba, card);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2827bdce44ef6ad039b0ce85803b6f97ad57a3d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 11:27:54 +0000
+Subject: selftests: bpf: Reset global state between reuseport test runs
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+[ Upstream commit 51bad0f05616c43d6d34b0a19bcc9bdab8e8fb39 ]
+
+Currently, there is a lot of false positives if a single reuseport test
+fails. This is because expected_results and the result map are not cleared.
+
+Zero both after individual test runs, which fixes the mentioned false
+positives.
+
+Fixes: 91134d849a0e ("bpf: Test BPF_PROG_TYPE_SK_REUSEPORT")
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200124112754.19664-5-lmb@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/test_select_reuseport.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_select_reuseport.c b/tools/testing/selftests/bpf/test_select_reuseport.c
+index 7566c13eb51a7..079d0f5a29091 100644
+--- a/tools/testing/selftests/bpf/test_select_reuseport.c
++++ b/tools/testing/selftests/bpf/test_select_reuseport.c
+@@ -30,7 +30,7 @@
+ #define REUSEPORT_ARRAY_SIZE 32
+
+ static int result_map, tmp_index_ovr_map, linum_map, data_check_map;
+-static enum result expected_results[NR_RESULTS];
++static __u32 expected_results[NR_RESULTS];
+ static int sk_fds[REUSEPORT_ARRAY_SIZE];
+ static int reuseport_array, outer_map;
+ static int select_by_skb_data_prog;
+@@ -662,7 +662,19 @@ static void setup_per_test(int type, unsigned short family, bool inany)
+
+ static void cleanup_per_test(void)
+ {
+- int i, err;
++ int i, err, zero = 0;
++
++ memset(expected_results, 0, sizeof(expected_results));
++
++ for (i = 0; i < NR_RESULTS; i++) {
++ err = bpf_map_update_elem(result_map, &i, &zero, BPF_ANY);
++ RET_IF(err, "reset elem in result_map",
++ "i:%u err:%d errno:%d\n", i, err, errno);
++ }
++
++ err = bpf_map_update_elem(linum_map, &zero, &zero, BPF_ANY);
++ RET_IF(err, "reset line number in linum_map", "err:%d errno:%d\n",
++ err, errno);
+
+ for (i = 0; i < REUSEPORT_ARRAY_SIZE; i++)
+ close(sk_fds[i]);
+--
+2.20.1
+
--- /dev/null
+From 2cc5fec30ed8d8c5340e6064ff20e5a1675bb6d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 14:11:25 +1100
+Subject: selftests/eeh: Bump EEH wait time to 60s
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 414f50434aa2463202a5b35e844f4125dd1a7101 ]
+
+Some newer cards supported by aacraid can take up to 40s to recover
+after an EEH event. This causes spurious failures in the basic EEH
+self-test since the current maximim timeout is only 30s.
+
+Fix the immediate issue by bumping the timeout to a default of 60s,
+and allow the wait time to be specified via an environmental variable
+(EEH_MAX_WAIT).
+
+Reported-by: Steve Best <sbest@redhat.com>
+Suggested-by: Douglas Miller <dougmill@us.ibm.com>
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200122031125.25991-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/eeh/eeh-functions.sh | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
+index 26112ab5cdf42..f52ed92b53e74 100755
+--- a/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
++++ b/tools/testing/selftests/powerpc/eeh/eeh-functions.sh
+@@ -53,9 +53,13 @@ eeh_one_dev() {
+ # is a no-op.
+ echo $dev >/sys/kernel/debug/powerpc/eeh_dev_check
+
+- # Enforce a 30s timeout for recovery. Even the IPR, which is infamously
+- # slow to reset, should recover within 30s.
+- max_wait=30
++ # Default to a 60s timeout when waiting for a device to recover. This
++ # is an arbitrary default which can be overridden by setting the
++ # EEH_MAX_WAIT environmental variable when required.
++
++ # The current record holder for longest recovery time is:
++ # "Adaptec Series 8 12G SAS/PCIe 3" at 39 seconds
++ max_wait=${EEH_MAX_WAIT:=60}
+
+ for i in `seq 0 ${max_wait}` ; do
+ if pe_ok $dev ; then
+--
+2.20.1
+
--- /dev/null
+From 1ac1b2ea899ff4adddc28fdc803ad251b9ed994d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:36:46 -0500
+Subject: selftests/net: make so_txtime more robust to timer variance
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit ea6a547669b37453f2b1a5d85188d75b3613dfaa ]
+
+The SO_TXTIME test depends on accurate timers. In some virtualized
+environments the test has been reported to be flaky. This is easily
+reproduced by disabling kvm acceleration in Qemu.
+
+Allow greater variance in a run and retry to further reduce flakiness.
+
+Observed errors are one of two kinds: either the packet arrives too
+early or late at recv(), or it was dropped in the qdisc itself and the
+recv() call times out.
+
+In the latter case, the qdisc queues a notification to the error
+queue of the send socket. Also explicitly report this cause.
+
+Link: https://lore.kernel.org/netdev/CA+FuTSdYOnJCsGuj43xwV1jxvYsaoa_LzHQF9qMyhrkLrivxKw@mail.gmail.com
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/so_txtime.c | 84 +++++++++++++++++++++++-
+ tools/testing/selftests/net/so_txtime.sh | 9 ++-
+ 2 files changed, 88 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/net/so_txtime.c b/tools/testing/selftests/net/so_txtime.c
+index 34df4c8882afb..383bac05ac324 100644
+--- a/tools/testing/selftests/net/so_txtime.c
++++ b/tools/testing/selftests/net/so_txtime.c
+@@ -12,7 +12,11 @@
+ #include <arpa/inet.h>
+ #include <error.h>
+ #include <errno.h>
++#include <inttypes.h>
+ #include <linux/net_tstamp.h>
++#include <linux/errqueue.h>
++#include <linux/ipv6.h>
++#include <linux/tcp.h>
+ #include <stdbool.h>
+ #include <stdlib.h>
+ #include <stdio.h>
+@@ -28,7 +32,7 @@ static int cfg_clockid = CLOCK_TAI;
+ static bool cfg_do_ipv4;
+ static bool cfg_do_ipv6;
+ static uint16_t cfg_port = 8000;
+-static int cfg_variance_us = 2000;
++static int cfg_variance_us = 4000;
+
+ static uint64_t glob_tstart;
+
+@@ -43,6 +47,9 @@ static struct timed_send cfg_in[MAX_NUM_PKT];
+ static struct timed_send cfg_out[MAX_NUM_PKT];
+ static int cfg_num_pkt;
+
++static int cfg_errq_level;
++static int cfg_errq_type;
++
+ static uint64_t gettime_ns(void)
+ {
+ struct timespec ts;
+@@ -90,13 +97,15 @@ static void do_send_one(int fdt, struct timed_send *ts)
+
+ }
+
+-static void do_recv_one(int fdr, struct timed_send *ts)
++static bool do_recv_one(int fdr, struct timed_send *ts)
+ {
+ int64_t tstop, texpect;
+ char rbuf[2];
+ int ret;
+
+ ret = recv(fdr, rbuf, sizeof(rbuf), 0);
++ if (ret == -1 && errno == EAGAIN)
++ return true;
+ if (ret == -1)
+ error(1, errno, "read");
+ if (ret != 1)
+@@ -113,6 +122,8 @@ static void do_recv_one(int fdr, struct timed_send *ts)
+
+ if (labs(tstop - texpect) > cfg_variance_us)
+ error(1, 0, "exceeds variance (%d us)", cfg_variance_us);
++
++ return false;
+ }
+
+ static void do_recv_verify_empty(int fdr)
+@@ -125,12 +136,70 @@ static void do_recv_verify_empty(int fdr)
+ error(1, 0, "recv: not empty as expected (%d, %d)", ret, errno);
+ }
+
++static void do_recv_errqueue_timeout(int fdt)
++{
++ char control[CMSG_SPACE(sizeof(struct sock_extended_err)) +
++ CMSG_SPACE(sizeof(struct sockaddr_in6))] = {0};
++ char data[sizeof(struct ipv6hdr) +
++ sizeof(struct tcphdr) + 1];
++ struct sock_extended_err *err;
++ struct msghdr msg = {0};
++ struct iovec iov = {0};
++ struct cmsghdr *cm;
++ int64_t tstamp = 0;
++ int ret;
++
++ iov.iov_base = data;
++ iov.iov_len = sizeof(data);
++
++ msg.msg_iov = &iov;
++ msg.msg_iovlen = 1;
++
++ msg.msg_control = control;
++ msg.msg_controllen = sizeof(control);
++
++ while (1) {
++ ret = recvmsg(fdt, &msg, MSG_ERRQUEUE);
++ if (ret == -1 && errno == EAGAIN)
++ break;
++ if (ret == -1)
++ error(1, errno, "errqueue");
++ if (msg.msg_flags != MSG_ERRQUEUE)
++ error(1, 0, "errqueue: flags 0x%x\n", msg.msg_flags);
++
++ cm = CMSG_FIRSTHDR(&msg);
++ if (cm->cmsg_level != cfg_errq_level ||
++ cm->cmsg_type != cfg_errq_type)
++ error(1, 0, "errqueue: type 0x%x.0x%x\n",
++ cm->cmsg_level, cm->cmsg_type);
++
++ err = (struct sock_extended_err *)CMSG_DATA(cm);
++ if (err->ee_origin != SO_EE_ORIGIN_TXTIME)
++ error(1, 0, "errqueue: origin 0x%x\n", err->ee_origin);
++ if (err->ee_code != ECANCELED)
++ error(1, 0, "errqueue: code 0x%x\n", err->ee_code);
++
++ tstamp = ((int64_t) err->ee_data) << 32 | err->ee_info;
++ tstamp -= (int64_t) glob_tstart;
++ tstamp /= 1000 * 1000;
++ fprintf(stderr, "send: pkt %c at %" PRId64 "ms dropped\n",
++ data[ret - 1], tstamp);
++
++ msg.msg_flags = 0;
++ msg.msg_controllen = sizeof(control);
++ }
++
++ error(1, 0, "recv: timeout");
++}
++
+ static void setsockopt_txtime(int fd)
+ {
+ struct sock_txtime so_txtime_val = { .clockid = cfg_clockid };
+ struct sock_txtime so_txtime_val_read = { 0 };
+ socklen_t vallen = sizeof(so_txtime_val);
+
++ so_txtime_val.flags = SOF_TXTIME_REPORT_ERRORS;
++
+ if (setsockopt(fd, SOL_SOCKET, SO_TXTIME,
+ &so_txtime_val, sizeof(so_txtime_val)))
+ error(1, errno, "setsockopt txtime");
+@@ -194,7 +263,8 @@ static void do_test(struct sockaddr *addr, socklen_t alen)
+ for (i = 0; i < cfg_num_pkt; i++)
+ do_send_one(fdt, &cfg_in[i]);
+ for (i = 0; i < cfg_num_pkt; i++)
+- do_recv_one(fdr, &cfg_out[i]);
++ if (do_recv_one(fdr, &cfg_out[i]))
++ do_recv_errqueue_timeout(fdt);
+
+ do_recv_verify_empty(fdr);
+
+@@ -280,6 +350,10 @@ int main(int argc, char **argv)
+ addr6.sin6_family = AF_INET6;
+ addr6.sin6_port = htons(cfg_port);
+ addr6.sin6_addr = in6addr_loopback;
++
++ cfg_errq_level = SOL_IPV6;
++ cfg_errq_type = IPV6_RECVERR;
++
+ do_test((void *)&addr6, sizeof(addr6));
+ }
+
+@@ -289,6 +363,10 @@ int main(int argc, char **argv)
+ addr4.sin_family = AF_INET;
+ addr4.sin_port = htons(cfg_port);
+ addr4.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
++
++ cfg_errq_level = SOL_IP;
++ cfg_errq_type = IP_RECVERR;
++
+ do_test((void *)&addr4, sizeof(addr4));
+ }
+
+diff --git a/tools/testing/selftests/net/so_txtime.sh b/tools/testing/selftests/net/so_txtime.sh
+index 5aa519328a5b5..3f7800eaecb1e 100755
+--- a/tools/testing/selftests/net/so_txtime.sh
++++ b/tools/testing/selftests/net/so_txtime.sh
+@@ -5,7 +5,12 @@
+
+ # Run in network namespace
+ if [[ $# -eq 0 ]]; then
+- ./in_netns.sh $0 __subprocess
++ if ! ./in_netns.sh $0 __subprocess; then
++ # test is time sensitive, can be flaky
++ echo "test failed: retry once"
++ ./in_netns.sh $0 __subprocess
++ fi
++
+ exit $?
+ fi
+
+@@ -18,7 +23,7 @@ tc qdisc add dev lo root fq
+ ./so_txtime -4 -6 -c mono a,10,b,20 a,10,b,20
+ ./so_txtime -4 -6 -c mono a,20,b,10 b,20,a,20
+
+-if tc qdisc replace dev lo root etf clockid CLOCK_TAI delta 200000; then
++if tc qdisc replace dev lo root etf clockid CLOCK_TAI delta 400000; then
+ ! ./so_txtime -4 -6 -c tai a,-1 a,-1
+ ! ./so_txtime -4 -6 -c tai a,0 a,0
+ ./so_txtime -4 -6 -c tai a,10 a,10
+--
+2.20.1
+
--- /dev/null
+From 5a49508b483af386cf5e79a311adde6affe32168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 19:12:20 +0200
+Subject: selftests: settings: tests can be in subsubdirs
+
+From: Matthieu Baerts <matthieu.baerts@tessares.net>
+
+[ Upstream commit ac87813d4372f4c005264acbe3b7f00c1dee37c4 ]
+
+Commit 852c8cbf34d3 ("selftests/kselftest/runner.sh: Add 45 second
+timeout per test") adds support for a new per-test-directory "settings"
+file. But this only works for tests not in a sub-subdirectories, e.g.
+
+ - tools/testing/selftests/rtc (rtc) is OK,
+ - tools/testing/selftests/net/mptcp (net/mptcp) is not.
+
+We have to increase the timeout for net/mptcp tests which are not
+upstreamed yet but this fix is valid for other tests if they need to add
+a "settings" file, see the full list with:
+
+ tools/testing/selftests/*/*/**/Makefile
+
+Note that this patch changes the text header message printed at the end
+of the execution but this text is modified only for the tests that are
+in sub-subdirectories, e.g.
+
+ ok 1 selftests: net/mptcp: mptcp_connect.sh
+
+Before we had:
+
+ ok 1 selftests: mptcp: mptcp_connect.sh
+
+But showing the full target name is probably better, just in case a
+subsubdir has the same name as another one in another subdirectory.
+
+Fixes: 852c8cbf34d3 (selftests/kselftest/runner.sh: Add 45 second timeout per test)
+Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kselftest/runner.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh
+index a8d20cbb711cf..e84d901f85672 100644
+--- a/tools/testing/selftests/kselftest/runner.sh
++++ b/tools/testing/selftests/kselftest/runner.sh
+@@ -91,7 +91,7 @@ run_one()
+ run_many()
+ {
+ echo "TAP version 13"
+- DIR=$(basename "$PWD")
++ DIR="${PWD#${BASE_DIR}/}"
+ test_num=0
+ total=$(echo "$@" | wc -w)
+ echo "1..$total"
+--
+2.20.1
+
--- /dev/null
+From a0a5e633698b36f8387581af668249e270e0ad49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 20:39:46 -0500
+Subject: selinux: ensure we cleanup the internal AVC counters on error in
+ avc_insert()
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit d8db60cb23e49a92cf8cada3297395c7fa50fdf8 ]
+
+Fix avc_insert() to call avc_node_kill() if we've already allocated
+an AVC node and the code fails to insert the node in the cache.
+
+Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
+Reported-by: rsiddoji@codeaurora.org
+Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/avc.c | 51 ++++++++++++++++++++----------------------
+ 1 file changed, 24 insertions(+), 27 deletions(-)
+
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 23dc888ae3056..6646300f7ccb2 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -617,40 +617,37 @@ static struct avc_node *avc_insert(struct selinux_avc *avc,
+ struct avc_node *pos, *node = NULL;
+ int hvalue;
+ unsigned long flag;
++ spinlock_t *lock;
++ struct hlist_head *head;
+
+ if (avc_latest_notif_update(avc, avd->seqno, 1))
+- goto out;
++ return NULL;
+
+ node = avc_alloc_node(avc);
+- if (node) {
+- struct hlist_head *head;
+- spinlock_t *lock;
+- int rc = 0;
+-
+- hvalue = avc_hash(ssid, tsid, tclass);
+- avc_node_populate(node, ssid, tsid, tclass, avd);
+- rc = avc_xperms_populate(node, xp_node);
+- if (rc) {
+- kmem_cache_free(avc_node_cachep, node);
+- return NULL;
+- }
+- head = &avc->avc_cache.slots[hvalue];
+- lock = &avc->avc_cache.slots_lock[hvalue];
++ if (!node)
++ return NULL;
+
+- spin_lock_irqsave(lock, flag);
+- hlist_for_each_entry(pos, head, list) {
+- if (pos->ae.ssid == ssid &&
+- pos->ae.tsid == tsid &&
+- pos->ae.tclass == tclass) {
+- avc_node_replace(avc, node, pos);
+- goto found;
+- }
++ avc_node_populate(node, ssid, tsid, tclass, avd);
++ if (avc_xperms_populate(node, xp_node)) {
++ avc_node_kill(avc, node);
++ return NULL;
++ }
++
++ hvalue = avc_hash(ssid, tsid, tclass);
++ head = &avc->avc_cache.slots[hvalue];
++ lock = &avc->avc_cache.slots_lock[hvalue];
++ spin_lock_irqsave(lock, flag);
++ hlist_for_each_entry(pos, head, list) {
++ if (pos->ae.ssid == ssid &&
++ pos->ae.tsid == tsid &&
++ pos->ae.tclass == tclass) {
++ avc_node_replace(avc, node, pos);
++ goto found;
+ }
+- hlist_add_head_rcu(&node->list, head);
+-found:
+- spin_unlock_irqrestore(lock, flag);
+ }
+-out:
++ hlist_add_head_rcu(&node->list, head);
++found:
++ spin_unlock_irqrestore(lock, flag);
+ return node;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 31bcf45c3b9abce9e876fb1356bbb235dc8479ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 17:25:47 +0530
+Subject: selinux: ensure we cleanup the internal AVC counters on error in
+ avc_update()
+
+From: Jaihind Yadav <jaihindyadav@codeaurora.org>
+
+[ Upstream commit 030b995ad9ece9fa2d218af4429c1c78c2342096 ]
+
+In AVC update we don't call avc_node_kill() when avc_xperms_populate()
+fails, resulting in the avc->avc_cache.active_nodes counter having a
+false value. In last patch this changes was missed , so correcting it.
+
+Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
+Signed-off-by: Jaihind Yadav <jaihindyadav@codeaurora.org>
+Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
+[PM: merge fuzz, minor description cleanup]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/avc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 6646300f7ccb2..d18cb32a242ae 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -891,7 +891,7 @@ static int avc_update_node(struct selinux_avc *avc,
+ if (orig->ae.xp_node) {
+ rc = avc_xperms_populate(node, orig->ae.xp_node);
+ if (rc) {
+- kmem_cache_free(avc_node_cachep, node);
++ avc_node_kill(avc, node);
+ goto out_unlock;
+ }
+ }
+--
+2.20.1
+
net-dsa-tag_qca-make-sure-there-is-headroom-for-tag.patch
net-sched-matchall-add-missing-validation-of-tca_matchall_flags.patch
net-sched-flower-add-missing-validation-of-tca_flower_flags.patch
+drm-gma500-fixup-fbdev-stolen-size-usage-evaluation.patch
+ath10k-fix-qmi-init-error-handling.patch
+wil6210-fix-break-that-is-never-reached-because-of-z.patch
+drm-qxl-complete-exception-handling-in-qxl_device_in.patch
+nfsd4-avoid-null-deference-on-strange-copy-compounds.patch
+rcu-nocb-fix-dump_tree-hierarchy-print-always-active.patch
+rcu-fix-missed-wakeup-of-exp_wq-waiters.patch
+soc-fsl-qe-change-return-type-of-cpm_muram_alloc-to-.patch
+rcu-fix-data-race-due-to-atomic_t-copy-by-value.patch
+f2fs-preallocate-dio-blocks-when-forcing-buffered_io.patch
+f2fs-call-f2fs_balance_fs-outside-of-locked-page.patch
+media-meson-add-missing-allocation-failure-check-on-.patch
+clk-meson-pll-fix-by-0-division-in-__pll_params_to_r.patch
+cpu-hotplug-stop_machine-fix-stop_machine-vs-hotplug.patch
+brcmfmac-fix-memory-leak-in-brcmf_p2p_create_p2pdev.patch
+brcmfmac-fix-use-after-free-in-brcmf_sdio_readframes.patch
+pci-fix-pci_add_dma_alias-bitmask-size.patch
+drm-amd-display-map-odm-memory-correctly-when-doing-.patch
+leds-pca963x-fix-open-drain-initialization.patch
+ext4-fix-ext4_dax_read-write-inode-locking-sequence-.patch
+alsa-ctl-allow-tlv-read-operation-for-callback-type-.patch
+gianfar-fix-tx-timestamping-with-a-stacked-dsa-drive.patch
+pinctrl-sh-pfc-sh7264-fix-can-function-gpios.patch
+printk-fix-exclusive_console-replaying.patch
+drm-mipi_dbi-fix-off-by-one-bugs-in-mipi_dbi_blank.patch
+drm-msm-adreno-fix-zap-vs-no-zap-handling.patch
+pxa168fb-fix-the-function-used-to-release-some-memor.patch
+media-ov5640-fix-check-for-pll1-exceeding-max-allowe.patch
+media-i2c-mt9v032-fix-enum-mbus-codes-and-frame-size.patch
+media-sun4i-csi-deal-with-dram-offset.patch
+media-sun4i-csi-fix-data-sampling-polarity-handling.patch
+media-sun4i-csi-fix-hv-sync-polarity-handling.patch
+clk-at91-sam9x60-fix-programmable-clock-prescaler.patch
+powerpc-powernv-iov-ensure-the-pdn-for-vfs-always-co.patch
+clk-meson-meson8b-make-the-ccf-use-the-glitch-free-m.patch
+gpio-gpio-grgpio-fix-possible-sleep-in-atomic-contex.patch
+iommu-vt-d-fix-off-by-one-in-pasid-allocation.patch
+x86-fpu-deactivate-fpu-state-after-failure-during-st.patch
+char-random-silence-a-lockdep-splat-with-printk.patch
+media-sti-bdisp-fix-a-possible-sleep-in-atomic-conte.patch
+kernel-module-fix-memleak-in-module_add_modinfo_attr.patch
+ib-core-let-ib-core-distribute-cache-update-events.patch
+pinctrl-baytrail-do-not-clear-irq-flags-on-direct-ir.patch
+efi-x86-map-the-entire-efi-vendor-string-before-copy.patch
+mips-loongson-fix-potential-null-dereference-in-loon.patch
+sparc-add-.exit.data-section.patch
+net-ethernet-ixp4xx-standard-module-init.patch
+raid6-test-fix-a-compilation-error.patch
+uio-fix-a-sleep-in-atomic-context-bug-in-uio_dmem_ge.patch
+drm-amdgpu-sriov-workaround-on-rev_id-for-navi12-und.patch
+spi-fsl-lpspi-fix-only-one-cs-gpio-working.patch
+drm-nouveau-nouveau-fix-incorrect-sizeof-on-args.src.patch
+usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch
+usb-dwc2-fix-in-fifo-allocation.patch
+clocksource-drivers-bcm2835_timer-fix-memory-leak-of.patch
+drm-amd-display-clear-state-after-exiting-fixed-acti.patch
+kselftest-minimise-dependency-of-get_size-on-c-libra.patch
+jbd2-clear-jbd2_abort-flag-before-journal_reset-to-u.patch
+ext4-fix-deadlock-allocating-bio_post_read_ctx-from-.patch
+clk-ti-dra7-fix-parent-for-gmac_clkctrl.patch
+x86-sysfb-fix-check-for-bad-vram-size.patch
+pwm-omap-dmtimer-simplify-error-handling.patch
+udf-allow-writing-to-rewritable-partitions.patch
+dmaengine-fsl-qdma-fix-duplicated-argument-to.patch
+wan-hdlc_x25-fix-skb-handling.patch
+s390-pci-fix-possible-deadlock-in-recover_store.patch
+powerpc-iov-move-vf-pdev-fixup-into-pcibios_fixup_io.patch
+tracing-fix-tracing_stat-return-values-in-error-hand.patch
+tracing-fix-very-unlikely-race-of-registering-two-st.patch
+arm-8952-1-disable-kmemleak-on-xip-kernels.patch
+ext4-jbd2-ensure-panic-when-aborting-with-zero-errno.patch
+ath10k-correct-the-dma-direction-for-management-tx-b.patch
+rtw88-fix-rate-mask-for-1ss-chip.patch
+brcmfmac-sdio-fix-oob-interrupt-initialization-on-br.patch
+selftests-settings-tests-can-be-in-subsubdirs.patch
+rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-n.patch
+drm-amd-display-retrain-dongles-when-sink_count-beco.patch
+tracing-simplify-assignment-parsing-for-hist-trigger.patch
+nbd-add-a-flush_workqueue-in-nbd_start_device.patch
+kvm-s390-enotsupp-eopnotsupp-fixups.patch
+btrfs-keep-pages-dirty-when-using-btrfs_writepage_fi.patch
+drivers-block-zram-zram_drv.c-fix-error-return-codes.patch
+block-bfq-do-not-plug-i-o-for-bfq_queues-with-no-pro.patch
+kconfig-fix-broken-dependency-in-randconfig-generate.patch
+clk-qcom-don-t-overwrite-cfg-in-clk_rcg2_dfs_populat.patch
+clk-qcom-rcg2-don-t-crash-if-our-parent-can-t-be-fou.patch
+drm-amdkfd-fix-a-bug-in-sdma-rlc-queue-counting-unde.patch
+bpf-sockhash-synchronize_rcu-before-free-ing-map.patch
+drm-amdgpu-remove-4-set-but-not-used-variable-in-amd.patch
+ath10k-correct-the-tlv-len-of-ath10k_wmi_tlv_op_gen_.patch
+drm-amdgpu-ensure-ret-is-always-initialized-when-usi.patch
+drm-panel-simple-add-logic-pd-type-28-display-suppor.patch
+arm64-dts-rockchip-fix-nanopc-t4-cooling-maps.patch
+modules-lockdep-suppress-suspicious-rcu-usage-warnin.patch
+asoc-intel-sof_rt5682-add-quirk-for-number-of-hdmi-d.patch
+asoc-intel-sof_rt5682-add-support-for-tgl-max98357a-.patch
+regulator-rk808-lower-log-level-on-optional-gpios-be.patch
+net-wan-fsl_ucc_hdlc-reject-muram-offsets-above-64k.patch
+nfc-port100-convert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch
+arm64-dts-allwinner-h6-add-pmu-mode.patch
+arm64-dts-allwinner-h5-add-pmu-node.patch
+arm-dts-allwinner-h3-add-pmu-node.patch
+opp-free-static-opps-on-errors-while-adding-them.patch
+selinux-ensure-we-cleanup-the-internal-avc-counters-.patch
+arm64-dts-qcom-msm8996-disable-usb2-phy-suspend-by-c.patch
+padata-validate-cpumask-without-removed-cpu-during-o.patch
+padata-always-acquire-cpu_hotplug_lock-before-pinst-.patch
+clk-imx-add-correct-failure-handling-for-clk-based-h.patch
+arm-exynos_defconfig-bring-back-explicitly-wanted-op.patch
+arm-dts-imx6-rdu2-disable-wp-for-usdhc2-and-usdhc3.patch
+arm-dts-imx6-rdu2-limit-usbh1-to-full-speed.patch
+bus-ti-sysc-implement-quirk-handling-for-clkdm_noaut.patch
+pci-iproc-apply-quirk_paxc_bridge-for-module-as-well.patch
+media-cx23885-add-support-for-avermedia-ce310b.patch
+pci-add-generic-quirk-for-increasing-d3hot-delay.patch
+pci-increase-d3-delay-for-amd-ryzen5-7-xhci-controll.patch
+revert-nfp-abm-fix-memory-leak-in-nfp_abm_u32_knode_.patch
+gpu-drm-ingenic-avoid-null-pointer-deference-in-plan.patch
+selftests-net-make-so_txtime-more-robust-to-timer-va.patch
+media-v4l2-device.h-explicitly-compare-grp-id-mask-t.patch
+reiserfs-fix-spurious-unlock-in-reiserfs_fill_super-.patch
+samples-bpf-set-fno-stack-protector-when-building-bp.patch
+r8169-check-that-realtek-phy-driver-module-is-loaded.patch
+fore200e-fix-incorrect-checks-of-null-pointer-derefe.patch
+isdn-don-t-mark-kcapi_proc_exit-as-__exit.patch
+arm-omap2-pdata-quirks-add-prm-data-for-reset-suppor.patch
+netfilter-nft_tunnel-add-the-missing-erspan_version-.patch
+alsa-usx2y-adjust-indentation-in-snd_usx2y_hwdep_dsp.patch
+pci-add-nr_devfns-parameter-to-pci_add_dma_alias.patch
+pci-add-dma-alias-quirk-for-plx-pex-ntb.patch
+b43legacy-fix-wcast-function-type.patch
+ipw2x00-fix-wcast-function-type.patch
+iwlegacy-fix-wcast-function-type.patch
+rtlwifi-rtl_pci-fix-wcast-function-type.patch
+orinoco-avoid-assertion-in-case-of-null-pointer.patch
+drm-amdgpu-fix-kiq-ring-test-fail-in-tdr-of-sriov.patch
+clk-qcom-smd-add-missing-bimc-clock.patch
+acpica-disassembler-create-buffer-fields-in-acpi_par.patch
+nfsd-clone-should-commit-src-file-metadata-too.patch
+scsi-ufs-complete-pending-requests-in-host-reset-and.patch
+scsi-aic7xxx-adjust-indentation-in-ahc_find_syncrate.patch
+crypto-inside-secure-add-unspecified-has_iomem-depen.patch
+drm-mediatek-handle-events-when-enabling-disabling-c.patch
+clk-renesas-rcar-gen3-allow-changing-the-rpc-d2-cloc.patch
+arm-dts-r8a7779-add-device-node-for-arm-global-timer.patch
+selinux-ensure-we-cleanup-the-internal-avc-counters-.patch-19513
+scsi-lpfc-fix-rework-setting-of-fdmi-symbolic-node-n.patch
+arm64-dts-qcom-db845c-enable-ath10k-8bit-host-cap-qu.patch
+iommu-amd-check-feature-support-bit-before-accessing.patch
+iommu-amd-only-support-x2apic-with-ivhd-type-11h-40h.patch
+iommu-iova-silence-warnings-under-memory-pressure.patch
+clk-actually-call-the-clock-init-before-any-other-ca.patch
+dmaengine-store-module-owner-in-dma_device-struct.patch
+dmaengine-imx-sdma-fix-memory-leak.patch
+bpf-print-error-message-for-bpftool-cgroup-show.patch
+net-phy-realtek-add-logging-for-the-rgmii-tx-delay-c.patch
+crypto-chtls-fixed-memory-leak.patch
+x86-vdso-provide-missing-include-file.patch
+pm-devfreq-exynos-ppmu-fix-excessive-stack-usage.patch
+pm-devfreq-rk3399_dmc-add-compile_test-and-have_arm_.patch
+drm-fbdev-fallback-to-non-tiled-mode-if-all-tiles-no.patch
+pinctrl-sh-pfc-sh7269-fix-can-function-gpios.patch
+reset-uniphier-add-scssi-reset-control-for-each-chan.patch
+asoc-soc-topology-fix-endianness-issues.patch
+fbdev-fix-numbering-of-fbcon-options.patch
+rdma-rxe-fix-error-type-of-mmap_offset.patch
+clk-sunxi-ng-add-mux-and-pll-notifiers-for-a64-cpu-c.patch
+alsa-sh-fix-unused-variable-warnings.patch
+clk-use-parent-node-pointer-during-registration-if-n.patch
+clk-uniphier-add-scssi-clock-gate-for-each-channel.patch
+alsa-hda-realtek-apply-mic-mute-led-quirk-for-dell-e.patch
+alsa-sh-fix-compile-warning-wrt-const.patch
+net-phy-fixed_phy-fix-use-after-free-when-checking-l.patch
+tools-lib-api-fs-fix-gcc9-stringop-truncation-compil.patch
+vfio-spapr-nvlink2-skip-unpinning-pages-on-error-exi.patch
+asoc-intel-sof_rt5682-ignore-the-speaker-amp-when-th.patch
+x86-unwind-orc-fix-config_modules-build-warning.patch
+acpi-button-add-dmi-quirk-for-razer-blade-stealth-13.patch
+iommu-vt-d-match-cpu-and-iommu-paging-mode.patch
+iommu-vt-d-avoid-sending-invalid-page-response.patch
+drm-amdkfd-fix-permissions-of-hang_hws.patch
+mlx5-work-around-high-stack-usage-with-gcc.patch
+rdma-hns-avoid-printing-address-of-mtt-page.patch
+drm-remove-the-newline-for-crc-source-name.patch
+usb-dwc3-use-proper-initializers-for-property-entrie.patch
+arm-dts-stm32-add-power-supply-for-dsi-panel-on-stm3.patch
+usbip-fix-unsafe-unaligned-pointer-usage.patch
+udf-fix-free-space-reporting-for-metadata-and-virtua.patch
+drm-mediatek-add-gamma-property-according-to-hardwar.patch
+staging-rtl8188-avoid-excessive-stack-usage.patch
+ib-hfi1-add-software-counter-for-ctxt0-seq-drop.patch
+ib-hfi1-add-rcvshortlengtherrcnt-to-hfi1stats.patch
+soc-tegra-fuse-correct-straps-address-for-older-tegr.patch
+efi-x86-don-t-panic-or-bug-on-non-critical-error-con.patch
+rcu-use-write_once-for-assignments-to-pprev-for-hlis.patch
+input-edt-ft5x06-work-around-first-register-access-e.patch
+bnxt-detach-page-from-page-pool-before-sending-up-th.patch
+x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch
+wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch
+clocksource-davinci-only-enable-clockevents-once-tim.patch
+arm64-dts-rockchip-fix-dwmmc-clock-name-for-px30.patch
+arm64-dts-rockchip-add-reg-property-to-brcmf-sub-nod.patch
+arm-dts-rockchip-add-reg-property-to-brcmf-sub-node-.patch
+alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch
+asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
+raid6-test-fix-a-compilation-warning.patch
+rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
+tty-synclinkmp-adjust-indentation-in-several-functio.patch
+tty-synclink_gt-adjust-indentation-in-several-functi.patch
+misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch
+visorbus-fix-uninitialized-variable-access.patch
+driver-core-platform-prevent-resouce-overflow-from-c.patch
+driver-core-print-device-when-resources-present-in-r.patch
+asoc-sof-intel-hda-dai-fix-compilation-warning-in-pc.patch
+bpf-return-ebadrqc-for-invalid-map-type-in-__bpf_tx_.patch
+vme-bridges-reduce-stack-usage.patch
+drm-nouveau-secboot-gm20b-initialize-pointer-in-gm20.patch
+drm-nouveau-gr-gk20a-gm200-add-terminators-to-method.patch
+drm-nouveau-fix-copy-paste-error-in-nouveau_fence_wa.patch
+drm-nouveau-drm-ttm-remove-set-but-not-used-variable.patch
+drm-nouveau-fault-gv100-fix-memory-leak-on-module-un.patch
+dm-thin-don-t-allow-changing-data-device-during-thin.patch
+gpiolib-set-lockdep-class-for-hierarchical-irq-domai.patch
+drm-vmwgfx-prevent-memory-leak-in-vmw_cmdbuf_res_add.patch
+perf-imx_ddr-fix-cpu-hotplug-state-cleanup.patch
+usb-musb-omap2430-get-rid-of-musb-.set_vbus-for-omap.patch
+kbuild-remove-.tmp-file-when-filechk-fails.patch
+iommu-arm-smmu-v3-use-write_once-when-changing-valid.patch
+alsa-usb-audio-unlock-on-error-in-probe.patch
+f2fs-set-i_linkable-early-to-avoid-wrong-access-by-v.patch
+f2fs-free-sysfs-kobject.patch
+scsi-ufs-pass-device-information-to-apply_dev_quirks.patch
+scsi-ufs-mediatek-add-apply_dev_quirks-variant-opera.patch
+scsi-iscsi-don-t-destroy-session-if-there-are-outsta.patch
+crypto-essiv-fix-aead-capitalization-and-preposition.patch
+alsa-usb-audio-add-implicit-fb-quirk-for-motu-m-seri.patch
+rdma-mlx5-don-t-fake-udata-for-kernel-path.patch
+arm64-lse-fix-lse-atomics-with-llvm-s-integrated-ass.patch
+arm64-fix-alternatives-with-llvm-s-integrated-assemb.patch
+drm-amd-display-fixup-dml-dependencies.patch
+edac-sifive-fix-return-value-check-in-ecc_register.patch
+kvm-ppc-remove-set-but-not-used-variable-ra-rs-rt.patch
+arm64-dts-ti-k3-j721e-main-add-missing-power-domains.patch
+sched-core-fix-size-of-rq-uclamp-initialization.patch
+sched-topology-assert-non-numa-topology-masks-don-t-.patch
+perf-x86-amd-constrain-large-increment-per-cycle-eve.patch
+watchdog-softlockup-enforce-that-timestamp-is-valid-.patch
+acpi-iort-fix-number-of-ids-handling-in-iort_id_map.patch
+debugobjects-fix-various-data-races.patch
+asoc-sof-intel-hda-fix-skl-dai-count.patch
+regulator-vctrl-regulator-avoid-deadlock-getting-and.patch
+f2fs-fix-memleak-of-kobject.patch
+x86-mm-fix-nx-bit-clearing-issue-in-kernel_map_pages.patch
+pwm-omap-dmtimer-remove-pwm-chip-in-.remove-before-m.patch
+cmd64x-potential-buffer-overflow-in-cmd64x_program_t.patch
+ide-serverworks-potential-overflow-in-svwks_set_pio_.patch
+pwm-remove-set-but-not-set-variable-pwm.patch
+btrfs-fix-possible-null-pointer-dereference-in-integ.patch
+btrfs-safely-advance-counter-when-looking-up-bio-csu.patch
+btrfs-device-stats-log-when-stats-are-zeroed.patch
+module-avoid-setting-info-name-early-in-case-we-can-.patch
+remoteproc-initialize-rproc_class-before-use.patch
+regulator-core-fix-exported-symbols-to-the-exported-.patch
+irqchip-mbigen-set-driver-.suppress_bind_attrs-to-av.patch
+alsa-hda-hdmi-add-retry-logic-to-parse_intel_hdmi.patch
+spi-spi-fsl-qspi-ensure-width-is-respected-in-spi-me.patch
+kbuild-use-s-instead-of-e-for-precise-cc-option-test.patch
+objtool-fix-arch-x86_64-build-error.patch
+x86-decoder-add-test-opcode-to-group3-2.patch
+s390-adjust-mpacked-stack-support-check-for-clang-10.patch
+s390-ftrace-generate-traced-function-stack-frame.patch
+driver-core-platform-fix-u32-greater-or-equal-to-zer.patch
+bpf-btf-always-output-invariant-hit-in-pahole-dwarf-.patch
+alsa-hda-add-docking-station-support-for-lenovo-thin.patch
+sunrpc-fix-potential-leaks-in-sunrpc_cache_unhash.patch
+drm-nouveau-mmu-fix-comptag-memory-leak.patch
+powerpc-sriov-remove-vf-eeh_dev-state-when-disabling.patch
+media-uvcvideo-add-a-quirk-to-force-geo-gc6500-camer.patch
+btrfs-separate-definition-of-assertion-failure-handl.patch
+btrfs-fix-split-brain-handling-when-changing-fsid-to.patch
+bcache-cached_dev_free-needs-to-put-the-sb-page.patch
+bcache-rework-error-unwinding-in-register_bcache.patch
+bcache-fix-use-after-free-in-register_bcache.patch
+iommu-vt-d-remove-unnecessary-warn_on_once.patch
+alarmtimer-make-alarmtimer-platform-device-child-of-.patch
+selftests-bpf-reset-global-state-between-reuseport-t.patch
+jbd2-switch-to-use-jbd2_journal_abort-when-failed-to.patch
+jbd2-make-sure-eshutdown-to-be-recorded-in-the-journ.patch
+powerpc-pseries-lparcfg-fix-display-of-maximum-memor.patch
+selftests-eeh-bump-eeh-wait-time-to-60s.patch
+arm-8951-1-fix-kexec-compilation-issue.patch
+alsa-usb-audio-add-quirks-for-line6-helix-devices-fw.patch
+hostap-adjust-indentation-in-prism2_hostapd_add_sta.patch
+rtw88-fix-potential-null-skb-access-in-tx-isr.patch
+iwlegacy-ensure-loop-counter-addr-does-not-wrap-and-.patch
+cifs-fix-unitialized-variable-poential-problem-with-.patch
+cifs-fix-mount-options-set-in-automount.patch
+cifs-fix-null-dereference-in-match_prepath.patch
+bpf-map_seq_next-should-always-increase-position-ind.patch
+powerpc-mm-don-t-log-user-reads-to-0xffffffff.patch
+ceph-check-availability-of-mds-cluster-on-mount-afte.patch
+rbd-work-around-wuninitialized-warning.patch
+drm-amd-display-do-not-allocate-display_mode_lib-unn.patch
+irqchip-gic-v3-only-provision-redistributors-that-ar.patch
+drm-nouveau-disp-nv50-prevent-oops-when-no-channel-m.patch
+char-hpet-fix-out-of-bounds-read-bug.patch
+ftrace-fpid_next-should-increase-position-index.patch
+trigger_next-should-increase-position-index.patch
+radeon-insert-10ms-sleep-in-dce5_crtc_load_lut.patch
+powerpc-do-not-consider-weak-unresolved-symbol-reloc.patch
+btrfs-do-not-do-delalloc-reservation-under-page-lock.patch
+ocfs2-make-local-header-paths-relative-to-c-files.patch
+ocfs2-fix-a-null-pointer-dereference-when-call-ocfs2.patch
+lib-scatterlist.c-adjust-indentation-in-__sg_alloc_t.patch
+reiserfs-prevent-null-pointer-dereference-in-reiserf.patch
+bcache-fix-memory-corruption-in-bch_cache_accounting.patch
+bcache-explicity-type-cast-in-bset_bkey_last.patch
+bcache-fix-incorrect-data-type-usage-in-btree_flush_.patch
+irqchip-gic-v3-its-reference-to-its_invall_cmd-descr.patch
+nvmet-pass-lockdep-expression-to-rcu-lists.patch
+nvme-pci-remove-nvmeq-tags.patch
+iwlwifi-mvm-fix-thermal-zone-registration.patch
+iwlwifi-mvm-check-the-sta-is-not-null-in-iwl_mvm_cfg.patch
+asm-generic-tlb-add-missing-config-symbol.patch
+microblaze-prevent-the-overflow-of-the-start.patch
+brd-check-and-limit-max_part-par.patch
+drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_la.patch
+drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_vo.patch
+nfs-fix-memory-leaks.patch
+help_next-should-increase-position-index.patch
+i40e-relax-i40e_xsk_wakeup-s-return-value-when-pf-is.patch
+cifs-log-warning-message-once-if-out-of-disk-space.patch
+virtio_balloon-prevent-pfn-array-overflow.patch
+fuse-don-t-overflow-llong_max-with-end-offset.patch
+mlxsw-spectrum_dpipe-add-missing-error-path.patch
+s390-pci-recover-handle-in-clp_set_pci_fn.patch
+drm-amdgpu-display-handle-multiple-numbers-of-fclks-.patch
+bcache-properly-initialize-path-and-err-in-register_.patch
--- /dev/null
+From a621d4c881759e096736128064ac81d02aedb1e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 15:55:40 +0100
+Subject: soc: fsl: qe: change return type of cpm_muram_alloc() to s32
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 800cd6fb76f0ec7711deb72a86c924db1ae42648 ]
+
+There are a number of problems with cpm_muram_alloc() and its
+callers. Most callers assign the return value to some variable and
+then use IS_ERR_VALUE to check for allocation failure. However, when
+that variable is not sizeof(long), this leads to warnings - and it is
+indeed broken to do e.g.
+
+ u32 foo = cpm_muram_alloc();
+ if (IS_ERR_VALUE(foo))
+
+on a 64-bit platform, since the condition
+
+ foo >= (unsigned long)-ENOMEM
+
+is tautologically false. There are also callers that ignore the
+possibility of error, and then there are those that check for error by
+comparing the return value to 0...
+
+One could fix that by changing all callers to store the return value
+temporarily in an "unsigned long" and test that. However, use of
+IS_ERR_VALUE() is error-prone and should be restricted to things which
+are inherently long-sized (stuff in pt_regs etc.). Instead, let's aim
+for changing to the standard kernel style
+
+ int foo = cpm_muram_alloc();
+ if (foo < 0)
+ deal_with_it()
+ some->where = foo;
+
+Changing the return type from unsigned long to s32 (aka signed int)
+doesn't change the value that gets stored into any of the callers'
+variables except if the caller was storing the result in a u64 _and_
+the allocation failed, so in itself this patch should be a no-op.
+
+Another problem with cpm_muram_alloc() is that it can certainly
+validly return 0 - and except if some cpm_muram_alloc_fixed() call
+interferes, the very first cpm_muram_alloc() call will return just
+that. But that shows that both ucc_slow_free() and ucc_fast_free() are
+buggy, since they assume that a value of 0 means "that field was never
+allocated". We'll later change cpm_muram_free() to accept (and ignore)
+a negative offset, so callers can use a sentinel of -1 instead of 0
+and just unconditionally call cpm_muram_free().
+
+Reviewed-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/qe_common.c | 29 ++++++++++++++++-------------
+ include/soc/fsl/qe/qe.h | 16 ++++++++--------
+ 2 files changed, 24 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/soc/fsl/qe/qe_common.c b/drivers/soc/fsl/qe/qe_common.c
+index 83e85e61669f5..84c90105e588b 100644
+--- a/drivers/soc/fsl/qe/qe_common.c
++++ b/drivers/soc/fsl/qe/qe_common.c
+@@ -32,7 +32,7 @@ static phys_addr_t muram_pbase;
+
+ struct muram_block {
+ struct list_head head;
+- unsigned long start;
++ s32 start;
+ int size;
+ };
+
+@@ -110,13 +110,14 @@ out_muram:
+ * @algo: algorithm for alloc.
+ * @data: data for genalloc's algorithm.
+ *
+- * This function returns an offset into the muram area.
++ * This function returns a non-negative offset into the muram area, or
++ * a negative errno on failure.
+ */
+-static unsigned long cpm_muram_alloc_common(unsigned long size,
+- genpool_algo_t algo, void *data)
++static s32 cpm_muram_alloc_common(unsigned long size,
++ genpool_algo_t algo, void *data)
+ {
+ struct muram_block *entry;
+- unsigned long start;
++ s32 start;
+
+ if (!muram_pool && cpm_muram_init())
+ goto out2;
+@@ -137,7 +138,7 @@ static unsigned long cpm_muram_alloc_common(unsigned long size,
+ out1:
+ gen_pool_free(muram_pool, start, size);
+ out2:
+- return (unsigned long)-ENOMEM;
++ return -ENOMEM;
+ }
+
+ /*
+@@ -145,13 +146,14 @@ out2:
+ * @size: number of bytes to allocate
+ * @align: requested alignment, in bytes
+ *
+- * This function returns an offset into the muram area.
++ * This function returns a non-negative offset into the muram area, or
++ * a negative errno on failure.
+ * Use cpm_dpram_addr() to get the virtual address of the area.
+ * Use cpm_muram_free() to free the allocation.
+ */
+-unsigned long cpm_muram_alloc(unsigned long size, unsigned long align)
++s32 cpm_muram_alloc(unsigned long size, unsigned long align)
+ {
+- unsigned long start;
++ s32 start;
+ unsigned long flags;
+ struct genpool_data_align muram_pool_data;
+
+@@ -168,7 +170,7 @@ EXPORT_SYMBOL(cpm_muram_alloc);
+ * cpm_muram_free - free a chunk of multi-user ram
+ * @offset: The beginning of the chunk as returned by cpm_muram_alloc().
+ */
+-int cpm_muram_free(unsigned long offset)
++int cpm_muram_free(s32 offset)
+ {
+ unsigned long flags;
+ int size;
+@@ -194,13 +196,14 @@ EXPORT_SYMBOL(cpm_muram_free);
+ * cpm_muram_alloc_fixed - reserve a specific region of multi-user ram
+ * @offset: offset of allocation start address
+ * @size: number of bytes to allocate
+- * This function returns an offset into the muram area
++ * This function returns @offset if the area was available, a negative
++ * errno otherwise.
+ * Use cpm_dpram_addr() to get the virtual address of the area.
+ * Use cpm_muram_free() to free the allocation.
+ */
+-unsigned long cpm_muram_alloc_fixed(unsigned long offset, unsigned long size)
++s32 cpm_muram_alloc_fixed(unsigned long offset, unsigned long size)
+ {
+- unsigned long start;
++ s32 start;
+ unsigned long flags;
+ struct genpool_data_fixed muram_pool_data_fixed;
+
+diff --git a/include/soc/fsl/qe/qe.h b/include/soc/fsl/qe/qe.h
+index c1036d16ed03b..2d35d5db16231 100644
+--- a/include/soc/fsl/qe/qe.h
++++ b/include/soc/fsl/qe/qe.h
+@@ -98,26 +98,26 @@ static inline void qe_reset(void) {}
+ int cpm_muram_init(void);
+
+ #if defined(CONFIG_CPM) || defined(CONFIG_QUICC_ENGINE)
+-unsigned long cpm_muram_alloc(unsigned long size, unsigned long align);
+-int cpm_muram_free(unsigned long offset);
+-unsigned long cpm_muram_alloc_fixed(unsigned long offset, unsigned long size);
++s32 cpm_muram_alloc(unsigned long size, unsigned long align);
++int cpm_muram_free(s32 offset);
++s32 cpm_muram_alloc_fixed(unsigned long offset, unsigned long size);
+ void __iomem *cpm_muram_addr(unsigned long offset);
+ unsigned long cpm_muram_offset(void __iomem *addr);
+ dma_addr_t cpm_muram_dma(void __iomem *addr);
+ #else
+-static inline unsigned long cpm_muram_alloc(unsigned long size,
+- unsigned long align)
++static inline s32 cpm_muram_alloc(unsigned long size,
++ unsigned long align)
+ {
+ return -ENOSYS;
+ }
+
+-static inline int cpm_muram_free(unsigned long offset)
++static inline int cpm_muram_free(s32 offset)
+ {
+ return -ENOSYS;
+ }
+
+-static inline unsigned long cpm_muram_alloc_fixed(unsigned long offset,
+- unsigned long size)
++static inline s32 cpm_muram_alloc_fixed(unsigned long offset,
++ unsigned long size)
+ {
+ return -ENOSYS;
+ }
+--
+2.20.1
+
--- /dev/null
+From 85b97d534eda00e96a2ffcaa78ffe2b8eec0cccf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 21:23:03 +0300
+Subject: soc/tegra: fuse: Correct straps' address for older Tegra124 device
+ trees
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 2d9ea1934f8ef0dfb862d103389562cc28b4fc03 ]
+
+Trying to read out Chip ID before APBMISC registers are mapped won't
+succeed, in a result Tegra124 gets a wrong address for the HW straps
+register if machine uses an old outdated device tree.
+
+Fixes: 297c4f3dcbff ("soc/tegra: fuse: Restrict legacy code to 32-bit ARM")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/tegra-apbmisc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/tegra/fuse/tegra-apbmisc.c b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+index df76778af601e..f8b9c4058926b 100644
+--- a/drivers/soc/tegra/fuse/tegra-apbmisc.c
++++ b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+@@ -123,7 +123,7 @@ void __init tegra_init_apbmisc(void)
+ apbmisc.flags = IORESOURCE_MEM;
+
+ /* strapping options */
+- if (tegra_get_chip_id() == TEGRA124) {
++ if (of_machine_is_compatible("nvidia,tegra124")) {
+ straps.start = 0x7000e864;
+ straps.end = 0x7000e867;
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 7514b953c1e57ffa37a2b4e96f7da540b18061dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 00:07:42 -0800
+Subject: sparc: Add .exit.data section.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 548f0b9a5f4cffa0cecf62eb12aa8db682e4eee6 ]
+
+This fixes build errors of all sorts.
+
+Also, emit .exit.text unconditionally.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/vmlinux.lds.S | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
+index 61afd787bd0c7..59b6df13ddead 100644
+--- a/arch/sparc/kernel/vmlinux.lds.S
++++ b/arch/sparc/kernel/vmlinux.lds.S
+@@ -172,12 +172,14 @@ SECTIONS
+ }
+ PERCPU_SECTION(SMP_CACHE_BYTES)
+
+-#ifdef CONFIG_JUMP_LABEL
+ . = ALIGN(PAGE_SIZE);
+ .exit.text : {
+ EXIT_TEXT
+ }
+-#endif
++
++ .exit.data : {
++ EXIT_DATA
++ }
+
+ . = ALIGN(PAGE_SIZE);
+ __init_end = .;
+--
+2.20.1
+
--- /dev/null
+From 7084cbe62dcbf5749806ae7ca59416c67440769d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 14:13:33 +0000
+Subject: spi: fsl-lpspi: fix only one cs-gpio working
+
+From: Philippe Schenker <philippe.schenker@toradex.com>
+
+[ Upstream commit bc3a8b295e5bca9d1ec2622a6ba38289f9fd3d8a ]
+
+Why it does not work at the moment:
+- num_chipselect sets the number of cs-gpios that are in the DT.
+ This comes from drivers/spi/spi.c
+- num_chipselect gets set with devm_spi_register_controller, that is
+ called in drivers/spi/spi.c
+- devm_spi_register_controller got called after num_chipselect has
+ been used.
+
+How this commit fixes the issue:
+- devm_spi_register_controller gets called before num_chipselect is
+ being used.
+
+Fixes: c7a402599504 ("spi: lpspi: use the core way to implement cs-gpio function")
+Signed-off-by: Philippe Schenker <philippe.schenker@toradex.com>
+Link: https://lore.kernel.org/r/20191204141312.1411251-1-philippe.schenker@toradex.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-lpspi.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/spi/spi-fsl-lpspi.c b/drivers/spi/spi-fsl-lpspi.c
+index 3528ed5eea9b5..92e460d4f3d10 100644
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -862,6 +862,22 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ fsl_lpspi->dev = &pdev->dev;
+ fsl_lpspi->is_slave = is_slave;
+
++ controller->bits_per_word_mask = SPI_BPW_RANGE_MASK(8, 32);
++ controller->transfer_one = fsl_lpspi_transfer_one;
++ controller->prepare_transfer_hardware = lpspi_prepare_xfer_hardware;
++ controller->unprepare_transfer_hardware = lpspi_unprepare_xfer_hardware;
++ controller->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
++ controller->flags = SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX;
++ controller->dev.of_node = pdev->dev.of_node;
++ controller->bus_num = pdev->id;
++ controller->slave_abort = fsl_lpspi_slave_abort;
++
++ ret = devm_spi_register_controller(&pdev->dev, controller);
++ if (ret < 0) {
++ dev_err(&pdev->dev, "spi_register_controller error.\n");
++ goto out_controller_put;
++ }
++
+ if (!fsl_lpspi->is_slave) {
+ for (i = 0; i < controller->num_chipselect; i++) {
+ int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
+@@ -885,16 +901,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ controller->prepare_message = fsl_lpspi_prepare_message;
+ }
+
+- controller->bits_per_word_mask = SPI_BPW_RANGE_MASK(8, 32);
+- controller->transfer_one = fsl_lpspi_transfer_one;
+- controller->prepare_transfer_hardware = lpspi_prepare_xfer_hardware;
+- controller->unprepare_transfer_hardware = lpspi_unprepare_xfer_hardware;
+- controller->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
+- controller->flags = SPI_MASTER_MUST_RX | SPI_MASTER_MUST_TX;
+- controller->dev.of_node = pdev->dev.of_node;
+- controller->bus_num = pdev->id;
+- controller->slave_abort = fsl_lpspi_slave_abort;
+-
+ init_completion(&fsl_lpspi->xfer_done);
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+@@ -952,12 +958,6 @@ static int fsl_lpspi_probe(struct platform_device *pdev)
+ if (ret < 0)
+ dev_err(&pdev->dev, "dma setup error %d, use pio\n", ret);
+
+- ret = devm_spi_register_controller(&pdev->dev, controller);
+- if (ret < 0) {
+- dev_err(&pdev->dev, "spi_register_controller error.\n");
+- goto out_controller_put;
+- }
+-
+ return 0;
+
+ out_controller_put:
+--
+2.20.1
+
--- /dev/null
+From 3d207dedaed2706fca104734e8287eb9c5d0cbfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 16:46:13 +0100
+Subject: spi: spi-fsl-qspi: Ensure width is respected in spi-mem operations
+
+From: Michael Walle <michael@walle.cc>
+
+[ Upstream commit b0177aca7aea7e8917d4e463334b51facb293d02 ]
+
+Make use of a core helper to ensure the desired width is respected
+when calling spi-mem operators.
+
+Otherwise only the SPI controller will be matched with the flash chip,
+which might lead to wrong widths. Also consider the width specified by
+the user in the device tree.
+
+Fixes: 84d043185dbe ("spi: Add a driver for the Freescale/NXP QuadSPI controller")
+Signed-off-by: Michael Walle <michael@walle.cc>
+Link: https://lore.kernel.org/r/20200114154613.8195-1-michael@walle.cc
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-qspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-qspi.c b/drivers/spi/spi-fsl-qspi.c
+index 63c9f7edaf6cb..43078ba3def5d 100644
+--- a/drivers/spi/spi-fsl-qspi.c
++++ b/drivers/spi/spi-fsl-qspi.c
+@@ -398,7 +398,7 @@ static bool fsl_qspi_supports_op(struct spi_mem *mem,
+ op->data.nbytes > q->devtype_data->txfifo)
+ return false;
+
+- return true;
++ return spi_mem_default_supports_op(mem, op);
+ }
+
+ static void fsl_qspi_prepare_lut(struct fsl_qspi *q,
+--
+2.20.1
+
--- /dev/null
+From 4e2c9c81d981c7e286b8d534c79edab855367ea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 22:48:21 +0100
+Subject: staging: rtl8188: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c497ae2077c055b85c1bf04f3d182a84bd8f365b ]
+
+The rtl8188 copy of the os_dep support code causes a
+warning about a very significant stack usage in the translate_scan()
+function:
+
+drivers/staging/rtl8188eu/os_dep/ioctl_linux.c: In function 'translate_scan':
+drivers/staging/rtl8188eu/os_dep/ioctl_linux.c:306:1: error: the frame size of 1560 bytes is larger than 1400 bytes [-Werror=frame-larger-than=]
+
+Use the same trick as in the rtl8723bs copy of the same function, and
+allocate it dynamically.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200104214832.558198-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+index ec5835d1aa8ce..9f0418ee75284 100644
+--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+@@ -229,18 +229,21 @@ static char *translate_scan(struct adapter *padapter,
+
+ /* parsing WPA/WPA2 IE */
+ {
+- u8 buf[MAX_WPA_IE_LEN];
++ u8 *buf;
+ u8 wpa_ie[255], rsn_ie[255];
+ u16 wpa_len = 0, rsn_len = 0;
+ u8 *p;
+
++ buf = kzalloc(MAX_WPA_IE_LEN, GFP_ATOMIC);
++ if (!buf)
++ return start;
++
+ rtw_get_sec_ie(pnetwork->network.ies, pnetwork->network.ie_length, rsn_ie, &rsn_len, wpa_ie, &wpa_len);
+ RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: ssid =%s\n", pnetwork->network.ssid.ssid));
+ RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: wpa_len =%d rsn_len =%d\n", wpa_len, rsn_len));
+
+ if (wpa_len > 0) {
+ p = buf;
+- memset(buf, 0, MAX_WPA_IE_LEN);
+ p += sprintf(p, "wpa_ie=");
+ for (i = 0; i < wpa_len; i++)
+ p += sprintf(p, "%02x", wpa_ie[i]);
+@@ -257,7 +260,6 @@ static char *translate_scan(struct adapter *padapter,
+ }
+ if (rsn_len > 0) {
+ p = buf;
+- memset(buf, 0, MAX_WPA_IE_LEN);
+ p += sprintf(p, "rsn_ie=");
+ for (i = 0; i < rsn_len; i++)
+ p += sprintf(p, "%02x", rsn_ie[i]);
+@@ -271,6 +273,7 @@ static char *translate_scan(struct adapter *padapter,
+ iwe.u.data.length = rsn_len;
+ start = iwe_stream_add_point(info, start, stop, &iwe, rsn_ie);
+ }
++ kfree(buf);
+ }
+
+ {/* parsing WPS IE */
+--
+2.20.1
+
--- /dev/null
+From bc784fd5be3ac74bba991a0f4ea018c8865a62be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 13:40:34 -0500
+Subject: sunrpc: Fix potential leaks in sunrpc_cache_unhash()
+
+From: Trond Myklebust <trondmy@gmail.com>
+
+[ Upstream commit 1d82163714c16ebe09c7a8c9cd3cef7abcc16208 ]
+
+When we unhash the cache entry, we need to handle any pending upcalls
+by calling cache_fresh_unlocked().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/cache.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index f740cb51802af..7ede1e52fd812 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -1888,7 +1888,9 @@ void sunrpc_cache_unhash(struct cache_detail *cd, struct cache_head *h)
+ if (!hlist_unhashed(&h->cache_list)){
+ hlist_del_init_rcu(&h->cache_list);
+ cd->entries--;
++ set_bit(CACHE_CLEANED, &h->flags);
+ spin_unlock(&cd->hash_lock);
++ cache_fresh_unlocked(h, cd);
+ cache_put(h, cd);
+ } else
+ spin_unlock(&cd->hash_lock);
+--
+2.20.1
+
--- /dev/null
+From 8098796b6339f88ab8d8621cebbe526fc736274c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 08:01:09 +0000
+Subject: tools lib api fs: Fix gcc9 stringop-truncation compilation error
+
+From: Andrey Zhizhikin <andrey.z@gmail.com>
+
+[ Upstream commit 6794200fa3c9c3e6759dae099145f23e4310f4f7 ]
+
+GCC9 introduced string hardening mechanisms, which exhibits the error
+during fs api compilation:
+
+error: '__builtin_strncpy' specified bound 4096 equals destination size
+[-Werror=stringop-truncation]
+
+This comes when the length of copy passed to strncpy is is equal to
+destination size, which could potentially lead to buffer overflow.
+
+There is a need to mitigate this potential issue by limiting the size of
+destination by 1 and explicitly terminate the destination with NULL.
+
+Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andrii Nakryiko <andriin@fb.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: bpf@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Link: http://lore.kernel.org/lkml/20191211080109.18765-1-andrey.zhizhikin@leica-geosystems.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/api/fs/fs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
+index 7aba8243a0e7c..bd021a0eeef8c 100644
+--- a/tools/lib/api/fs/fs.c
++++ b/tools/lib/api/fs/fs.c
+@@ -210,6 +210,7 @@ static bool fs__env_override(struct fs *fs)
+ size_t name_len = strlen(fs->name);
+ /* name + "_PATH" + '\0' */
+ char upper_name[name_len + 5 + 1];
++
+ memcpy(upper_name, fs->name, name_len);
+ mem_toupper(upper_name, name_len);
+ strcpy(&upper_name[name_len], "_PATH");
+@@ -219,7 +220,8 @@ static bool fs__env_override(struct fs *fs)
+ return false;
+
+ fs->found = true;
+- strncpy(fs->path, override_path, sizeof(fs->path));
++ strncpy(fs->path, override_path, sizeof(fs->path) - 1);
++ fs->path[sizeof(fs->path) - 1] = '\0';
+ return true;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 629c43aaf6f0298ee33490a0d116b2332b3ff624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2014 22:49:41 +0100
+Subject: tracing: Fix tracing_stat return values in error handling paths
+
+From: Luis Henriques <luis.henriques@canonical.com>
+
+[ Upstream commit afccc00f75bbbee4e4ae833a96c2d29a7259c693 ]
+
+tracing_stat_init() was always returning '0', even on the error paths. It
+now returns -ENODEV if tracing_init_dentry() fails or -ENOMEM if it fails
+to created the 'trace_stat' debugfs directory.
+
+Link: http://lkml.kernel.org/r/1410299381-20108-1-git-send-email-luis.henriques@canonical.com
+
+Fixes: ed6f1c996bfe4 ("tracing: Check return value of tracing_init_dentry()")
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+[ Pulled from the archeological digging of my INBOX ]
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_stat.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index 9ab0a1a7ad5ee..1257dc6c07796 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -282,18 +282,22 @@ static int tracing_stat_init(void)
+
+ d_tracing = tracing_init_dentry();
+ if (IS_ERR(d_tracing))
+- return 0;
++ return -ENODEV;
+
+ stat_dir = tracefs_create_dir("trace_stat", d_tracing);
+- if (!stat_dir)
++ if (!stat_dir) {
+ pr_warn("Could not create tracefs 'trace_stat' entry\n");
++ return -ENOMEM;
++ }
+ return 0;
+ }
+
+ static int init_stat_file(struct stat_session *session)
+ {
+- if (!stat_dir && tracing_stat_init())
+- return -ENODEV;
++ int ret;
++
++ if (!stat_dir && (ret = tracing_stat_init()))
++ return ret;
+
+ session->file = tracefs_create_file(session->ts->name, 0644,
+ stat_dir,
+--
+2.20.1
+
--- /dev/null
+From 0bbe256d09a54704884ca0c201567227628ab605 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 17:47:49 -0500
+Subject: tracing: Fix very unlikely race of registering two stat tracers
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit dfb6cd1e654315168e36d947471bd2a0ccd834ae ]
+
+Looking through old emails in my INBOX, I came across a patch from Luis
+Henriques that attempted to fix a race of two stat tracers registering the
+same stat trace (extremely unlikely, as this is done in the kernel, and
+probably doesn't even exist). The submitted patch wasn't quite right as it
+needed to deal with clean up a bit better (if two stat tracers were the
+same, it would have the same files).
+
+But to make the code cleaner, all we needed to do is to keep the
+all_stat_sessions_mutex held for most of the registering function.
+
+Link: http://lkml.kernel.org/r/1410299375-20068-1-git-send-email-luis.henriques@canonical.com
+
+Fixes: 002bb86d8d42f ("tracing/ftrace: separate events tracing and stats tracing engine")
+Reported-by: Luis Henriques <luis.henriques@canonical.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_stat.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index 1257dc6c07796..3c9c17feea333 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -310,7 +310,7 @@ static int init_stat_file(struct stat_session *session)
+ int register_stat_tracer(struct tracer_stat *trace)
+ {
+ struct stat_session *session, *node;
+- int ret;
++ int ret = -EINVAL;
+
+ if (!trace)
+ return -EINVAL;
+@@ -321,17 +321,15 @@ int register_stat_tracer(struct tracer_stat *trace)
+ /* Already registered? */
+ mutex_lock(&all_stat_sessions_mutex);
+ list_for_each_entry(node, &all_stat_sessions, session_list) {
+- if (node->ts == trace) {
+- mutex_unlock(&all_stat_sessions_mutex);
+- return -EINVAL;
+- }
++ if (node->ts == trace)
++ goto out;
+ }
+- mutex_unlock(&all_stat_sessions_mutex);
+
++ ret = -ENOMEM;
+ /* Init the session */
+ session = kzalloc(sizeof(*session), GFP_KERNEL);
+ if (!session)
+- return -ENOMEM;
++ goto out;
+
+ session->ts = trace;
+ INIT_LIST_HEAD(&session->session_list);
+@@ -340,15 +338,16 @@ int register_stat_tracer(struct tracer_stat *trace)
+ ret = init_stat_file(session);
+ if (ret) {
+ destroy_session(session);
+- return ret;
++ goto out;
+ }
+
++ ret = 0;
+ /* Register */
+- mutex_lock(&all_stat_sessions_mutex);
+ list_add_tail(&session->session_list, &all_stat_sessions);
++ out:
+ mutex_unlock(&all_stat_sessions_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ void unregister_stat_tracer(struct tracer_stat *trace)
+--
+2.20.1
+
--- /dev/null
+From 71932f5d2e6dc5e5e9ae1228ac9104023025a103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 12:40:20 -0500
+Subject: tracing: Simplify assignment parsing for hist triggers
+
+From: Tom Zanussi <zanussi@kernel.org>
+
+[ Upstream commit b527b638fd63ba791dc90a0a6e9a3035b10df52b ]
+
+In the process of adding better error messages for sorting, I realized
+that strsep was being used incorrectly and some of the error paths I
+was expecting to be hit weren't and just fell through to the common
+invalid key error case.
+
+It also became obvious that for keyword assignments, it wasn't
+necessary to save the full assignment and reparse it later, and having
+a common empty-assignment check would also make more sense in terms of
+error processing.
+
+Change the code to fix these problems and simplify it for new error
+message changes in a subsequent patch.
+
+Link: http://lkml.kernel.org/r/1c3ef0b6655deaf345f6faee2584a0298ac2d743.1561743018.git.zanussi@kernel.org
+
+Fixes: e62347d24534 ("tracing: Add hist trigger support for user-defined sorting ('sort=' param)")
+Fixes: 7ef224d1d0e3 ("tracing: Add 'hist' event trigger command")
+Fixes: a4072fe85ba3 ("tracing: Add a clock attribute for hist triggers")
+Reported-by: Masami Hiramatsu <mhiramat@kernel.org>
+Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Tom Zanussi <zanussi@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_hist.c | 70 ++++++++++++--------------------
+ 1 file changed, 27 insertions(+), 43 deletions(-)
+
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index 4be7fc84d6b6a..a31be3fce3e8e 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -2037,12 +2037,6 @@ static int parse_map_size(char *str)
+ unsigned long size, map_bits;
+ int ret;
+
+- strsep(&str, "=");
+- if (!str) {
+- ret = -EINVAL;
+- goto out;
+- }
+-
+ ret = kstrtoul(str, 0, &size);
+ if (ret)
+ goto out;
+@@ -2102,25 +2096,25 @@ static int parse_action(char *str, struct hist_trigger_attrs *attrs)
+ static int parse_assignment(struct trace_array *tr,
+ char *str, struct hist_trigger_attrs *attrs)
+ {
+- int ret = 0;
++ int len, ret = 0;
+
+- if ((str_has_prefix(str, "key=")) ||
+- (str_has_prefix(str, "keys="))) {
+- attrs->keys_str = kstrdup(str, GFP_KERNEL);
++ if ((len = str_has_prefix(str, "key=")) ||
++ (len = str_has_prefix(str, "keys="))) {
++ attrs->keys_str = kstrdup(str + len, GFP_KERNEL);
+ if (!attrs->keys_str) {
+ ret = -ENOMEM;
+ goto out;
+ }
+- } else if ((str_has_prefix(str, "val=")) ||
+- (str_has_prefix(str, "vals=")) ||
+- (str_has_prefix(str, "values="))) {
+- attrs->vals_str = kstrdup(str, GFP_KERNEL);
++ } else if ((len = str_has_prefix(str, "val=")) ||
++ (len = str_has_prefix(str, "vals=")) ||
++ (len = str_has_prefix(str, "values="))) {
++ attrs->vals_str = kstrdup(str + len, GFP_KERNEL);
+ if (!attrs->vals_str) {
+ ret = -ENOMEM;
+ goto out;
+ }
+- } else if (str_has_prefix(str, "sort=")) {
+- attrs->sort_key_str = kstrdup(str, GFP_KERNEL);
++ } else if ((len = str_has_prefix(str, "sort="))) {
++ attrs->sort_key_str = kstrdup(str + len, GFP_KERNEL);
+ if (!attrs->sort_key_str) {
+ ret = -ENOMEM;
+ goto out;
+@@ -2131,12 +2125,8 @@ static int parse_assignment(struct trace_array *tr,
+ ret = -ENOMEM;
+ goto out;
+ }
+- } else if (str_has_prefix(str, "clock=")) {
+- strsep(&str, "=");
+- if (!str) {
+- ret = -EINVAL;
+- goto out;
+- }
++ } else if ((len = str_has_prefix(str, "clock="))) {
++ str += len;
+
+ str = strstrip(str);
+ attrs->clock = kstrdup(str, GFP_KERNEL);
+@@ -2144,8 +2134,8 @@ static int parse_assignment(struct trace_array *tr,
+ ret = -ENOMEM;
+ goto out;
+ }
+- } else if (str_has_prefix(str, "size=")) {
+- int map_bits = parse_map_size(str);
++ } else if ((len = str_has_prefix(str, "size="))) {
++ int map_bits = parse_map_size(str + len);
+
+ if (map_bits < 0) {
+ ret = map_bits;
+@@ -2185,8 +2175,14 @@ parse_hist_trigger_attrs(struct trace_array *tr, char *trigger_str)
+
+ while (trigger_str) {
+ char *str = strsep(&trigger_str, ":");
++ char *rhs;
+
+- if (strchr(str, '=')) {
++ rhs = strchr(str, '=');
++ if (rhs) {
++ if (!strlen(++rhs)) {
++ ret = -EINVAL;
++ goto free;
++ }
+ ret = parse_assignment(tr, str, attrs);
+ if (ret)
+ goto free;
+@@ -4559,10 +4555,6 @@ static int create_val_fields(struct hist_trigger_data *hist_data,
+ if (!fields_str)
+ goto out;
+
+- strsep(&fields_str, "=");
+- if (!fields_str)
+- goto out;
+-
+ for (i = 0, j = 1; i < TRACING_MAP_VALS_MAX &&
+ j < TRACING_MAP_VALS_MAX; i++) {
+ field_str = strsep(&fields_str, ",");
+@@ -4657,10 +4649,6 @@ static int create_key_fields(struct hist_trigger_data *hist_data,
+ if (!fields_str)
+ goto out;
+
+- strsep(&fields_str, "=");
+- if (!fields_str)
+- goto out;
+-
+ for (i = n_vals; i < n_vals + TRACING_MAP_KEYS_MAX; i++) {
+ field_str = strsep(&fields_str, ",");
+ if (!field_str)
+@@ -4818,12 +4806,6 @@ static int create_sort_keys(struct hist_trigger_data *hist_data)
+ if (!fields_str)
+ goto out;
+
+- strsep(&fields_str, "=");
+- if (!fields_str) {
+- ret = -EINVAL;
+- goto out;
+- }
+-
+ for (i = 0; i < TRACING_MAP_SORT_KEYS_MAX; i++) {
+ struct hist_field *hist_field;
+ char *field_str, *field_name;
+@@ -4832,9 +4814,11 @@ static int create_sort_keys(struct hist_trigger_data *hist_data)
+ sort_key = &hist_data->sort_keys[i];
+
+ field_str = strsep(&fields_str, ",");
+- if (!field_str) {
+- if (i == 0)
+- ret = -EINVAL;
++ if (!field_str)
++ break;
++
++ if (!*field_str) {
++ ret = -EINVAL;
+ break;
+ }
+
+@@ -4844,7 +4828,7 @@ static int create_sort_keys(struct hist_trigger_data *hist_data)
+ }
+
+ field_name = strsep(&field_str, ".");
+- if (!field_name) {
++ if (!field_name || !*field_name) {
+ ret = -EINVAL;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From ceb227de08398d9b7eeb228c1f92e0eb5f9845ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 10:03:06 +0300
+Subject: trigger_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 6722b23e7a2ace078344064a9735fb73e554e9ef ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+Without patch:
+ # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger
+ dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset
+ n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ # Available triggers:
+ # traceon traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ 6+1 records in
+ 6+1 records out
+ 206 bytes copied, 0.00027916 s, 738 kB/s
+
+Notice the printing of "# Available triggers:..." after the line.
+
+With the patch:
+ # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger
+ dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset
+ n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ 2+1 records in
+ 2+1 records out
+ 88 bytes copied, 0.000526867 s, 167 kB/s
+
+It only prints the end of the file, and does not restart.
+
+Link: http://lkml.kernel.org/r/3c35ee24-dd3a-8119-9c19-552ed253388a@virtuozzo.com
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_trigger.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 40106fff06a48..287d77eae59b3 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -116,9 +116,10 @@ static void *trigger_next(struct seq_file *m, void *t, loff_t *pos)
+ {
+ struct trace_event_file *event_file = event_file_data(m->private);
+
+- if (t == SHOW_AVAILABLE_TRIGGERS)
++ if (t == SHOW_AVAILABLE_TRIGGERS) {
++ (*pos)++;
+ return NULL;
+-
++ }
+ return seq_list_next(t, &event_file->triggers, pos);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d125cce3e46fbe836811b367ca3b878eb2030717 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 19:39:13 -0700
+Subject: tty: synclink_gt: Adjust indentation in several functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 446e76873b5e4e70bdee5db2f2a894d5b4a7d081 ]
+
+Clang warns:
+
+../drivers/tty/synclink_gt.c:1337:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (C_CRTSCTS(tty)) {
+ ^
+../drivers/tty/synclink_gt.c:1335:2: note: previous statement is here
+ if (I_IXOFF(tty))
+ ^
+../drivers/tty/synclink_gt.c:2563:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+ ^
+../drivers/tty/synclink_gt.c:2561:2: note: previous statement is here
+ if (I_INPCK(info->port.tty))
+ ^
+../drivers/tty/synclink_gt.c:3221:3: warning: misleading indentation;
+statement is not part of the previous 'else' [-Wmisleading-indentation]
+ set_signals(info);
+ ^
+../drivers/tty/synclink_gt.c:3219:2: note: previous statement is here
+ else
+ ^
+3 warnings generated.
+
+The indentation on these lines is not at all consistent, tabs and spaces
+are mixed together. Convert to just using tabs to be consistent with the
+Linux kernel coding style and eliminate these warnings from clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/822
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218023912.13827-1-natechancellor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/synclink_gt.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index e8a9047de4516..36f1a4d870eb1 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -1334,10 +1334,10 @@ static void throttle(struct tty_struct * tty)
+ DBGINFO(("%s throttle\n", info->device_name));
+ if (I_IXOFF(tty))
+ send_xchar(tty, STOP_CHAR(tty));
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals &= ~SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1359,10 +1359,10 @@ static void unthrottle(struct tty_struct * tty)
+ else
+ send_xchar(tty, START_CHAR(tty));
+ }
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -2560,8 +2560,8 @@ static void change_params(struct slgt_info *info)
+ info->read_status_mask = IRQ_RXOVER;
+ if (I_INPCK(info->port.tty))
+ info->read_status_mask |= MASK_PARITY | MASK_FRAMING;
+- if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- info->read_status_mask |= MASK_BREAK;
++ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++ info->read_status_mask |= MASK_BREAK;
+ if (I_IGNPAR(info->port.tty))
+ info->ignore_status_mask |= MASK_PARITY | MASK_FRAMING;
+ if (I_IGNBRK(info->port.tty)) {
+@@ -3192,7 +3192,7 @@ static int tiocmset(struct tty_struct *tty,
+ info->signals &= ~SerialSignal_DTR;
+
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return 0;
+ }
+@@ -3203,7 +3203,7 @@ static int carrier_raised(struct tty_port *port)
+ struct slgt_info *info = container_of(port, struct slgt_info, port);
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return (info->signals & SerialSignal_DCD) ? 1 : 0;
+ }
+@@ -3218,7 +3218,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ info->signals |= SerialSignal_RTS | SerialSignal_DTR;
+ else
+ info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4307eb6b9bdcf563ec410ba86c9382ebebff8c31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 19:47:20 -0700
+Subject: tty: synclinkmp: Adjust indentation in several functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 1feedf61e7265128244f6993f23421f33dd93dbc ]
+
+Clang warns:
+
+../drivers/tty/synclinkmp.c:1456:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (C_CRTSCTS(tty)) {
+ ^
+../drivers/tty/synclinkmp.c:1453:2: note: previous statement is here
+ if (I_IXOFF(tty))
+ ^
+../drivers/tty/synclinkmp.c:2473:8: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ info->port.tty->hw_stopped = 0;
+ ^
+../drivers/tty/synclinkmp.c:2471:7: note: previous statement is here
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ ^
+../drivers/tty/synclinkmp.c:2482:8: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ info->port.tty->hw_stopped = 1;
+ ^
+../drivers/tty/synclinkmp.c:2480:7: note: previous statement is here
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ ^
+../drivers/tty/synclinkmp.c:2809:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+ ^
+../drivers/tty/synclinkmp.c:2807:2: note: previous statement is here
+ if (I_INPCK(info->port.tty))
+ ^
+../drivers/tty/synclinkmp.c:3246:3: warning: misleading indentation;
+statement is not part of the previous 'else' [-Wmisleading-indentation]
+ set_signals(info);
+ ^
+../drivers/tty/synclinkmp.c:3244:2: note: previous statement is here
+ else
+ ^
+5 warnings generated.
+
+The indentation on these lines is not at all consistent, tabs and spaces
+are mixed together. Convert to just using tabs to be consistent with the
+Linux kernel coding style and eliminate these warnings from clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/823
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218024720.3528-1-natechancellor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/synclinkmp.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
+index fcb91bf7a15ba..54b897a646d02 100644
+--- a/drivers/tty/synclinkmp.c
++++ b/drivers/tty/synclinkmp.c
+@@ -1453,10 +1453,10 @@ static void throttle(struct tty_struct * tty)
+ if (I_IXOFF(tty))
+ send_xchar(tty, STOP_CHAR(tty));
+
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->serial_signals &= ~SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1482,10 +1482,10 @@ static void unthrottle(struct tty_struct * tty)
+ send_xchar(tty, START_CHAR(tty));
+ }
+
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->serial_signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -2470,7 +2470,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ if (status & SerialSignal_CTS) {
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ printk("CTS tx start...");
+- info->port.tty->hw_stopped = 0;
++ info->port.tty->hw_stopped = 0;
+ tx_start(info);
+ info->pending_bh |= BH_TRANSMIT;
+ return;
+@@ -2479,7 +2479,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ if (!(status & SerialSignal_CTS)) {
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ printk("CTS tx stop...");
+- info->port.tty->hw_stopped = 1;
++ info->port.tty->hw_stopped = 1;
+ tx_stop(info);
+ }
+ }
+@@ -2806,8 +2806,8 @@ static void change_params(SLMP_INFO *info)
+ info->read_status_mask2 = OVRN;
+ if (I_INPCK(info->port.tty))
+ info->read_status_mask2 |= PE | FRME;
+- if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- info->read_status_mask1 |= BRKD;
++ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++ info->read_status_mask1 |= BRKD;
+ if (I_IGNPAR(info->port.tty))
+ info->ignore_status_mask2 |= PE | FRME;
+ if (I_IGNBRK(info->port.tty)) {
+@@ -3177,7 +3177,7 @@ static int tiocmget(struct tty_struct *tty)
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ result = ((info->serial_signals & SerialSignal_RTS) ? TIOCM_RTS : 0) |
+@@ -3215,7 +3215,7 @@ static int tiocmset(struct tty_struct *tty,
+ info->serial_signals &= ~SerialSignal_DTR;
+
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ return 0;
+@@ -3227,7 +3227,7 @@ static int carrier_raised(struct tty_port *port)
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ return (info->serial_signals & SerialSignal_DCD) ? 1 : 0;
+@@ -3243,7 +3243,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ info->serial_signals |= SerialSignal_RTS | SerialSignal_DTR;
+ else
+ info->serial_signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2e3bc1824b1bd7ca5f6e7d8b251857c0a80e166f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 12:11:14 +0100
+Subject: udf: Allow writing to 'Rewritable' partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 15fb05fd286ac57a0802d71624daeb5c1c2d5b07 ]
+
+UDF 2.60 standard states in section 2.2.14.2:
+
+ A partition with Access Type 3 (rewritable) shall define a Freed
+ Space Bitmap or a Freed Space Table, see 2.3.3. All other partitions
+ shall not define a Freed Space Bitmap or a Freed Space Table.
+
+ Rewritable partitions are used on media that require some form of
+ preprocessing before re-writing data (for example legacy MO). Such
+ partitions shall use Access Type 3.
+
+ Overwritable partitions are used on media that do not require
+ preprocessing before overwriting data (for example: CD-RW, DVD-RW,
+ DVD+RW, DVD-RAM, BD-RE, HD DVD-Rewritable). Such partitions shall
+ use Access Type 4.
+
+however older versions of the standard didn't have this wording and
+there are tools out there that create UDF filesystems with rewritable
+partitions but that don't contain a Freed Space Bitmap or a Freed Space
+Table on media that does not require pre-processing before overwriting a
+block. So instead of forcing media with rewritable partition read-only,
+base this decision on presence of a Freed Space Bitmap or a Freed Space
+Table.
+
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Fixes: b085fbe2ef7f ("udf: Fix crash during mount")
+Link: https://lore.kernel.org/linux-fsdevel/20200112144735.hj2emsoy4uwsouxz@pali
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 8c28e93e9b730..008bf96b1732d 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -1035,7 +1035,6 @@ static int check_partition_desc(struct super_block *sb,
+ switch (le32_to_cpu(p->accessType)) {
+ case PD_ACCESS_TYPE_READ_ONLY:
+ case PD_ACCESS_TYPE_WRITE_ONCE:
+- case PD_ACCESS_TYPE_REWRITABLE:
+ case PD_ACCESS_TYPE_NONE:
+ goto force_ro;
+ }
+--
+2.20.1
+
--- /dev/null
+From 2199bc41790e91ae18c0699d3d4f4fc1c0b65a6b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:36:49 +0100
+Subject: udf: Fix free space reporting for metadata and virtual partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit a4a8b99ec819ca60b49dc582a4287ef03411f117 ]
+
+Free space on filesystems with metadata or virtual partition maps
+currently gets misreported. This is because these partitions are just
+remapped onto underlying real partitions from which keep track of free
+blocks. Take this remapping into account when counting free blocks as
+well.
+
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 008bf96b1732d..4baa1ca91e9be 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -2491,17 +2491,29 @@ static unsigned int udf_count_free_table(struct super_block *sb,
+ static unsigned int udf_count_free(struct super_block *sb)
+ {
+ unsigned int accum = 0;
+- struct udf_sb_info *sbi;
++ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct udf_part_map *map;
++ unsigned int part = sbi->s_partition;
++ int ptype = sbi->s_partmaps[part].s_partition_type;
++
++ if (ptype == UDF_METADATA_MAP25) {
++ part = sbi->s_partmaps[part].s_type_specific.s_metadata.
++ s_phys_partition_ref;
++ } else if (ptype == UDF_VIRTUAL_MAP15 || ptype == UDF_VIRTUAL_MAP20) {
++ /*
++ * Filesystems with VAT are append-only and we cannot write to
++ * them. Let's just report 0 here.
++ */
++ return 0;
++ }
+
+- sbi = UDF_SB(sb);
+ if (sbi->s_lvid_bh) {
+ struct logicalVolIntegrityDesc *lvid =
+ (struct logicalVolIntegrityDesc *)
+ sbi->s_lvid_bh->b_data;
+- if (le32_to_cpu(lvid->numOfPartitions) > sbi->s_partition) {
++ if (le32_to_cpu(lvid->numOfPartitions) > part) {
+ accum = le32_to_cpu(
+- lvid->freeSpaceTable[sbi->s_partition]);
++ lvid->freeSpaceTable[part]);
+ if (accum == 0xFFFFFFFF)
+ accum = 0;
+ }
+@@ -2510,7 +2522,7 @@ static unsigned int udf_count_free(struct super_block *sb)
+ if (accum)
+ return accum;
+
+- map = &sbi->s_partmaps[sbi->s_partition];
++ map = &sbi->s_partmaps[part];
+ if (map->s_partition_flags & UDF_PART_FLAG_UNALLOC_BITMAP) {
+ accum += udf_count_free_bitmap(sb,
+ map->s_uspace.s_bitmap);
+--
+2.20.1
+
--- /dev/null
+From 42f3cf5bec9b4df8be189004d96386b6074263fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 17:44:05 +0800
+Subject: uio: fix a sleep-in-atomic-context bug in
+ uio_dmem_genirq_irqcontrol()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit b74351287d4bd90636c3f48bc188c2f53824c2d4 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+kernel/irq/manage.c, 523:
+ synchronize_irq in disable_irq
+drivers/uio/uio_dmem_genirq.c, 140:
+ disable_irq in uio_dmem_genirq_irqcontrol
+drivers/uio/uio_dmem_genirq.c, 134:
+ _raw_spin_lock_irqsave in uio_dmem_genirq_irqcontrol
+
+synchronize_irq() can sleep at runtime.
+
+To fix this bug, disable_irq() is called without holding the spinlock.
+
+This bug is found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20191218094405.6009-1-baijiaju1990@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/uio/uio_dmem_genirq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
+index ebcf1434e296d..44858f70f5f52 100644
+--- a/drivers/uio/uio_dmem_genirq.c
++++ b/drivers/uio/uio_dmem_genirq.c
+@@ -132,11 +132,13 @@ static int uio_dmem_genirq_irqcontrol(struct uio_info *dev_info, s32 irq_on)
+ if (irq_on) {
+ if (test_and_clear_bit(0, &priv->flags))
+ enable_irq(dev_info->irq);
++ spin_unlock_irqrestore(&priv->lock, flags);
+ } else {
+- if (!test_and_set_bit(0, &priv->flags))
++ if (!test_and_set_bit(0, &priv->flags)) {
++ spin_unlock_irqrestore(&priv->lock, flags);
+ disable_irq(dev_info->irq);
++ }
+ }
+- spin_unlock_irqrestore(&priv->lock, flags);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From f65dd5fa51c4793627497f09070ce9e45640c5c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 11:34:31 +0000
+Subject: usb: dwc2: Fix IN FIFO allocation
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit 644139f8b64d818f6345351455f14471510879a5 ]
+
+On chips with fewer FIFOs than endpoints (for example RK3288 which has 9
+endpoints, but only 6 which are cabable of input), the DPTXFSIZN
+registers above the FIFO count may return invalid values.
+
+With logging added on startup, I see:
+
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=1 sz=256
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=2 sz=128
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=3 sz=128
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=4 sz=64
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=5 sz=64
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=6 sz=32
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=7 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=8 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=9 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=10 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=11 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=12 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=13 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=14 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=15 sz=0
+
+but:
+
+ # cat /sys/kernel/debug/ff580000.usb/fifo
+ Non-periodic FIFOs:
+ RXFIFO: Size 275
+ NPTXFIFO: Size 16, Start 0x00000113
+
+ Periodic TXFIFOs:
+ DPTXFIFO 1: Size 256, Start 0x00000123
+ DPTXFIFO 2: Size 128, Start 0x00000223
+ DPTXFIFO 3: Size 128, Start 0x000002a3
+ DPTXFIFO 4: Size 64, Start 0x00000323
+ DPTXFIFO 5: Size 64, Start 0x00000363
+ DPTXFIFO 6: Size 32, Start 0x000003a3
+ DPTXFIFO 7: Size 0, Start 0x000003e3
+ DPTXFIFO 8: Size 0, Start 0x000003a3
+ DPTXFIFO 9: Size 256, Start 0x00000123
+
+so it seems that FIFO 9 is mirroring FIFO 1.
+
+Fix the allocation by using the FIFO count instead of the endpoint count
+when selecting a FIFO for an endpoint.
+
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index 6be10e496e105..a9133773b89e4 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -4056,11 +4056,12 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
+ * a unique tx-fifo even if it is non-periodic.
+ */
+ if (dir_in && hsotg->dedicated_fifos) {
++ unsigned fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+ u32 fifo_index = 0;
+ u32 fifo_size = UINT_MAX;
+
+ size = hs_ep->ep.maxpacket * hs_ep->mc;
+- for (i = 1; i < hsotg->num_of_eps; ++i) {
++ for (i = 1; i <= fifo_count; ++i) {
+ if (hsotg->fifo_map & (1 << i))
+ continue;
+ val = dwc2_readl(hsotg, DPTXFSIZN(i));
+--
+2.20.1
+
--- /dev/null
+From e06c14f2d9d67cee4db63d8adcd888f6ed3c1c1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 09:46:23 -0800
+Subject: usb: dwc3: use proper initializers for property entries
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+[ Upstream commit 5eb5afb07853d6e90d3a2b230c825e028e948f79 ]
+
+We should not be reaching into property entries and initialize them by
+hand, but rather use proper initializer macros. This way we can alter
+internal representation of property entries with no visible changes to
+their users.
+
+Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/host.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/host.c b/drivers/usb/dwc3/host.c
+index 5567ed2cddbec..fa252870c926f 100644
+--- a/drivers/usb/dwc3/host.c
++++ b/drivers/usb/dwc3/host.c
+@@ -88,10 +88,10 @@ int dwc3_host_init(struct dwc3 *dwc)
+ memset(props, 0, sizeof(struct property_entry) * ARRAY_SIZE(props));
+
+ if (dwc->usb3_lpm_capable)
+- props[prop_idx++].name = "usb3-lpm-capable";
++ props[prop_idx++] = PROPERTY_ENTRY_BOOL("usb3-lpm-capable");
+
+ if (dwc->usb2_lpm_disable)
+- props[prop_idx++].name = "usb2-lpm-disable";
++ props[prop_idx++] = PROPERTY_ENTRY_BOOL("usb2-lpm-disable");
+
+ /**
+ * WORKAROUND: dwc3 revisions <=3.00a have a limitation
+@@ -103,7 +103,7 @@ int dwc3_host_init(struct dwc3 *dwc)
+ * This following flag tells XHCI to do just that.
+ */
+ if (dwc->revision <= DWC3_REVISION_300A)
+- props[prop_idx++].name = "quirk-broken-port-ped";
++ props[prop_idx++] = PROPERTY_ENTRY_BOOL("quirk-broken-port-ped");
+
+ if (prop_idx) {
+ ret = platform_device_add_properties(xhci, props);
+--
+2.20.1
+
--- /dev/null
+From f821e69ac933918b142b3c8b35fbb7f0d4798e82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:43:49 +0800
+Subject: usb: gadget: udc: fix possible sleep-in-atomic-context bugs in
+ gr_probe()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 9c1ed62ae0690dfe5d5e31d8f70e70a95cb48e52 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/usb/gadget/udc/core.c, 1175:
+ kzalloc(GFP_KERNEL) in usb_add_gadget_udc_release
+drivers/usb/gadget/udc/core.c, 1272:
+ usb_add_gadget_udc_release in usb_add_gadget_udc
+drivers/usb/gadget/udc/gr_udc.c, 2186:
+ usb_add_gadget_udc in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+drivers/usb/gadget/udc/core.c, 1195:
+ mutex_lock in usb_add_gadget_udc_release
+drivers/usb/gadget/udc/core.c, 1272:
+ usb_add_gadget_udc_release in usb_add_gadget_udc
+drivers/usb/gadget/udc/gr_udc.c, 2186:
+ usb_add_gadget_udc in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+drivers/usb/gadget/udc/gr_udc.c, 212:
+ debugfs_create_file in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2197:
+ gr_dfs_create in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+drivers/usb/gadget/udc/gr_udc.c, 2114:
+ devm_request_threaded_irq in gr_request_irq
+drivers/usb/gadget/udc/gr_udc.c, 2202:
+ gr_request_irq in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+kzalloc(GFP_KERNEL), mutex_lock(), debugfs_create_file() and
+devm_request_threaded_irq() can sleep at runtime.
+
+To fix these possible bugs, usb_add_gadget_udc(), gr_dfs_create() and
+gr_request_irq() are called without handling the spinlock.
+
+These bugs are found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/gr_udc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index 7a0e9a58c2d84..116d386472efe 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -2176,8 +2176,6 @@ static int gr_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- spin_lock(&dev->lock);
+-
+ /* Inside lock so that no gadget can use this udc until probe is done */
+ retval = usb_add_gadget_udc(dev->dev, &dev->gadget);
+ if (retval) {
+@@ -2186,15 +2184,21 @@ static int gr_probe(struct platform_device *pdev)
+ }
+ dev->added = 1;
+
++ spin_lock(&dev->lock);
++
+ retval = gr_udc_init(dev);
+- if (retval)
++ if (retval) {
++ spin_unlock(&dev->lock);
+ goto out;
+-
+- gr_dfs_create(dev);
++ }
+
+ /* Clear all interrupt enables that might be left on since last boot */
+ gr_disable_interrupts_and_pullup(dev);
+
++ spin_unlock(&dev->lock);
++
++ gr_dfs_create(dev);
++
+ retval = gr_request_irq(dev, dev->irq);
+ if (retval) {
+ dev_err(dev->dev, "Failed to request irq %d\n", dev->irq);
+@@ -2223,8 +2227,6 @@ static int gr_probe(struct platform_device *pdev)
+ dev_info(dev->dev, "regs: %p, irq %d\n", dev->regs, dev->irq);
+
+ out:
+- spin_unlock(&dev->lock);
+-
+ if (retval)
+ gr_remove(pdev);
+
+--
+2.20.1
+
--- /dev/null
+From ecaeb587a78859a48f9608068f7efde3c7dae3ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 07:25:26 -0600
+Subject: usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 91b6dec32e5c25fbdbb564d1e5af23764ec17ef1 ]
+
+We currently have musb_set_vbus() called from two different paths. Mostly
+it gets called from the USB PHY via omap_musb_set_mailbox(), but in some
+cases it can get also called from musb_stage0_irq() rather via .set_vbus:
+
+(musb_set_host [musb_hdrc])
+(omap2430_musb_set_vbus [omap2430])
+(musb_stage0_irq [musb_hdrc])
+(musb_interrupt [musb_hdrc])
+(omap2430_musb_interrupt [omap2430])
+
+This is racy and will not work with introducing generic helper functions
+for musb_set_host() and musb_set_peripheral(). We want to get rid of the
+busy loops in favor of usleep_range().
+
+Let's just get rid of .set_vbus for omap2430 glue layer and let the PHY
+code handle VBUS with musb_set_vbus(). Note that in the follow-up patch
+we can completely remove omap2430_musb_set_vbus(), but let's do it in a
+separate patch as this change may actually turn out to be needed as a
+fix.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200115132547.364-5-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/musb/omap2430.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index a3d2fef677468..5c93226e0e20a 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -361,8 +361,6 @@ static const struct musb_platform_ops omap2430_ops = {
+ .init = omap2430_musb_init,
+ .exit = omap2430_musb_exit,
+
+- .set_vbus = omap2430_musb_set_vbus,
+-
+ .enable = omap2430_musb_enable,
+ .disable = omap2430_musb_disable,
+
+--
+2.20.1
+
--- /dev/null
+From 83b1879518cc2f57e0f797de3f81c27ff7e63fac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 18:24:16 -0700
+Subject: usbip: Fix unsafe unaligned pointer usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 585c91f40d201bc564d4e76b83c05b3b5363fe7e ]
+
+Fix unsafe unaligned pointer usage in usbip network interfaces. usbip tool
+build fails with new gcc -Werror=address-of-packed-member checks.
+
+usbip_network.c: In function ‘usbip_net_pack_usb_device’:
+usbip_network.c:79:32: error: taking address of packed member of ‘struct usbip_usb_device’ may result in an unaligned pointer value [-Werror=address-of-packed-member]
+ 79 | usbip_net_pack_uint32_t(pack, &udev->busnum);
+
+Fix with minor changes to pass by value instead of by address.
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20200109012416.2875-1-skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/usb/usbip/src/usbip_network.c | 40 +++++++++++++++++------------
+ tools/usb/usbip/src/usbip_network.h | 12 +++------
+ 2 files changed, 27 insertions(+), 25 deletions(-)
+
+diff --git a/tools/usb/usbip/src/usbip_network.c b/tools/usb/usbip/src/usbip_network.c
+index d595d72693fbb..ed4dc8c142690 100644
+--- a/tools/usb/usbip/src/usbip_network.c
++++ b/tools/usb/usbip/src/usbip_network.c
+@@ -50,39 +50,39 @@ void usbip_setup_port_number(char *arg)
+ info("using port %d (\"%s\")", usbip_port, usbip_port_string);
+ }
+
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num)
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num)
+ {
+ uint32_t i;
+
+ if (pack)
+- i = htonl(*num);
++ i = htonl(num);
+ else
+- i = ntohl(*num);
++ i = ntohl(num);
+
+- *num = i;
++ return i;
+ }
+
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num)
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num)
+ {
+ uint16_t i;
+
+ if (pack)
+- i = htons(*num);
++ i = htons(num);
+ else
+- i = ntohs(*num);
++ i = ntohs(num);
+
+- *num = i;
++ return i;
+ }
+
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev)
+ {
+- usbip_net_pack_uint32_t(pack, &udev->busnum);
+- usbip_net_pack_uint32_t(pack, &udev->devnum);
+- usbip_net_pack_uint32_t(pack, &udev->speed);
++ udev->busnum = usbip_net_pack_uint32_t(pack, udev->busnum);
++ udev->devnum = usbip_net_pack_uint32_t(pack, udev->devnum);
++ udev->speed = usbip_net_pack_uint32_t(pack, udev->speed);
+
+- usbip_net_pack_uint16_t(pack, &udev->idVendor);
+- usbip_net_pack_uint16_t(pack, &udev->idProduct);
+- usbip_net_pack_uint16_t(pack, &udev->bcdDevice);
++ udev->idVendor = usbip_net_pack_uint16_t(pack, udev->idVendor);
++ udev->idProduct = usbip_net_pack_uint16_t(pack, udev->idProduct);
++ udev->bcdDevice = usbip_net_pack_uint16_t(pack, udev->bcdDevice);
+ }
+
+ void usbip_net_pack_usb_interface(int pack __attribute__((unused)),
+@@ -129,6 +129,14 @@ ssize_t usbip_net_send(int sockfd, void *buff, size_t bufflen)
+ return usbip_net_xmit(sockfd, buff, bufflen, 1);
+ }
+
++static inline void usbip_net_pack_op_common(int pack,
++ struct op_common *op_common)
++{
++ op_common->version = usbip_net_pack_uint16_t(pack, op_common->version);
++ op_common->code = usbip_net_pack_uint16_t(pack, op_common->code);
++ op_common->status = usbip_net_pack_uint32_t(pack, op_common->status);
++}
++
+ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ {
+ struct op_common op_common;
+@@ -140,7 +148,7 @@ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ op_common.code = code;
+ op_common.status = status;
+
+- PACK_OP_COMMON(1, &op_common);
++ usbip_net_pack_op_common(1, &op_common);
+
+ rc = usbip_net_send(sockfd, &op_common, sizeof(op_common));
+ if (rc < 0) {
+@@ -164,7 +172,7 @@ int usbip_net_recv_op_common(int sockfd, uint16_t *code, int *status)
+ goto err;
+ }
+
+- PACK_OP_COMMON(0, &op_common);
++ usbip_net_pack_op_common(0, &op_common);
+
+ if (op_common.version != USBIP_VERSION) {
+ err("USBIP Kernel and tool version mismatch: %d %d:",
+diff --git a/tools/usb/usbip/src/usbip_network.h b/tools/usb/usbip/src/usbip_network.h
+index 555215eae43e9..83b4c5344f721 100644
+--- a/tools/usb/usbip/src/usbip_network.h
++++ b/tools/usb/usbip/src/usbip_network.h
+@@ -32,12 +32,6 @@ struct op_common {
+
+ } __attribute__((packed));
+
+-#define PACK_OP_COMMON(pack, op_common) do {\
+- usbip_net_pack_uint16_t(pack, &(op_common)->version);\
+- usbip_net_pack_uint16_t(pack, &(op_common)->code);\
+- usbip_net_pack_uint32_t(pack, &(op_common)->status);\
+-} while (0)
+-
+ /* ---------------------------------------------------------------------- */
+ /* Dummy Code */
+ #define OP_UNSPEC 0x00
+@@ -163,11 +157,11 @@ struct op_devlist_reply_extra {
+ } while (0)
+
+ #define PACK_OP_DEVLIST_REPLY(pack, reply) do {\
+- usbip_net_pack_uint32_t(pack, &(reply)->ndev);\
++ (reply)->ndev = usbip_net_pack_uint32_t(pack, (reply)->ndev);\
+ } while (0)
+
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num);
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num);
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num);
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num);
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev);
+ void usbip_net_pack_usb_interface(int pack, struct usbip_usb_interface *uinf);
+
+--
+2.20.1
+
--- /dev/null
+From de58a9036a804cccff69ff1ddaa43ba91a88443d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 12:09:27 +1100
+Subject: vfio/spapr/nvlink2: Skip unpinning pages on error exit
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 338b4e10f939a71194d8ecef7ece205a942cec05 ]
+
+The nvlink2 subdriver for IBM Witherspoon machines preregisters
+GPU memory in the IOMMI API so KVM TCE code can map this memory
+for DMA as well. This is done by mm_iommu_newdev() called from
+vfio_pci_nvgpu_regops::mmap.
+
+In an unlikely event of failure the data->mem remains NULL and
+since mm_iommu_put() (which unregisters the region and unpins memory
+if that was regular memory) does not expect mem=NULL, it should not be
+called.
+
+This adds a check to only call mm_iommu_put() for a valid data->mem.
+
+Fixes: 7f92891778df ("vfio_pci: Add NVIDIA GV100GL [Tesla V100 SXM2] subdriver")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci_nvlink2.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci_nvlink2.c b/drivers/vfio/pci/vfio_pci_nvlink2.c
+index f2983f0f84bea..3f5f8198a6bb1 100644
+--- a/drivers/vfio/pci/vfio_pci_nvlink2.c
++++ b/drivers/vfio/pci/vfio_pci_nvlink2.c
+@@ -97,8 +97,10 @@ static void vfio_pci_nvgpu_release(struct vfio_pci_device *vdev,
+
+ /* If there were any mappings at all... */
+ if (data->mm) {
+- ret = mm_iommu_put(data->mm, data->mem);
+- WARN_ON(ret);
++ if (data->mem) {
++ ret = mm_iommu_put(data->mm, data->mem);
++ WARN_ON(ret);
++ }
+
+ mmdrop(data->mm);
+ }
+--
+2.20.1
+
--- /dev/null
+From a2edc967f4ca59fb19e743e9d58081983ac7fd82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 02:40:58 -0500
+Subject: virtio_balloon: prevent pfn array overflow
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 6e9826e77249355c09db6ba41cd3f84e89f4b614 ]
+
+Make sure, at build time, that pfn array is big enough to hold a single
+page. It happens to be true since the PAGE_SHIFT value at the moment is
+20, which is 1M - exactly 256 4K balloon pages.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_balloon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index c962d9b370c69..d2c4eb9efd70b 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -157,6 +157,8 @@ static void set_page_pfns(struct virtio_balloon *vb,
+ {
+ unsigned int i;
+
++ BUILD_BUG_ON(VIRTIO_BALLOON_PAGES_PER_PAGE > VIRTIO_BALLOON_ARRAY_PFNS_MAX);
++
+ /*
+ * Set balloon pfns pointing at this page.
+ * Note that the first pfn points at start of the page.
+--
+2.20.1
+
--- /dev/null
+From 04f3a0693ce9e776d9dbf0e1a35659a1c24311ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:29:40 +0100
+Subject: visorbus: fix uninitialized variable access
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit caf82f727e69b647f09d57a1fc56e69d22a5f483 ]
+
+The setup_crash_devices_work_queue function only partially initializes
+the message it sends to chipset_init, leading to undefined behavior:
+
+drivers/visorbus/visorchipset.c: In function 'setup_crash_devices_work_queue':
+drivers/visorbus/visorchipset.c:333:6: error: '((unsigned char*)&msg.hdr.flags)[0]' is used uninitialized in this function [-Werror=uninitialized]
+ if (inmsg->hdr.flags.response_expected)
+
+Set up the entire structure, zero-initializing the 'response_expected'
+flag.
+
+This was apparently found by the patch that added the -O3 build option
+in Kconfig.
+
+Fixes: 12e364b9f08a ("staging: visorchipset driver to provide registration and other services")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107202950.782951-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/visorbus/visorchipset.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c
+index ca752b8f495fa..cb1eb7e05f871 100644
+--- a/drivers/visorbus/visorchipset.c
++++ b/drivers/visorbus/visorchipset.c
+@@ -1210,14 +1210,17 @@ static void setup_crash_devices_work_queue(struct work_struct *work)
+ {
+ struct controlvm_message local_crash_bus_msg;
+ struct controlvm_message local_crash_dev_msg;
+- struct controlvm_message msg;
++ struct controlvm_message msg = {
++ .hdr.id = CONTROLVM_CHIPSET_INIT,
++ .cmd.init_chipset = {
++ .bus_count = 23,
++ .switch_count = 0,
++ },
++ };
+ u32 local_crash_msg_offset;
+ u16 local_crash_msg_count;
+
+ /* send init chipset msg */
+- msg.hdr.id = CONTROLVM_CHIPSET_INIT;
+- msg.cmd.init_chipset.bus_count = 23;
+- msg.cmd.init_chipset.switch_count = 0;
+ chipset_init(&msg);
+ /* get saved message count */
+ if (visorchannel_read(chipset_dev->controlvm_channel,
+--
+2.20.1
+
--- /dev/null
+From 66a253e80cc0c93e785fffa570388be20e7edee2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:05:43 +0100
+Subject: vme: bridges: reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7483e7a939c074d887450ef1c4d9ccc5909405f8 ]
+
+With CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3, the stack usage in vme_fake
+grows above the warning limit:
+
+drivers/vme/bridges/vme_fake.c: In function 'fake_master_read':
+drivers/vme/bridges/vme_fake.c:610:1: error: the frame size of 1160 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+drivers/vme/bridges/vme_fake.c: In function 'fake_master_write':
+drivers/vme/bridges/vme_fake.c:797:1: error: the frame size of 1160 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+The problem is that in some configurations, each call to
+fake_vmereadX() puts another variable on the stack.
+
+Reduce the amount of inlining to get back to the previous state,
+with no function using more than 200 bytes each.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107200610.3482901-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vme/bridges/vme_fake.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/vme/bridges/vme_fake.c b/drivers/vme/bridges/vme_fake.c
+index 3208a4409e44e..6a1bc284f297c 100644
+--- a/drivers/vme/bridges/vme_fake.c
++++ b/drivers/vme/bridges/vme_fake.c
+@@ -414,8 +414,9 @@ static void fake_lm_check(struct fake_driver *bridge, unsigned long long addr,
+ }
+ }
+
+-static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u8 fake_vmeread8(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u8 retval = 0xff;
+ int i;
+@@ -446,8 +447,9 @@ static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+ return retval;
+ }
+
+-static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u16 fake_vmeread16(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u16 retval = 0xffff;
+ int i;
+@@ -478,8 +480,9 @@ static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+ return retval;
+ }
+
+-static u32 fake_vmeread32(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u32 fake_vmeread32(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u32 retval = 0xffffffff;
+ int i;
+@@ -609,8 +612,9 @@ out:
+ return retval;
+ }
+
+-static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite8(struct fake_driver *bridge,
++ u8 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+@@ -639,8 +643,9 @@ static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+
+ }
+
+-static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite16(struct fake_driver *bridge,
++ u16 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+@@ -669,8 +674,9 @@ static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+
+ }
+
+-static void fake_vmewrite32(struct fake_driver *bridge, u32 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite32(struct fake_driver *bridge,
++ u32 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+--
+2.20.1
+
--- /dev/null
+From 85d5004d41487fc16ff886e9cd508bfa3afa0868 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 07:00:34 +0100
+Subject: wan/hdlc_x25: fix skb handling
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 953c4a08dfc9ffe763a8340ac10f459d6c6cc4eb ]
+
+o call skb_reset_network_header() before hdlc->xmit()
+ o change skb proto to HDLC (0x0019) before hdlc->xmit()
+ o call dev_queue_xmit_nit() before hdlc->xmit()
+
+This changes make it possible to trace (tcpdump) outgoing layer2
+(ETH_P_HDLC) packets
+
+Additionally call skb_reset_network_header() after each skb_push() /
+skb_pull().
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/hdlc_x25.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
+index 5643675ff7241..bf78073ee7fd9 100644
+--- a/drivers/net/wan/hdlc_x25.c
++++ b/drivers/net/wan/hdlc_x25.c
+@@ -62,11 +62,12 @@ static int x25_data_indication(struct net_device *dev, struct sk_buff *skb)
+ {
+ unsigned char *ptr;
+
+- skb_push(skb, 1);
+-
+ if (skb_cow(skb, 1))
+ return NET_RX_DROP;
+
++ skb_push(skb, 1);
++ skb_reset_network_header(skb);
++
+ ptr = skb->data;
+ *ptr = X25_IFACE_DATA;
+
+@@ -79,6 +80,13 @@ static int x25_data_indication(struct net_device *dev, struct sk_buff *skb)
+ static void x25_data_transmit(struct net_device *dev, struct sk_buff *skb)
+ {
+ hdlc_device *hdlc = dev_to_hdlc(dev);
++
++ skb_reset_network_header(skb);
++ skb->protocol = hdlc_type_trans(skb, dev);
++
++ if (dev_nit_active(dev))
++ dev_queue_xmit_nit(skb, dev);
++
+ hdlc->xmit(skb, dev); /* Ignore return value :-( */
+ }
+
+@@ -93,6 +101,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
+ switch (skb->data[0]) {
+ case X25_IFACE_DATA: /* Data to be transmitted */
+ skb_pull(skb, 1);
++ skb_reset_network_header(skb);
+ if ((result = lapb_data_request(dev, skb)) != LAPB_OK)
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+--
+2.20.1
+
--- /dev/null
+From d697c648898d213eb3783eb0c04ffade9bf7178a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 13:04:42 +0100
+Subject: wan: ixp4xx_hss: fix compile-testing on 64-bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 504c28c853ec5c626900b914b5833daf0581a344 ]
+
+Change the driver to use portable integer types to avoid
+warnings during compile testing:
+
+drivers/net/wan/ixp4xx_hss.c:863:21: error: cast to 'u32 *' (aka 'unsigned int *') from smaller integer type 'int' [-Werror,-Wint-to-pointer-cast]
+ memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
+ ^
+drivers/net/wan/ixp4xx_hss.c:979:12: error: incompatible pointer types passing 'u32 *' (aka 'unsigned int *') to parameter of type 'dma_addr_t *' (aka 'unsigned long long *') [-Werror,-Wincompatible-pointer-types]
+ &port->desc_tab_phys)))
+ ^~~~~~~~~~~~~~~~~~~~
+include/linux/dmapool.h:27:20: note: passing argument to parameter 'handle' here
+ dma_addr_t *handle);
+ ^
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/ixp4xx_hss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
+index ea6ee6a608ce3..e7619cec978a8 100644
+--- a/drivers/net/wan/ixp4xx_hss.c
++++ b/drivers/net/wan/ixp4xx_hss.c
+@@ -258,7 +258,7 @@ struct port {
+ struct hss_plat_info *plat;
+ buffer_t *rx_buff_tab[RX_DESCS], *tx_buff_tab[TX_DESCS];
+ struct desc *desc_tab; /* coherent */
+- u32 desc_tab_phys;
++ dma_addr_t desc_tab_phys;
+ unsigned int id;
+ unsigned int clock_type, clock_rate, loopback;
+ unsigned int initialized, carrier;
+@@ -858,7 +858,7 @@ static int hss_hdlc_xmit(struct sk_buff *skb, struct net_device *dev)
+ dev->stats.tx_dropped++;
+ return NETDEV_TX_OK;
+ }
+- memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
++ memcpy_swab32(mem, (u32 *)((uintptr_t)skb->data & ~3), bytes / 4);
+ dev_kfree_skb(skb);
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 1e9bd7a7840f1c84feeb6648a94c0d063b66a704 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 19:17:02 +0100
+Subject: watchdog/softlockup: Enforce that timestamp is valid on boot
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 11e31f608b499f044f24b20be73f1dcab3e43f8a ]
+
+Robert reported that during boot the watchdog timestamp is set to 0 for one
+second which is the indicator for a watchdog reset.
+
+The reason for this is that the timestamp is in seconds and the time is
+taken from sched clock and divided by ~1e9. sched clock starts at 0 which
+means that for the first second during boot the watchdog timestamp is 0,
+i.e. reset.
+
+Use ULONG_MAX as the reset indicator value so the watchdog works correctly
+right from the start. ULONG_MAX would only conflict with a real timestamp
+if the system reaches an uptime of 136 years on 32bit and almost eternity
+on 64bit.
+
+Reported-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/87o8v3uuzl.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/watchdog.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index f41334ef09713..cbd3cf503c904 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -161,6 +161,8 @@ static void lockup_detector_update_enable(void)
+
+ #ifdef CONFIG_SOFTLOCKUP_DETECTOR
+
++#define SOFTLOCKUP_RESET ULONG_MAX
++
+ /* Global variables, exported for sysctl */
+ unsigned int __read_mostly softlockup_panic =
+ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
+@@ -274,7 +276,7 @@ notrace void touch_softlockup_watchdog_sched(void)
+ * Preemption can be enabled. It doesn't matter which CPU's timestamp
+ * gets zeroed here, so use the raw_ operation.
+ */
+- raw_cpu_write(watchdog_touch_ts, 0);
++ raw_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+
+ notrace void touch_softlockup_watchdog(void)
+@@ -298,14 +300,14 @@ void touch_all_softlockup_watchdogs(void)
+ * the softlockup check.
+ */
+ for_each_cpu(cpu, &watchdog_allowed_mask)
+- per_cpu(watchdog_touch_ts, cpu) = 0;
++ per_cpu(watchdog_touch_ts, cpu) = SOFTLOCKUP_RESET;
+ wq_watchdog_touch(-1);
+ }
+
+ void touch_softlockup_watchdog_sync(void)
+ {
+ __this_cpu_write(softlockup_touch_sync, true);
+- __this_cpu_write(watchdog_touch_ts, 0);
++ __this_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+
+ static int is_softlockup(unsigned long touch_ts)
+@@ -383,7 +385,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
+ /* .. and repeat */
+ hrtimer_forward_now(hrtimer, ns_to_ktime(sample_period));
+
+- if (touch_ts == 0) {
++ if (touch_ts == SOFTLOCKUP_RESET) {
+ if (unlikely(__this_cpu_read(softlockup_touch_sync))) {
+ /*
+ * If the time stamp was touched atomically
+--
+2.20.1
+
--- /dev/null
+From 42d447a3d79284141ea7cdaa75910370a9d27ee8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 12:09:53 +0000
+Subject: wil6210: fix break that is never reached because of zero'ing of a
+ retry counter
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5b1413f00b5beb9f5fed94e43ea0c497d5db9633 ]
+
+There is a check on the retry counter invalid_buf_id_retry that is always
+false because invalid_buf_id_retry is initialized to zero on each iteration
+of a while-loop. Fix this by initializing the retry counter before the
+while-loop starts.
+
+Addresses-Coverity: ("Logically dead code")
+Fixes: b4a967b7d0f5 ("wil6210: reset buff id in status message after completion")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/wil6210/txrx_edma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+index 04d576deae72c..6cb0d7bcfe765 100644
+--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
+@@ -880,6 +880,7 @@ static struct sk_buff *wil_sring_reap_rx_edma(struct wil6210_priv *wil,
+ u8 data_offset;
+ struct wil_rx_status_extended *s;
+ u16 sring_idx = sring - wil->srings;
++ int invalid_buff_id_retry;
+
+ BUILD_BUG_ON(sizeof(struct wil_rx_status_extended) > sizeof(skb->cb));
+
+@@ -893,9 +894,9 @@ again:
+ /* Extract the buffer ID from the status message */
+ buff_id = le16_to_cpu(wil_rx_status_get_buff_id(msg));
+
++ invalid_buff_id_retry = 0;
+ while (!buff_id) {
+ struct wil_rx_status_extended *s;
+- int invalid_buff_id_retry = 0;
+
+ wil_dbg_txrx(wil,
+ "buff_id is not updated yet by HW, (swhead 0x%x)\n",
+--
+2.20.1
+
--- /dev/null
+From 866c788a77096b2fdb258e832732bb44581ffd66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 13:11:54 +0900
+Subject: x86/decoder: Add TEST opcode to Group3-2
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 8b7e20a7ba54836076ff35a28349dabea4cec48f ]
+
+Add TEST opcode to Group3-2 reg=001b as same as Group3-1 does.
+
+Commit
+
+ 12a78d43de76 ("x86/decoder: Add new TEST instruction pattern")
+
+added a TEST opcode assignment to f6 XX/001/XXX (Group 3-1), but did
+not add f7 XX/001/XXX (Group 3-2).
+
+Actually, this TEST opcode variant (ModRM.reg /1) is not described in
+the Intel SDM Vol2 but in AMD64 Architecture Programmer's Manual Vol.3,
+Appendix A.2 Table A-6. ModRM.reg Extensions for the Primary Opcode Map.
+
+Without this fix, Randy found a warning by insn_decoder_test related
+to this issue as below.
+
+ HOSTCC arch/x86/tools/insn_decoder_test
+ HOSTCC arch/x86/tools/insn_sanity
+ TEST posttest
+ arch/x86/tools/insn_decoder_test: warning: Found an x86 instruction decoder bug, please report this.
+ arch/x86/tools/insn_decoder_test: warning: ffffffff81000bf1: f7 0b 00 01 08 00 testl $0x80100,(%rbx)
+ arch/x86/tools/insn_decoder_test: warning: objdump says 6 bytes, but insn_get_length() says 2
+ arch/x86/tools/insn_decoder_test: warning: Decoded and checked 11913894 instructions with 1 failures
+ TEST posttest
+ arch/x86/tools/insn_sanity: Success: decoded and checked 1000000 random instructions with 0 errors (seed:0x871ce29c)
+
+To fix this error, add the TEST opcode according to AMD64 APM Vol.3.
+
+ [ bp: Massage commit message. ]
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lkml.kernel.org/r/157966631413.9580.10311036595431878351.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/x86-opcode-map.txt | 2 +-
+ tools/arch/x86/lib/x86-opcode-map.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index 0a0e9112f2842..5cb9f009f2be3 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -909,7 +909,7 @@ EndTable
+
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+diff --git a/tools/arch/x86/lib/x86-opcode-map.txt b/tools/arch/x86/lib/x86-opcode-map.txt
+index 0a0e9112f2842..5cb9f009f2be3 100644
+--- a/tools/arch/x86/lib/x86-opcode-map.txt
++++ b/tools/arch/x86/lib/x86-opcode-map.txt
+@@ -909,7 +909,7 @@ EndTable
+
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+--
+2.20.1
+
--- /dev/null
+From ebdba022ffda4cedce39c25e34e28bd5acc76b6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 20:59:06 +0100
+Subject: x86/fpu: Deactivate FPU state after failure during state load
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit bbc55341b9c67645d1a5471506370caf7dd4a203 ]
+
+In __fpu__restore_sig(), fpu_fpregs_owner_ctx needs to be reset if the
+FPU state was not fully restored. Otherwise the following may happen (on
+the same CPU):
+
+ Task A Task B fpu_fpregs_owner_ctx
+ *active* A.fpu
+ __fpu__restore_sig()
+ ctx switch load B.fpu
+ *active* B.fpu
+ fpregs_lock()
+ copy_user_to_fpregs_zeroing()
+ copy_kernel_to_xregs() *modify*
+ copy_user_to_xregs() *fails*
+ fpregs_unlock()
+ ctx switch skip loading B.fpu,
+ *active* B.fpu
+
+In the success case, fpu_fpregs_owner_ctx is set to the current task.
+
+In the failure case, the FPU state might have been modified by loading
+the init state.
+
+In this case, fpu_fpregs_owner_ctx needs to be reset in order to ensure
+that the FPU state of the following task is loaded from saved state (and
+not skipped because it was the previous state).
+
+Reset fpu_fpregs_owner_ctx after a failure during restore occurred, to
+ensure that the FPU state for the next task is always loaded.
+
+The problem was debugged-by Yu-cheng Yu <yu-cheng.yu@intel.com>.
+
+ [ bp: Massage commit message. ]
+
+Fixes: 5f409e20b7945 ("x86/fpu: Defer FPU state load until return to userspace")
+Reported-by: Yu-cheng Yu <yu-cheng.yu@intel.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Fenghua Yu <fenghua.yu@intel.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Jann Horn <jannh@google.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: "Ravi V. Shankar" <ravi.v.shankar@intel.com>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20191220195906.plk6kpmsrikvbcfn@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/fpu/signal.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
+index 0071b794ed193..400a05e1c1c51 100644
+--- a/arch/x86/kernel/fpu/signal.c
++++ b/arch/x86/kernel/fpu/signal.c
+@@ -352,6 +352,7 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ fpregs_unlock();
+ return 0;
+ }
++ fpregs_deactivate(fpu);
+ fpregs_unlock();
+ }
+
+@@ -403,6 +404,8 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size)
+ }
+ if (!ret)
+ fpregs_mark_activate();
++ else
++ fpregs_deactivate(fpu);
+ fpregs_unlock();
+
+ err_out:
+--
+2.20.1
+
--- /dev/null
+From 990aecab5c859f7c5e7ec3852417888c4db688e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 18:22:36 +0100
+Subject: x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 75fbef0a8b6b4bb19b9a91b5214f846c2dc5139e ]
+
+The following commit:
+
+ 15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()")
+
+modified kernel_map_pages_in_pgd() to manage writable permissions
+of memory mappings in the EFI page table in a different way, but
+in the process, it removed the ability to clear NX attributes from
+read-only mappings, by clobbering the clear mask if _PAGE_RW is not
+being requested.
+
+Failure to remove the NX attribute from read-only mappings is
+unlikely to be a security issue, but it does prevent us from
+tightening the permissions in the EFI page tables going forward,
+so let's fix it now.
+
+Fixes: 15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20200113172245.27925-5-ardb@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pageattr.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index 0d09cc5aad614..a19a71b4d1850 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -2215,7 +2215,7 @@ int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+ .pgd = pgd,
+ .numpages = numpages,
+ .mask_set = __pgprot(0),
+- .mask_clr = __pgprot(0),
++ .mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW)),
+ .flags = 0,
+ };
+
+@@ -2224,12 +2224,6 @@ int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+ if (!(__supported_pte_mask & _PAGE_NX))
+ goto out;
+
+- if (!(page_flags & _PAGE_NX))
+- cpa.mask_clr = __pgprot(_PAGE_NX);
+-
+- if (!(page_flags & _PAGE_RW))
+- cpa.mask_clr = __pgprot(_PAGE_RW);
+-
+ if (!(page_flags & _PAGE_ENC))
+ cpa.mask_clr = pgprot_encrypted(cpa.mask_clr);
+
+--
+2.20.1
+
--- /dev/null
+From f2c1f5c3d0134cb42b1d6ee61d2d5ed113e4033c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 20:54:27 +0800
+Subject: x86/nmi: Remove irq_work from the long duration NMI handler
+
+From: Changbin Du <changbin.du@gmail.com>
+
+[ Upstream commit 248ed51048c40d36728e70914e38bffd7821da57 ]
+
+First, printk() is NMI-context safe now since the safe printk() has been
+implemented and it already has an irq_work to make NMI-context safe.
+
+Second, this NMI irq_work actually does not work if a NMI handler causes
+panic by watchdog timeout. It has no chance to run in such case, while
+the safe printk() will flush its per-cpu buffers before panicking.
+
+While at it, repurpose the irq_work callback into a function which
+concentrates the NMI duration checking and makes the code easier to
+follow.
+
+ [ bp: Massage. ]
+
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20200111125427.15662-1-changbin.du@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/nmi.h | 1 -
+ arch/x86/kernel/nmi.c | 20 +++++++++-----------
+ 2 files changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
+index 75ded1d13d98d..9d5d949e662e1 100644
+--- a/arch/x86/include/asm/nmi.h
++++ b/arch/x86/include/asm/nmi.h
+@@ -41,7 +41,6 @@ struct nmiaction {
+ struct list_head list;
+ nmi_handler_t handler;
+ u64 max_duration;
+- struct irq_work irq_work;
+ unsigned long flags;
+ const char *name;
+ };
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index e676a9916c498..54c21d6abd5ac 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -104,18 +104,22 @@ static int __init nmi_warning_debugfs(void)
+ }
+ fs_initcall(nmi_warning_debugfs);
+
+-static void nmi_max_handler(struct irq_work *w)
++static void nmi_check_duration(struct nmiaction *action, u64 duration)
+ {
+- struct nmiaction *a = container_of(w, struct nmiaction, irq_work);
++ u64 whole_msecs = READ_ONCE(action->max_duration);
+ int remainder_ns, decimal_msecs;
+- u64 whole_msecs = READ_ONCE(a->max_duration);
++
++ if (duration < nmi_longest_ns || duration < action->max_duration)
++ return;
++
++ action->max_duration = duration;
+
+ remainder_ns = do_div(whole_msecs, (1000 * 1000));
+ decimal_msecs = remainder_ns / 1000;
+
+ printk_ratelimited(KERN_INFO
+ "INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n",
+- a->handler, whole_msecs, decimal_msecs);
++ action->handler, whole_msecs, decimal_msecs);
+ }
+
+ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+@@ -142,11 +146,7 @@ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+ delta = sched_clock() - delta;
+ trace_nmi_handler(a->handler, (int)delta, thishandled);
+
+- if (delta < nmi_longest_ns || delta < a->max_duration)
+- continue;
+-
+- a->max_duration = delta;
+- irq_work_queue(&a->irq_work);
++ nmi_check_duration(a, delta);
+ }
+
+ rcu_read_unlock();
+@@ -164,8 +164,6 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
+ if (!action->handler)
+ return -EINVAL;
+
+- init_irq_work(&action->irq_work, nmi_max_handler);
+-
+ raw_spin_lock_irqsave(&desc->lock, flags);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 5f26813cf25397e139a780bf5836cac01424db13 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 18:04:10 -0500
+Subject: x86/sysfb: Fix check for bad VRAM size
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit dacc9092336be20b01642afe1a51720b31f60369 ]
+
+When checking whether the reported lfb_size makes sense, the height
+* stride result is page-aligned before seeing whether it exceeds the
+reported size.
+
+This doesn't work if height * stride is not an exact number of pages.
+For example, as reported in the kernel bugzilla below, an 800x600x32 EFI
+framebuffer gets skipped because of this.
+
+Move the PAGE_ALIGN to after the check vs size.
+
+Reported-by: Christopher Head <chead@chead.ca>
+Tested-by: Christopher Head <chead@chead.ca>
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206051
+Link: https://lkml.kernel.org/r/20200107230410.2291947-1-nivedita@alum.mit.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/sysfb_simplefb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
+index 01f0e2263b86b..298fc1edd9c95 100644
+--- a/arch/x86/kernel/sysfb_simplefb.c
++++ b/arch/x86/kernel/sysfb_simplefb.c
+@@ -90,11 +90,11 @@ __init int create_simplefb(const struct screen_info *si,
+ if (si->orig_video_isVGA == VIDEO_TYPE_VLFB)
+ size <<= 16;
+ length = mode->height * mode->stride;
+- length = PAGE_ALIGN(length);
+ if (length > size) {
+ printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
+ return -EINVAL;
+ }
++ length = PAGE_ALIGN(length);
+
+ /* setup IORESOURCE_MEM as framebuffer memory */
+ memset(&res, 0, sizeof(res));
+--
+2.20.1
+
--- /dev/null
+From 5b6080587a27e11fce6357eb5227dcb8a68cf326 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:07:29 +0800
+Subject: x86/unwind/orc: Fix !CONFIG_MODULES build warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shile Zhang <shile.zhang@linux.alibaba.com>
+
+[ Upstream commit 22a7fa8848c5e881d87ef2f7f3c2ea77b286e6f9 ]
+
+To fix follwowing warning due to ORC sort moved to build time:
+
+ arch/x86/kernel/unwind_orc.c:210:12: warning: ‘orc_sort_cmp’ defined but not used [-Wunused-function]
+ arch/x86/kernel/unwind_orc.c:190:13: warning: ‘orc_sort_swap’ defined but not used [-Wunused-function]
+
+Signed-off-by: Shile Zhang <shile.zhang@linux.alibaba.com>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/c9c81536-2afc-c8aa-c5f8-c7618ecd4f54@linux.alibaba.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/unwind_orc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 332ae6530fa88..7a9306bc5982f 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -187,6 +187,8 @@ static struct orc_entry *orc_find(unsigned long ip)
+ return orc_ftrace_find(ip);
+ }
+
++#ifdef CONFIG_MODULES
++
+ static void orc_sort_swap(void *_a, void *_b, int size)
+ {
+ struct orc_entry *orc_a, *orc_b;
+@@ -229,7 +231,6 @@ static int orc_sort_cmp(const void *_a, const void *_b)
+ return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
+ }
+
+-#ifdef CONFIG_MODULES
+ void unwind_module_init(struct module *mod, void *_orc_ip, size_t orc_ip_size,
+ void *_orc, size_t orc_size)
+ {
+--
+2.20.1
+
--- /dev/null
+From 24166933693d725547d5d17050e6d69c95f04263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:36:07 -0500
+Subject: x86/vdso: Provide missing include file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Valdis Klētnieks <valdis.kletnieks@vt.edu>
+
+[ Upstream commit bff47c2302cc249bcd550b17067f8dddbd4b6f77 ]
+
+When building with C=1, sparse issues a warning:
+
+ CHECK arch/x86/entry/vdso/vdso32-setup.c
+ arch/x86/entry/vdso/vdso32-setup.c:28:28: warning: symbol 'vdso32_enabled' was not declared. Should it be static?
+
+Provide the missing header file.
+
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/36224.1575599767@turing-police
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vdso/vdso32-setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
+index 240626e7f55aa..43842fade8fa1 100644
+--- a/arch/x86/entry/vdso/vdso32-setup.c
++++ b/arch/x86/entry/vdso/vdso32-setup.c
+@@ -11,6 +11,7 @@
+ #include <linux/smp.h>
+ #include <linux/kernel.h>
+ #include <linux/mm_types.h>
++#include <linux/elf.h>
+
+ #include <asm/processor.h>
+ #include <asm/vdso.h>
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
