--- /dev/null
+From 979a2665eb6c603ddce0ab374041ab101827b2e7 Mon Sep 17 00:00:00 2001
+From: Murphy Zhou <jencce.kernel@gmail.com>
+Date: Sat, 14 Mar 2020 11:38:31 +0800
+Subject: CIFS: fiemap: do not return EINVAL if get nothing
+
+From: Murphy Zhou <jencce.kernel@gmail.com>
+
+commit 979a2665eb6c603ddce0ab374041ab101827b2e7 upstream.
+
+If we call fiemap on a truncated file with none blocks allocated,
+it makes sense we get nothing from this call. No output means
+no blocks have been counted, but the call succeeded. It's a valid
+response.
+
+Simple example reproducer:
+xfs_io -f 'truncate 2M' -c 'fiemap -v' /cifssch/testfile
+xfs_io: ioctl(FS_IOC_FIEMAP) ["/cifssch/testfile"]: Invalid argument
+
+Signed-off-by: Murphy Zhou <jencce.kernel@gmail.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cifs/smb2ops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -3315,7 +3315,7 @@ static int smb3_fiemap(struct cifs_tcon
+ if (rc)
+ goto out;
+
+- if (out_data_len < sizeof(struct file_allocated_range_buffer)) {
++ if (out_data_len && out_data_len < sizeof(struct file_allocated_range_buffer)) {
+ rc = -EINVAL;
+ goto out;
+ }
--- /dev/null
+From cb2116ff97859d34fda6cb561ac654415f4c6230 Mon Sep 17 00:00:00 2001
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+Date: Wed, 19 Feb 2020 16:31:12 +0200
+Subject: iio: accel: adxl372: Set iio_chan BE
+
+From: Alexandru Tachici <alexandru.tachici@analog.com>
+
+commit cb2116ff97859d34fda6cb561ac654415f4c6230 upstream.
+
+Data stored in the iio-buffer is BE and this
+should be specified in the iio_chan_spec struct.
+
+Fixes: f4f55ce38e5f8 ("iio:adxl372: Add FIFO and interrupts support")
+Signed-off-by: Alexandru Tachici <alexandru.tachici@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/adxl372.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/iio/accel/adxl372.c
++++ b/drivers/iio/accel/adxl372.c
+@@ -237,6 +237,7 @@ static const struct adxl372_axis_lookup
+ .realbits = 12, \
+ .storagebits = 16, \
+ .shift = 4, \
++ .endianness = IIO_BE, \
+ }, \
+ }
+
--- /dev/null
+From a500f3bd787f8224341e44b238f318c407b10897 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Tue, 28 Jan 2020 12:57:39 +0000
+Subject: iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+commit a500f3bd787f8224341e44b238f318c407b10897 upstream.
+
+The differential channels require writing the channel offset register (COR).
+Otherwise they do not work in differential mode.
+The configuration of COR is missing in triggered mode.
+
+Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/at91-sama5d2_adc.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/drivers/iio/adc/at91-sama5d2_adc.c
++++ b/drivers/iio/adc/at91-sama5d2_adc.c
+@@ -723,6 +723,7 @@ static int at91_adc_configure_trigger(st
+
+ for_each_set_bit(bit, indio->active_scan_mask, indio->num_channels) {
+ struct iio_chan_spec const *chan = at91_adc_chan_get(indio, bit);
++ u32 cor;
+
+ if (!chan)
+ continue;
+@@ -732,6 +733,20 @@ static int at91_adc_configure_trigger(st
+ continue;
+
+ if (state) {
++ cor = at91_adc_readl(st, AT91_SAMA5D2_COR);
++
++ if (chan->differential)
++ cor |= (BIT(chan->channel) |
++ BIT(chan->channel2)) <<
++ AT91_SAMA5D2_COR_DIFF_OFFSET;
++ else
++ cor &= ~(BIT(chan->channel) <<
++ AT91_SAMA5D2_COR_DIFF_OFFSET);
++
++ at91_adc_writel(st, AT91_SAMA5D2_COR, cor);
++ }
++
++ if (state) {
+ at91_adc_writel(st, AT91_SAMA5D2_CHER,
+ BIT(chan->channel));
+ /* enable irq only if not using DMA */
--- /dev/null
+From e19ac9d9a978f8238a85a28ed624094a497d5ae6 Mon Sep 17 00:00:00 2001
+From: Olivier Moysan <olivier.moysan@st.com>
+Date: Tue, 21 Jan 2020 12:02:56 +0100
+Subject: iio: adc: stm32-dfsdm: fix sleep in atomic context
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+commit e19ac9d9a978f8238a85a28ed624094a497d5ae6 upstream.
+
+This commit fixes the error message:
+"BUG: sleeping function called from invalid context at kernel/irq/chip.c"
+Suppress the trigger irq handler. Make the buffer transfers directly
+in DMA callback, instead.
+Push buffers without timestamps, as timestamps are not supported
+in DFSDM driver.
+
+Fixes: 11646e81d775 ("iio: adc: stm32-dfsdm: add support for buffer modes")
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/adc/stm32-dfsdm-adc.c | 43 ++++++++------------------------------
+ 1 file changed, 10 insertions(+), 33 deletions(-)
+
+--- a/drivers/iio/adc/stm32-dfsdm-adc.c
++++ b/drivers/iio/adc/stm32-dfsdm-adc.c
+@@ -842,31 +842,6 @@ static inline void stm32_dfsdm_process_d
+ }
+ }
+
+-static irqreturn_t stm32_dfsdm_adc_trigger_handler(int irq, void *p)
+-{
+- struct iio_poll_func *pf = p;
+- struct iio_dev *indio_dev = pf->indio_dev;
+- struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
+- int available = stm32_dfsdm_adc_dma_residue(adc);
+-
+- while (available >= indio_dev->scan_bytes) {
+- s32 *buffer = (s32 *)&adc->rx_buf[adc->bufi];
+-
+- stm32_dfsdm_process_data(adc, buffer);
+-
+- iio_push_to_buffers_with_timestamp(indio_dev, buffer,
+- pf->timestamp);
+- available -= indio_dev->scan_bytes;
+- adc->bufi += indio_dev->scan_bytes;
+- if (adc->bufi >= adc->buf_sz)
+- adc->bufi = 0;
+- }
+-
+- iio_trigger_notify_done(indio_dev->trig);
+-
+- return IRQ_HANDLED;
+-}
+-
+ static void stm32_dfsdm_dma_buffer_done(void *data)
+ {
+ struct iio_dev *indio_dev = data;
+@@ -874,11 +849,6 @@ static void stm32_dfsdm_dma_buffer_done(
+ int available = stm32_dfsdm_adc_dma_residue(adc);
+ size_t old_pos;
+
+- if (indio_dev->currentmode & INDIO_BUFFER_TRIGGERED) {
+- iio_trigger_poll_chained(indio_dev->trig);
+- return;
+- }
+-
+ /*
+ * FIXME: In Kernel interface does not support cyclic DMA buffer,and
+ * offers only an interface to push data samples per samples.
+@@ -906,7 +876,15 @@ static void stm32_dfsdm_dma_buffer_done(
+ adc->bufi = 0;
+ old_pos = 0;
+ }
+- /* regular iio buffer without trigger */
++ /*
++ * In DMA mode the trigger services of IIO are not used
++ * (e.g. no call to iio_trigger_poll).
++ * Calling irq handler associated to the hardware trigger is not
++ * relevant as the conversions have already been done. Data
++ * transfers are performed directly in DMA callback instead.
++ * This implementation avoids to call trigger irq handler that
++ * may sleep, in an atomic context (DMA irq handler context).
++ */
+ if (adc->dev_data->type == DFSDM_IIO)
+ iio_push_to_buffers(indio_dev, buffer);
+ }
+@@ -1517,8 +1495,7 @@ static int stm32_dfsdm_adc_init(struct i
+ }
+
+ ret = iio_triggered_buffer_setup(indio_dev,
+- &iio_pollfunc_store_time,
+- &stm32_dfsdm_adc_trigger_handler,
++ &iio_pollfunc_store_time, NULL,
+ &stm32_dfsdm_buffer_setup_ops);
+ if (ret) {
+ stm32_dfsdm_dma_release(indio_dev);
--- /dev/null
+From 016a8845f6da65b2203f102f192046fbb624e250 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Thu, 27 Feb 2020 17:27:34 +0100
+Subject: iio: chemical: sps30: fix missing triggered buffer dependency
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Petr Štetiar <ynezz@true.cz>
+
+commit 016a8845f6da65b2203f102f192046fbb624e250 upstream.
+
+SPS30 uses triggered buffer, but the dependency is not specified in the
+Kconfig file. Fix this by selecting IIO_BUFFER and IIO_TRIGGERED_BUFFER
+config symbols.
+
+Cc: stable@vger.kernel.org
+Fixes: 232e0f6ddeae ("iio: chemical: add support for Sensirion SPS30 sensor")
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/chemical/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iio/chemical/Kconfig
++++ b/drivers/iio/chemical/Kconfig
+@@ -91,6 +91,8 @@ config SPS30
+ tristate "SPS30 particulate matter sensor"
+ depends on I2C
+ select CRC8
++ select IIO_BUFFER
++ select IIO_TRIGGERED_BUFFER
+ help
+ Say Y here to build support for the Sensirion SPS30 particulate
+ matter sensor.
--- /dev/null
+From 2ca5a8792d617b4035aacd0a8be527f667fbf912 Mon Sep 17 00:00:00 2001
+From: Tomas Novotny <tomas@novotny.cz>
+Date: Tue, 18 Feb 2020 16:44:51 +0100
+Subject: iio: light: vcnl4000: update sampling periods for vcnl4040
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomas Novotny <tomas@novotny.cz>
+
+commit 2ca5a8792d617b4035aacd0a8be527f667fbf912 upstream.
+
+Vishay has published a new version of "Designing the VCNL4200 Into an
+Application" application note in October 2019. The new version specifies
+that there is +-20% of part to part tolerance. Although the application
+note is related to vcnl4200, according to support the vcnl4040's "ASIC
+is quite similar to that one for the VCNL4200".
+
+So update the sampling periods (and comment), including the correct
+sampling period for proximity. Both sampling periods are lower. Users
+relying on the blocking behaviour of reading will get proximity
+measurements much earlier.
+
+Fixes: 5a441aade5b3 ("iio: light: vcnl4000 add support for the VCNL4040 proximity and light sensor")
+Reviewed-by: Guido Günther <agx@sigxcpu.org>
+Tested-by: Guido Günther <agx@sigxcpu.org>
+Signed-off-by: Tomas Novotny <tomas@novotny.cz>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/light/vcnl4000.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/light/vcnl4000.c
++++ b/drivers/iio/light/vcnl4000.c
+@@ -174,9 +174,10 @@ static int vcnl4200_init(struct vcnl4000
+ data->al_scale = 24000;
+ break;
+ case VCNL4040_PROD_ID:
+- /* Integration time is 80ms, add 10ms. */
+- data->vcnl4200_al.sampling_rate = ktime_set(0, 100000 * 1000);
+- data->vcnl4200_ps.sampling_rate = ktime_set(0, 100000 * 1000);
++ /* Default wait time is 80ms, add 20% tolerance. */
++ data->vcnl4200_al.sampling_rate = ktime_set(0, 96000 * 1000);
++ /* Default wait time is 5ms, add 20% tolerance. */
++ data->vcnl4200_ps.sampling_rate = ktime_set(0, 6000 * 1000);
+ data->al_scale = 120000;
+ break;
+ }
--- /dev/null
+From b42aa97ed5f1169cfd37175ef388ea62ff2dcf43 Mon Sep 17 00:00:00 2001
+From: Tomas Novotny <tomas@novotny.cz>
+Date: Tue, 18 Feb 2020 16:44:50 +0100
+Subject: iio: light: vcnl4000: update sampling periods for vcnl4200
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tomas Novotny <tomas@novotny.cz>
+
+commit b42aa97ed5f1169cfd37175ef388ea62ff2dcf43 upstream.
+
+Vishay has published a new version of "Designing the VCNL4200 Into an
+Application" application note in October 2019. The new version specifies
+that there is +-20% of part to part tolerance. This explains the drift
+seen during experiments. The proximity pulse width is also changed from
+32us to 30us. According to the support, the tolerance also applies to
+ambient light.
+
+So update the sampling periods. As the reading is blocking, current
+users may notice slightly longer response time.
+
+Fixes: be38866fbb97 ("iio: vcnl4000: add support for VCNL4200")
+Reviewed-by: Guido Günther <agx@sigxcpu.org>
+Signed-off-by: Tomas Novotny <tomas@novotny.cz>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/light/vcnl4000.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/iio/light/vcnl4000.c
++++ b/drivers/iio/light/vcnl4000.c
+@@ -167,10 +167,10 @@ static int vcnl4200_init(struct vcnl4000
+ data->vcnl4200_ps.reg = VCNL4200_PS_DATA;
+ switch (id) {
+ case VCNL4200_PROD_ID:
+- /* Integration time is 50ms, but the experiments */
+- /* show 54ms in total. */
+- data->vcnl4200_al.sampling_rate = ktime_set(0, 54000 * 1000);
+- data->vcnl4200_ps.sampling_rate = ktime_set(0, 4200 * 1000);
++ /* Default wait time is 50ms, add 20% tolerance. */
++ data->vcnl4200_al.sampling_rate = ktime_set(0, 60000 * 1000);
++ /* Default wait time is 4.8ms, add 20% tolerance. */
++ data->vcnl4200_ps.sampling_rate = ktime_set(0, 5760 * 1000);
+ data->al_scale = 24000;
+ break;
+ case VCNL4040_PROD_ID:
--- /dev/null
+From b500c086e4110829a308c23e83a7cdc65b26228a Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan@gerhold.net>
+Date: Fri, 14 Feb 2020 12:03:24 +0100
+Subject: iio: magnetometer: ak8974: Fix negative raw values in sysfs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+commit b500c086e4110829a308c23e83a7cdc65b26228a upstream.
+
+At the moment, reading from in_magn_*_raw in sysfs tends to return
+large values around 65000, even though the output of ak8974 is actually
+limited to ±32768. This happens because the value is never converted
+to the signed 16-bit integer variant.
+
+Add an explicit cast to s16 to fix this.
+
+Fixes: 7c94a8b2ee8c ("iio: magn: add a driver for AK8974")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Linus Waleij <linus.walleij@linaro.org>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/magnetometer/ak8974.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/magnetometer/ak8974.c
++++ b/drivers/iio/magnetometer/ak8974.c
+@@ -564,7 +564,7 @@ static int ak8974_read_raw(struct iio_de
+ * We read all axes and discard all but one, for optimized
+ * reading, use the triggered buffer.
+ */
+- *val = le16_to_cpu(hw_values[chan->address]);
++ *val = (s16)le16_to_cpu(hw_values[chan->address]);
+
+ ret = IIO_VAL_INT;
+ }
--- /dev/null
+From e43d110cdc206b6df4dd438cd10c81d1da910aad Mon Sep 17 00:00:00 2001
+From: Wen-chien Jesse Sung <jesse.sung@canonical.com>
+Date: Mon, 24 Feb 2020 17:54:26 +0800
+Subject: iio: st_sensors: remap SMO8840 to LIS2DH12
+
+From: Wen-chien Jesse Sung <jesse.sung@canonical.com>
+
+commit e43d110cdc206b6df4dd438cd10c81d1da910aad upstream.
+
+According to ST, the HID is for LIS2DH12.
+
+Fixes: 3d56e19815b3 ("iio: accel: st_accel: Add support for the SMO8840 ACPI id")
+Signed-off-by: Wen-chien Jesse Sung <jesse.sung@canonical.com>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/accel/st_accel_i2c.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iio/accel/st_accel_i2c.c
++++ b/drivers/iio/accel/st_accel_i2c.c
+@@ -114,7 +114,7 @@ MODULE_DEVICE_TABLE(of, st_accel_of_matc
+
+ #ifdef CONFIG_ACPI
+ static const struct acpi_device_id st_accel_acpi_match[] = {
+- {"SMO8840", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME},
++ {"SMO8840", (kernel_ulong_t)LIS2DH12_ACCEL_DEV_NAME},
+ {"SMO8A90", (kernel_ulong_t)LNG2DM_ACCEL_DEV_NAME},
+ { },
+ };
--- /dev/null
+From 29e8c8253d7d5265f58122c0a7902e26df6c6f61 Mon Sep 17 00:00:00 2001
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+Date: Fri, 14 Feb 2020 17:46:35 +0100
+Subject: iio: trigger: stm32-timer: disable master mode when stopping
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+commit 29e8c8253d7d5265f58122c0a7902e26df6c6f61 upstream.
+
+Master mode should be disabled when stopping. This mainly impacts
+possible other use-case after timer has been stopped. Currently,
+master mode remains set (from start routine).
+
+Fixes: 6fb34812c2a2 ("iio: stm32 trigger: Add support for TRGO2 triggers")
+
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iio/trigger/stm32-timer-trigger.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/iio/trigger/stm32-timer-trigger.c
++++ b/drivers/iio/trigger/stm32-timer-trigger.c
+@@ -161,7 +161,8 @@ static int stm32_timer_start(struct stm3
+ return 0;
+ }
+
+-static void stm32_timer_stop(struct stm32_timer_trigger *priv)
++static void stm32_timer_stop(struct stm32_timer_trigger *priv,
++ struct iio_trigger *trig)
+ {
+ u32 ccer, cr1;
+
+@@ -179,6 +180,12 @@ static void stm32_timer_stop(struct stm3
+ regmap_write(priv->regmap, TIM_PSC, 0);
+ regmap_write(priv->regmap, TIM_ARR, 0);
+
++ /* Force disable master mode */
++ if (stm32_timer_is_trgo2_name(trig->name))
++ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS2, 0);
++ else
++ regmap_update_bits(priv->regmap, TIM_CR2, TIM_CR2_MMS, 0);
++
+ /* Make sure that registers are updated */
+ regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG);
+ }
+@@ -197,7 +204,7 @@ static ssize_t stm32_tt_store_frequency(
+ return ret;
+
+ if (freq == 0) {
+- stm32_timer_stop(priv);
++ stm32_timer_stop(priv, trig);
+ } else {
+ ret = stm32_timer_start(priv, trig, freq);
+ if (ret)
--- /dev/null
+From ce666be89a8a09c5924ff08fc32e119f974bdab6 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Tue, 17 Mar 2020 08:22:14 +0200
+Subject: intel_th: Fix user-visible error codes
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit ce666be89a8a09c5924ff08fc32e119f974bdab6 upstream.
+
+There are a few places in the driver that end up returning ENOTSUPP to
+the user, replace those with EINVAL.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Link: https://lore.kernel.org/r/20200317062215.15598-6-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -761,7 +761,7 @@ static int msc_configure(struct msc *msc
+ lockdep_assert_held(&msc->buf_mutex);
+
+ if (msc->mode > MSC_MODE_MULTI)
+- return -ENOTSUPP;
++ return -EINVAL;
+
+ if (msc->mode == MSC_MODE_MULTI) {
+ if (msc_win_set_lockout(msc->cur_win, WIN_READY, WIN_INUSE))
+@@ -1295,7 +1295,7 @@ static int msc_buffer_alloc(struct msc *
+ } else if (msc->mode == MSC_MODE_MULTI) {
+ ret = msc_buffer_multi_alloc(msc, nr_pages, nr_wins);
+ } else {
+- ret = -ENOTSUPP;
++ ret = -EINVAL;
+ }
+
+ if (!ret) {
+@@ -1531,7 +1531,7 @@ static ssize_t intel_th_msc_read(struct
+ if (ret >= 0)
+ *ppos = iter->offset;
+ } else {
+- ret = -ENOTSUPP;
++ ret = -EINVAL;
+ }
+
+ put_count:
--- /dev/null
+From 885f123554bbdc1807ca25a374be6e9b3bddf4de Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Tue, 17 Mar 2020 08:22:13 +0200
+Subject: intel_th: msu: Fix the unexpected state warning
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit 885f123554bbdc1807ca25a374be6e9b3bddf4de upstream.
+
+The unexpected state warning should only warn on illegal state
+transitions. Fix that.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Fixes: 615c164da0eb4 ("intel_th: msu: Introduce buffer interface")
+Cc: stable@vger.kernel.org # v5.4+
+Link: https://lore.kernel.org/r/20200317062215.15598-5-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -718,9 +718,6 @@ static int msc_win_set_lockout(struct ms
+
+ if (old != expect) {
+ ret = -EINVAL;
+- dev_warn_ratelimited(msc_dev(win->msc),
+- "expected lockout state %d, got %d\n",
+- expect, old);
+ goto unlock;
+ }
+
+@@ -741,6 +738,10 @@ unlock:
+ /* from intel_th_msc_window_unlock(), don't warn if not locked */
+ if (expect == WIN_LOCKED && old == new)
+ return 0;
++
++ dev_warn_ratelimited(msc_dev(win->msc),
++ "expected lockout state %d, got %d\n",
++ expect, old);
+ }
+
+ return ret;
--- /dev/null
+From add492d2e9446a77ede9bb43699ec85ca8fc1aba Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Tue, 17 Mar 2020 08:22:15 +0200
+Subject: intel_th: pci: Add Elkhart Lake CPU support
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit add492d2e9446a77ede9bb43699ec85ca8fc1aba upstream.
+
+This adds support for the Trace Hub in Elkhart Lake CPU.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200317062215.15598-7-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -235,6 +235,11 @@ static const struct pci_device_id intel_
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
+ {
++ /* Elkhart Lake CPU */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4529),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
++ {
+ /* Elkhart Lake */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4b26),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
--- /dev/null
+From 82f2bc2fcc0160d6f82dd1ac64518ae0a4dd183f Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Wed, 11 Mar 2020 12:41:21 -0700
+Subject: kbuild: Disable -Wpointer-to-enum-cast
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 82f2bc2fcc0160d6f82dd1ac64518ae0a4dd183f upstream.
+
+Clang's -Wpointer-to-int-cast deviates from GCC in that it warns when
+casting to enums. The kernel does this in certain places, such as device
+tree matches to set the version of the device being used, which allows
+the kernel to avoid using a gigantic union.
+
+https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L428
+https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L402
+https://elixir.bootlin.com/linux/v5.5.8/source/include/linux/mod_devicetable.h#L264
+
+To avoid a ton of false positive warnings, disable this particular part
+of the warning, which has been split off into a separate diagnostic so
+that the entire warning does not need to be turned off for clang. It
+will be visible under W=1 in case people want to go about fixing these
+easily and enabling the warning treewide.
+
+Cc: stable@vger.kernel.org
+Link: https://github.com/ClangBuiltLinux/linux/issues/887
+Link: https://github.com/llvm/llvm-project/commit/2a41b31fcdfcb67ab7038fc2ffb606fd50b83a84
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ scripts/Makefile.extrawarn | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -48,6 +48,7 @@ KBUILD_CFLAGS += -Wno-initializer-overri
+ KBUILD_CFLAGS += -Wno-format
+ KBUILD_CFLAGS += -Wno-sign-compare
+ KBUILD_CFLAGS += -Wno-format-zero-length
++KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast)
+ endif
+
+ endif
--- /dev/null
+From 4686392c32361c97e8434adf9cc77ad7991bfa81 Mon Sep 17 00:00:00 2001
+From: Ricky Wu <ricky_wu@realtek.com>
+Date: Mon, 16 Mar 2020 10:52:32 +0800
+Subject: mmc: rtsx_pci: Fix support for speed-modes that relies on tuning
+
+From: Ricky Wu <ricky_wu@realtek.com>
+
+commit 4686392c32361c97e8434adf9cc77ad7991bfa81 upstream.
+
+The TX/RX register should not be treated the same way to allow for better
+support of tuning. Fix this by using a default initial value for TX.
+
+Signed-off-by: Ricky Wu <ricky_wu@realtek.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200316025232.1167-1-ricky_wu@realtek.com
+[Ulf: Updated changelog]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/cardreader/rts5227.c | 2 +-
+ drivers/misc/cardreader/rts5249.c | 2 ++
+ drivers/misc/cardreader/rts5260.c | 2 +-
+ drivers/misc/cardreader/rts5261.c | 2 +-
+ drivers/mmc/host/rtsx_pci_sdmmc.c | 13 ++++++++-----
+ 5 files changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/misc/cardreader/rts5227.c
++++ b/drivers/misc/cardreader/rts5227.c
+@@ -394,7 +394,7 @@ static const struct pcr_ops rts522a_pcr_
+ void rts522a_init_params(struct rtsx_pcr *pcr)
+ {
+ rts5227_init_params(pcr);
+-
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 20, 11);
+ pcr->reg_pm_ctrl3 = RTS522A_PM_CTRL3;
+
+ pcr->option.ocp_en = 1;
+--- a/drivers/misc/cardreader/rts5249.c
++++ b/drivers/misc/cardreader/rts5249.c
+@@ -618,6 +618,7 @@ static const struct pcr_ops rts524a_pcr_
+ void rts524a_init_params(struct rtsx_pcr *pcr)
+ {
+ rts5249_init_params(pcr);
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11);
+ pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF;
+ pcr->option.ltr_l1off_snooze_sspwrgate =
+ LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF;
+@@ -733,6 +734,7 @@ static const struct pcr_ops rts525a_pcr_
+ void rts525a_init_params(struct rtsx_pcr *pcr)
+ {
+ rts5249_init_params(pcr);
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(25, 29, 11);
+ pcr->option.ltr_l1off_sspwrgate = LTR_L1OFF_SSPWRGATE_5250_DEF;
+ pcr->option.ltr_l1off_snooze_sspwrgate =
+ LTR_L1OFF_SNOOZE_SSPWRGATE_5250_DEF;
+--- a/drivers/misc/cardreader/rts5260.c
++++ b/drivers/misc/cardreader/rts5260.c
+@@ -662,7 +662,7 @@ void rts5260_init_params(struct rtsx_pcr
+ pcr->sd30_drive_sel_1v8 = CFG_DRIVER_TYPE_B;
+ pcr->sd30_drive_sel_3v3 = CFG_DRIVER_TYPE_B;
+ pcr->aspm_en = ASPM_L1_EN;
+- pcr->tx_initial_phase = SET_CLOCK_PHASE(1, 29, 16);
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 29, 11);
+ pcr->rx_initial_phase = SET_CLOCK_PHASE(24, 6, 5);
+
+ pcr->ic_version = rts5260_get_ic_version(pcr);
+--- a/drivers/misc/cardreader/rts5261.c
++++ b/drivers/misc/cardreader/rts5261.c
+@@ -763,7 +763,7 @@ void rts5261_init_params(struct rtsx_pcr
+ pcr->sd30_drive_sel_1v8 = CFG_DRIVER_TYPE_B;
+ pcr->sd30_drive_sel_3v3 = CFG_DRIVER_TYPE_B;
+ pcr->aspm_en = ASPM_L1_EN;
+- pcr->tx_initial_phase = SET_CLOCK_PHASE(20, 27, 16);
++ pcr->tx_initial_phase = SET_CLOCK_PHASE(27, 27, 11);
+ pcr->rx_initial_phase = SET_CLOCK_PHASE(24, 6, 5);
+
+ pcr->ic_version = rts5261_get_ic_version(pcr);
+--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
++++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
+@@ -606,19 +606,22 @@ static int sd_change_phase(struct realte
+ u8 sample_point, bool rx)
+ {
+ struct rtsx_pcr *pcr = host->pcr;
+-
++ u16 SD_VP_CTL = 0;
+ dev_dbg(sdmmc_dev(host), "%s(%s): sample_point = %d\n",
+ __func__, rx ? "RX" : "TX", sample_point);
+
+ rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, CHANGE_CLK);
+- if (rx)
++ if (rx) {
++ SD_VP_CTL = SD_VPRX_CTL;
+ rtsx_pci_write_register(pcr, SD_VPRX_CTL,
+ PHASE_SELECT_MASK, sample_point);
+- else
++ } else {
++ SD_VP_CTL = SD_VPTX_CTL;
+ rtsx_pci_write_register(pcr, SD_VPTX_CTL,
+ PHASE_SELECT_MASK, sample_point);
+- rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET, 0);
+- rtsx_pci_write_register(pcr, SD_VPCLK0_CTL, PHASE_NOT_RESET,
++ }
++ rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET, 0);
++ rtsx_pci_write_register(pcr, SD_VP_CTL, PHASE_NOT_RESET,
+ PHASE_NOT_RESET);
+ rtsx_pci_write_register(pcr, CLK_CTL, CHANGE_CLK, 0);
+ rtsx_pci_write_register(pcr, SD_CFG1, SD_ASYNC_FIFO_NOT_RST, 0);
--- /dev/null
+From 3397b251ea02003f47f0b1667f3fe30bb4f9ce90 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 16 Mar 2020 19:47:53 +0100
+Subject: mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012)
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 3397b251ea02003f47f0b1667f3fe30bb4f9ce90 upstream.
+
+On the Acer Aspire Switch 10 (SW5-012) microSD slot always reports the card
+being write-protected even though microSD cards do not have a write-protect
+switch at all.
+
+Add a new DMI_QUIRK_SD_NO_WRITE_PROTECT quirk which when set sets
+the MMC_CAP2_NO_WRITE_PROTECT flag on the controller for the external SD
+slot; and add a DMI quirk table entry which selects this quirk for the
+Acer SW5-012.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200316184753.393458-2-hdegoede@redhat.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-acpi.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -80,6 +80,7 @@ struct sdhci_acpi_host {
+
+ enum {
+ DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP = BIT(0),
++ DMI_QUIRK_SD_NO_WRITE_PROTECT = BIT(1),
+ };
+
+ static inline void *sdhci_acpi_priv(struct sdhci_acpi_host *c)
+@@ -671,6 +672,18 @@ static const struct dmi_system_id sdhci_
+ },
+ .driver_data = (void *)DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP,
+ },
++ {
++ /*
++ * The Acer Aspire Switch 10 (SW5-012) microSD slot always
++ * reports the card being write-protected even though microSD
++ * cards do not have a write-protect switch at all.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire SW5-012"),
++ },
++ .driver_data = (void *)DMI_QUIRK_SD_NO_WRITE_PROTECT,
++ },
+ {} /* Terminating entry */
+ };
+
+@@ -795,6 +808,9 @@ static int sdhci_acpi_probe(struct platf
+
+ if (quirks & DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP)
+ c->reset_signal_volt_on_suspend = true;
++
++ if (quirks & DMI_QUIRK_SD_NO_WRITE_PROTECT)
++ host->mmc->caps2 |= MMC_CAP2_NO_WRITE_PROTECT;
+ }
+
+ err = sdhci_setup_host(host);
--- /dev/null
+From 84d49b3d08a1d33690cc159036f381c31c27c17b Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 16 Mar 2020 19:47:52 +0100
+Subject: mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 84d49b3d08a1d33690cc159036f381c31c27c17b upstream.
+
+Based on a sample of 7 DSDTs from Cherry Trail devices using an AXP288
+PMIC depending on the design one of 2 possible LDOs on the PMIC is used
+for the MMC signalling voltage, either DLDO3 or GPIO1LDO (GPIO1 pin in
+low noise LDO mode).
+
+The Lenovo Miix 320-10ICR uses GPIO1LDO in the SHC1 ACPI device's DSM
+methods to set 3.3 or 1.8 signalling voltage and this appears to work
+as advertised, so presumably the device is actually using GPIO1LDO for
+the external microSD signalling voltage.
+
+But this device has a bug in the _PS0 method of the SHC1 ACPI device,
+the DSM remembers the last set signalling voltage and the _PS0 restores
+this after a (runtime) suspend-resume cycle, but it "restores" the voltage
+on DLDO3 instead of setting it on GPIO1LDO as the DSM method does. DLDO3
+is used for the LCD and setting it to 1.8V causes the LCD to go black.
+
+This commit works around this issue by calling the Intel DSM to reset the
+signal voltage to 3.3V after the host has been runtime suspended.
+This will make the _PS0 method reprogram the DLDO3 voltage to 3.3V, which
+leaves it at its original setting fixing the LCD going black.
+
+This commit adds and uses a DMI quirk mechanism to only trigger this
+workaround on the Lenovo Miix 320 while leaving the behavior of the
+driver unchanged on other devices.
+
+BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=111294
+BugLink: https://gitlab.freedesktop.org/drm/intel/issues/355
+Reported-by: russianneuromancer <russianneuromancer@ya.ru>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200316184753.393458-1-hdegoede@redhat.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-acpi.c | 68 ++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 66 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-acpi.c
++++ b/drivers/mmc/host/sdhci-acpi.c
+@@ -23,6 +23,7 @@
+ #include <linux/pm.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/pm.h>
+@@ -72,9 +73,15 @@ struct sdhci_acpi_host {
+ const struct sdhci_acpi_slot *slot;
+ struct platform_device *pdev;
+ bool use_runtime_pm;
++ bool is_intel;
++ bool reset_signal_volt_on_suspend;
+ unsigned long private[0] ____cacheline_aligned;
+ };
+
++enum {
++ DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP = BIT(0),
++};
++
+ static inline void *sdhci_acpi_priv(struct sdhci_acpi_host *c)
+ {
+ return (void *)c->private;
+@@ -391,6 +398,8 @@ static int intel_probe_slot(struct platf
+ host->mmc_host_ops.start_signal_voltage_switch =
+ intel_start_signal_voltage_switch;
+
++ c->is_intel = true;
++
+ return 0;
+ }
+
+@@ -647,6 +656,24 @@ static const struct acpi_device_id sdhci
+ };
+ MODULE_DEVICE_TABLE(acpi, sdhci_acpi_ids);
+
++static const struct dmi_system_id sdhci_acpi_quirks[] = {
++ {
++ /*
++ * The Lenovo Miix 320-10ICR has a bug in the _PS0 method of
++ * the SHC1 ACPI device, this bug causes it to reprogram the
++ * wrong LDO (DLDO3) to 1.8V if 1.8V modes are used and the
++ * card is (runtime) suspended + resumed. DLDO3 is used for
++ * the LCD and setting it to 1.8V causes the LCD to go black.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"),
++ },
++ .driver_data = (void *)DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP,
++ },
++ {} /* Terminating entry */
++};
++
+ static const struct sdhci_acpi_slot *sdhci_acpi_get_slot(struct acpi_device *adev)
+ {
+ const struct sdhci_acpi_uid_slot *u;
+@@ -663,17 +690,23 @@ static int sdhci_acpi_probe(struct platf
+ struct device *dev = &pdev->dev;
+ const struct sdhci_acpi_slot *slot;
+ struct acpi_device *device, *child;
++ const struct dmi_system_id *id;
+ struct sdhci_acpi_host *c;
+ struct sdhci_host *host;
+ struct resource *iomem;
+ resource_size_t len;
+ size_t priv_size;
++ int quirks = 0;
+ int err;
+
+ device = ACPI_COMPANION(dev);
+ if (!device)
+ return -ENODEV;
+
++ id = dmi_first_match(sdhci_acpi_quirks);
++ if (id)
++ quirks = (long)id->driver_data;
++
+ slot = sdhci_acpi_get_slot(device);
+
+ /* Power on the SDHCI controller and its children */
+@@ -759,6 +792,9 @@ static int sdhci_acpi_probe(struct platf
+ dev_warn(dev, "failed to setup card detect gpio\n");
+ c->use_runtime_pm = false;
+ }
++
++ if (quirks & DMI_QUIRK_RESET_SD_SIGNAL_VOLT_ON_SUSP)
++ c->reset_signal_volt_on_suspend = true;
+ }
+
+ err = sdhci_setup_host(host);
+@@ -823,17 +859,39 @@ static int sdhci_acpi_remove(struct plat
+ return 0;
+ }
+
++static void __maybe_unused sdhci_acpi_reset_signal_voltage_if_needed(
++ struct device *dev)
++{
++ struct sdhci_acpi_host *c = dev_get_drvdata(dev);
++ struct sdhci_host *host = c->host;
++
++ if (c->is_intel && c->reset_signal_volt_on_suspend &&
++ host->mmc->ios.signal_voltage != MMC_SIGNAL_VOLTAGE_330) {
++ struct intel_host *intel_host = sdhci_acpi_priv(c);
++ unsigned int fn = INTEL_DSM_V33_SWITCH;
++ u32 result = 0;
++
++ intel_dsm(intel_host, dev, fn, &result);
++ }
++}
++
+ #ifdef CONFIG_PM_SLEEP
+
+ static int sdhci_acpi_suspend(struct device *dev)
+ {
+ struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+ struct sdhci_host *host = c->host;
++ int ret;
+
+ if (host->tuning_mode != SDHCI_TUNING_MODE_3)
+ mmc_retune_needed(host->mmc);
+
+- return sdhci_suspend_host(host);
++ ret = sdhci_suspend_host(host);
++ if (ret)
++ return ret;
++
++ sdhci_acpi_reset_signal_voltage_if_needed(dev);
++ return 0;
+ }
+
+ static int sdhci_acpi_resume(struct device *dev)
+@@ -853,11 +911,17 @@ static int sdhci_acpi_runtime_suspend(st
+ {
+ struct sdhci_acpi_host *c = dev_get_drvdata(dev);
+ struct sdhci_host *host = c->host;
++ int ret;
+
+ if (host->tuning_mode != SDHCI_TUNING_MODE_3)
+ mmc_retune_needed(host->mmc);
+
+- return sdhci_runtime_suspend_host(host);
++ ret = sdhci_runtime_suspend_host(host);
++ if (ret)
++ return ret;
++
++ sdhci_acpi_reset_signal_voltage_if_needed(dev);
++ return 0;
+ }
+
+ static int sdhci_acpi_runtime_resume(struct device *dev)
--- /dev/null
+From 18b587b45c13bb6a07ed0edac15f06892593d07a Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Thu, 12 Mar 2020 19:42:57 +0900
+Subject: mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+commit 18b587b45c13bb6a07ed0edac15f06892593d07a upstream.
+
+The SDHCI_PRESET_FOR_* registers are not set for the UniPhier platform
+integration. (They are all read as zeros).
+
+Set the SDHCI_QUIRK2_PRESET_VALUE_BROKEN quirk flag. Otherwise, the
+High Speed DDR mode on the eMMC controller (MMC_TIMING_MMC_DDR52)
+would not work.
+
+I split the platform data to give no impact to other platforms,
+although the UniPhier platform is currently only the upstream user
+of this IP.
+
+The SDHCI_QUIRK2_PRESET_VALUE_BROKEN flag is set if the compatible
+string matches to "socionext,uniphier-sd4hc".
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200312104257.21017-1-yamada.masahiro@socionext.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-cadence.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-cadence.c
++++ b/drivers/mmc/host/sdhci-cadence.c
+@@ -11,6 +11,7 @@
+ #include <linux/mmc/host.h>
+ #include <linux/mmc/mmc.h>
+ #include <linux/of.h>
++#include <linux/of_device.h>
+
+ #include "sdhci-pltfm.h"
+
+@@ -235,6 +236,11 @@ static const struct sdhci_ops sdhci_cdns
+ .set_uhs_signaling = sdhci_cdns_set_uhs_signaling,
+ };
+
++static const struct sdhci_pltfm_data sdhci_cdns_uniphier_pltfm_data = {
++ .ops = &sdhci_cdns_ops,
++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
++};
++
+ static const struct sdhci_pltfm_data sdhci_cdns_pltfm_data = {
+ .ops = &sdhci_cdns_ops,
+ };
+@@ -334,6 +340,7 @@ static void sdhci_cdns_hs400_enhanced_st
+ static int sdhci_cdns_probe(struct platform_device *pdev)
+ {
+ struct sdhci_host *host;
++ const struct sdhci_pltfm_data *data;
+ struct sdhci_pltfm_host *pltfm_host;
+ struct sdhci_cdns_priv *priv;
+ struct clk *clk;
+@@ -350,8 +357,12 @@ static int sdhci_cdns_probe(struct platf
+ if (ret)
+ return ret;
+
++ data = of_device_get_match_data(dev);
++ if (!data)
++ data = &sdhci_cdns_pltfm_data;
++
+ nr_phy_params = sdhci_cdns_phy_param_count(dev->of_node);
+- host = sdhci_pltfm_init(pdev, &sdhci_cdns_pltfm_data,
++ host = sdhci_pltfm_init(pdev, data,
+ struct_size(priv, phy_params, nr_phy_params));
+ if (IS_ERR(host)) {
+ ret = PTR_ERR(host);
+@@ -431,7 +442,10 @@ static const struct dev_pm_ops sdhci_cdn
+ };
+
+ static const struct of_device_id sdhci_cdns_match[] = {
+- { .compatible = "socionext,uniphier-sd4hc" },
++ {
++ .compatible = "socionext,uniphier-sd4hc",
++ .data = &sdhci_cdns_uniphier_pltfm_data,
++ },
+ { .compatible = "cdns,sd4hc" },
+ { /* sentinel */ }
+ };
--- /dev/null
+From 53dd0a7cd65edc83b0c243d1c08377c8b876b2ee Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Sun, 15 Mar 2020 17:44:25 +0100
+Subject: mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 53dd0a7cd65edc83b0c243d1c08377c8b876b2ee upstream.
+
+SAMA5D2x doesn't drive CMD line if GPIO is used as CD line (at least
+SAMA5D27 doesn't). Fix this by forcing card-detect in the module
+if module-controlled CD is not used.
+
+Fixed commit addresses the problem only for non-removable cards. This
+amends it to also cover gpio-cd case.
+
+Cc: stable@vger.kernel.org
+Fixes: 7a1e3f143176 ("mmc: sdhci-of-at91: force card detect value for non removable devices")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Link: https://lore.kernel.org/r/8d10950d9940468577daef4772b82a071b204716.1584290561.git.mirq-linux@rere.qmqm.pl
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/sdhci-of-at91.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/sdhci-of-at91.c
++++ b/drivers/mmc/host/sdhci-of-at91.c
+@@ -125,7 +125,8 @@ static void sdhci_at91_reset(struct sdhc
+
+ sdhci_reset(host, mask);
+
+- if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ || mmc_gpio_get_cd(host->mmc) >= 0)
+ sdhci_at91_set_force_card_detect(host);
+
+ if (priv->cal_always_on && (mask & SDHCI_RESET_ALL))
+@@ -416,8 +417,11 @@ static int sdhci_at91_probe(struct platf
+ * detection procedure using the SDMCC_CD signal is bypassed.
+ * This bit is reset when a software reset for all command is performed
+ * so we need to implement our own reset function to set back this bit.
++ *
++ * WA: SAMA5D2 doesn't drive CMD if using CD GPIO line.
+ */
+- if (host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ if ((host->mmc->caps & MMC_CAP_NONREMOVABLE)
++ || mmc_gpio_get_cd(host->mmc) >= 0)
+ sdhci_at91_set_force_card_detect(host);
+
+ pm_runtime_put_autosuspend(&pdev->dev);
--- /dev/null
+From 5190044c2965514a973184ca68ef5fad57a24670 Mon Sep 17 00:00:00 2001
+From: Jessica Yu <jeyu@kernel.org>
+Date: Wed, 11 Mar 2020 18:01:20 +0100
+Subject: modpost: move the namespace field in Module.symvers last
+
+From: Jessica Yu <jeyu@kernel.org>
+
+commit 5190044c2965514a973184ca68ef5fad57a24670 upstream.
+
+In order to preserve backwards compatability with kmod tools, we have to
+move the namespace field in Module.symvers last, as the depmod -e -E
+option looks at the first three fields in Module.symvers to check symbol
+versions (and it's expected they stay in the original order of crc,
+symbol, module).
+
+In addition, update an ancient comment above read_dump() in modpost that
+suggested that the export type field in Module.symvers was optional. I
+suspect that there were historical reasons behind that comment that are
+no longer accurate. We have been unconditionally printing the export
+type since 2.6.18 (commit bd5cbcedf44), which is over a decade ago now.
+
+Fix up read_dump() to treat each field as non-optional. I suspect the
+original read_dump() code treated the export field as optional in order
+to support pre <= 2.6.18 Module.symvers (which did not have the export
+type field). Note that although symbol namespaces are optional, the
+field will not be omitted from Module.symvers if a symbol does not have
+a namespace. In this case, the field will simply be empty and the next
+delimiter or end of line will follow.
+
+Cc: stable@vger.kernel.org
+Fixes: cb9b55d21fe0 ("modpost: add support for symbol namespaces")
+Tested-by: Matthias Maennich <maennich@google.com>
+Reviewed-by: Matthias Maennich <maennich@google.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/kbuild/modules.rst | 4 ++--
+ scripts/export_report.pl | 2 +-
+ scripts/mod/modpost.c | 24 ++++++++++++------------
+ 3 files changed, 15 insertions(+), 15 deletions(-)
+
+--- a/Documentation/kbuild/modules.rst
++++ b/Documentation/kbuild/modules.rst
+@@ -470,9 +470,9 @@ build.
+
+ The syntax of the Module.symvers file is::
+
+- <CRC> <Symbol> <Namespace> <Module> <Export Type>
++ <CRC> <Symbol> <Module> <Export Type> <Namespace>
+
+- 0xe1cc2a05 usb_stor_suspend USB_STORAGE drivers/usb/storage/usb-storage EXPORT_SYMBOL_GPL
++ 0xe1cc2a05 usb_stor_suspend drivers/usb/storage/usb-storage EXPORT_SYMBOL_GPL USB_STORAGE
+
+ The fields are separated by tabs and values may be empty (e.g.
+ if no namespace is defined for an exported symbol).
+--- a/scripts/export_report.pl
++++ b/scripts/export_report.pl
+@@ -94,7 +94,7 @@ if (defined $opt{'o'}) {
+ #
+ while ( <$module_symvers> ) {
+ chomp;
+- my (undef, $symbol, $namespace, $module, $gpl) = split('\t');
++ my (undef, $symbol, $module, $gpl, $namespace) = split('\t');
+ $SYMBOL { $symbol } = [ $module , "0" , $symbol, $gpl];
+ }
+ close($module_symvers);
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -2433,7 +2433,7 @@ static void write_if_changed(struct buff
+ }
+
+ /* parse Module.symvers file. line format:
+- * 0x12345678<tab>symbol<tab>module[[<tab>export]<tab>something]
++ * 0x12345678<tab>symbol<tab>module<tab>export<tab>namespace
+ **/
+ static void read_dump(const char *fname, unsigned int kernel)
+ {
+@@ -2446,7 +2446,7 @@ static void read_dump(const char *fname,
+ return;
+
+ while ((line = get_next_line(&pos, file, size))) {
+- char *symname, *namespace, *modname, *d, *export, *end;
++ char *symname, *namespace, *modname, *d, *export;
+ unsigned int crc;
+ struct module *mod;
+ struct symbol *s;
+@@ -2454,16 +2454,16 @@ static void read_dump(const char *fname,
+ if (!(symname = strchr(line, '\t')))
+ goto fail;
+ *symname++ = '\0';
+- if (!(namespace = strchr(symname, '\t')))
+- goto fail;
+- *namespace++ = '\0';
+- if (!(modname = strchr(namespace, '\t')))
++ if (!(modname = strchr(symname, '\t')))
+ goto fail;
+ *modname++ = '\0';
+- if ((export = strchr(modname, '\t')) != NULL)
+- *export++ = '\0';
+- if (export && ((end = strchr(export, '\t')) != NULL))
+- *end = '\0';
++ if (!(export = strchr(modname, '\t')))
++ goto fail;
++ *export++ = '\0';
++ if (!(namespace = strchr(export, '\t')))
++ goto fail;
++ *namespace++ = '\0';
++
+ crc = strtoul(line, &d, 16);
+ if (*symname == '\0' || *modname == '\0' || *d != '\0')
+ goto fail;
+@@ -2514,9 +2514,9 @@ static void write_dump(const char *fname
+ namespace = symbol->namespace;
+ buf_printf(&buf, "0x%08x\t%s\t%s\t%s\t%s\n",
+ symbol->crc, symbol->name,
+- namespace ? namespace : "",
+ symbol->module->name,
+- export_str(symbol->export));
++ export_str(symbol->export),
++ namespace ? namespace : "");
+ }
+ symbol = symbol->next;
+ }
alsa-seq-oss-fix-running-status-after-receiving-sysex.patch
alsa-pcm-oss-avoid-plugin-buffer-overflow.patch
alsa-pcm-oss-remove-warning-from-snd_pcm_plug_alloc-checks.patch
+tty-fix-compat-tiocgserial-leaking-uninitialized-memory.patch
+tty-fix-compat-tiocgserial-checking-wrong-function-ptr.patch
+iio-chemical-sps30-fix-missing-triggered-buffer-dependency.patch
+iio-st_sensors-remap-smo8840-to-lis2dh12.patch
+iio-trigger-stm32-timer-disable-master-mode-when-stopping.patch
+iio-accel-adxl372-set-iio_chan-be.patch
+iio-magnetometer-ak8974-fix-negative-raw-values-in-sysfs.patch
+iio-adc-stm32-dfsdm-fix-sleep-in-atomic-context.patch
+iio-adc-at91-sama5d2_adc-fix-differential-channels-in-triggered-mode.patch
+iio-light-vcnl4000-update-sampling-periods-for-vcnl4200.patch
+iio-light-vcnl4000-update-sampling-periods-for-vcnl4040.patch
+mmc-rtsx_pci-fix-support-for-speed-modes-that-relies-on-tuning.patch
+mmc-sdhci-of-at91-fix-cd-gpios-for-sama5d2.patch
+mmc-sdhci-cadence-set-sdhci_quirk2_preset_value_broken-for-uniphier.patch
+mmc-sdhci-acpi-switch-signal-voltage-back-to-3.3v-on-suspend-on-external-microsd-on-lenovo-miix-320.patch
+mmc-sdhci-acpi-disable-write-protect-detection-on-acer-aspire-switch-10-sw5-012.patch
+cifs-fiemap-do-not-return-einval-if-get-nothing.patch
+kbuild-disable-wpointer-to-enum-cast.patch
+staging-rtl8188eu-add-device-id-for-mercusys-mw150us-v2.patch
+staging-greybus-loopback_test-fix-poll-mask-build-breakage.patch
+staging-speakup-fix-get_word-non-space-look-ahead.patch
+intel_th-msu-fix-the-unexpected-state-warning.patch
+intel_th-fix-user-visible-error-codes.patch
+intel_th-pci-add-elkhart-lake-cpu-support.patch
+modpost-move-the-namespace-field-in-module.symvers-last.patch
--- /dev/null
+From 8f3675be4bda33adbdc1dd2ab3b6c76a7599a79e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 12 Mar 2020 12:01:49 +0100
+Subject: staging: greybus: loopback_test: fix poll-mask build breakage
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 8f3675be4bda33adbdc1dd2ab3b6c76a7599a79e upstream.
+
+A scripted conversion from userland POLL* to kernel EPOLL* constants
+mistakingly replaced the poll flags in the loopback_test tool, which
+therefore no longer builds.
+
+Fixes: a9a08845e9ac ("vfs: do bulk POLL* -> EPOLL* replacement")
+Cc: stable <stable@vger.kernel.org> # 4.16
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20200312110151.22028-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/greybus/tools/loopback_test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/greybus/tools/loopback_test.c
++++ b/drivers/staging/greybus/tools/loopback_test.c
+@@ -655,7 +655,7 @@ static int open_poll_files(struct loopba
+ goto err;
+ }
+ read(t->fds[fds_idx].fd, &dummy, 1);
+- t->fds[fds_idx].events = EPOLLERR|EPOLLPRI;
++ t->fds[fds_idx].events = POLLERR | POLLPRI;
+ t->fds[fds_idx].revents = 0;
+ fds_idx++;
+ }
+@@ -748,7 +748,7 @@ static int wait_for_complete(struct loop
+ }
+
+ for (i = 0; i < t->poll_count; i++) {
+- if (t->fds[i].revents & EPOLLPRI) {
++ if (t->fds[i].revents & POLLPRI) {
+ /* Dummy read to clear the event */
+ read(t->fds[i].fd, &dummy, 1);
+ number_of_events++;
--- /dev/null
+From bb5786b9286c253557a0115bc8d21879e61b7b94 Mon Sep 17 00:00:00 2001
+From: Michael Straube <straube.linux@gmail.com>
+Date: Thu, 12 Mar 2020 10:36:52 +0100
+Subject: staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
+
+From: Michael Straube <straube.linux@gmail.com>
+
+commit bb5786b9286c253557a0115bc8d21879e61b7b94 upstream.
+
+This device was added to the stand-alone driver on github.
+Add it to the staging driver as well.
+
+Link: https://github.com/lwfinger/rtl8188eu/commit/2141f244c3e7
+Signed-off-by: Michael Straube <straube.linux@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200312093652.13918-1-straube.linux@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -38,6 +38,7 @@ static const struct usb_device_id rtw_us
+ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
+ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
+ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
++ {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ {} /* Terminating entry */
--- /dev/null
+From 9d32c0cde4e2d1343dfb88a67b2ec6397705b32b Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Fri, 6 Mar 2020 01:30:47 +0100
+Subject: staging/speakup: fix get_word non-space look-ahead
+
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+
+commit 9d32c0cde4e2d1343dfb88a67b2ec6397705b32b upstream.
+
+get_char was erroneously given the address of the pointer to the text
+instead of the address of the text, thus leading to random crashes when
+the user requests speaking a word while the current position is on a space
+character and say_word_ctl is not enabled.
+
+Reported-on: https://github.com/bytefire/speakup/issues/1
+Reported-by: Kirk Reiser <kirk@reisers.ca>
+Reported-by: Janina Sajka <janina@rednote.net>
+Reported-by: Alexandr Epaneshnikov <aarnaarn2@gmail.com>
+Reported-by: Gregory Nowak <greg@gregn.net>
+Reported-by: deedra waters <deedra@the-brannons.com>
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Tested-by: Alexandr Epaneshnikov <aarnaarn2@gmail.com>
+Tested-by: Gregory Nowak <greg@gregn.net>
+Tested-by: Michael Taboada <michael@michaels.world>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200306003047.thijtmqrnayd3dmw@function
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/speakup/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/speakup/main.c
++++ b/drivers/staging/speakup/main.c
+@@ -561,7 +561,7 @@ static u_long get_word(struct vc_data *v
+ return 0;
+ } else if (tmpx < vc->vc_cols - 2 &&
+ (ch == SPACE || ch == 0 || (ch < 0x100 && IS_WDLM(ch))) &&
+- get_char(vc, (u_short *)&tmp_pos + 1, &temp) > SPACE) {
++ get_char(vc, (u_short *)tmp_pos + 1, &temp) > SPACE) {
+ tmp_pos += 2;
+ tmpx++;
+ } else {
--- /dev/null
+From 6e622cd8bd888c7fa3ee2b7dfb3514ab53b21570 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 24 Feb 2020 10:20:44 -0800
+Subject: tty: fix compat TIOCGSERIAL checking wrong function ptr
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 6e622cd8bd888c7fa3ee2b7dfb3514ab53b21570 upstream.
+
+Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into
+tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start
+checking for the presence of the ->set_serial function pointer rather
+than ->get_serial. This appears to be a copy-and-paste error, since
+->get_serial is the function pointer that is called as well as the
+pointer that is checked by the non-compat version of TIOCGSERIAL.
+
+Fix this by checking the correct function pointer.
+
+Fixes: 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()")
+Cc: <stable@vger.kernel.org> # v4.20+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20200224182044.234553-3-ebiggers@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/tty_io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2738,7 +2738,7 @@ static int compat_tty_tiocgserial(struct
+ memset(&v, 0, sizeof(v));
+ memset(&v32, 0, sizeof(v32));
+
+- if (!tty->ops->set_serial)
++ if (!tty->ops->get_serial)
+ return -ENOTTY;
+ err = tty->ops->get_serial(tty, &v);
+ if (!err) {
--- /dev/null
+From 17329563a97df3ba474eca5037c1336e46e14ff8 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 24 Feb 2020 10:20:43 -0800
+Subject: tty: fix compat TIOCGSERIAL leaking uninitialized memory
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 17329563a97df3ba474eca5037c1336e46e14ff8 upstream.
+
+Commit 77654350306a ("take compat TIOC[SG]SERIAL treatment into
+tty_compat_ioctl()") changed the compat version of TIOCGSERIAL to start
+copying a whole 'serial_struct32' to userspace rather than individual
+fields, but failed to initialize all padding and fields -- namely the
+hole after the 'iomem_reg_shift' field, and the 'reserved' field.
+
+Fix this by initializing the struct to zero.
+
+[v2: use sizeof, and convert the adjacent line for consistency.]
+
+Reported-by: syzbot+8da9175e28eadcb203ce@syzkaller.appspotmail.com
+Fixes: 77654350306a ("take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl()")
+Cc: <stable@vger.kernel.org> # v4.20+
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Acked-by: Jiri Slaby <jslaby@suse.cz>
+Link: https://lore.kernel.org/r/20200224182044.234553-2-ebiggers@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/tty_io.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2734,7 +2734,9 @@ static int compat_tty_tiocgserial(struct
+ struct serial_struct32 v32;
+ struct serial_struct v;
+ int err;
+- memset(&v, 0, sizeof(struct serial_struct));
++
++ memset(&v, 0, sizeof(v));
++ memset(&v32, 0, sizeof(v32));
+
+ if (!tty->ops->set_serial)
+ return -ENOTTY;
projects / thirdparty / kernel / stable-queue.git / commitdiff
