--- /dev/null
+From aa7c46b5a8f30eec20aeb6360d74552553cc135a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:37 +0000
+Subject: ACPI / APEI: Don't wait to serialise with oops messages when
+ panic()ing
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 78b0b690f6558ed788dccafa45965325dd11ba89 ]
+
+oops_begin() exists to group printk() messages with the oops message
+printed by die(). To reach this caller we know that platform firmware
+took this error first, then notified the OS via NMI with a 'panic'
+severity.
+
+Don't wait for another CPU to release the die-lock before panic()ing,
+our only goal is to print this fatal error and panic().
+
+This code is always called in_nmi(), and since commit 42a0bb3f7138
+("printk/nmi: generic solution for safe printk in NMI"), it has been
+safe to call printk() from this context. Messages are batched in a
+per-cpu buffer and printed via irq-work, or a call back from panic().
+
+Link: https://patchwork.kernel.org/patch/10313555/
+Acked-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index f008ba7c9cedc..0c46b79e31b1e 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -33,7 +33,6 @@
+ #include <linux/interrupt.h>
+ #include <linux/timer.h>
+ #include <linux/cper.h>
+-#include <linux/kdebug.h>
+ #include <linux/platform_device.h>
+ #include <linux/mutex.h>
+ #include <linux/ratelimit.h>
+@@ -949,7 +948,6 @@ static int ghes_notify_nmi(unsigned int cmd, struct pt_regs *regs)
+
+ sev = ghes_severity(ghes->estatus->error_severity);
+ if (sev >= GHES_SEV_PANIC) {
+- oops_begin();
+ ghes_print_queued_estatus();
+ __ghes_panic(ghes);
+ }
+--
+2.20.1
+
--- /dev/null
+From c6dff47dbef9da434b9e94f3b259346d1cd0e1f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 18:48:39 +0000
+Subject: ACPI / APEI: Switch estatus pool to use vmalloc memory
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit 0ac234be1a9497498e57d958f4251f5257b116b4 ]
+
+The ghes code is careful to parse and round firmware's advertised
+memory requirements for CPER records, up to a maximum of 64K.
+However when ghes_estatus_pool_expand() does its work, it splits
+the requested size into PAGE_SIZE granules.
+
+This means if firmware generates 5K of CPER records, and correctly
+describes this in the table, __process_error() will silently fail as it
+is unable to allocate more than PAGE_SIZE.
+
+Switch the estatus pool to vmalloc() memory. On x86 vmalloc() memory
+may fault and be fixed up by vmalloc_fault(). To prevent this call
+vmalloc_sync_all() before an NMI handler could discover the memory.
+
+Signed-off-by: James Morse <james.morse@arm.com>
+Reviewed-by: Borislav Petkov <bp@suse.de>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/apei/ghes.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index 0c46b79e31b1e..73177b8a07bd1 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -170,40 +170,40 @@ static int ghes_estatus_pool_init(void)
+ return 0;
+ }
+
+-static void ghes_estatus_pool_free_chunk_page(struct gen_pool *pool,
++static void ghes_estatus_pool_free_chunk(struct gen_pool *pool,
+ struct gen_pool_chunk *chunk,
+ void *data)
+ {
+- free_page(chunk->start_addr);
++ vfree((void *)chunk->start_addr);
+ }
+
+ static void ghes_estatus_pool_exit(void)
+ {
+ gen_pool_for_each_chunk(ghes_estatus_pool,
+- ghes_estatus_pool_free_chunk_page, NULL);
++ ghes_estatus_pool_free_chunk, NULL);
+ gen_pool_destroy(ghes_estatus_pool);
+ }
+
+ static int ghes_estatus_pool_expand(unsigned long len)
+ {
+- unsigned long i, pages, size, addr;
+- int ret;
++ unsigned long size, addr;
+
+ ghes_estatus_pool_size_request += PAGE_ALIGN(len);
+ size = gen_pool_size(ghes_estatus_pool);
+ if (size >= ghes_estatus_pool_size_request)
+ return 0;
+- pages = (ghes_estatus_pool_size_request - size) / PAGE_SIZE;
+- for (i = 0; i < pages; i++) {
+- addr = __get_free_page(GFP_KERNEL);
+- if (!addr)
+- return -ENOMEM;
+- ret = gen_pool_add(ghes_estatus_pool, addr, PAGE_SIZE, -1);
+- if (ret)
+- return ret;
+- }
+
+- return 0;
++ addr = (unsigned long)vmalloc(PAGE_ALIGN(len));
++ if (!addr)
++ return -ENOMEM;
++
++ /*
++ * New allocation must be visible in all pgd before it can be found by
++ * an NMI allocating from the pool.
++ */
++ vmalloc_sync_all();
++
++ return gen_pool_add(ghes_estatus_pool, addr, PAGE_ALIGN(len), -1);
+ }
+
+ static int map_gen_v2(struct ghes *ghes)
+--
+2.20.1
+
--- /dev/null
+From a2340ffcec39e497cf6d07d0c05f879c62081cab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Dec 2018 13:59:24 +0100
+Subject: ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1a2fa02f7489dc4d746f2a15fb77b3ce1affade8 ]
+
+Ignore acpi_device_fix_up_power() return value. If we return an error
+we end up with acpi_default_enumeration() still creating a platform-
+device for the device and we end up with the device still being used
+but without the special LPSS related handling which is not useful.
+
+Specicifically ignoring the error fixes the touchscreen no longer
+working after a suspend/resume on a Prowise PT301 tablet.
+
+This tablet has a broken _PS0 method on the touchscreen's I2C controller,
+causing acpi_device_fix_up_power() to fail, causing fallback to standard
+platform-dev handling and specifically causing acpi_lpss_save/restore_ctx
+to not run.
+
+The I2C controllers _PS0 method does actually turn on the device, but then
+does some more nonsense which fails when run during early boot trying to
+use I2C opregion handling on another not-yet registered I2C controller.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_lpss.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
+index b21c241aaab9f..30ccd94f87d24 100644
+--- a/drivers/acpi/acpi_lpss.c
++++ b/drivers/acpi/acpi_lpss.c
+@@ -665,12 +665,7 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
+ * have _PS0 and _PS3 without _PSC (and no power resources), so
+ * acpi_bus_init_power() will assume that the BIOS has put them into D0.
+ */
+- ret = acpi_device_fix_up_power(adev);
+- if (ret) {
+- /* Skip the device, but continue the namespace scan. */
+- ret = 0;
+- goto err_out;
+- }
++ acpi_device_fix_up_power(adev);
+
+ adev->driver_data = pdata;
+ pdev = acpi_create_platform_device(adev, dev_desc->properties);
+--
+2.20.1
+
--- /dev/null
+From 453c35cdd39dcf39e2a9e263716d9c62c25d1af0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Feb 2019 10:21:23 +0000
+Subject: apparmor: delete the dentry in aafs_remove() to avoid a leak
+
+From: Chris Coulson <chris.coulson@canonical.com>
+
+[ Upstream commit 201218e4d3dfa1346e30997f48725acce3f26d01 ]
+
+Although the apparmorfs dentries are always dropped from the dentry cache
+when the usage count drops to zero, there is no guarantee that this will
+happen in aafs_remove(), as another thread might still be using it. In
+this scenario, this means that the dentry will temporarily continue to
+appear in the results of lookups, even after the call to aafs_remove().
+
+In the case of removal of a profile - it also causes simple_rmdir()
+on the profile directory to fail, as the directory won't be empty until
+the usage counts of all child dentries have decreased to zero. This
+results in the dentry for the profile directory leaking and appearing
+empty in the file system tree forever.
+
+Signed-off-by: Chris Coulson <chris.coulson@canonical.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/apparmorfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c
+index 40e3a098f6fb5..d95a7e41a29d4 100644
+--- a/security/apparmor/apparmorfs.c
++++ b/security/apparmor/apparmorfs.c
+@@ -361,6 +361,7 @@ static void aafs_remove(struct dentry *dentry)
+ simple_rmdir(dir, dentry);
+ else
+ simple_unlink(dir, dentry);
++ d_delete(dentry);
+ dput(dentry);
+ }
+ inode_unlock(dir);
+--
+2.20.1
+
--- /dev/null
+From c7c6bbc726dea06607a81f00bce3ebd1450c9bc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:04:16 +0100
+Subject: ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 7c41ea57beb2aee96fa63091a457b1a2826f3c42 ]
+
+If debugging on i.MX is enabled DEBUG_IMX_UART_PORT defines which UART
+is used for the debug output. If however debugging is off don't only
+hide the then unused config item but drop it completely by using a
+dependency instead of a conditional prompt.
+
+This fixes DEBUG_IMX_UART_PORT being present in the kernel config even
+if DEBUG_LL is disabled.
+
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig.debug | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index f6fcb8a798890..f95a90dfc282a 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1432,21 +1432,21 @@ config DEBUG_OMAP2PLUS_UART
+ depends on ARCH_OMAP2PLUS
+
+ config DEBUG_IMX_UART_PORT
+- int "i.MX Debug UART Port Selection" if DEBUG_IMX1_UART || \
+- DEBUG_IMX25_UART || \
+- DEBUG_IMX21_IMX27_UART || \
+- DEBUG_IMX31_UART || \
+- DEBUG_IMX35_UART || \
+- DEBUG_IMX50_UART || \
+- DEBUG_IMX51_UART || \
+- DEBUG_IMX53_UART || \
+- DEBUG_IMX6Q_UART || \
+- DEBUG_IMX6SL_UART || \
+- DEBUG_IMX6SX_UART || \
+- DEBUG_IMX6UL_UART || \
+- DEBUG_IMX7D_UART
++ int "i.MX Debug UART Port Selection"
++ depends on DEBUG_IMX1_UART || \
++ DEBUG_IMX25_UART || \
++ DEBUG_IMX21_IMX27_UART || \
++ DEBUG_IMX31_UART || \
++ DEBUG_IMX35_UART || \
++ DEBUG_IMX50_UART || \
++ DEBUG_IMX51_UART || \
++ DEBUG_IMX53_UART || \
++ DEBUG_IMX6Q_UART || \
++ DEBUG_IMX6SL_UART || \
++ DEBUG_IMX6SX_UART || \
++ DEBUG_IMX6UL_UART || \
++ DEBUG_IMX7D_UART
+ default 1
+- depends on ARCH_MXC
+ help
+ Choose UART port on which kernel low-level debug messages
+ should be output.
+--
+2.20.1
+
--- /dev/null
+From bdedec7ba6b67f57c5818f8029dea26130844635 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 14:48:51 -0800
+Subject: ARM: dts: Fix hsi gdd range for omap4
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit e9e685480b74aef3f3d0967dadb52eea3ff625d2 ]
+
+While reviewing the missing mcasp ranges I noticed omap4 hsi range
+for gdd is wrong so let's fix it.
+
+I'm not aware of any omap4 devices in mainline kernel though that use
+hsi though.
+
+Fixes: 84badc5ec5fc ("ARM: dts: omap4: Move l4 child devices to probe
+them with ti-sysc")
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap4-l4.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap4-l4.dtsi b/arch/arm/boot/dts/omap4-l4.dtsi
+index 6eb26b837446c..5059ecac44787 100644
+--- a/arch/arm/boot/dts/omap4-l4.dtsi
++++ b/arch/arm/boot/dts/omap4-l4.dtsi
+@@ -196,12 +196,12 @@
+ clock-names = "fck";
+ #address-cells = <1>;
+ #size-cells = <1>;
+- ranges = <0x0 0x58000 0x4000>;
++ ranges = <0x0 0x58000 0x5000>;
+
+ hsi: hsi@0 {
+ compatible = "ti,omap4-hsi";
+ reg = <0x0 0x4000>,
+- <0x4a05c000 0x1000>;
++ <0x5000 0x1000>;
+ reg-names = "sys", "gdd";
+
+ clocks = <&l3_init_clkctrl OMAP4_HSI_CLKCTRL 0>;
+--
+2.20.1
+
--- /dev/null
+From 7da70bb287a3f45f38cc409063189a83ae111505 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 09:00:51 +0200
+Subject: ARM: dts: Fix up SQ201 flash access
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit d88b11ef91b15d0af9c0676cbf4f441a0dff0c56 ]
+
+This sets the partition information on the SQ201 to be read
+out from the RedBoot partition table, removes the static
+partition table and sets our boot options to mount root from
+/dev/mtdblock2 where the squashfs+JFFS2 resides.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/gemini-sq201.dts | 37 ++++--------------------------
+ 1 file changed, 5 insertions(+), 32 deletions(-)
+
+diff --git a/arch/arm/boot/dts/gemini-sq201.dts b/arch/arm/boot/dts/gemini-sq201.dts
+index 3787cf3763c41..e9e4a8a02600b 100644
+--- a/arch/arm/boot/dts/gemini-sq201.dts
++++ b/arch/arm/boot/dts/gemini-sq201.dts
+@@ -20,7 +20,7 @@
+ };
+
+ chosen {
+- bootargs = "console=ttyS0,115200n8";
++ bootargs = "console=ttyS0,115200n8 root=/dev/mtdblock2 rw rootfstype=squashfs,jffs2 rootwait";
+ stdout-path = &uart0;
+ };
+
+@@ -138,37 +138,10 @@
+ /* 16MB of flash */
+ reg = <0x30000000 0x01000000>;
+
+- partition@0 {
+- label = "RedBoot";
+- reg = <0x00000000 0x00120000>;
+- read-only;
+- };
+- partition@120000 {
+- label = "Kernel";
+- reg = <0x00120000 0x00200000>;
+- };
+- partition@320000 {
+- label = "Ramdisk";
+- reg = <0x00320000 0x00600000>;
+- };
+- partition@920000 {
+- label = "Application";
+- reg = <0x00920000 0x00600000>;
+- };
+- partition@f20000 {
+- label = "VCTL";
+- reg = <0x00f20000 0x00020000>;
+- read-only;
+- };
+- partition@f40000 {
+- label = "CurConf";
+- reg = <0x00f40000 0x000a0000>;
+- read-only;
+- };
+- partition@fe0000 {
+- label = "FIS directory";
+- reg = <0x00fe0000 0x00020000>;
+- read-only;
++ partitions {
++ compatible = "redboot-fis";
++ /* Eraseblock at 0xfe0000 */
++ fis-index-block = <0x1fc>;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 260a118cbf331fbe8c3966c95361e3448cb21f79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:40:52 -0200
+Subject: ARM: dts: imx1: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 62864d5665c4fc636d3021f829b3ac00fa058e30 ]
+
+Boards based on imx1 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx1.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx1-ads.dts | 1 +
+ arch/arm/boot/dts/imx1-apf9328.dts | 1 +
+ arch/arm/boot/dts/imx1.dtsi | 2 --
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx1-ads.dts b/arch/arm/boot/dts/imx1-ads.dts
+index a1d81badb5c8a..119b19ba53b6d 100644
+--- a/arch/arm/boot/dts/imx1-ads.dts
++++ b/arch/arm/boot/dts/imx1-ads.dts
+@@ -21,6 +21,7 @@
+ };
+
+ memory@8000000 {
++ device_type = "memory";
+ reg = <0x08000000 0x04000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx1-apf9328.dts b/arch/arm/boot/dts/imx1-apf9328.dts
+index 11515c0cb195c..ee4b1b106b1ae 100644
+--- a/arch/arm/boot/dts/imx1-apf9328.dts
++++ b/arch/arm/boot/dts/imx1-apf9328.dts
+@@ -21,6 +21,7 @@
+ };
+
+ memory@8000000 {
++ device_type = "memory";
+ reg = <0x08000000 0x00800000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx1.dtsi b/arch/arm/boot/dts/imx1.dtsi
+index 3edc7b5550d88..2b6e77029de4d 100644
+--- a/arch/arm/boot/dts/imx1.dtsi
++++ b/arch/arm/boot/dts/imx1.dtsi
+@@ -15,10 +15,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio1;
+--
+2.20.1
+
--- /dev/null
+From 5160623d566cbce5f2af7e8a22ebcf35992055fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:08:55 -0200
+Subject: ARM: dts: imx23: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit b629e83520fafe6f4c2f3e8c88c78a496fc4987c ]
+
+Boards based on imx23 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx23.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx23-evk.dts | 1 +
+ arch/arm/boot/dts/imx23-olinuxino.dts | 1 +
+ arch/arm/boot/dts/imx23-sansa.dts | 1 +
+ arch/arm/boot/dts/imx23-stmp378x_devb.dts | 1 +
+ arch/arm/boot/dts/imx23-xfi3.dts | 1 +
+ arch/arm/boot/dts/imx23.dtsi | 2 --
+ 6 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx23-evk.dts b/arch/arm/boot/dts/imx23-evk.dts
+index ad2ae25b7b4db..aca27aa2d44bd 100644
+--- a/arch/arm/boot/dts/imx23-evk.dts
++++ b/arch/arm/boot/dts/imx23-evk.dts
+@@ -10,6 +10,7 @@
+ compatible = "fsl,imx23-evk", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-olinuxino.dts b/arch/arm/boot/dts/imx23-olinuxino.dts
+index e9351774c6199..109f51603d45e 100644
+--- a/arch/arm/boot/dts/imx23-olinuxino.dts
++++ b/arch/arm/boot/dts/imx23-olinuxino.dts
+@@ -20,6 +20,7 @@
+ compatible = "olimex,imx23-olinuxino", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-sansa.dts b/arch/arm/boot/dts/imx23-sansa.dts
+index 67de7863ad795..fa22fd9b24129 100644
+--- a/arch/arm/boot/dts/imx23-sansa.dts
++++ b/arch/arm/boot/dts/imx23-sansa.dts
+@@ -50,6 +50,7 @@
+ compatible = "sandisk,sansa_fuze_plus", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-stmp378x_devb.dts b/arch/arm/boot/dts/imx23-stmp378x_devb.dts
+index 95c7b918f6d60..aab029349420d 100644
+--- a/arch/arm/boot/dts/imx23-stmp378x_devb.dts
++++ b/arch/arm/boot/dts/imx23-stmp378x_devb.dts
+@@ -17,6 +17,7 @@
+ compatible = "fsl,stmp378x-devb", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23-xfi3.dts b/arch/arm/boot/dts/imx23-xfi3.dts
+index 9616e500b9961..2b5df8dfd3ff3 100644
+--- a/arch/arm/boot/dts/imx23-xfi3.dts
++++ b/arch/arm/boot/dts/imx23-xfi3.dts
+@@ -49,6 +49,7 @@
+ compatible = "creative,x-fi3", "fsl,imx23";
+
+ memory@40000000 {
++ device_type = "memory";
+ reg = <0x40000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
+index 71bfd2b15609a..aaaa987d8eff9 100644
+--- a/arch/arm/boot/dts/imx23.dtsi
++++ b/arch/arm/boot/dts/imx23.dtsi
+@@ -13,10 +13,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio0;
+--
+2.20.1
+
--- /dev/null
+From 48c7a0249de8f50e2f3d078369479751a67b4034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:40:54 -0200
+Subject: ARM: dts: imx25: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 59d8bb363f563e4a147a291037bf979cb8ff9a59 ]
+
+Boards based on imx25 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx25.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi | 1 +
+ arch/arm/boot/dts/imx25-karo-tx25.dts | 1 +
+ arch/arm/boot/dts/imx25-pdk.dts | 1 +
+ arch/arm/boot/dts/imx25.dtsi | 2 --
+ 4 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+index e316fe08837a3..e4d7da267532d 100644
+--- a/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
++++ b/arch/arm/boot/dts/imx25-eukrea-cpuimx25.dtsi
+@@ -18,6 +18,7 @@
+ compatible = "eukrea,cpuimx25", "fsl,imx25";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x4000000>; /* 64M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx25-karo-tx25.dts b/arch/arm/boot/dts/imx25-karo-tx25.dts
+index 5cb6967866c0a..f37e9a75a3ca7 100644
+--- a/arch/arm/boot/dts/imx25-karo-tx25.dts
++++ b/arch/arm/boot/dts/imx25-karo-tx25.dts
+@@ -37,6 +37,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x02000000 0x90000000 0x02000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx25-pdk.dts b/arch/arm/boot/dts/imx25-pdk.dts
+index a5626b46ac4e1..f8544a9e46330 100644
+--- a/arch/arm/boot/dts/imx25-pdk.dts
++++ b/arch/arm/boot/dts/imx25-pdk.dts
+@@ -12,6 +12,7 @@
+ compatible = "fsl,imx25-pdk", "fsl,imx25";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x4000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
+index 85c15ee632727..8c8ad80de4614 100644
+--- a/arch/arm/boot/dts/imx25.dtsi
++++ b/arch/arm/boot/dts/imx25.dtsi
+@@ -12,10 +12,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+--
+2.20.1
+
--- /dev/null
+From 7c709869b19b4acc4f5a209fa64781142ed7f67a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 10:40:53 -0200
+Subject: ARM: dts: imx27: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 38715dcd49b4430ac5b6bc1293278d91a4d32bd5 ]
+
+Boards based on imx27 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx27.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx27-apf27.dts | 1 +
+ arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi | 1 +
+ arch/arm/boot/dts/imx27-pdk.dts | 1 +
+ arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi | 1 +
+ arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi | 1 +
+ arch/arm/boot/dts/imx27.dtsi | 2 --
+ 6 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx27-apf27.dts b/arch/arm/boot/dts/imx27-apf27.dts
+index 3eddd805a793a..f635d5c5029c4 100644
+--- a/arch/arm/boot/dts/imx27-apf27.dts
++++ b/arch/arm/boot/dts/imx27-apf27.dts
+@@ -20,6 +20,7 @@
+ compatible = "armadeus,imx27-apf27", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x04000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+index 9c455dcbe6ebf..c85f9d01768a1 100644
+--- a/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
++++ b/arch/arm/boot/dts/imx27-eukrea-cpuimx27.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "eukrea,cpuimx27", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x04000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx27-pdk.dts b/arch/arm/boot/dts/imx27-pdk.dts
+index f9a882d991329..35123b7cb6b3e 100644
+--- a/arch/arm/boot/dts/imx27-pdk.dts
++++ b/arch/arm/boot/dts/imx27-pdk.dts
+@@ -10,6 +10,7 @@
+ compatible = "fsl,imx27-pdk", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
+index cbad7c88c58cc..b0b4f7c00246d 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
++++ b/arch/arm/boot/dts/imx27-phytec-phycard-s-som.dtsi
+@@ -18,6 +18,7 @@
+ compatible = "phytec,imx27-pca100", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x08000000>; /* 128MB */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+index ec466b4bfd410..0935e1400e5d2 100644
+--- a/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
++++ b/arch/arm/boot/dts/imx27-phytec-phycore-som.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "phytec,imx27-pcm038", "fsl,imx27";
+
+ memory@a0000000 {
++ device_type = "memory";
+ reg = <0xa0000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
+index 753d88df16274..39e75b997bdc8 100644
+--- a/arch/arm/boot/dts/imx27.dtsi
++++ b/arch/arm/boot/dts/imx27.dtsi
+@@ -16,10 +16,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+--
+2.20.1
+
--- /dev/null
+From 8b798c2c5b72afb798da4dffb5d82cc0f33d6b05 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:40:45 -0200
+Subject: ARM: dts: imx31: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 013d37e4707e24c7b9bc3fc55aeda55ce9c2b262 ]
+
+Boards based on imx31 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx31.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Tested-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx31-bug.dts | 1 +
+ arch/arm/boot/dts/imx31-lite.dts | 1 +
+ arch/arm/boot/dts/imx31.dtsi | 2 --
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx31-bug.dts b/arch/arm/boot/dts/imx31-bug.dts
+index 6ee4ff8e4e8f0..9eb960cc02cc5 100644
+--- a/arch/arm/boot/dts/imx31-bug.dts
++++ b/arch/arm/boot/dts/imx31-bug.dts
+@@ -17,6 +17,7 @@
+ compatible = "buglabs,imx31-bug", "fsl,imx31";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>; /* 128M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx31-lite.dts b/arch/arm/boot/dts/imx31-lite.dts
+index db52ddccabc33..d17abdfb6330c 100644
+--- a/arch/arm/boot/dts/imx31-lite.dts
++++ b/arch/arm/boot/dts/imx31-lite.dts
+@@ -18,6 +18,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx31.dtsi b/arch/arm/boot/dts/imx31.dtsi
+index ca1419ca303c3..2fc64d2c7c88e 100644
+--- a/arch/arm/boot/dts/imx31.dtsi
++++ b/arch/arm/boot/dts/imx31.dtsi
+@@ -10,10 +10,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio1;
+--
+2.20.1
+
--- /dev/null
+From 914a005705dbae192278528084ee4e43d8e699cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:40:46 -0200
+Subject: ARM: dts: imx35: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 8721610a6c2b8c42fc57819d8c3bfbb9166f95a3 ]
+
+Boards based on imx35 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx35.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi | 1 +
+ arch/arm/boot/dts/imx35-pdk.dts | 1 +
+ arch/arm/boot/dts/imx35.dtsi | 2 --
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi b/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
+index ba39d938f2891..5f8a47a9fcd40 100644
+--- a/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
++++ b/arch/arm/boot/dts/imx35-eukrea-cpuimx35.dtsi
+@@ -18,6 +18,7 @@
+ compatible = "eukrea,cpuimx35", "fsl,imx35";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>; /* 128M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx35-pdk.dts b/arch/arm/boot/dts/imx35-pdk.dts
+index df613e88fd2c1..ddce0a844758b 100644
+--- a/arch/arm/boot/dts/imx35-pdk.dts
++++ b/arch/arm/boot/dts/imx35-pdk.dts
+@@ -11,6 +11,7 @@
+ compatible = "fsl,imx35-pdk", "fsl,imx35";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x8000000>,
+ <0x90000000 0x8000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
+index 1c50b785cad47..b36b97b655dda 100644
+--- a/arch/arm/boot/dts/imx35.dtsi
++++ b/arch/arm/boot/dts/imx35.dtsi
+@@ -13,10 +13,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+--
+2.20.1
+
--- /dev/null
+From 22434d8e39c865304f05570643f1e58d5ebb98dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Nov 2018 11:25:19 -0200
+Subject: ARM: dts: imx50: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit aab5e3ea95b958cf22a24e756a84e635bdb081c1 ]
+
+imx50-evk has duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx50.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx50-evk.dts | 1 +
+ arch/arm/boot/dts/imx50.dtsi | 2 --
+ 2 files changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
+index 682a99783ee69..a25da415cb02e 100644
+--- a/arch/arm/boot/dts/imx50-evk.dts
++++ b/arch/arm/boot/dts/imx50-evk.dts
+@@ -12,6 +12,7 @@
+ compatible = "fsl,imx50-evk", "fsl,imx50";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x80000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx50.dtsi b/arch/arm/boot/dts/imx50.dtsi
+index ab522c2da6df6..9e9e92acceb27 100644
+--- a/arch/arm/boot/dts/imx50.dtsi
++++ b/arch/arm/boot/dts/imx50.dtsi
+@@ -22,10 +22,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+--
+2.20.1
+
--- /dev/null
+From c9e4095011f500f1e226cc50defa234830e9ac2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 19:14:45 -0200
+Subject: ARM: dts: imx51: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 6a9681168b83c62abfa457c709f2f4b126bd6b92 ]
+
+Boards based on imx51 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx51.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx51-apf51.dts | 1 +
+ arch/arm/boot/dts/imx51-babbage.dts | 1 +
+ arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi | 1 +
+ arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi | 1 +
+ arch/arm/boot/dts/imx51-ts4800.dts | 1 +
+ arch/arm/boot/dts/imx51-zii-rdu1.dts | 1 +
+ arch/arm/boot/dts/imx51-zii-scu2-mezz.dts | 1 +
+ arch/arm/boot/dts/imx51-zii-scu3-esb.dts | 1 +
+ arch/arm/boot/dts/imx51.dtsi | 2 --
+ 9 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx51-apf51.dts b/arch/arm/boot/dts/imx51-apf51.dts
+index 79d80036f74de..1eddf2908b3f2 100644
+--- a/arch/arm/boot/dts/imx51-apf51.dts
++++ b/arch/arm/boot/dts/imx51-apf51.dts
+@@ -22,6 +22,7 @@
+ compatible = "armadeus,imx51-apf51", "fsl,imx51";
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-babbage.dts b/arch/arm/boot/dts/imx51-babbage.dts
+index ba60b0cb3cc13..99191466a8085 100644
+--- a/arch/arm/boot/dts/imx51-babbage.dts
++++ b/arch/arm/boot/dts/imx51-babbage.dts
+@@ -15,6 +15,7 @@
+ };
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi b/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
+index 5761a66e8a0d3..82d8df097ef1f 100644
+--- a/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
++++ b/arch/arm/boot/dts/imx51-digi-connectcore-som.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "digi,connectcore-ccxmx51-som", "fsl,imx51";
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x08000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi b/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
+index f8902a338e49a..2e3125391bc49 100644
+--- a/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
++++ b/arch/arm/boot/dts/imx51-eukrea-cpuimx51.dtsi
+@@ -23,6 +23,7 @@
+ compatible = "eukrea,cpuimx51", "fsl,imx51";
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x10000000>; /* 256M */
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx51-ts4800.dts b/arch/arm/boot/dts/imx51-ts4800.dts
+index 39eb067904c3d..4344632f79400 100644
+--- a/arch/arm/boot/dts/imx51-ts4800.dts
++++ b/arch/arm/boot/dts/imx51-ts4800.dts
+@@ -18,6 +18,7 @@
+ };
+
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0x10000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+index 3fb66ddfe93a5..9235fd45a824e 100644
+--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts
++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts
+@@ -53,6 +53,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts b/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
+index 26cf08549df40..f5b2d768fe47f 100644
+--- a/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
++++ b/arch/arm/boot/dts/imx51-zii-scu2-mezz.dts
+@@ -18,6 +18,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51-zii-scu3-esb.dts b/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
+index e6ebac8f43e4f..ad90d66ccca6c 100644
+--- a/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
++++ b/arch/arm/boot/dts/imx51-zii-scu3-esb.dts
+@@ -18,6 +18,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@90000000 {
++ device_type = "memory";
+ reg = <0x90000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi
+index ef2abc0978439..81f60c96a2e41 100644
+--- a/arch/arm/boot/dts/imx51.dtsi
++++ b/arch/arm/boot/dts/imx51.dtsi
+@@ -16,10 +16,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+--
+2.20.1
+
--- /dev/null
+From 9311b50747beff4b1ff5de84e8e071fd8ca232be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 19:14:46 -0200
+Subject: ARM: dts: imx53: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit e8fd17b900a4a1e3a8bef7b44727cbad35db05a7 ]
+
+Boards based on imx53 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx53.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-ard.dts | 1 +
+ arch/arm/boot/dts/imx53-cx9020.dts | 1 +
+ arch/arm/boot/dts/imx53-m53.dtsi | 1 +
+ arch/arm/boot/dts/imx53-qsb-common.dtsi | 1 +
+ arch/arm/boot/dts/imx53-smd.dts | 1 +
+ arch/arm/boot/dts/imx53-tqma53.dtsi | 1 +
+ arch/arm/boot/dts/imx53-tx53.dtsi | 1 +
+ arch/arm/boot/dts/imx53-usbarmory.dts | 1 +
+ arch/arm/boot/dts/imx53.dtsi | 2 --
+ 9 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-ard.dts b/arch/arm/boot/dts/imx53-ard.dts
+index 117bd002dd1d1..7d5a48250f867 100644
+--- a/arch/arm/boot/dts/imx53-ard.dts
++++ b/arch/arm/boot/dts/imx53-ard.dts
+@@ -19,6 +19,7 @@
+ compatible = "fsl,imx53-ard", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-cx9020.dts b/arch/arm/boot/dts/imx53-cx9020.dts
+index cf70ebc4399a2..c875e23ee45fb 100644
+--- a/arch/arm/boot/dts/imx53-cx9020.dts
++++ b/arch/arm/boot/dts/imx53-cx9020.dts
+@@ -22,6 +22,7 @@
+ };
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>,
+ <0xb0000000 0x20000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx53-m53.dtsi b/arch/arm/boot/dts/imx53-m53.dtsi
+index ce45f08e30514..db2e5bce9b6a1 100644
+--- a/arch/arm/boot/dts/imx53-m53.dtsi
++++ b/arch/arm/boot/dts/imx53-m53.dtsi
+@@ -16,6 +16,7 @@
+ compatible = "aries,imx53-m53", "denx,imx53-m53", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>,
+ <0xb0000000 0x20000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx53-qsb-common.dtsi b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+index 50dde84b72ed7..f00dda334976a 100644
+--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi
++++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi
+@@ -11,6 +11,7 @@
+ };
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>,
+ <0xb0000000 0x20000000>;
+ };
+diff --git a/arch/arm/boot/dts/imx53-smd.dts b/arch/arm/boot/dts/imx53-smd.dts
+index 462071c9ddd73..09071ca11c6cf 100644
+--- a/arch/arm/boot/dts/imx53-smd.dts
++++ b/arch/arm/boot/dts/imx53-smd.dts
+@@ -12,6 +12,7 @@
+ compatible = "fsl,imx53-smd", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-tqma53.dtsi b/arch/arm/boot/dts/imx53-tqma53.dtsi
+index a72b8981fc3bd..c77d58f06c949 100644
+--- a/arch/arm/boot/dts/imx53-tqma53.dtsi
++++ b/arch/arm/boot/dts/imx53-tqma53.dtsi
+@@ -17,6 +17,7 @@
+ compatible = "tq,tqma53", "fsl,imx53";
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x40000000>; /* Up to 1GiB */
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-tx53.dtsi b/arch/arm/boot/dts/imx53-tx53.dtsi
+index 54cf3e67069a9..4ab135906949f 100644
+--- a/arch/arm/boot/dts/imx53-tx53.dtsi
++++ b/arch/arm/boot/dts/imx53-tx53.dtsi
+@@ -51,6 +51,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53-usbarmory.dts b/arch/arm/boot/dts/imx53-usbarmory.dts
+index f6268d0ded296..ee6263d1c2d3d 100644
+--- a/arch/arm/boot/dts/imx53-usbarmory.dts
++++ b/arch/arm/boot/dts/imx53-usbarmory.dts
+@@ -58,6 +58,7 @@
+ };
+
+ memory@70000000 {
++ device_type = "memory";
+ reg = <0x70000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
+index b6b0818343c4e..8accbe16b7584 100644
+--- a/arch/arm/boot/dts/imx53.dtsi
++++ b/arch/arm/boot/dts/imx53.dtsi
+@@ -23,10 +23,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+--
+2.20.1
+
--- /dev/null
+From 0d42fa793f4d769d71dfbd4a371148f73331e4b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 16:10:01 -0200
+Subject: ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 998a84c27a7f3f9133d32af64e19c05cec161a1a ]
+
+imx53-voipac-dmm-668 has two memory nodes, but the correct representation
+would be to use a single one with two reg entries - one for each RAM chip
+select, so fix it accordingly.
+
+Reported-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Marco Franchi <marco.franchi@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+index f83a8c62ea531..d595034f3f1bf 100644
+--- a/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
++++ b/arch/arm/boot/dts/imx53-voipac-dmm-668.dtsi
+@@ -17,12 +17,8 @@
+
+ memory@70000000 {
+ device_type = "memory";
+- reg = <0x70000000 0x20000000>;
+- };
+-
+- memory@b0000000 {
+- device_type = "memory";
+- reg = <0xb0000000 0x20000000>;
++ reg = <0x70000000 0x20000000>,
++ <0xb0000000 0x20000000>;
+ };
+
+ regulators {
+--
+2.20.1
+
--- /dev/null
+From f515219215829e6b754ec1c89991aed11b4bfbe1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:43:43 -0300
+Subject: ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 7e5d0bf6afcc7bd72f78e7f33570e2e0945624f0 ]
+
+Since commit a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
+a storm of accelerometer interrupts is seen:
+
+[ 114.211283] irq 260: nobody cared (try booting with the "irqpoll" option)
+[ 114.218108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.4 #1
+[ 114.223960] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+[ 114.230531] [<c0112858>] (unwind_backtrace) from [<c010cdc8>] (show_stack+0x10/0x14)
+[ 114.238301] [<c010cdc8>] (show_stack) from [<c0c1aa1c>] (dump_stack+0xd8/0x110)
+[ 114.245644] [<c0c1aa1c>] (dump_stack) from [<c0193594>] (__report_bad_irq+0x30/0xc0)
+[ 114.253417] [<c0193594>] (__report_bad_irq) from [<c01933ac>] (note_interrupt+0x108/0x298)
+[ 114.261707] [<c01933ac>] (note_interrupt) from [<c018ffe4>] (handle_irq_event_percpu+0x70/0x80)
+[ 114.270433] [<c018ffe4>] (handle_irq_event_percpu) from [<c019002c>] (handle_irq_event+0x38/0x5c)
+[ 114.279326] [<c019002c>] (handle_irq_event) from [<c019438c>] (handle_level_irq+0xc8/0x154)
+[ 114.287701] [<c019438c>] (handle_level_irq) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
+[ 114.296166] [<c018eda0>] (generic_handle_irq) from [<c0534214>] (mxc_gpio_irq_handler+0x30/0xf0)
+[ 114.304975] [<c0534214>] (mxc_gpio_irq_handler) from [<c0534334>] (mx3_gpio_irq_handler+0x60/0xb0)
+[ 114.313955] [<c0534334>] (mx3_gpio_irq_handler) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
+[ 114.322762] [<c018eda0>] (generic_handle_irq) from [<c018f3ac>] (__handle_domain_irq+0x64/0xe0)
+[ 114.331485] [<c018f3ac>] (__handle_domain_irq) from [<c05215a8>] (gic_handle_irq+0x4c/0xa8)
+[ 114.339862] [<c05215a8>] (gic_handle_irq) from [<c0101a70>] (__irq_svc+0x70/0x98)
+[ 114.347361] Exception stack(0xc1301ec0 to 0xc1301f08)
+[ 114.352435] 1ec0: 00000001 00000006 00000000 c130c340 00000001 c130f688 9785636d c13ea2e8
+[ 114.360635] 1ee0: 9784907d 0000001a eaf99d78 0000001a 00000000 c1301f10 c0182b00 c0878de4
+[ 114.368830] 1f00: 20000013 ffffffff
+[ 114.372349] [<c0101a70>] (__irq_svc) from [<c0878de4>] (cpuidle_enter_state+0x168/0x5f4)
+[ 114.380464] [<c0878de4>] (cpuidle_enter_state) from [<c08792ac>] (cpuidle_enter+0x28/0x38)
+[ 114.388751] [<c08792ac>] (cpuidle_enter) from [<c015ef9c>] (do_idle+0x224/0x2a8)
+[ 114.396168] [<c015ef9c>] (do_idle) from [<c015f3b8>] (cpu_startup_entry+0x18/0x20)
+[ 114.403765] [<c015f3b8>] (cpu_startup_entry) from [<c1200e54>] (start_kernel+0x43c/0x500)
+[ 114.411958] handlers:
+[ 114.414302] [<a01028b8>] irq_default_primary_handler threaded [<fd7a3b08>] mma8452_interrupt
+[ 114.422974] Disabling IRQ #260
+
+ CPU0 CPU1
+....
+260: 100001 0 gpio-mxc 31 Level mma8451
+
+The MMA8451 interrupt triggers as low level, so the GPIO6_IO31 pin
+needs to activate its pull up, otherwise it will stay always at low level
+generating multiple interrupts.
+
+The current device tree does not configure the IOMUX for this pin, so
+it uses whathever comes configured from the bootloader.
+
+The IOMUXC_SW_PAD_CTL_PAD_EIM_BCLK register value comes as 0x8000 from
+the bootloader, which has PKE bit cleared, hence disabling the
+pull-up.
+
+Instead of relying on a previous configuration from the bootloader,
+configure the GPIO6_IO31 pin with pull-up enabled in order to fix
+this problem.
+
+Fixes: a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-By: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+index 9f11f1fcc3e6c..9d086a3b5ffc0 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+@@ -177,6 +177,8 @@
+ accelerometer@1c {
+ compatible = "fsl,mma8451";
+ reg = <0x1c>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_mma8451_int>;
+ interrupt-parent = <&gpio6>;
+ interrupts = <31 IRQ_TYPE_LEVEL_LOW>;
+ };
+@@ -522,6 +524,12 @@
+ >;
+ };
+
++ pinctrl_mma8451_int: mma8451intgrp {
++ fsl,pins = <
++ MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0xb0b1
++ >;
++ };
++
+ pinctrl_pwm3: pwm1grp {
+ fsl,pins = <
+ MX6QDL_PAD_SD4_DAT1__PWM3_OUT 0x1b0b1
+--
+2.20.1
+
--- /dev/null
+From bf2e42703abe79ee16399247a1c024d97a8e6db6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 13:59:45 -0200
+Subject: ARM: dts: imx6sl: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 7fa8ab65ee15e386558ac5e971004712da91e2dd ]
+
+Boards based on imx6sl have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx6sl.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6sl-evk.dts | 1 +
+ arch/arm/boot/dts/imx6sl-warp.dts | 1 +
+ arch/arm/boot/dts/imx6sl.dtsi | 2 --
+ arch/arm/boot/dts/imx6sll-evk.dts | 1 +
+ 4 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
+index 679b4482ab13a..f7a48e4622e1b 100644
+--- a/arch/arm/boot/dts/imx6sl-evk.dts
++++ b/arch/arm/boot/dts/imx6sl-evk.dts
+@@ -17,6 +17,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sl-warp.dts b/arch/arm/boot/dts/imx6sl-warp.dts
+index 404e602e67813..408da704c459b 100644
+--- a/arch/arm/boot/dts/imx6sl-warp.dts
++++ b/arch/arm/boot/dts/imx6sl-warp.dts
+@@ -55,6 +55,7 @@
+ compatible = "warp,imx6sl-warp", "fsl,imx6sl";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
+index 2fa88c6f18820..55d1872aa81a8 100644
+--- a/arch/arm/boot/dts/imx6sl.dtsi
++++ b/arch/arm/boot/dts/imx6sl.dtsi
+@@ -13,10 +13,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec;
+diff --git a/arch/arm/boot/dts/imx6sll-evk.dts b/arch/arm/boot/dts/imx6sll-evk.dts
+index c8e115564ba2c..0c2406ac8a638 100644
+--- a/arch/arm/boot/dts/imx6sll-evk.dts
++++ b/arch/arm/boot/dts/imx6sll-evk.dts
+@@ -20,6 +20,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 21a86b306ddcd922862ef66265bc97ba87fb03e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 13:59:44 -0200
+Subject: ARM: dts: imx6sx: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 216f35fedd8688c8b654ebfbad18c6e64713fad7 ]
+
+Boards based on imx6sx have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx6sx.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6sx-nitrogen6sx.dts | 1 +
+ arch/arm/boot/dts/imx6sx-sabreauto.dts | 1 +
+ arch/arm/boot/dts/imx6sx-sdb.dtsi | 1 +
+ arch/arm/boot/dts/imx6sx-softing-vining-2000.dts | 1 +
+ arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts | 1 +
+ arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts | 1 +
+ arch/arm/boot/dts/imx6sx-udoo-neo-full.dts | 1 +
+ arch/arm/boot/dts/imx6sx.dtsi | 2 --
+ 8 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts b/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
+index adb5cc7d8ce2f..832b5c5d7441a 100644
+--- a/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
++++ b/arch/arm/boot/dts/imx6sx-nitrogen6sx.dts
+@@ -12,6 +12,7 @@
+ compatible = "boundary,imx6sx-nitrogen6sx", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-sabreauto.dts b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+index 841a27f3198ff..48aede543612b 100644
+--- a/arch/arm/boot/dts/imx6sx-sabreauto.dts
++++ b/arch/arm/boot/dts/imx6sx-sabreauto.dts
+@@ -11,6 +11,7 @@
+ compatible = "fsl,imx6sx-sabreauto", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-sdb.dtsi b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+index d6d517e4922ff..91f809ed1370a 100644
+--- a/arch/arm/boot/dts/imx6sx-sdb.dtsi
++++ b/arch/arm/boot/dts/imx6sx-sdb.dtsi
+@@ -21,6 +21,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts b/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
+index 252175b592475..2bc51623a8060 100644
+--- a/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
++++ b/arch/arm/boot/dts/imx6sx-softing-vining-2000.dts
+@@ -21,6 +21,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
+index 40ccdf43dffc5..db0feb9b9f5d7 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-basic.dts
+@@ -49,6 +49,7 @@
+ compatible = "udoo,neobasic", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
+index 42bfc8f8f7f6b..5c7a2bb9141cb 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-extended.dts
+@@ -49,6 +49,7 @@
+ compatible = "udoo,neoextended", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts b/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
+index c84c877f09d49..13dfe2afaba56 100644
+--- a/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
++++ b/arch/arm/boot/dts/imx6sx-udoo-neo-full.dts
+@@ -49,6 +49,7 @@
+ compatible = "udoo,neofull", "fsl,imx6sx";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
+index 7b62e6fb47ebe..ae0728df542e9 100644
+--- a/arch/arm/boot/dts/imx6sx.dtsi
++++ b/arch/arm/boot/dts/imx6sx.dtsi
+@@ -15,10 +15,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ can0 = &flexcan1;
+--
+2.20.1
+
--- /dev/null
+From 1ce7076854be34f1e1b59165fd07c5288074b8f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 13:59:43 -0200
+Subject: ARM: dts: imx6ul: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 750d8df6e7b269b828f66631a1d39ea027afc92a ]
+
+Boards based on imx6ul have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx6ul.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 1 +
+ arch/arm/boot/dts/imx6ul-geam.dts | 1 +
+ arch/arm/boot/dts/imx6ul-isiot.dtsi | 1 +
+ arch/arm/boot/dts/imx6ul-litesom.dtsi | 1 +
+ arch/arm/boot/dts/imx6ul-opos6ul.dtsi | 1 +
+ arch/arm/boot/dts/imx6ul-pico-hobbit.dts | 1 +
+ arch/arm/boot/dts/imx6ul-tx6ul.dtsi | 1 +
+ arch/arm/boot/dts/imx6ul.dtsi | 2 --
+ arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi | 1 +
+ arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi | 1 +
+ 10 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+index 32a07232c0345..8180211265592 100644
+--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi
+@@ -12,6 +12,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-geam.dts b/arch/arm/boot/dts/imx6ul-geam.dts
+index d81d20f8fc8dd..85cfad080f15c 100644
+--- a/arch/arm/boot/dts/imx6ul-geam.dts
++++ b/arch/arm/boot/dts/imx6ul-geam.dts
+@@ -51,6 +51,7 @@
+ compatible = "engicam,imx6ul-geam", "fsl,imx6ul";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x08000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-isiot.dtsi b/arch/arm/boot/dts/imx6ul-isiot.dtsi
+index cd99285511544..1cb52744f58ad 100644
+--- a/arch/arm/boot/dts/imx6ul-isiot.dtsi
++++ b/arch/arm/boot/dts/imx6ul-isiot.dtsi
+@@ -46,6 +46,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-litesom.dtsi b/arch/arm/boot/dts/imx6ul-litesom.dtsi
+index 8f775f6974d1c..8d6893210842b 100644
+--- a/arch/arm/boot/dts/imx6ul-litesom.dtsi
++++ b/arch/arm/boot/dts/imx6ul-litesom.dtsi
+@@ -48,6 +48,7 @@
+ compatible = "grinn,imx6ul-litesom", "fsl,imx6ul";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6ul-opos6ul.dtsi b/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
+index a031bee311df4..cf7faf4b9c47e 100644
+--- a/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul-opos6ul.dtsi
+@@ -49,6 +49,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0>; /* will be filled by U-Boot */
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
+index 0c09420f99512..797262d2f27fd 100644
+--- a/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
++++ b/arch/arm/boot/dts/imx6ul-pico-hobbit.dts
+@@ -53,6 +53,7 @@
+
+ /* Will be filled by the bootloader */
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+index 02b5ba42cd591..bb6dbfd5546b4 100644
+--- a/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul-tx6ul.dtsi
+@@ -71,6 +71,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0>; /* will be filled by U-Boot */
+ };
+
+diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
+index 336cdead3da54..50834a43e5fb2 100644
+--- a/arch/arm/boot/dts/imx6ul.dtsi
++++ b/arch/arm/boot/dts/imx6ul.dtsi
+@@ -15,10 +15,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ ethernet0 = &fec1;
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
+index 10ab4697950f5..fb213bec46543 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-nonwifi.dtsi
+@@ -7,6 +7,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x10000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+index 183193e8580dd..038d8c90f6dfe 100644
+--- a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
++++ b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi
+@@ -7,6 +7,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From e5dd25c1c2628393a14cbaa888efc1fa3f09c103 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:40:47 -0200
+Subject: ARM: dts: imx7: Fix memory node duplication
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 29988e867cb17de7119e971f9acfad2c3fccdb47 ]
+
+Boards based on imx7 have duplicate memory nodes:
+
+- One coming from the board dts file: memory@
+
+- One coming from the imx7s.dtsi file.
+
+Fix the duplication by removing the memory node from the dtsi file
+and by adding 'device_type = "memory";' in the board dts.
+
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx7d-cl-som-imx7.dts | 3 ++-
+ arch/arm/boot/dts/imx7d-colibri-emmc.dtsi | 1 +
+ arch/arm/boot/dts/imx7d-colibri.dtsi | 1 +
+ arch/arm/boot/dts/imx7d-nitrogen7.dts | 1 +
+ arch/arm/boot/dts/imx7d-pico.dtsi | 1 +
+ arch/arm/boot/dts/imx7d-sdb.dts | 1 +
+ arch/arm/boot/dts/imx7s-colibri.dtsi | 1 +
+ arch/arm/boot/dts/imx7s-warp.dts | 1 +
+ arch/arm/boot/dts/imx7s.dtsi | 2 --
+ 9 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+index 584418f517a88..62d5e9a4a7818 100644
+--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts
+@@ -19,6 +19,7 @@
+ compatible = "compulab,cl-som-imx7", "fsl,imx7d";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x10000000>; /* 256 MB - minimal configuration */
+ };
+
+@@ -284,4 +285,4 @@
+ MX7D_PAD_LPSR_GPIO1_IO05__GPIO1_IO5 0x14 /* OTG PWREN */
+ >;
+ };
+-};
+\ No newline at end of file
++};
+diff --git a/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi b/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
+index 04d24ee17b142..898f4b8d7421f 100644
+--- a/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
++++ b/arch/arm/boot/dts/imx7d-colibri-emmc.dtsi
+@@ -8,6 +8,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx7d-colibri.dtsi b/arch/arm/boot/dts/imx7d-colibri.dtsi
+index d9f8fb69511b6..e2e327f437e35 100644
+--- a/arch/arm/boot/dts/imx7d-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7d-colibri.dtsi
+@@ -45,6 +45,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+index 177d21fdeb288..6b4acea1ef795 100644
+--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts
++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts
+@@ -12,6 +12,7 @@
+ compatible = "boundary,imx7d-nitrogen7", "fsl,imx7d";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x40000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7d-pico.dtsi b/arch/arm/boot/dts/imx7d-pico.dtsi
+index f27b3849d3ff3..934a019f341e4 100644
+--- a/arch/arm/boot/dts/imx7d-pico.dtsi
++++ b/arch/arm/boot/dts/imx7d-pico.dtsi
+@@ -49,6 +49,7 @@
+ compatible = "technexion,imx7d-pico", "fsl,imx7d";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts
+index c9b3c60b0eb22..317f1bcc56e2a 100644
+--- a/arch/arm/boot/dts/imx7d-sdb.dts
++++ b/arch/arm/boot/dts/imx7d-sdb.dts
+@@ -15,6 +15,7 @@
+ };
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x80000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7s-colibri.dtsi b/arch/arm/boot/dts/imx7s-colibri.dtsi
+index fe8344cee8641..1fb1ec5d3d707 100644
+--- a/arch/arm/boot/dts/imx7s-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7s-colibri.dtsi
+@@ -45,6 +45,7 @@
+
+ / {
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x10000000>;
+ };
+ };
+diff --git a/arch/arm/boot/dts/imx7s-warp.dts b/arch/arm/boot/dts/imx7s-warp.dts
+index fa390da636de7..97d5c711eb0ca 100644
+--- a/arch/arm/boot/dts/imx7s-warp.dts
++++ b/arch/arm/boot/dts/imx7s-warp.dts
+@@ -51,6 +51,7 @@
+ compatible = "warp,imx7s-warp", "fsl,imx7s";
+
+ memory@80000000 {
++ device_type = "memory";
+ reg = <0x80000000 0x20000000>;
+ };
+
+diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
+index 90f5bdfa9b3ce..7eaf96b425bed 100644
+--- a/arch/arm/boot/dts/imx7s.dtsi
++++ b/arch/arm/boot/dts/imx7s.dtsi
+@@ -17,10 +17,8 @@
+ * The decompressor and also some bootloaders rely on a
+ * pre-existing /chosen node to be available to insert the
+ * command line and merge other ATAGS info.
+- * Also for U-Boot there must be a pre-existing /memory node.
+ */
+ chosen {};
+- memory { device_type = "memory"; };
+
+ aliases {
+ gpio0 = &gpio1;
+--
+2.20.1
+
--- /dev/null
+From f7d6702f0a96756003869fca67c767418079739a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 22:58:58 +0100
+Subject: ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit e614f341253f8541baf0230a8dc6a016b544b1e2 ]
+
+Without enabling keep-power-in-suspend, we can't wake the device
+up using WOL packet, and the log is flooded with these messages
+on resume:
+
+sunxi-mmc 1c10000.mmc: send stop command failed
+sunxi-mmc 1c10000.mmc: data error, sending stop command
+sunxi-mmc 1c10000.mmc: send stop command failed
+sunxi-mmc 1c10000.mmc: data error, sending stop command
+
+So to make the WiFi really a wakeup-source, we need to keep it powered
+during suspend.
+
+Fixes: 0e23372080def7 ("arm: dts: sun8i: Add the TBS A711 tablet devicetree")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+index 1537ce148cc19..49547a43cc90a 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+@@ -171,6 +171,7 @@
+ vqmmc-supply = <®_dldo1>;
+ non-removable;
+ wakeup-source;
++ keep-power-in-suspend;
+ status = "okay";
+
+ brcmf: wifi@1 {
+--
+2.20.1
+
--- /dev/null
+From 8139547b03607c008712aad5960054b044a462a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 22:58:38 +0100
+Subject: ARM: ks8695: fix section mismatch warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4aa64677330beeeed721b4b122884dabad845d66 ]
+
+WARNING: vmlinux.o(.text+0x13250): Section mismatch in reference from the function acs5k_i2c_init() to the (unknown reference) .init.data:(unknown)
+The function acs5k_i2c_init() references
+the (unknown reference) __initdata (unknown).
+This is often because acs5k_i2c_init lacks a __initdata
+annotation or the annotation of (unknown) is wrong.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-ks8695/board-acs5k.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-ks8695/board-acs5k.c b/arch/arm/mach-ks8695/board-acs5k.c
+index ef835d82cdb95..5783062224c39 100644
+--- a/arch/arm/mach-ks8695/board-acs5k.c
++++ b/arch/arm/mach-ks8695/board-acs5k.c
+@@ -100,7 +100,7 @@ static struct i2c_board_info acs5k_i2c_devs[] __initdata = {
+ },
+ };
+
+-static void acs5k_i2c_init(void)
++static void __init acs5k_i2c_init(void)
+ {
+ /* The gpio interface */
+ gpiod_add_lookup_table(&acs5k_i2c_gpiod_table);
+--
+2.20.1
+
--- /dev/null
+From 68dd0da42cdb375bdbb017175f6632a7094aeec7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 19:57:42 +0200
+Subject: ARM: OMAP1: fix USB configuration for device-only setups
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit c7b7b5cbd0c859b1546a5a3455d457708bdadf4c ]
+
+Currently we do USB configuration only if the host mode (CONFIG_USB)
+is enabled. But it should be done also in the case of device-only setups,
+so change the condition to CONFIG_USB_SUPPORT. This allows to use
+omap_udc on Palm Tungsten E.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/Makefile | 2 +-
+ arch/arm/mach-omap1/include/mach/usb.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile
+index e8ccf51c6f292..ec0235899de20 100644
+--- a/arch/arm/mach-omap1/Makefile
++++ b/arch/arm/mach-omap1/Makefile
+@@ -25,7 +25,7 @@ obj-y += $(i2c-omap-m) $(i2c-omap-y)
+
+ led-y := leds.o
+
+-usb-fs-$(CONFIG_USB) := usb.o
++usb-fs-$(CONFIG_USB_SUPPORT) := usb.o
+ obj-y += $(usb-fs-m) $(usb-fs-y)
+
+ # Specific board support
+diff --git a/arch/arm/mach-omap1/include/mach/usb.h b/arch/arm/mach-omap1/include/mach/usb.h
+index 77867778d4ec7..5429d86c7190d 100644
+--- a/arch/arm/mach-omap1/include/mach/usb.h
++++ b/arch/arm/mach-omap1/include/mach/usb.h
+@@ -11,7 +11,7 @@
+
+ #include <linux/platform_data/usb-omap1.h>
+
+-#if IS_ENABLED(CONFIG_USB)
++#if IS_ENABLED(CONFIG_USB_SUPPORT)
+ void omap1_usb_init(struct omap_usb_config *pdata);
+ #else
+ static inline void omap1_usb_init(struct omap_usb_config *pdata)
+--
+2.20.1
+
--- /dev/null
+From 8c77bafa4bd80898f2892d83037dbe382528df36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 11:50:28 +0000
+Subject: arm64: dts: marvell: armada-37xx: Enable emmc on espressobin
+
+From: Ding Tao <miyatsu@qq.com>
+
+[ Upstream commit 43ebc7c1b3ed8198b9acf3019eca16e722f7331c ]
+
+The ESPRESSObin board has a emmc interface available on U11: declare it
+and let the bootloader enable it if the emmc is present.
+
+[gregory.clement@bootlin.com: disable the emmc by default]
+Signed-off-by: Ding Tao <miyatsu@qq.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/marvell/armada-3720-espressobin.dts | 22 +++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+index 3ab25ad402b90..846003bb480cd 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+@@ -60,9 +60,31 @@
+ cd-gpios = <&gpionb 3 GPIO_ACTIVE_LOW>;
+ marvell,pad-type = "sd";
+ vqmmc-supply = <&vcc_sd_reg1>;
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&sdio_pins>;
+ status = "okay";
+ };
+
++/* U11 */
++&sdhci0 {
++ non-removable;
++ bus-width = <8>;
++ mmc-ddr-1_8v;
++ mmc-hs400-1_8v;
++ marvell,xenon-emmc;
++ marvell,xenon-tun-count = <9>;
++ marvell,pad-type = "fixed-1-8v";
++
++ pinctrl-names = "default";
++ pinctrl-0 = <&mmc_pins>;
++/*
++ * This eMMC is not populated on all boards, so disable it by
++ * default and let the bootloader enable it, if it is present
++ */
++ status = "disabled";
++};
++
+ &spi0 {
+ status = "okay";
+
+--
+2.20.1
+
--- /dev/null
+From 6f7f9d0fb57dd9cd52bc95336d6366fcf12a15a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:43:55 +0200
+Subject: arm64: dts: renesas: draak: Fix CVBS input
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 6f61a2c8f1f6163c7e08c77c5f71df0427e4d2f6 ]
+
+A typo in the adv7180 DT node prevents successful probing of the VIN.
+Fix it.
+
+Fixes: 6a0942c20f5c ("arm64: dts: renesas: draak: Describe CVBS input")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Acked-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+index a8e8f2669d4c5..1b8f19ee257f0 100644
+--- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
++++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+@@ -188,7 +188,7 @@
+ compatible = "adi,adv7180cp";
+ reg = <0x20>;
+
+- port {
++ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+--
+2.20.1
+
--- /dev/null
+From a6c90edc170b9762f20812ce7b977b42b55d8586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 22:50:40 +0000
+Subject: arm64: mm: Prevent mismatched 52-bit VA support
+
+From: Steve Capper <steve.capper@arm.com>
+
+[ Upstream commit a96a33b1ca57dbea4285893dedf290aeb8eb090b ]
+
+For cases where there is a mismatch in ARMv8.2-LVA support between CPUs
+we have to be careful in allowing secondary CPUs to boot if 52-bit
+virtual addresses have already been enabled on the boot CPU.
+
+This patch adds code to the secondary startup path. If the boot CPU has
+enabled 52-bit VAs then ID_AA64MMFR2_EL1 is checked to see if the
+secondary can also enable 52-bit support. If not, the secondary is
+prevented from booting and an error message is displayed indicating why.
+
+Technically this patch could be implemented using the cpufeature code
+when considering 52-bit userspace support. However, we employ low level
+checks here as the cpufeature code won't be able to run if we have
+mismatched 52-bit kernel va support.
+
+Signed-off-by: Steve Capper <steve.capper@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/head.S | 26 ++++++++++++++++++++++++++
+ arch/arm64/kernel/smp.c | 5 +++++
+ 2 files changed, 31 insertions(+)
+
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 77ca59598c8b1..06058fba5f86c 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -703,6 +703,7 @@ secondary_startup:
+ /*
+ * Common entry point for secondary CPUs.
+ */
++ bl __cpu_secondary_check52bitva
+ bl __cpu_setup // initialise processor
+ bl __enable_mmu
+ ldr x8, =__secondary_switched
+@@ -779,6 +780,31 @@ ENTRY(__enable_mmu)
+ ret
+ ENDPROC(__enable_mmu)
+
++ENTRY(__cpu_secondary_check52bitva)
++#ifdef CONFIG_ARM64_52BIT_VA
++ ldr_l x0, vabits_user
++ cmp x0, #52
++ b.ne 2f
++
++ mrs_s x0, SYS_ID_AA64MMFR2_EL1
++ and x0, x0, #(0xf << ID_AA64MMFR2_LVA_SHIFT)
++ cbnz x0, 2f
++
++ adr_l x0, va52mismatch
++ mov w1, #1
++ strb w1, [x0]
++ dmb sy
++ dc ivac, x0 // Invalidate potentially stale cache line
++
++ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x0, x1
++1: wfe
++ wfi
++ b 1b
++
++#endif
++2: ret
++ENDPROC(__cpu_secondary_check52bitva)
++
+ __no_granule_support:
+ /* Indicate that this CPU can't boot and is stuck in the kernel */
+ update_early_cpu_boot_status CPU_STUCK_IN_KERNEL, x1, x2
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 25fcd22a4bb24..2c31d65bc541b 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -108,6 +108,7 @@ static int boot_secondary(unsigned int cpu, struct task_struct *idle)
+ }
+
+ static DECLARE_COMPLETION(cpu_running);
++bool va52mismatch __ro_after_init;
+
+ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ {
+@@ -137,6 +138,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+
+ if (!cpu_online(cpu)) {
+ pr_crit("CPU%u: failed to come online\n", cpu);
++
++ if (IS_ENABLED(CONFIG_ARM64_52BIT_VA) && va52mismatch)
++ pr_crit("CPU%u: does not support 52-bit VAs\n", cpu);
++
+ ret = -EIO;
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 1250475e9cdc3ede9d71b4d6d175c8e77605e5c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 13:41:32 +0000
+Subject: arm64: preempt: Fix big-endian when checking preempt count in
+ assembly
+
+From: Will Deacon <will.deacon@arm.com>
+
+[ Upstream commit 7faa313f05cad184e8b17750f0cbe5216ac6debb ]
+
+Commit 396244692232 ("arm64: preempt: Provide our own implementation of
+asm/preempt.h") extended the preempt count field in struct thread_info
+to 64 bits, so that it consists of a 32-bit count plus a 32-bit flag
+indicating whether or not the current task needs rescheduling.
+
+Whilst the asm-offsets definition of TSK_TI_PREEMPT was updated to point
+to this new field, the assembly usage was left untouched meaning that a
+32-bit load from TSK_TI_PREEMPT on a big-endian machine actually returns
+the reschedule flag instead of the count.
+
+Whilst we could fix this by pointing TSK_TI_PREEMPT at the count field,
+we're actually better off reworking the two assembly users so that they
+operate on the whole 64-bit value in favour of inspecting the thread
+flags separately in order to determine whether a reschedule is needed.
+
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Reported-by: "kernelci.org bot" <bot@kernelci.org>
+Tested-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/assembler.h | 8 +++-----
+ arch/arm64/kernel/entry.S | 6 ++----
+ 2 files changed, 5 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index 5a97ac8531682..0c100506a29aa 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -683,11 +683,9 @@ USER(\label, ic ivau, \tmp2) // invalidate I line PoU
+ .macro if_will_cond_yield_neon
+ #ifdef CONFIG_PREEMPT
+ get_thread_info x0
+- ldr w1, [x0, #TSK_TI_PREEMPT]
+- ldr x0, [x0, #TSK_TI_FLAGS]
+- cmp w1, #PREEMPT_DISABLE_OFFSET
+- csel x0, x0, xzr, eq
+- tbnz x0, #TIF_NEED_RESCHED, .Lyield_\@ // needs rescheduling?
++ ldr x0, [x0, #TSK_TI_PREEMPT]
++ sub x0, x0, #PREEMPT_DISABLE_OFFSET
++ cbz x0, .Lyield_\@
+ /* fall through to endif_yield_neon */
+ .subsection 1
+ .Lyield_\@ :
+diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
+index 5f800384cb9a8..bb68323530458 100644
+--- a/arch/arm64/kernel/entry.S
++++ b/arch/arm64/kernel/entry.S
+@@ -622,10 +622,8 @@ el1_irq:
+ irq_handler
+
+ #ifdef CONFIG_PREEMPT
+- ldr w24, [tsk, #TSK_TI_PREEMPT] // get preempt count
+- cbnz w24, 1f // preempt count != 0
+- ldr x0, [tsk, #TSK_TI_FLAGS] // get flags
+- tbz x0, #TIF_NEED_RESCHED, 1f // needs rescheduling?
++ ldr x24, [tsk, #TSK_TI_PREEMPT] // get preempt count
++ cbnz x24, 1f // preempt count != 0
+ bl el1_preempt
+ 1:
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 7566a3f2350d7e4c72d4dbf7f527affa4da383d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 18:07:33 +0000
+Subject: arm64: smp: Handle errors reported by the firmware
+
+From: Suzuki K Poulose <Suzuki.Poulose@arm.com>
+
+[ Upstream commit f357b3a7e17af7736d67d8267edc1ed3d1dd9391 ]
+
+The __cpu_up() routine ignores the errors reported by the firmware
+for a CPU bringup operation and looks for the error status set by the
+booting CPU. If the CPU never entered the kernel, we could end up
+in assuming stale error status, which otherwise would have been
+set/cleared appropriately by the booting CPU.
+
+Reported-by: Steve Capper <steve.capper@arm.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/smp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
+index 2c31d65bc541b..52aa51f6310b0 100644
+--- a/arch/arm64/kernel/smp.c
++++ b/arch/arm64/kernel/smp.c
+@@ -146,6 +146,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)
+ }
+ } else {
+ pr_err("CPU%u: failed to boot: %d\n", cpu, ret);
++ return ret;
+ }
+
+ secondary_data.task = NULL;
+--
+2.20.1
+
--- /dev/null
+From 208c44a812f751f81d252c6120db2db567750e26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 10:54:32 +0100
+Subject: ASoC: compress: fix unsigned integer overflow check
+
+From: Xiaojun Sang <xsang@codeaurora.org>
+
+[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ]
+
+Parameter fragments and fragment_size are type of u32. U32_MAX is
+the correct check.
+
+Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/compress_offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 516ec35873256..509038d6bccdb 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -529,7 +529,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
+ params->buffer.fragments == 0)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 0a0fd64db891a41ed3ed9f3c8ad1af2faf8a7e52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:49 +0100
+Subject: ASoC: kirkwood: fix device remove ordering
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit dc39596a906d5b604f4e64597b6e904fc14625e8 ]
+
+The devm conversion of kirkwood was incorrect; on removal, devm takes
+effect after the "remove" function has returned. So, the effect of
+the conversion was to change the order during remove from:
+
+ - snd_soc_unregister_component() (unpublishes interfaces)
+ - clk_disable_unprepare()
+ - cleanup resources
+
+After the conversion, this became:
+
+ - clk_disable_unprepare() - while the device may still be active
+ - snd_soc_unregister_component()
+ - cleanup resources
+
+Hence, it introduces a bug, where the internal clock for the device
+may be shut down before the device itself has been shut down. It is
+known that Marvell SoCs, including Dove, locks up if registers for a
+peripheral that has its clocks disabled are accessed.
+
+Fixes: f98fc0f8154e ("ASoC: kirkwood: replace platform to component")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyP-0004oN-BA@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index b84a504168473..4395bb7029a06 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -595,7 +595,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ priv->ctl_rec |= KIRKWOOD_RECCTL_BURST_128;
+ }
+
+- err = devm_snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
++ err = snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
+ soc_dai, 2);
+ if (err) {
+ dev_err(&pdev->dev, "snd_soc_register_component failed\n");
+@@ -618,6 +618,7 @@ static int kirkwood_i2s_dev_remove(struct platform_device *pdev)
+ {
+ struct kirkwood_dma_data *priv = dev_get_drvdata(&pdev->dev);
+
++ snd_soc_unregister_component(&pdev->dev);
+ if (!IS_ERR(priv->extclk))
+ clk_disable_unprepare(priv->extclk);
+ clk_disable_unprepare(priv->clk);
+--
+2.20.1
+
--- /dev/null
+From d8942f83579d542768f2f562162d7be725e7c14d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:44 +0100
+Subject: ASoC: kirkwood: fix external clock probe defer
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ]
+
+When our call to get the external clock fails, we forget to clean up
+the enabled internal clock correctly. Enable the clock after we have
+obtained all our resources.
+
+Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index 9a2777b72dcd0..b84a504168473 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -563,10 +563,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->clk);
+ }
+
+- err = clk_prepare_enable(priv->clk);
+- if (err < 0)
+- return err;
+-
+ priv->extclk = devm_clk_get(&pdev->dev, "extclk");
+ if (IS_ERR(priv->extclk)) {
+ if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
+@@ -582,6 +578,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ }
+ }
+
++ err = clk_prepare_enable(priv->clk);
++ if (err < 0)
++ return err;
++
+ /* Some sensible defaults - this reflects the powerup values */
+ priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
+ priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
+--
+2.20.1
+
--- /dev/null
+From 96bf75984d86f0d27655982f17a48d25ccd1eb44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Oct 2019 17:30:06 +0200
+Subject: ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 9110d1b0e229cebb1ffce0c04db2b22beffd513d ]
+
+According to the PM8916 Hardware Register Description,
+CDC_D_CDC_CONN_HPHR_DAC_CTL has only a single bit (RX_SEL)
+to switch between RX1 (0) and RX2 (1). It is not possible to
+disable it entirely to achieve the "ZERO" state.
+
+However, at the moment the "RDAC2 MUX" mixer defines three possible
+values ("ZERO", "RX2" and "RX1"). Setting the mixer to "ZERO"
+actually configures it to RX1. Setting the mixer to "RX1" has
+(seemingly) no effect.
+
+Remove "ZERO" and replace it with "RX1" to fix this.
+
+Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20191020153007.206070-1-stephan@gerhold.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index b7cf7cce95fec..4f0497ab1aa80 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -303,7 +303,7 @@ struct pm8916_wcd_analog_priv {
+ };
+
+ static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
+-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" };
++static const char *const rdac2_mux_text[] = { "RX1", "RX2" };
+ static const char *const hph_text[] = { "ZERO", "Switch", };
+
+ static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT(
+@@ -318,7 +318,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT(
+
+ /* RDAC2 MUX */
+ static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE(
+- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text);
++ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text);
+
+ static const struct snd_kcontrol_new spkr_switch[] = {
+ SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0)
+--
+2.20.1
+
--- /dev/null
+From a1894bca56d97a10c18b6cdbe95395e665407050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:44:07 +0800
+Subject: ASoC: rt5645: Headphone Jack sense inverts on the LattePanda board
+
+From: Hui Wang <hui.wang@canonical.com>
+
+[ Upstream commit 406dcbc55a0a20fd155be889a4a0c4b812f7c18e ]
+
+The LattePanda board has a sound card chtrt5645, when there is nothing
+plugged in the headphone jack, the system thinks the headphone is
+plugged in, while we plug a headphone in the jack, the system thinks
+the headphone is unplugged.
+
+If adding quirk=0x21 in the module parameter, the headphone jack can
+work well. So let us fix it via platform_data.
+
+https://bugs.launchpad.net/bugs/182459
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5645.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
+index 1dc70f452c1b9..f842db498c741 100644
+--- a/sound/soc/codecs/rt5645.c
++++ b/sound/soc/codecs/rt5645.c
+@@ -3662,6 +3662,11 @@ static const struct rt5645_platform_data jd_mode3_platform_data = {
+ .jd_mode = 3,
+ };
+
++static const struct rt5645_platform_data lattepanda_board_platform_data = {
++ .jd_mode = 2,
++ .inv_jd1_1 = true
++};
++
+ static const struct dmi_system_id dmi_platform_data[] = {
+ {
+ .ident = "Chrome Buddy",
+@@ -3759,6 +3764,15 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ },
+ .driver_data = (void *)&intel_braswell_platform_data,
+ },
++ {
++ .ident = "LattePanda board",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_BOARD_VERSION, "Default string"),
++ },
++ .driver_data = (void *)&lattepanda_board_platform_data,
++ },
+ { }
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 46e1ef4aab1d2e08d9bb055ccd320646bba508f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 18:00:12 +0100
+Subject: ASoC: samsung: i2s: Fix prescaler setting for the secondary DAI
+
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+
+[ Upstream commit 323fb7b947b265753de34703dbbf8acc8ea3a4de ]
+
+Make sure i2s->rclk_srcrate is properly initialized also during
+playback through the secondary DAI.
+
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/samsung/i2s.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index ce00fe2f6aae3..d4bde4834ce5f 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -604,6 +604,7 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
+ unsigned int fmt)
+ {
+ struct i2s_dai *i2s = to_info(dai);
++ struct i2s_dai *other = get_other_dai(i2s);
+ int lrp_shift, sdf_shift, sdf_mask, lrp_rlow, mod_slave;
+ u32 mod, tmp = 0;
+ unsigned long flags;
+@@ -661,7 +662,8 @@ static int i2s_set_fmt(struct snd_soc_dai *dai,
+ * CLK_I2S_RCLK_SRC clock is not exposed so we ensure any
+ * clock configuration assigned in DT is not overwritten.
+ */
+- if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL)
++ if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL &&
++ other->clk_data.clks == NULL)
+ i2s_set_sysclk(dai, SAMSUNG_I2S_RCLKSRC_0,
+ 0, SND_SOC_CLOCK_IN);
+ break;
+@@ -699,6 +701,7 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
+ {
+ struct i2s_dai *i2s = to_info(dai);
++ struct i2s_dai *other = get_other_dai(i2s);
+ u32 mod, mask = 0, val = 0;
+ struct clk *rclksrc;
+ unsigned long flags;
+@@ -784,6 +787,9 @@ static int i2s_hw_params(struct snd_pcm_substream *substream,
+ i2s->frmclk = params_rate(params);
+
+ rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC];
++ if (!rclksrc || IS_ERR(rclksrc))
++ rclksrc = other->clk_table[CLK_I2S_RCLK_SRC];
++
+ if (rclksrc && !IS_ERR(rclksrc))
+ i2s->rclk_srcrate = clk_get_rate(rclksrc);
+
+--
+2.20.1
+
--- /dev/null
+From c3fc28696c4037b0b7de20b31acb4916c536063c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 14:36:54 +0100
+Subject: ASoC: stm32: sai: add restriction on mmap support
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+[ Upstream commit eaf072e512d54c95b0977eda06cbca3151ace1e5 ]
+
+Do not support mmap in S/PDIF mode. In S/PDIF mode
+the buffer has to be copied, to allow the channel status
+bits insertion.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20191104133654.28750-1-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 2fb2b914e78b4..6c2e69e32c864 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -994,6 +994,16 @@ static int stm32_sai_pcm_process_spdif(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
++/* No support of mmap in S/PDIF mode */
++static const struct snd_pcm_hardware stm32_sai_pcm_hw_spdif = {
++ .info = SNDRV_PCM_INFO_INTERLEAVED,
++ .buffer_bytes_max = 8 * PAGE_SIZE,
++ .period_bytes_min = 1024,
++ .period_bytes_max = PAGE_SIZE,
++ .periods_min = 2,
++ .periods_max = 8,
++};
++
+ static const struct snd_pcm_hardware stm32_sai_pcm_hw = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
+ .buffer_bytes_max = 8 * PAGE_SIZE,
+@@ -1050,7 +1060,7 @@ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = {
+ };
+
+ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config_spdif = {
+- .pcm_hardware = &stm32_sai_pcm_hw,
++ .pcm_hardware = &stm32_sai_pcm_hw_spdif,
+ .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+ .process = stm32_sai_pcm_process_spdif,
+ };
+--
+2.20.1
+
--- /dev/null
+From 6dada8a73ae2c68162ea3bd1c26dbfe53b10ada5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 20:28:27 +0100
+Subject: ata: ahci: mvebu: do Armada 38x configuration only on relevant SoCs
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 96dbcb40e4b1a387cdb9b21f43638c759aebb5a4 ]
+
+At the beginning, only Armada 38x SoCs where supported by the
+ahci_mvebu.c driver. Commit 15d3ce7b63bd ("ata: ahci_mvebu: add
+support for Armada 3700 variant") introduced Armada 3700 support. As
+opposed to Armada 38x SoCs, the 3700 variants do not have to configure
+mbus and the regret option. This patch took care of avoiding such
+configuration when not needed in the probe function, but failed to do
+the same in the resume path. While doing so looks harmless by
+experience, let's clean the driver logic and avoid doing this useless
+configuration with Armada 3700 SoCs.
+
+Because the logic is very similar between these two places, it has
+been decided to factorize this code and put it in a "Armada 38x
+configuration function". This function is part of a new
+(per-compatible) platform data structure, so that the addition of such
+configuration function for Armada 3700 will be eased.
+
+Fixes: 15d3ce7b63bd ("ata: ahci_mvebu: add support for Armada 3700 variant")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/ahci_mvebu.c | 68 ++++++++++++++++++++++++++++++----------
+ 1 file changed, 51 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c
+index f9cb51be38ebf..a54214291481f 100644
+--- a/drivers/ata/ahci_mvebu.c
++++ b/drivers/ata/ahci_mvebu.c
+@@ -28,6 +28,10 @@
+ #define AHCI_WINDOW_BASE(win) (0x64 + ((win) << 4))
+ #define AHCI_WINDOW_SIZE(win) (0x68 + ((win) << 4))
+
++struct ahci_mvebu_plat_data {
++ int (*plat_config)(struct ahci_host_priv *hpriv);
++};
++
+ static void ahci_mvebu_mbus_config(struct ahci_host_priv *hpriv,
+ const struct mbus_dram_target_info *dram)
+ {
+@@ -62,6 +66,22 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv)
+ writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA);
+ }
+
++static int ahci_mvebu_armada_380_config(struct ahci_host_priv *hpriv)
++{
++ const struct mbus_dram_target_info *dram;
++ int rc = 0;
++
++ dram = mv_mbus_dram_info();
++ if (dram)
++ ahci_mvebu_mbus_config(hpriv, dram);
++ else
++ rc = -ENODEV;
++
++ ahci_mvebu_regret_option(hpriv);
++
++ return rc;
++}
++
+ /**
+ * ahci_mvebu_stop_engine
+ *
+@@ -126,13 +146,10 @@ static int ahci_mvebu_resume(struct platform_device *pdev)
+ {
+ struct ata_host *host = platform_get_drvdata(pdev);
+ struct ahci_host_priv *hpriv = host->private_data;
+- const struct mbus_dram_target_info *dram;
++ const struct ahci_mvebu_plat_data *pdata = hpriv->plat_data;
+
+- dram = mv_mbus_dram_info();
+- if (dram)
+- ahci_mvebu_mbus_config(hpriv, dram);
+-
+- ahci_mvebu_regret_option(hpriv);
++ if (pdata->plat_config)
++ pdata->plat_config(hpriv);
+
+ return ahci_platform_resume_host(&pdev->dev);
+ }
+@@ -154,28 +171,31 @@ static struct scsi_host_template ahci_platform_sht = {
+
+ static int ahci_mvebu_probe(struct platform_device *pdev)
+ {
++ const struct ahci_mvebu_plat_data *pdata;
+ struct ahci_host_priv *hpriv;
+- const struct mbus_dram_target_info *dram;
+ int rc;
+
++ pdata = of_device_get_match_data(&pdev->dev);
++ if (!pdata)
++ return -EINVAL;
++
+ hpriv = ahci_platform_get_resources(pdev, 0);
+ if (IS_ERR(hpriv))
+ return PTR_ERR(hpriv);
+
++ hpriv->plat_data = (void *)pdata;
++
+ rc = ahci_platform_enable_resources(hpriv);
+ if (rc)
+ return rc;
+
+ hpriv->stop_engine = ahci_mvebu_stop_engine;
+
+- if (of_device_is_compatible(pdev->dev.of_node,
+- "marvell,armada-380-ahci")) {
+- dram = mv_mbus_dram_info();
+- if (!dram)
+- return -ENODEV;
+-
+- ahci_mvebu_mbus_config(hpriv, dram);
+- ahci_mvebu_regret_option(hpriv);
++ pdata = hpriv->plat_data;
++ if (pdata->plat_config) {
++ rc = pdata->plat_config(hpriv);
++ if (rc)
++ goto disable_resources;
+ }
+
+ rc = ahci_platform_init_host(pdev, hpriv, &ahci_mvebu_port_info,
+@@ -190,9 +210,23 @@ disable_resources:
+ return rc;
+ }
+
++static const struct ahci_mvebu_plat_data ahci_mvebu_armada_380_plat_data = {
++ .plat_config = ahci_mvebu_armada_380_config,
++};
++
++static const struct ahci_mvebu_plat_data ahci_mvebu_armada_3700_plat_data = {
++ .plat_config = NULL,
++};
++
+ static const struct of_device_id ahci_mvebu_of_match[] = {
+- { .compatible = "marvell,armada-380-ahci", },
+- { .compatible = "marvell,armada-3700-ahci", },
++ {
++ .compatible = "marvell,armada-380-ahci",
++ .data = &ahci_mvebu_armada_380_plat_data,
++ },
++ {
++ .compatible = "marvell,armada-3700-ahci",
++ .data = &ahci_mvebu_armada_3700_plat_data,
++ },
+ { },
+ };
+ MODULE_DEVICE_TABLE(of, ahci_mvebu_of_match);
+--
+2.20.1
+
--- /dev/null
+From 6f38e174d7f6184ae2deede35ac4aea563fe04b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:13 +0200
+Subject: ath6kl: Fix off by one error in scan completion
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit 5803c12816c43bd09e5f4247dd9313c2d9a2c41b ]
+
+When ath6kl was reworked to share code between regular and scheduled scans
+in commit 3b8ffc6a22ba ("ath6kl: Configure probed SSID list consistently"),
+probed SSID entry changed from 1-index to 0-indexed. However,
+ath6kl_cfg80211_scan_complete_event() was missed in that change. Fix its
+indexing so that we correctly clear out the probed SSID list.
+
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index 6c98d7903ffb6..d7c626d9594e1 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -1093,7 +1093,7 @@ void ath6kl_cfg80211_scan_complete_event(struct ath6kl_vif *vif, bool aborted)
+ if (vif->scan_req->n_ssids && vif->scan_req->ssids[0].ssid_len) {
+ for (i = 0; i < vif->scan_req->n_ssids; i++) {
+ ath6kl_wmi_probedssid_cmd(ar->wmi, vif->fw_vif_idx,
+- i + 1, DISABLE_SSID_FLAG,
++ i, DISABLE_SSID_FLAG,
+ 0, NULL);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From f45cb87d72a858e3ba9f4dd7e062ee625a5ff2f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 09:43:11 +0200
+Subject: ath6kl: Only use match sets when firmware supports it
+
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+
+[ Upstream commit fb376a495fbdb886f38cfaf5a3805401b9e46f13 ]
+
+Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+merged the probed and matched SSID lists before sending them to the
+firmware. In the process, it assumed match set support is always available
+in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check
+that the firmware supports matching SSIDs in scheduled scans before setting
+MATCH_SSID_FLAG.
+
+Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index e121187f371ff..6c98d7903ffb6 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
+ else
+ ssid_list[i].flag = ANY_SSID_FLAG;
+
+- if (n_match_ssid == 0)
++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
+ ssid_list[i].flag |= MATCH_SSID_FLAG;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3837b3dbc67337a66477a2388eae3f3f24c844b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:23:19 -0600
+Subject: atl1e: checking the status of atl1e_write_phy_reg
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit ff07d48d7bc0974d4f96a85a4df14564fb09f1ef ]
+
+atl1e_write_phy_reg() could fail. The fix issues an error message when
+it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 9dc6da039a6d9..3164aad29bcf8 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -473,7 +473,9 @@ static void atl1e_mdio_write(struct net_device *netdev, int phy_id,
+ {
+ struct atl1e_adapter *adapter = netdev_priv(netdev);
+
+- atl1e_write_phy_reg(&adapter->hw, reg_num & MDIO_REG_ADDR_MASK, val);
++ if (atl1e_write_phy_reg(&adapter->hw,
++ reg_num & MDIO_REG_ADDR_MASK, val))
++ netdev_err(netdev, "write phy register failed\n");
+ }
+
+ static int atl1e_mii_ioctl(struct net_device *netdev,
+--
+2.20.1
+
--- /dev/null
+From 7884f72ca383dce78fab9ad79cbbf7abd7116246 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 22:53:47 +0800
+Subject: bcache: do not check if debug dentry is ERR or NULL explicitly on
+ remove
+
+From: Shenghui Wang <shhuiw@foxmail.com>
+
+[ Upstream commit ae17102316550b4b230a283febe31b2a9ff30084 ]
+
+debugfs_remove and debugfs_remove_recursive will check if the dentry
+pointer is NULL or ERR, and will do nothing in that case.
+
+Remove the check in cache_set_free and bch_debug_init.
+
+Signed-off-by: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/debug.c | 3 +--
+ drivers/md/bcache/super.c | 3 +--
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/bcache/debug.c b/drivers/md/bcache/debug.c
+index 06da66b2488ae..8c53d874ada4a 100644
+--- a/drivers/md/bcache/debug.c
++++ b/drivers/md/bcache/debug.c
+@@ -249,8 +249,7 @@ void bch_debug_init_cache_set(struct cache_set *c)
+
+ void bch_debug_exit(void)
+ {
+- if (!IS_ERR_OR_NULL(bcache_debug))
+- debugfs_remove_recursive(bcache_debug);
++ debugfs_remove_recursive(bcache_debug);
+ }
+
+ void __init bch_debug_init(struct kobject *kobj)
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 4998b4cae9c11..14d381cc6d747 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1491,8 +1491,7 @@ static void cache_set_free(struct closure *cl)
+ struct cache *ca;
+ unsigned int i;
+
+- if (!IS_ERR_OR_NULL(c->debug))
+- debugfs_remove(c->debug);
++ debugfs_remove(c->debug);
+
+ bch_open_buckets_free(c);
+ bch_btree_cache_free(c);
+--
+2.20.1
+
--- /dev/null
+From 85a58265c9dba38a5ac4a1115a8545969974c800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 22:53:50 +0800
+Subject: bcache: do not mark writeback_running too early
+
+From: Shenghui Wang <shhuiw@foxmail.com>
+
+[ Upstream commit 79b791466e525c98f6aeee9acf5726e7b27f4231 ]
+
+A fresh backing device is not attached to any cache_set, and
+has no writeback kthread created until first attached to some
+cache_set.
+
+But bch_cached_dev_writeback_init run
+"
+ dc->writeback_running = true;
+ WARN_ON(test_and_clear_bit(BCACHE_DEV_WB_RUNNING,
+ &dc->disk.flags));
+"
+for any newly formatted backing devices.
+
+For a fresh standalone backing device, we can get something like
+following even if no writeback kthread created:
+------------------------
+/sys/block/bcache0/bcache# cat writeback_running
+1
+/sys/block/bcache0/bcache# cat writeback_rate_debug
+rate: 512.0k/sec
+dirty: 0.0k
+target: 0.0k
+proportional: 0.0k
+integral: 0.0k
+change: 0.0k/sec
+next io: -15427384ms
+
+The none ZERO fields are misleading as no alive writeback kthread yet.
+
+Set dc->writeback_running false as no writeback thread created in
+bch_cached_dev_writeback_init().
+
+We have writeback thread created and woken up in bch_cached_dev_writeback
+_start(). Set dc->writeback_running true before bch_writeback_queue()
+called, as a writeback thread will check if dc->writeback_running is true
+before writing back dirty data, and hung if false detected.
+
+After the change, we can get the following output for a fresh standalone
+backing device:
+-----------------------
+/sys/block/bcache0/bcache$ cat writeback_running
+0
+/sys/block/bcache0/bcache# cat writeback_rate_debug
+rate: 0.0k/sec
+dirty: 0.0k
+target: 0.0k
+proportional: 0.0k
+integral: 0.0k
+change: 0.0k/sec
+next io: 0ms
+
+v1 -> v2:
+ Set dc->writeback_running before bch_writeback_queue() called,
+
+Signed-off-by: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/writeback.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index ba5395fd386d5..b5fc3c6c7178e 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -781,7 +781,7 @@ void bch_cached_dev_writeback_init(struct cached_dev *dc)
+ bch_keybuf_init(&dc->writeback_keys);
+
+ dc->writeback_metadata = true;
+- dc->writeback_running = true;
++ dc->writeback_running = false;
+ dc->writeback_percent = 10;
+ dc->writeback_delay = 30;
+ atomic_long_set(&dc->writeback_rate.rate, 1024);
+@@ -810,6 +810,7 @@ int bch_cached_dev_writeback_start(struct cached_dev *dc)
+ destroy_workqueue(dc->writeback_write_wq);
+ return PTR_ERR(dc->writeback_thread);
+ }
++ dc->writeback_running = true;
+
+ WARN_ON(test_and_set_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags));
+ schedule_delayed_work(&dc->writeback_rate_update,
+--
+2.20.1
+
--- /dev/null
+From 356cca2455bc15ee93db7e45f3bb0bd1913e7044 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 11:55:39 +0100
+Subject: blktrace: Show requests without sector
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 0803de78049fe1b0baf44bcddc727b036fb9139b ]
+
+Currently, blktrace will not show requests that don't have any data as
+rq->__sector is initialized to -1 which is out of device range and thus
+discarded by act_log_check(). This is most notably the case for cache
+flush requests sent to the device. Fix the problem by making
+blk_rq_trace_sector() return 0 for requests without initialized sector.
+
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/blktrace_api.h | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/blktrace_api.h b/include/linux/blktrace_api.h
+index 8804753805ac5..7bb2d8de9f308 100644
+--- a/include/linux/blktrace_api.h
++++ b/include/linux/blktrace_api.h
+@@ -116,7 +116,13 @@ extern void blk_fill_rwbs(char *rwbs, unsigned int op, int bytes);
+
+ static inline sector_t blk_rq_trace_sector(struct request *rq)
+ {
+- return blk_rq_is_passthrough(rq) ? 0 : blk_rq_pos(rq);
++ /*
++ * Tracing should ignore starting sector for passthrough requests and
++ * requests where starting sector didn't get set.
++ */
++ if (blk_rq_is_passthrough(rq) || blk_rq_pos(rq) == (sector_t)-1)
++ return 0;
++ return blk_rq_pos(rq);
+ }
+
+ static inline unsigned int blk_rq_trace_nr_sectors(struct request *rq)
+--
+2.20.1
+
--- /dev/null
+From 0ebb64471c58257f0f0ff2c8d3c2f49341dd279e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 10:48:47 +0300
+Subject: block: drbd: remove a stray unlock in __drbd_send_protocol()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ]
+
+There are two callers of this function and they both unlock the mutex so
+this ends up being a double unlock.
+
+Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index ef8212a4b73ef..a49a8d91a5990 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -796,7 +796,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
+
+ if (nc->tentative && connection->agreed_pro_version < 92) {
+ rcu_read_unlock();
+- mutex_unlock(&sock->mutex);
+ drbd_err(connection, "--dry-run is not supported by peer");
+ return -EOPNOTSUPP;
+ }
+--
+2.20.1
+
--- /dev/null
+From a146dce1cd61aae9458584207392acdc4a61228d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 12:22:28 +0100
+Subject: Bluetooth: hci_bcm: Handle specific unknown packets after firmware
+ loading
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Bakker <xc-racer2@live.ca>
+
+[ Upstream commit 22bba80500fdf624a7cfbb65fdfa97a038ae224d ]
+
+The Broadcom controller on aries S5PV210 boards sends out a couple of
+unknown packets after the firmware is loaded. This will cause
+logging of errors such as:
+ Bluetooth: hci0: Frame reassembly failed (-84)
+
+This is probably also the case with other boards, as there are related
+Android userspace patches for custom ROMs such as
+https://review.lineageos.org/#/c/LineageOS/android_system_bt/+/142721/
+Since this appears to be intended behaviour, treated them as diagnostic
+packets.
+
+Note that this is another variant of commit 01d5e44ace8a
+("Bluetooth: hci_bcm: Handle empty packet after firmware loading")
+
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Paweł Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bluetooth/hci_bcm.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
+index aa6b7ed9fdf12..59e5fc5eec8f8 100644
+--- a/drivers/bluetooth/hci_bcm.c
++++ b/drivers/bluetooth/hci_bcm.c
+@@ -51,6 +51,12 @@
+ #define BCM_LM_DIAG_PKT 0x07
+ #define BCM_LM_DIAG_SIZE 63
+
++#define BCM_TYPE49_PKT 0x31
++#define BCM_TYPE49_SIZE 0
++
++#define BCM_TYPE52_PKT 0x34
++#define BCM_TYPE52_SIZE 0
++
+ #define BCM_AUTOSUSPEND_DELAY 5000 /* default autosleep delay */
+
+ /**
+@@ -564,12 +570,28 @@ finalize:
+ .lsize = 0, \
+ .maxlen = BCM_NULL_SIZE
+
++#define BCM_RECV_TYPE49 \
++ .type = BCM_TYPE49_PKT, \
++ .hlen = BCM_TYPE49_SIZE, \
++ .loff = 0, \
++ .lsize = 0, \
++ .maxlen = BCM_TYPE49_SIZE
++
++#define BCM_RECV_TYPE52 \
++ .type = BCM_TYPE52_PKT, \
++ .hlen = BCM_TYPE52_SIZE, \
++ .loff = 0, \
++ .lsize = 0, \
++ .maxlen = BCM_TYPE52_SIZE
++
+ static const struct h4_recv_pkt bcm_recv_pkts[] = {
+ { H4_RECV_ACL, .recv = hci_recv_frame },
+ { H4_RECV_SCO, .recv = hci_recv_frame },
+ { H4_RECV_EVENT, .recv = hci_recv_frame },
+ { BCM_RECV_LM_DIAG, .recv = hci_recv_diag },
+ { BCM_RECV_NULL, .recv = hci_recv_diag },
++ { BCM_RECV_TYPE49, .recv = hci_recv_diag },
++ { BCM_RECV_TYPE52, .recv = hci_recv_diag },
+ };
+
+ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
+--
+2.20.1
+
--- /dev/null
+From f8933c8181c3272eb7edc5d03e8073da2674a76a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:31 -0500
+Subject: bnxt_en: query force speeds before disabling autoneg mode.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 56d374624778652d2a999e18c87a25338b127b41 ]
+
+With autoneg enabled, PHY loopback test fails. To disable autoneg,
+driver needs to send a valid forced speed to FW. FW is not sending
+async event for invalid speeds. To fix this, query forced speeds
+and send the correct speed when disabling autoneg mode.
+
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 22 ++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index eaa285bf908b9..2240c23b0a4c9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2390,17 +2390,37 @@ static int bnxt_hwrm_mac_loopback(struct bnxt *bp, bool enable)
+ return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ }
+
++static int bnxt_query_force_speeds(struct bnxt *bp, u16 *force_speeds)
++{
++ struct hwrm_port_phy_qcaps_output *resp = bp->hwrm_cmd_resp_addr;
++ struct hwrm_port_phy_qcaps_input req = {0};
++ int rc;
++
++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_PORT_PHY_QCAPS, -1, -1);
++ mutex_lock(&bp->hwrm_cmd_lock);
++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (!rc)
++ *force_speeds = le16_to_cpu(resp->supported_speeds_force_mode);
++
++ mutex_unlock(&bp->hwrm_cmd_lock);
++ return rc;
++}
++
+ static int bnxt_disable_an_for_lpbk(struct bnxt *bp,
+ struct hwrm_port_phy_cfg_input *req)
+ {
+ struct bnxt_link_info *link_info = &bp->link_info;
+- u16 fw_advertising = link_info->advertising;
++ u16 fw_advertising;
+ u16 fw_speed;
+ int rc;
+
+ if (!link_info->autoneg)
+ return 0;
+
++ rc = bnxt_query_force_speeds(bp, &fw_advertising);
++ if (rc)
++ return rc;
++
+ fw_speed = PORT_PHY_CFG_REQ_FORCE_LINK_SPEED_1GB;
+ if (netif_carrier_ok(bp->dev))
+ fw_speed = bp->link_info.link_speed;
+--
+2.20.1
+
--- /dev/null
+From 8e87eb2201e00e17872662de16ec33d2d303fb86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:28 -0500
+Subject: bnxt_en: Return linux standard errors in bnxt_ethtool.c
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 7c675421afef18253a86ffc383f57bc15ef32ea8 ]
+
+Currently firmware specific errors are returned directly in flash_device
+and reset ethtool hooks. Modify it to return linux standard errors
+to userspace when flashing operations fail.
+
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 56 +++++++++++++------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index da9b876899963..eaa285bf908b9 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1444,14 +1444,22 @@ static int bnxt_flash_nvram(struct net_device *dev,
+ rc = hwrm_send_message(bp, &req, sizeof(req), FLASH_NVRAM_TIMEOUT);
+ dma_free_coherent(&bp->pdev->dev, data_len, kmem, dma_handle);
+
++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to flash the device\n");
++ rc = -EACCES;
++ } else if (rc) {
++ rc = -EIO;
++ }
+ return rc;
+ }
+
+ static int bnxt_firmware_reset(struct net_device *dev,
+ u16 dir_type)
+ {
+- struct bnxt *bp = netdev_priv(dev);
+ struct hwrm_fw_reset_input req = {0};
++ struct bnxt *bp = netdev_priv(dev);
++ int rc;
+
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_FW_RESET, -1, -1);
+
+@@ -1491,7 +1499,15 @@ static int bnxt_firmware_reset(struct net_device *dev,
+ return -EINVAL;
+ }
+
+- return hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ rc = hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ if (rc == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to reset the device\n");
++ rc = -EACCES;
++ } else if (rc) {
++ rc = -EIO;
++ }
++ return rc;
+ }
+
+ static int bnxt_flash_firmware(struct net_device *dev,
+@@ -1698,9 +1714,9 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ struct hwrm_nvm_install_update_output *resp = bp->hwrm_cmd_resp_addr;
+ struct hwrm_nvm_install_update_input install = {0};
+ const struct firmware *fw;
++ int rc, hwrm_err = 0;
+ u32 item_len;
+ u16 index;
+- int rc;
+
+ bnxt_hwrm_fw_set_time(bp);
+
+@@ -1743,15 +1759,16 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ memcpy(kmem, fw->data, fw->size);
+ modify.host_src_addr = cpu_to_le64(dma_handle);
+
+- rc = hwrm_send_message(bp, &modify, sizeof(modify),
+- FLASH_PACKAGE_TIMEOUT);
++ hwrm_err = hwrm_send_message(bp, &modify,
++ sizeof(modify),
++ FLASH_PACKAGE_TIMEOUT);
+ dma_free_coherent(&bp->pdev->dev, fw->size, kmem,
+ dma_handle);
+ }
+ }
+ release_firmware(fw);
+- if (rc)
+- return rc;
++ if (rc || hwrm_err)
++ goto err_exit;
+
+ if ((install_type & 0xffff) == 0)
+ install_type >>= 16;
+@@ -1759,12 +1776,10 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ install.install_type = cpu_to_le32(install_type);
+
+ mutex_lock(&bp->hwrm_cmd_lock);
+- rc = _hwrm_send_message(bp, &install, sizeof(install),
+- INSTALL_PACKAGE_TIMEOUT);
+- if (rc) {
+- rc = -EOPNOTSUPP;
++ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
++ INSTALL_PACKAGE_TIMEOUT);
++ if (hwrm_err)
+ goto flash_pkg_exit;
+- }
+
+ if (resp->error_code) {
+ u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+@@ -1772,12 +1787,11 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ install.flags |= cpu_to_le16(
+ NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+- rc = _hwrm_send_message(bp, &install, sizeof(install),
+- INSTALL_PACKAGE_TIMEOUT);
+- if (rc) {
+- rc = -EOPNOTSUPP;
++ hwrm_err = _hwrm_send_message(bp, &install,
++ sizeof(install),
++ INSTALL_PACKAGE_TIMEOUT);
++ if (hwrm_err)
+ goto flash_pkg_exit;
+- }
+ }
+ }
+
+@@ -1788,6 +1802,14 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ }
+ flash_pkg_exit:
+ mutex_unlock(&bp->hwrm_cmd_lock);
++err_exit:
++ if (hwrm_err == HWRM_ERR_CODE_RESOURCE_ACCESS_DENIED) {
++ netdev_info(dev,
++ "PF does not have admin privileges to flash the device\n");
++ rc = -EACCES;
++ } else if (hwrm_err) {
++ rc = -EOPNOTSUPP;
++ }
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 57ba8949461045de596ea41954fc4589d1272f3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 18:46:29 -0500
+Subject: bnxt_en: Save ring statistics before reset.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit b8875ca356f1c0b17ec68be6666269373a62288e ]
+
+With the current driver, the statistics reported by .ndo_get_stats64()
+are reset when the device goes down. Store a snapshot of the
+rtnl_link_stats64 before shutdown. This snapshot is added to the
+current counters in .ndo_get_stats64() so that the counters will not
+get reset when the device is down.
+
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 57 +++++++++++++++++------
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 +
+ 2 files changed, 44 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index c54a74de7b088..2f61175f5655a 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7148,6 +7148,9 @@ static bool bnxt_drv_busy(struct bnxt *bp)
+ test_bit(BNXT_STATE_READ_STATS, &bp->state));
+ }
+
++static void bnxt_get_ring_stats(struct bnxt *bp,
++ struct rtnl_link_stats64 *stats);
++
+ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
+ bool link_re_init)
+ {
+@@ -7173,6 +7176,9 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init,
+ del_timer_sync(&bp->timer);
+ bnxt_free_skbs(bp);
+
++ /* Save ring stats before shutdown */
++ if (bp->bnapi)
++ bnxt_get_ring_stats(bp, &bp->net_stats_prev);
+ if (irq_re_init) {
+ bnxt_free_irq(bp);
+ bnxt_del_napi(bp);
+@@ -7234,23 +7240,12 @@ static int bnxt_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+ return -EOPNOTSUPP;
+ }
+
+-static void
+-bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
++static void bnxt_get_ring_stats(struct bnxt *bp,
++ struct rtnl_link_stats64 *stats)
+ {
+- u32 i;
+- struct bnxt *bp = netdev_priv(dev);
++ int i;
+
+- set_bit(BNXT_STATE_READ_STATS, &bp->state);
+- /* Make sure bnxt_close_nic() sees that we are reading stats before
+- * we check the BNXT_STATE_OPEN flag.
+- */
+- smp_mb__after_atomic();
+- if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
+- clear_bit(BNXT_STATE_READ_STATS, &bp->state);
+- return;
+- }
+
+- /* TODO check if we need to synchronize with bnxt_close path */
+ for (i = 0; i < bp->cp_nr_rings; i++) {
+ struct bnxt_napi *bnapi = bp->bnapi[i];
+ struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+@@ -7279,6 +7274,40 @@ bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
+
+ stats->tx_dropped += le64_to_cpu(hw_stats->tx_drop_pkts);
+ }
++}
++
++static void bnxt_add_prev_stats(struct bnxt *bp,
++ struct rtnl_link_stats64 *stats)
++{
++ struct rtnl_link_stats64 *prev_stats = &bp->net_stats_prev;
++
++ stats->rx_packets += prev_stats->rx_packets;
++ stats->tx_packets += prev_stats->tx_packets;
++ stats->rx_bytes += prev_stats->rx_bytes;
++ stats->tx_bytes += prev_stats->tx_bytes;
++ stats->rx_missed_errors += prev_stats->rx_missed_errors;
++ stats->multicast += prev_stats->multicast;
++ stats->tx_dropped += prev_stats->tx_dropped;
++}
++
++static void
++bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats)
++{
++ struct bnxt *bp = netdev_priv(dev);
++
++ set_bit(BNXT_STATE_READ_STATS, &bp->state);
++ /* Make sure bnxt_close_nic() sees that we are reading stats before
++ * we check the BNXT_STATE_OPEN flag.
++ */
++ smp_mb__after_atomic();
++ if (!test_bit(BNXT_STATE_OPEN, &bp->state)) {
++ clear_bit(BNXT_STATE_READ_STATS, &bp->state);
++ *stats = bp->net_stats_prev;
++ return;
++ }
++
++ bnxt_get_ring_stats(bp, stats);
++ bnxt_add_prev_stats(bp, stats);
+
+ if (bp->flags & BNXT_FLAG_PORT_STATS) {
+ struct rx_port_stats *rx = bp->hw_rx_port_stats;
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+index cf2d4a6583d55..f9e253b705ece 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -1302,6 +1302,7 @@ struct bnxt {
+ void *hwrm_cmd_resp_addr;
+ dma_addr_t hwrm_cmd_resp_dma_addr;
+
++ struct rtnl_link_stats64 net_stats_prev;
+ struct rx_port_stats *hw_rx_port_stats;
+ struct tx_port_stats *hw_tx_port_stats;
+ struct rx_port_stats_ext *hw_rx_port_stats_ext;
+--
+2.20.1
+
--- /dev/null
+From 5b119118504a823af253c972645061e64f8b45d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 17:00:23 +0100
+Subject: bpf/cpumap: make sure frame_size for build_skb is aligned if headroom
+ isn't
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 77ea5f4cbe2084db9ab021ba73fb7eadf1610884 ]
+
+The frame_size passed to build_skb must be aligned, else it is
+possible that the embedded struct skb_shared_info gets unaligned.
+
+For correctness make sure that xdpf->headroom in included in the
+alignment. No upstream drivers can hit this, as all XDP drivers provide
+an aligned headroom. This was discovered when playing with implementing
+XDP support for mvneta, which have a 2 bytes DSA header, and this
+Marvell ARM64 platform didn't like doing atomic operations on an
+unaligned skb_shinfo(skb)->dataref addresses.
+
+Fixes: 1c601d829ab0 ("bpf: cpumap xdp_buff to skb conversion and allocation")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cpumap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index 24aac0d0f4127..8974b3755670e 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -183,7 +183,7 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ * is not at a fixed memory location, with mixed length
+ * packets, which is bad for cache-line hotness.
+ */
+- frame_size = SKB_DATA_ALIGN(xdpf->len) + xdpf->headroom +
++ frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+ pkt_data_start = xdpf->data - xdpf->headroom;
+--
+2.20.1
+
--- /dev/null
+From ce2392603d1658560303b13f0583b1b0c8d00886 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 22:15:37 +0800
+Subject: bpf: decrease usercnt if bpf_map_new_fd() fails in
+ bpf_map_get_fd_by_id()
+
+From: Peng Sun <sironhide0null@gmail.com>
+
+[ Upstream commit 781e62823cb81b972dc8652c1827205cda2ac9ac ]
+
+In bpf/syscall.c, bpf_map_get_fd_by_id() use bpf_map_inc_not_zero()
+to increase the refcount, both map->refcnt and map->usercnt. Then, if
+bpf_map_new_fd() fails, should handle map->usercnt too.
+
+Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID")
+Signed-off-by: Peng Sun <sironhide0null@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 6e544e364821e..90bb0c05c10e9 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -1887,7 +1887,7 @@ static int bpf_map_get_fd_by_id(const union bpf_attr *attr)
+
+ fd = bpf_map_new_fd(map, f_flags);
+ if (fd < 0)
+- bpf_map_put(map);
++ bpf_map_put_with_uref(map);
+
+ return fd;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0cb5c7c7d017aeee63efaf022865cec79a7493e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 22:36:25 +0800
+Subject: bpf: drop refcount if bpf_map_new_fd() fails in map_create()
+
+From: Peng Sun <sironhide0null@gmail.com>
+
+[ Upstream commit 352d20d611414715353ee65fc206ee57ab1a6984 ]
+
+In bpf/syscall.c, map_create() first set map->usercnt to 1, a file
+descriptor is supposed to return to userspace. When bpf_map_new_fd()
+fails, drop the refcount.
+
+Fixes: bd5f5f4ecb78 ("bpf: Add BPF_MAP_GET_FD_BY_ID")
+Signed-off-by: Peng Sun <sironhide0null@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/syscall.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index 90bb0c05c10e9..596959288eb9e 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -559,12 +559,12 @@ static int map_create(union bpf_attr *attr)
+ err = bpf_map_new_fd(map, f_flags);
+ if (err < 0) {
+ /* failed to allocate fd.
+- * bpf_map_put() is needed because the above
++ * bpf_map_put_with_uref() is needed because the above
+ * bpf_map_alloc_id() has published the map
+ * to the userspace and the userspace may
+ * have refcnt-ed it through BPF_MAP_GET_FD_BY_ID.
+ */
+- bpf_map_put(map);
++ bpf_map_put_with_uref(map);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d279a61843b1bfd3236046b7a4f807a49115f54f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 20:20:06 +0100
+Subject: brcmfmac: Fix access point mode
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 861cb5eb467f5e38dce1aabe4e8db379255bd89b ]
+
+Since commit 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+the Raspberry Pi 3 A+ (BCM43455) isn't able to operate in AP mode with
+hostapd (device_ap_sme=1 use_monitor=0):
+
+brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52
+
+So add the missing mgmt_stypes for AP mode to fix this.
+
+Fixes: 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+index c7c520f327f2b..bbdc6000afb9b 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6314,6 +6314,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] = {
+ .tx = 0xffff,
+ .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+ BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
++ },
++ [NL80211_IFTYPE_AP] = {
++ .tx = 0xffff,
++ .rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
++ BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
++ BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
++ BIT(IEEE80211_STYPE_DISASSOC >> 4) |
++ BIT(IEEE80211_STYPE_AUTH >> 4) |
++ BIT(IEEE80211_STYPE_DEAUTH >> 4) |
++ BIT(IEEE80211_STYPE_ACTION >> 4)
+ }
+ };
+
+--
+2.20.1
+
--- /dev/null
+From d45a02c1c61e777478e0eebbc1328d6ead613af6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 07:53:44 +0000
+Subject: brcmfmac: set F2 watermark to 256 for 4373
+
+From: Wright Feng <wright.feng@cypress.com>
+
+[ Upstream commit e1a08730eeb0bad4d82c3bc40e74854872de618d ]
+
+We got SDIO_CRC_ERROR with 4373 on SDR104 when doing bi-directional
+throughput test. Enable watermark to 256 to guarantee the operation
+stability.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../broadcom/brcm80211/brcmfmac/sdio.c | 26 +++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 53e4962ceb8ae..e487dd78cc024 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -49,6 +49,10 @@
+ #define DCMD_RESP_TIMEOUT msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT msecs_to_jiffies(2500)
+
++/* watermark expressed in number of words */
++#define DEFAULT_F2_WATERMARK 0x8
++#define CY_4373_F2_WATERMARK 0x40
++
+ #ifdef DEBUG
+
+ #define BRCMF_TRAP_INFO_SIZE 80
+@@ -138,6 +142,8 @@ struct rte_console {
+ /* 1: isolate internal sdio signals, put external pads in tri-state; requires
+ * sdio bus power cycle to clear (rev 9) */
+ #define SBSDIO_DEVCTL_PADS_ISO 0x08
++/* 1: enable F2 Watermark */
++#define SBSDIO_DEVCTL_F2WM_ENAB 0x10
+ /* Force SD->SB reset mapping (rev 11) */
+ #define SBSDIO_DEVCTL_SB_RST_CTL 0x30
+ /* Determined by CoreControl bit */
+@@ -4060,6 +4066,7 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ void *nvram;
+ u32 nvram_len;
+ u8 saveclk;
++ u8 devctl;
+
+ brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+
+@@ -4115,8 +4122,23 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
+ bus->hostintmask, NULL);
+
+-
+- brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
++ switch (sdiod->func1->device) {
++ case SDIO_DEVICE_ID_CYPRESS_4373:
++ brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
++ CY_4373_F2_WATERMARK);
++ brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++ CY_4373_F2_WATERMARK, &err);
++ devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
++ &err);
++ devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
++ brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
++ &err);
++ break;
++ default:
++ brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++ DEFAULT_F2_WATERMARK, &err);
++ break;
++ }
+ } else {
+ /* Disable F2 again */
+ sdio_disable_func(sdiod->func2);
+--
+2.20.1
+
--- /dev/null
+From 0e992aa526913444af44abff01a4ba2b6deeb0f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 07:53:45 +0000
+Subject: brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373
+
+From: Madhan Mohan R <MadhanMohan.R@cypress.com>
+
+[ Upstream commit 58e4bbea0c1d9b5ace11df968c5dc096ce052a73 ]
+
+Along with F2 watermark (existing) configuration, F1 MesBusyCtrl
+should be enabled & sdio device RX FIFO watermark should be
+configured to avoid overflow errors.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Madhan Mohan R <madhanmohan.r@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 9 ++++++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index e487dd78cc024..abaed2fa2defd 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4133,6 +4133,9 @@ static void brcmf_sdio_firmware_callback(struct device *dev, int err,
+ devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
+ brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
+ &err);
++ brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
++ CY_4373_F2_WATERMARK |
++ SBSDIO_MESBUSYCTRL_ENAB, &err);
+ break;
+ default:
+ brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+index 7faed831f07d5..34b031154da93 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -77,7 +77,7 @@
+ #define SBSDIO_GPIO_OUT 0x10006
+ /* gpio enable */
+ #define SBSDIO_GPIO_EN 0x10007
+-/* rev < 7, watermark for sdio device */
++/* rev < 7, watermark for sdio device TX path */
+ #define SBSDIO_WATERMARK 0x10008
+ /* control busy signal generation */
+ #define SBSDIO_DEVICE_CTL 0x10009
+@@ -104,6 +104,13 @@
+ #define SBSDIO_FUNC1_RFRAMEBCHI 0x1001C
+ /* MesBusyCtl (rev 11) */
+ #define SBSDIO_FUNC1_MESBUSYCTRL 0x1001D
++/* Watermark for sdio device RX path */
++#define SBSDIO_MESBUSY_RXFIFO_WM_MASK 0x7F
++#define SBSDIO_MESBUSY_RXFIFO_WM_SHIFT 0
++/* Enable busy capability for MES access */
++#define SBSDIO_MESBUSYCTRL_ENAB 0x80
++#define SBSDIO_MESBUSYCTRL_ENAB_SHIFT 7
++
+ /* Sdio Core Rev 12 */
+ #define SBSDIO_FUNC1_WAKEUPCTRL 0x1001E
+ #define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK 0x1
+--
+2.20.1
+
--- /dev/null
+From 04a07de8a32b84225efeec0c1d4ba73b6d47200b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 20:54:28 +0100
+Subject: bridge: ebtables: don't crash when using dnat target in output chains
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ]
+
+xt_in() returns NULL in the output hook, skip the pkt_type change for
+that case, redirection only makes sense in broute/prerouting hooks.
+
+Reported-by: Tom Yan <tom.ty89@gmail.com>
+Cc: Linus Lüssing <linus.luessing@c0d3.blue>
+Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
+index dfc86a0199dab..1d8c834d90189 100644
+--- a/net/bridge/netfilter/ebt_dnat.c
++++ b/net/bridge/netfilter/ebt_dnat.c
+@@ -19,7 +19,6 @@ static unsigned int
+ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ const struct ebt_nat_info *info = par->targinfo;
+- struct net_device *dev;
+
+ if (!skb_make_writable(skb, 0))
+ return EBT_DROP;
+@@ -32,10 +31,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ else
+ skb->pkt_type = PACKET_MULTICAST;
+ } else {
+- if (xt_hooknum(par) != NF_BR_BROUTING)
+- dev = br_port_get_rcu(xt_in(par))->br->dev;
+- else
++ const struct net_device *dev;
++
++ switch (xt_hooknum(par)) {
++ case NF_BR_BROUTING:
+ dev = xt_in(par);
++ break;
++ case NF_BR_PRE_ROUTING:
++ dev = br_port_get_rcu(xt_in(par))->br->dev;
++ break;
++ default:
++ dev = NULL;
++ break;
++ }
++
++ if (!dev) /* NF_BR_LOCAL_OUT */
++ return info->target;
+
+ if (ether_addr_equal(info->mac, dev->dev_addr))
+ skb->pkt_type = PACKET_HOST;
+--
+2.20.1
+
--- /dev/null
+From b87e3de9fc319036c5863d1c7f55d463fce14601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 13:04:44 +0000
+Subject: Btrfs: allow clear_extent_dirty() to receive a cached extent state
+ record
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 0e6ec385b55f6001da8c6b1532494241e52c550d ]
+
+We can have a lot freed extents during the life span of transaction, so
+the red black tree that keeps track of the ranges of each freed extent
+(fs_info->freed_extents[]) can get quite big. When finishing a
+transaction commit we find each range, process it (discard the extents,
+unpin them) and then remove it from the red black tree.
+
+We can use an extent state record as a cache when searching for a range,
+so that when we clean the range we can use the cached extent state we
+passed to the search function instead of iterating the red black tree
+again. Doing things as fast as possible when finishing a transaction (in
+state TRANS_STATE_UNBLOCKED) is convenient as it reduces the time we
+block another task that wants to commit the next transaction.
+
+So change clear_extent_dirty() to allow an optional extent state record to
+be passed as an argument, which will be passed down to __clear_extent_bit.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/disk-io.c | 7 +++++--
+ fs/btrfs/extent-tree.c | 7 +++++--
+ fs/btrfs/extent_io.h | 4 ++--
+ 3 files changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index b2dc613ebed2c..96296dc7d2ea4 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4350,6 +4350,8 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info,
+ unpin = pinned_extents;
+ again:
+ while (1) {
++ struct extent_state *cached_state = NULL;
++
+ /*
+ * The btrfs_finish_extent_commit() may get the same range as
+ * ours between find_first_extent_bit and clear_extent_dirty.
+@@ -4358,13 +4360,14 @@ again:
+ */
+ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+- EXTENT_DIRTY, NULL);
++ EXTENT_DIRTY, &cached_state);
+ if (ret) {
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
+ }
+
+- clear_extent_dirty(unpin, start, end);
++ clear_extent_dirty(unpin, start, end, &cached_state);
++ free_extent_state(cached_state);
+ btrfs_error_unpin_extent_range(fs_info, start, end);
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ cond_resched();
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 024dd336b20ae..4bda5c09cdfe7 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -6618,9 +6618,11 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans)
+ unpin = &fs_info->freed_extents[0];
+
+ while (!trans->aborted) {
++ struct extent_state *cached_state = NULL;
++
+ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+- EXTENT_DIRTY, NULL);
++ EXTENT_DIRTY, &cached_state);
+ if (ret) {
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
+@@ -6630,9 +6632,10 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans)
+ ret = btrfs_discard_extent(fs_info, start,
+ end + 1 - start, NULL);
+
+- clear_extent_dirty(unpin, start, end);
++ clear_extent_dirty(unpin, start, end, &cached_state);
+ unpin_extent_range(fs_info, start, end, true);
+ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
++ free_extent_state(cached_state);
+ cond_resched();
+ }
+
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index ed27becd963c5..a3598b24441e1 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -348,11 +348,11 @@ static inline int set_extent_dirty(struct extent_io_tree *tree, u64 start,
+ }
+
+ static inline int clear_extent_dirty(struct extent_io_tree *tree, u64 start,
+- u64 end)
++ u64 end, struct extent_state **cached)
+ {
+ return clear_extent_bit(tree, start, end,
+ EXTENT_DIRTY | EXTENT_DELALLOC |
+- EXTENT_DO_ACCOUNTING, 0, 0, NULL);
++ EXTENT_DO_ACCOUNTING, 0, 0, cached);
+ }
+
+ int convert_extent_bit(struct extent_io_tree *tree, u64 start, u64 end,
+--
+2.20.1
+
--- /dev/null
+From 46d7e9e862eeca0e2cb8264ca63df5e5aaefc54c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 16:16:38 +0200
+Subject: btrfs: Check for missing device before bio submission in
+ btrfs_map_bio
+
+From: Nikolay Borisov <nborisov@suse.com>
+
+[ Upstream commit fc8a168aa9ab1680c2bd52bf9db7c994e0f2524f ]
+
+Before btrfs_map_bio submits all stripe bios it does a number of checks
+to ensure the device for every stripe is present. However, it doesn't do
+a DEV_STATE_MISSING check, instead this is relegated to the lower level
+btrfs_schedule_bio (in the async submission case, sync submission
+doesn't check DEV_STATE_MISSING at all). Additionally
+btrfs_schedule_bios does the duplicate device->bdev check which has
+already been performed in btrfs_map_bio.
+
+This patch moves the DEV_STATE_MISSING check in btrfs_map_bio and
+removes the duplicate device->bdev check. Doing so ensures that no bio
+cloning/submission happens for both async/sync requests in the face of
+missing device. This makes the async io submission path slightly shorter
+in terms of instruction count. No functional changes.
+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index a8297e7489d98..f84c18e86c816 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6106,12 +6106,6 @@ static noinline void btrfs_schedule_bio(struct btrfs_device *device,
+ int should_queue = 1;
+ struct btrfs_pending_bios *pending_bios;
+
+- if (test_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state) ||
+- !device->bdev) {
+- bio_io_error(bio);
+- return;
+- }
+-
+ /* don't bother with additional async steps for reads, right now */
+ if (bio_op(bio) == REQ_OP_READ) {
+ btrfsic_submit_bio(bio);
+@@ -6240,7 +6234,8 @@ blk_status_t btrfs_map_bio(struct btrfs_fs_info *fs_info, struct bio *bio,
+
+ for (dev_nr = 0; dev_nr < total_devs; dev_nr++) {
+ dev = bbio->stripes[dev_nr].dev;
+- if (!dev || !dev->bdev ||
++ if (!dev || !dev->bdev || test_bit(BTRFS_DEV_STATE_MISSING,
++ &dev->dev_state) ||
+ (bio_op(first_bio) == REQ_OP_WRITE &&
+ !test_bit(BTRFS_DEV_STATE_WRITEABLE, &dev->dev_state))) {
+ bbio_error(bbio, first_bio, logical);
+--
+2.20.1
+
--- /dev/null
+From 6b2bf4dc9146ed44cedcb351a3c74062040f34e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 11 Nov 2018 22:22:20 +0800
+Subject: btrfs: dev-replace: set result code of cancel by status of scrub
+
+From: Anand Jain <anand.jain@oracle.com>
+
+[ Upstream commit b47dda2ef6d793b67fd5979032dcd106e3f0a5c9 ]
+
+The device-replace needs to check the result code of the scrub workers
+in btrfs_dev_replace_cancel and distinguish if successful cancel
+operation and when the there was no operation running.
+
+If btrfs_scrub_cancel() fails, return
+BTRFS_IOCTL_DEV_REPLACE_RESULT_NOT_STARTED so that user can try
+to cancel the replace again.
+
+Signed-off-by: Anand Jain <anand.jain@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ update changelog ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/dev-replace.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 23b13fbecdc22..96763805787ed 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -810,16 +810,23 @@ int btrfs_dev_replace_cancel(struct btrfs_fs_info *fs_info)
+ btrfs_dev_replace_write_unlock(dev_replace);
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_STARTED:
+- result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
+ tgt_device = dev_replace->tgtdev;
+ src_device = dev_replace->srcdev;
+ btrfs_dev_replace_write_unlock(dev_replace);
+- btrfs_scrub_cancel(fs_info);
+- /* btrfs_dev_replace_finishing() will handle the cleanup part */
+- btrfs_info_in_rcu(fs_info,
+- "dev_replace from %s (devid %llu) to %s canceled",
+- btrfs_dev_name(src_device), src_device->devid,
+- btrfs_dev_name(tgt_device));
++ ret = btrfs_scrub_cancel(fs_info);
++ if (ret < 0) {
++ result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NOT_STARTED;
++ } else {
++ result = BTRFS_IOCTL_DEV_REPLACE_RESULT_NO_ERROR;
++ /*
++ * btrfs_dev_replace_finishing() will handle the
++ * cleanup part
++ */
++ btrfs_info_in_rcu(fs_info,
++ "dev_replace from %s (devid %llu) to %s canceled",
++ btrfs_dev_name(src_device), src_device->devid,
++ btrfs_dev_name(tgt_device));
++ }
+ break;
+ case BTRFS_IOCTL_DEV_REPLACE_STATE_SUSPENDED:
+ /*
+--
+2.20.1
+
--- /dev/null
+From 4ad941a54e54c13cef8428a61a9c342a3b7f6f82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 23:24:41 +0200
+Subject: btrfs: fix ncopies raid_attr for RAID56
+
+From: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+
+[ Upstream commit da612e31aee51bd13231c78a47c714b543bd3ad8 ]
+
+RAID5 and RAID6 profile store one copy of the data, not 2 or 3. These
+values are not yet used anywhere so there's no change.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Hans van Kranenburg <hans.van.kranenburg@mendix.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index f84c18e86c816..5bbcdcff68a9e 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -96,7 +96,7 @@ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ .devs_min = 2,
+ .tolerated_failures = 1,
+ .devs_increment = 1,
+- .ncopies = 2,
++ .ncopies = 1,
+ .raid_name = "raid5",
+ .bg_flag = BTRFS_BLOCK_GROUP_RAID5,
+ .mindev_error = BTRFS_ERROR_DEV_RAID5_MIN_NOT_MET,
+@@ -108,7 +108,7 @@ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ .devs_min = 3,
+ .tolerated_failures = 2,
+ .devs_increment = 1,
+- .ncopies = 3,
++ .ncopies = 1,
+ .raid_name = "raid6",
+ .bg_flag = BTRFS_BLOCK_GROUP_RAID6,
+ .mindev_error = BTRFS_ERROR_DEV_RAID6_MIN_NOT_MET,
+--
+2.20.1
+
--- /dev/null
+From 808b97fdab3748d72c72032e1565ec28d8eadc9d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 10:20:32 -0500
+Subject: btrfs: only track ref_heads in delayed_ref_updates
+
+From: Josef Bacik <jbacik@fb.com>
+
+[ Upstream commit 158ffa364bf723fa1ef128060646d23dc3942994 ]
+
+We use this number to figure out how many delayed refs to run, but
+__btrfs_run_delayed_refs really only checks every time we need a new
+delayed ref head, so we always run at least one ref head completely no
+matter what the number of items on it. Fix the accounting to only be
+adjusted when we add/remove a ref head.
+
+In addition to using this number to limit the number of delayed refs
+run, a future patch is also going to use it to calculate the amount of
+space required for delayed refs space reservation.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/delayed-ref.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 62ff545ba1f71..7e5c81e80e15d 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -234,8 +234,6 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ ref->in_tree = 0;
+ btrfs_put_delayed_ref(ref);
+ atomic_dec(&delayed_refs->num_entries);
+- if (trans->delayed_ref_updates)
+- trans->delayed_ref_updates--;
+ }
+
+ static bool merge_ref(struct btrfs_trans_handle *trans,
+@@ -446,7 +444,6 @@ inserted:
+ if (ref->action == BTRFS_ADD_DELAYED_REF)
+ list_add_tail(&ref->add_list, &href->ref_add_list);
+ atomic_inc(&root->num_entries);
+- trans->delayed_ref_updates++;
+ spin_unlock(&href->lock);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From b845f1bad28146fbf5c6e12f86897d556722aca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 14:11:26 -0800
+Subject: bus: ti-sysc: Check for no-reset and no-idle flags at the child level
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4014c08ba39476a18af546186da625a6833a1529 ]
+
+With ti-sysc, we need to now have the device tree properties for
+ti,no-reset-on-init and ti,no-idle-on-init at the module level instead
+of the child device level.
+
+Let's check for these properties at the child device level to enable
+quirks, and warn about moving the properties to the module level.
+
+Otherwise am335x-evm based boards tagging gpio1 with ti,no-reset-on-init
+will have their DDR power disabled if wired up in such a tricky way.
+
+Note that this should not be an issue for earlier kernels as we don't
+rely on this until the dts files have been updated to probe with ti-sysc
+interconnect target driver.
+
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index e95b26319cd91..5b31131d0cba2 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -91,6 +91,9 @@ struct sysc {
+ struct delayed_work idle_work;
+ };
+
++static void sysc_parse_dts_quirks(struct sysc *ddata, struct device_node *np,
++ bool is_child);
++
+ void sysc_write(struct sysc *ddata, int offset, u32 value)
+ {
+ writel_relaxed(value, ddata->module_va + offset);
+@@ -374,6 +377,7 @@ static int sysc_check_one_child(struct sysc *ddata,
+ dev_warn(ddata->dev, "really a child ti,hwmods property?");
+
+ sysc_check_quirk_stdout(ddata, np);
++ sysc_parse_dts_quirks(ddata, np, true);
+
+ return 0;
+ }
+@@ -1343,23 +1347,37 @@ static const struct sysc_dts_quirk sysc_dts_quirks[] = {
+ .mask = SYSC_QUIRK_NO_RESET_ON_INIT, },
+ };
+
+-static int sysc_init_dts_quirks(struct sysc *ddata)
++static void sysc_parse_dts_quirks(struct sysc *ddata, struct device_node *np,
++ bool is_child)
+ {
+- struct device_node *np = ddata->dev->of_node;
+ const struct property *prop;
+- int i, len, error;
+- u32 val;
+-
+- ddata->legacy_mode = of_get_property(np, "ti,hwmods", NULL);
++ int i, len;
+
+ for (i = 0; i < ARRAY_SIZE(sysc_dts_quirks); i++) {
+- prop = of_get_property(np, sysc_dts_quirks[i].name, &len);
++ const char *name = sysc_dts_quirks[i].name;
++
++ prop = of_get_property(np, name, &len);
+ if (!prop)
+ continue;
+
+ ddata->cfg.quirks |= sysc_dts_quirks[i].mask;
++ if (is_child) {
++ dev_warn(ddata->dev,
++ "dts flag should be at module level for %s\n",
++ name);
++ }
+ }
++}
++
++static int sysc_init_dts_quirks(struct sysc *ddata)
++{
++ struct device_node *np = ddata->dev->of_node;
++ int error;
++ u32 val;
++
++ ddata->legacy_mode = of_get_property(np, "ti,hwmods", NULL);
+
++ sysc_parse_dts_quirks(ddata, np, false);
+ error = of_property_read_u32(np, "ti,sysc-delay-us", &val);
+ if (!error) {
+ if (val > 255) {
+--
+2.20.1
+
--- /dev/null
+From 5f3362165c70b9bca869cf00a6640b8a86dc37c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:01:20 +0000
+Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on
+ open
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ]
+
+When the CAN interface is closed it the hardwre is put in power down
+mode, but does not reset the error counters / state. Reset the D_CAN on
+open, so the reported state and the actual state match.
+
+According to [1], the C_CAN module doesn't have the software reset.
+
+[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 9b61bfbea6cd1..24c6015f6c92b 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -52,6 +52,7 @@
+ #define CONTROL_EX_PDR BIT(8)
+
+ /* control register */
++#define CONTROL_SWR BIT(15)
+ #define CONTROL_TEST BIT(7)
+ #define CONTROL_CCE BIT(6)
+ #define CONTROL_DISABLE_AR BIT(5)
+@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ IF_MCONT_RCV_EOB);
+ }
+
++static int c_can_software_reset(struct net_device *dev)
++{
++ struct c_can_priv *priv = netdev_priv(dev);
++ int retry = 0;
++
++ if (priv->type != BOSCH_D_CAN)
++ return 0;
++
++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
++ msleep(20);
++ if (retry++ > 100) {
++ netdev_err(dev, "CCTRL: software reset failed\n");
++ return -EIO;
++ }
++ }
++
++ return 0;
++}
++
+ /*
+ * Configure C_CAN chip:
+ * - enable/disable auto-retransmission
+@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ static int c_can_chip_config(struct net_device *dev)
+ {
+ struct c_can_priv *priv = netdev_priv(dev);
++ int err;
++
++ err = c_can_software_reset(dev);
++ if (err)
++ return err;
+
+ /* enable automatic retransmission */
+ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
+--
+2.20.1
+
--- /dev/null
+From 5160836108e8c6695172df7b1b8c6650fedb7afa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 20:53:08 +0200
+Subject: can: flexcan: increase error counters if skb enqueueing via
+ can_rx_offload_queue_sorted() fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 758124335a9dd649ab820bfb5b328170919ee7dc ]
+
+The call to can_rx_offload_queue_sorted() may fail and return an error
+(in the current implementation due to resource shortage). The passed skb
+is consumed.
+
+This patch adds incrementing of the appropriate error counters to let
+the device statistics reflect that there's a problem.
+
+Reported-by: Martin Hundebøll <martin@geanix.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 581e84d8e2c89..bfe13c6627bed 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -566,6 +566,7 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ struct can_frame *cf;
+ bool rx_errors = false, tx_errors = false;
+ u32 timestamp;
++ int err;
+
+ timestamp = priv->read(®s->timer) << 16;
+
+@@ -614,7 +615,9 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ if (tx_errors)
+ dev->stats.tx_errors++;
+
+- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ if (err)
++ dev->stats.rx_fifo_errors++;
+ }
+
+ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+@@ -627,6 +630,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ int flt;
+ struct can_berr_counter bec;
+ u32 timestamp;
++ int err;
+
+ timestamp = priv->read(®s->timer) << 16;
+
+@@ -658,7 +662,9 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ if (unlikely(new_state == CAN_STATE_BUS_OFF))
+ can_bus_off(dev);
+
+- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ if (err)
++ dev->stats.rx_fifo_errors++;
+ }
+
+ static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
+--
+2.20.1
+
--- /dev/null
+From 7480c68a87d09ff53286a546fbd191c83fe466b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 15:38:19 +0200
+Subject: can: mcp251x: mcp251x_restart_work_handler(): Fix potential
+ force_quit race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timo Schlüßler <schluessler@krause.de>
+
+[ Upstream commit 27a0e54bae09d2dd023a01254db506d61cc50ba1 ]
+
+In mcp251x_restart_work_handler() the variable to stop the interrupt
+handler (priv->force_quit) is reset after the chip is restarted and thus
+a interrupt might occur.
+
+This patch fixes the potential race condition by resetting force_quit
+before enabling interrupts.
+
+Signed-off-by: Timo Schlüßler <schluessler@krause.de>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index de8d9dceb1236..0b0dd3f096dc6 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -773,6 +773,7 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ if (priv->after_suspend) {
+ mcp251x_hw_reset(spi);
+ mcp251x_setup(net, spi);
++ priv->force_quit = 0;
+ if (priv->after_suspend & AFTER_SUSPEND_RESTART) {
+ mcp251x_set_normal_mode(spi);
+ } else if (priv->after_suspend & AFTER_SUSPEND_UP) {
+@@ -784,7 +785,6 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ mcp251x_hw_sleep(spi);
+ }
+ priv->after_suspend = 0;
+- priv->force_quit = 0;
+ }
+
+ if (priv->restart_tx) {
+--
+2.20.1
+
--- /dev/null
+From 93e660f1d26923b0292c958947ea2b6085fefcf4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 08:58:45 +0000
+Subject: can: peak_usb: report bus recovery as well
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ]
+
+While the state changes are reported when the error counters increase
+and decrease, there is no event when the bus recovers and the error
+counters decrease again. So add those as well.
+
+Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING ->
+ERROR_ACTIVE instead of directly to ERROR_ACTIVE again.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Cc: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index 61f33c2fb1cd7..215cd74800df4 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -444,8 +444,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+ if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
+ /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ new_state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ }
+ break;
+
+@@ -468,9 +468,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+
+ if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
+- /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ /* no error (back to warning state) */
++ new_state = CAN_STATE_ERROR_WARNING;
++ break;
+ }
+ break;
+
+@@ -509,6 +509,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ mc->pdev->dev.can.can_stats.error_warning++;
+ break;
+
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ break;
++
+ default:
+ /* CAN_STATE_MAX (trick to handle other errors) */
+ cf->can_id |= CAN_ERR_CRTL;
+--
+2.20.1
+
--- /dev/null
+From d55e4481a4ddba4ceac6f3cb1dc859c28d960f0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 1f7f504dcd9d1262437bdcf4fa071e41dec1af03 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+If the hardware FIFO is empty can_rx_offload_offload_one() will return
+NULL.
+
+In case a CAN frame was read from the hardware,
+can_rx_offload_offload_one() returns the skb containing it.
+
+Without this patch can_rx_offload_irq_offload_fifo() bails out if no skb
+returned, regardless of the reason.
+
+Similar to can_rx_offload_irq_offload_timestamp() in case of a resource
+shortage the whole FIFO should be discarded, to avoid an IRQ storm and
+give the system some time to recover. However if the FIFO is empty the
+loop can be left.
+
+With this patch the loop is left in case of empty FIFO, but not on
+errors.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 0dded7a1067bb..5f7e97d54733c 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -257,7 +257,9 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+
+ while (1) {
+ skb = can_rx_offload_offload_one(offload, 0);
+- if (IS_ERR_OR_NULL(skb))
++ if (IS_ERR(skb))
++ continue;
++ if (!skb)
+ break;
+
+ skb_queue_tail(&offload->skb_queue, skb);
+--
+2.20.1
+
--- /dev/null
+From 194349dfe4403f5ea48fbdde8f385f38b6661841 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on
+ error
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit c2a9f74c9d18acfdcabd3361adc7eac82c537a66 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+However can_rx_offload_irq_offload_timestamp() bails out in the error
+case. In case of a resource shortage all mailboxes should be discarded,
+to avoid an IRQ storm and give the system some time to recover.
+
+Since can_rx_offload_irq_offload_timestamp() is typically called from a
+while loop, all message will eventually be discarded. So let's continue
+on error instead to discard them directly.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 1b3ce70c55bc7..0dded7a1067bb 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -225,7 +225,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+
+ skb = can_rx_offload_offload_one(offload, i);
+ if (IS_ERR_OR_NULL(skb))
+- break;
++ continue;
+
+ __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+ }
+--
+2.20.1
+
--- /dev/null
+From b4b85b4349dff567b126d8c448fc4eeb167ed2d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 16:03:18 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): do not increase the
+ skb_queue beyond skb_queue_len_max
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 ]
+
+The skb_queue is a linked list, holding the skb to be processed in the
+next NAPI call.
+
+Without this patch, the queue length in can_rx_offload_offload_one() is
+limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no
+array or other resources are accessed out-of-bound, however this
+behaviour is counterintuitive.
+
+This patch limits the rx-offload skb_queue length to skb_queue_len_max.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index a90005eac8b17..e32b65599a5f2 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -124,7 +124,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+ int ret;
+
+ /* If queue is full or skb not available, read to discard mailbox */
+- if (likely(skb_queue_len(&offload->skb_queue) <=
++ if (likely(skb_queue_len(&offload->skb_queue) <
+ offload->skb_queue_len_max))
+ skb = alloc_can_skb(offload->dev, &cf);
+
+--
+2.20.1
+
--- /dev/null
+From aff372608ba6b1ac02ebe1c920d9e9f422d4a3fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:15:07 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): increment
+ rx_fifo_errors on queue overflow or OOM
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 4e9016bee3bf0c24963097edace034ff205b565c ]
+
+If the rx-offload skb_queue is full or the skb allocation fails (due to OOM),
+the mailbox contents is discarded.
+
+This patch adds the incrementing of the rx_fifo_errors statistics counter.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index e32b65599a5f2..16af09c71cfed 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -134,8 +134,10 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+
+ ret = offload->mailbox_read(offload, &cf_overflow,
+ ×tamp, n);
+- if (ret)
++ if (ret) {
+ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++ }
+
+ return NULL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 74a2ebebd4ce00d8ee5cfef153cf34c408f73e52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 21:00:32 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to
+ propagate error value in case of errors
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit d763ab3044f0bf50bd0e6179f6b2cf1c125d1d94 ]
+
+Before this patch can_rx_offload_offload_one() returns a pointer to a
+skb containing the read CAN frame or a NULL pointer.
+
+However the meaning of the NULL pointer is ambiguous, it can either mean
+the requested mailbox is empty or there was an error.
+
+This patch fixes this situation by returning:
+- pointer to skb on success
+- NULL pointer if mailbox is empty
+- ERR_PTR() in case of an error
+
+All users of can_rx_offload_offload_one() have been adopted, no
+functional change intended.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 86 ++++++++++++++++++++++++++++++------
+ 1 file changed, 73 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 16af09c71cfed..1b3ce70c55bc7 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -116,39 +116,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b)
+ return cb_b->timestamp - cb_a->timestamp;
+ }
+
+-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
++/**
++ * can_rx_offload_offload_one() - Read one CAN frame from HW
++ * @offload: pointer to rx_offload context
++ * @n: number of mailbox to read
++ *
++ * The task of this function is to read a CAN frame from mailbox @n
++ * from the device and return the mailbox's content as a struct
++ * sk_buff.
++ *
++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue
++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be
++ * allocated, the mailbox contents is discarded by reading it into an
++ * overflow buffer. This way the mailbox is marked as free by the
++ * driver.
++ *
++ * Return: A pointer to skb containing the CAN frame on success.
++ *
++ * NULL if the mailbox @n is empty.
++ *
++ * ERR_PTR() in case of an error
++ */
++static struct sk_buff *
++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
+ {
+- struct sk_buff *skb = NULL;
++ struct sk_buff *skb = NULL, *skb_error = NULL;
+ struct can_rx_offload_cb *cb;
+ struct can_frame *cf;
+ int ret;
+
+- /* If queue is full or skb not available, read to discard mailbox */
+ if (likely(skb_queue_len(&offload->skb_queue) <
+- offload->skb_queue_len_max))
++ offload->skb_queue_len_max)) {
+ skb = alloc_can_skb(offload->dev, &cf);
++ if (unlikely(!skb))
++ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */
++ } else {
++ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */
++ }
+
+- if (!skb) {
++ /* If queue is full or skb not available, drop by reading into
++ * overflow buffer.
++ */
++ if (unlikely(skb_error)) {
+ struct can_frame cf_overflow;
+ u32 timestamp;
+
+ ret = offload->mailbox_read(offload, &cf_overflow,
+ ×tamp, n);
+- if (ret) {
+- offload->dev->stats.rx_dropped++;
+- offload->dev->stats.rx_fifo_errors++;
+- }
+
+- return NULL;
++ /* Mailbox was empty. */
++ if (unlikely(!ret))
++ return NULL;
++
++ /* Mailbox has been read and we're dropping it or
++ * there was a problem reading the mailbox.
++ *
++ * Increment error counters in any case.
++ */
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ /* There was a problem reading the mailbox, propagate
++ * error value.
++ */
++ if (unlikely(ret < 0))
++ return ERR_PTR(ret);
++
++ return skb_error;
+ }
+
+ cb = can_rx_offload_get_cb(skb);
+ ret = offload->mailbox_read(offload, cf, &cb->timestamp, n);
+- if (!ret) {
++
++ /* Mailbox was empty. */
++ if (unlikely(!ret)) {
+ kfree_skb(skb);
+ return NULL;
+ }
+
++ /* There was a problem reading the mailbox, propagate error value. */
++ if (unlikely(ret < 0)) {
++ kfree_skb(skb);
++
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ return ERR_PTR(ret);
++ }
++
++ /* Mailbox was read. */
+ return skb;
+ }
+
+@@ -168,7 +224,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+ continue;
+
+ skb = can_rx_offload_offload_one(offload, i);
+- if (!skb)
++ if (IS_ERR_OR_NULL(skb))
+ break;
+
+ __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+@@ -199,7 +255,11 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ struct sk_buff *skb;
+ int received = 0;
+
+- while ((skb = can_rx_offload_offload_one(offload, 0))) {
++ while (1) {
++ skb = can_rx_offload_offload_one(offload, 0);
++ if (IS_ERR_OR_NULL(skb))
++ break;
++
+ skb_queue_tail(&offload->skb_queue, skb);
+ received++;
+ }
+--
+2.20.1
+
--- /dev/null
+From 9db0d9e8f05b788305082a7562a1d0a0de13891d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:48:48 +0200
+Subject: can: rx-offload: can_rx_offload_queue_tail(): fix error handling,
+ avoid skb mem leak
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 6caf8a6d6586d44fd72f4aa1021d14aa82affafb ]
+
+If the rx-offload skb_queue is full can_rx_offload_queue_tail() will not
+queue the skb and return with an error.
+
+This patch frees the skb in case of a full queue, which brings
+can_rx_offload_queue_tail() in line with the
+can_rx_offload_queue_sorted() function, which has been adjusted in the
+previous patch.
+
+The return value is adjusted to -ENOBUFS to better reflect the actual
+problem.
+
+The device stats handling is left to the caller.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Reported-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 6cf0d0bc1e8d6..a90005eac8b17 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -261,8 +261,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+ struct sk_buff *skb)
+ {
+ if (skb_queue_len(&offload->skb_queue) >
+- offload->skb_queue_len_max)
+- return -ENOMEM;
++ offload->skb_queue_len_max) {
++ kfree_skb(skb);
++ return -ENOBUFS;
++ }
+
+ skb_queue_tail(&offload->skb_queue, skb);
+ can_rx_offload_schedule(offload);
+--
+2.20.1
+
--- /dev/null
+From 97bc2c789cd20a78bd15908bb1cb271625c56e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 09:39:32 -0500
+Subject: ceph: return -EINVAL if given fsc mount option on kernel w/o support
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit ff29fde84d1fc82f233c7da0daa3574a3942bec7 ]
+
+If someone requests fscache on the mount, and the kernel doesn't
+support it, it should fail the mount.
+
+[ Drop ceph prefix -- it's provided by pr_err. ]
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/super.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index ccab249a37f6a..2bd0b1ed9708e 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -248,6 +248,7 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ break;
+ case Opt_fscache_uniq:
++#ifdef CONFIG_CEPH_FSCACHE
+ kfree(fsopt->fscache_uniq);
+ fsopt->fscache_uniq = kstrndup(argstr[0].from,
+ argstr[0].to-argstr[0].from,
+@@ -256,7 +257,10 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ break;
+- /* misc */
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_wsize:
+ if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)
+ return -EINVAL;
+@@ -328,10 +332,15 @@ static int parse_fsopt_token(char *c, void *private)
+ fsopt->flags &= ~CEPH_MOUNT_OPT_INO32;
+ break;
+ case Opt_fscache:
++#ifdef CONFIG_CEPH_FSCACHE
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ kfree(fsopt->fscache_uniq);
+ fsopt->fscache_uniq = NULL;
+ break;
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_nofscache:
+ fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
+ kfree(fsopt->fscache_uniq);
+--
+2.20.1
+
--- /dev/null
+From 95ad497031488bd8c5cf50b3275b565014ebe7b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 17:39:06 +0200
+Subject: clk: at91: avoid sleeping early
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ]
+
+It is not allowed to sleep to early in the boot process and this may lead
+to kernel issues if the bootloader didn't prepare the slow clock and main
+clock.
+
+This results in the following error and dump stack on the AriettaG25:
+ bad: scheduling from the idle thread!
+
+Ensure it is possible to sleep, else simply have a delay.
+
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com
+Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver")
+Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-main.c | 5 ++++-
+ drivers/clk/at91/sckc.c | 20 ++++++++++++++++----
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index 2f97a843d6d6b..fb5c14af8cc8d 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -354,7 +354,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
+ regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
+ if (mcfr & AT91_PMC_MAINRDY)
+ return 0;
+- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(MAINF_LOOP_MIN_WAIT);
++ else
++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+ } while (time_before(prep_time, timeout));
+
+ return -ETIMEDOUT;
+diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
+index ab6ecefc49ad8..43ba2a8b03faf 100644
+--- a/drivers/clk/at91/sckc.c
++++ b/drivers/clk/at91/sckc.c
+@@ -74,7 +74,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
+
+ writel(tmp | AT91_SCKC_OSC32EN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -197,7 +200,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
+
+ writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -310,7 +316,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
+
+ writel(tmp, sckcr);
+
+- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(SLOWCK_SW_TIME_USEC);
++ else
++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+
+ return 0;
+ }
+@@ -443,7 +452,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
+ return 0;
+ }
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ osc->prepared = true;
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 53d673e4866446ac06b88c6c60ce49e5c0e000eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Sep 2019 17:04:11 +0200
+Subject: clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 44b09b11b813b8550e6b976ea51593bc23bba8d1 ]
+
+The meson-saradc driver manually sets the input clock for
+sar_adc_clk_sel. Update the GXBB clock driver (which is used on GXBB,
+GXL and GXM) so the rate settings on sar_adc_clk_div are propagated up
+to sar_adc_clk_sel which will let the common clock framework select the
+best matching parent clock if we want that.
+
+This makes sar_adc_clk_div consistent with the axg-aoclk and g12a-aoclk
+drivers, which both also specify CLK_SET_RATE_PARENT.
+
+Fixes: 33d0fcdfe0e870 ("clk: gxbb: add the SAR ADC clocks and expose them")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index 4d4f6d842c31c..d94b65061b9f1 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -836,6 +836,7 @@ static struct clk_regmap gxbb_sar_adc_clk_div = {
+ .ops = &clk_regmap_divider_ops,
+ .parent_names = (const char *[]){ "sar_adc_clk_sel" },
+ .num_parents = 1,
++ .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From f5725926d33b470e722f08f37fe03c6556c28cb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:02:01 +0200
+Subject: clk: samsung: exynos5420: Preserve PLL configuration during
+ suspend/resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ]
+
+Properly save and restore all top PLL related configuration registers
+during suspend/resume cycle. So far driver only handled EPLL and RPLL
+clocks, all other were reset to default values after suspend/resume cycle.
+This caused for example lower G3D (MALI Panfrost) performance after system
+resume, even if performance governor has been selected.
+
+Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index ce30862617a6e..d5af937212992 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -171,12 +171,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ GATE_BUS_CPU,
+ GATE_SCLK_CPU,
+ CLKOUT_CMU_CPU,
++ CPLL_CON0,
++ DPLL_CON0,
+ EPLL_CON0,
+ EPLL_CON1,
+ EPLL_CON2,
+ RPLL_CON0,
+ RPLL_CON1,
+ RPLL_CON2,
++ IPLL_CON0,
++ SPLL_CON0,
++ VPLL_CON0,
++ MPLL_CON0,
+ SRC_TOP0,
+ SRC_TOP1,
+ SRC_TOP2,
+--
+2.20.1
+
--- /dev/null
+From 669247e5c03e505172f6453e39447a46cba1e0ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 10:53:09 +0200
+Subject: clk: samsung: exynos5433: Fix error paths
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit faac3604d05e8015567124e5ee79edc3f1568a89 ]
+
+Add checking the value returned by samsung_clk_alloc_reg_dump() and
+devm_kcalloc(). While fixing this, also release all gathered clocks.
+
+Fixes: 523d3de41f02 ("clk: samsung: exynos5433: Add support for runtime PM")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+[s.nawrocki: squashed patch from K. Kozlowski adding missing slab.h header]
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5433.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index 426980514e679..302596dc79a2c 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -16,6 +16,7 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
++#include <linux/slab.h>
+
+ #include <dt-bindings/clock/exynos5433.h>
+
+@@ -5527,6 +5528,8 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+
+ data->clk_save = samsung_clk_alloc_reg_dump(info->clk_regs,
+ info->nr_clk_regs);
++ if (!data->clk_save)
++ return -ENOMEM;
+ data->nr_clk_save = info->nr_clk_regs;
+ data->clk_suspend = info->suspend_regs;
+ data->nr_clk_suspend = info->nr_suspend_regs;
+@@ -5535,12 +5538,19 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+ if (data->nr_pclks > 0) {
+ data->pclks = devm_kcalloc(dev, sizeof(struct clk *),
+ data->nr_pclks, GFP_KERNEL);
+-
++ if (!data->pclks) {
++ kfree(data->clk_save);
++ return -ENOMEM;
++ }
+ for (i = 0; i < data->nr_pclks; i++) {
+ struct clk *clk = of_clk_get(dev->of_node, i);
+
+- if (IS_ERR(clk))
++ if (IS_ERR(clk)) {
++ kfree(data->clk_save);
++ while (--i >= 0)
++ clk_put(data->pclks[i]);
+ return PTR_ERR(clk);
++ }
+ data->pclks[i] = clk;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From c0248dc4a7e7a6ffcfd3fdac2ec3fe96b1ad1eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 09:50:54 -0700
+Subject: clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit afdc74ed2d57e86c10b1d6831339770a802bab9a ]
+
+r375326 in Clang exposes an issue with operator precedence in
+sunxi_div_clk_setup:
+
+drivers/clk/sunxi/clk-sunxi.c:1083:30: warning: operator '?:' has lower
+precedence than '|'; '|' will be evaluated first
+[-Wbitwise-conditional-parentheses]
+ data->div[i].critical ?
+ ~~~~~~~~~~~~~~~~~~~~~ ^
+drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
+the '|' expression to silence this warning
+ data->div[i].critical ?
+ ^
+ )
+drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
+the '?:' expression to evaluate it first
+ data->div[i].critical ?
+ ^
+ (
+1 warning generated.
+
+It appears that the intention was for ?: to be evaluated first so that
+CLK_IS_CRITICAL could be added to clkflags if the critical boolean was
+set; right now, | is being evaluated first. Add parentheses around the
+?: block to have it be evaluated first.
+
+Fixes: 9919d44ff297 ("clk: sunxi: Use CLK_IS_CRITICAL flag for critical clks")
+Link: https://github.com/ClangBuiltLinux/linux/issues/745
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi/clk-sunxi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
+index 012714d94b429..004b411b640b3 100644
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -1086,8 +1086,8 @@ static struct clk ** __init sunxi_divs_clk_setup(struct device_node *node,
+ rate_hw, rate_ops,
+ gate_hw, &clk_gate_ops,
+ clkflags |
+- data->div[i].critical ?
+- CLK_IS_CRITICAL : 0);
++ (data->div[i].critical ?
++ CLK_IS_CRITICAL : 0));
+
+ WARN_ON(IS_ERR(clk_data->clks[i]));
+ }
+--
+2.20.1
+
--- /dev/null
+From 12d2d0806b278de5017980a0957e4bea385e93dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 12:28:09 +0100
+Subject: clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cdfc2e2086bf9c465f44e2db25561373b084a113 ]
+
+The zero'ing of bits 16 and 18 is incorrect. Currently the code
+is masking with the bitwise-and of BIT(16) & BIT(18) which is
+0, so the updated value for val is always zero. Fix this by bitwise
+and-ing value with the correct mask that will zero bits 16 and 18.
+
+Addresses-Coverity: (" Suspicious &= or |= constant expression")
+Fixes: b8eb71dcdd08 ("clk: sunxi-ng: Add A80 CCU")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun9i-a80.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+index 8936ef87652c0..c14bf782b2b33 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+@@ -1231,7 +1231,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev)
+
+ /* Enforce d1 = 0, d2 = 0 for Audio PLL */
+ val = readl(reg + SUN9I_A80_PLL_AUDIO_REG);
+- val &= (BIT(16) & BIT(18));
++ val &= ~(BIT(16) | BIT(18));
+ writel(val, reg + SUN9I_A80_PLL_AUDIO_REG);
+
+ /* Enforce P = 1 for both CPU cluster PLLs */
+--
+2.20.1
+
--- /dev/null
+From b8bedcdf3e808f04e47cb73b4f4d6518f9f65a31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 08:40:01 -0700
+Subject: clk: ti: clkctrl: Fix failed to enable error with double udelay
+ timeout
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 81a41901ffd46bac6df4c95b8290ac259e0feda8 ]
+
+Commit 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if
+timekeeping is suspended") added handling for cases when timekeeping is
+suspended. But looks like we can still get occasional "failed to enable"
+errors on the PM runtime resume path with udelay() returning faster than
+expected.
+
+With ti-sysc interconnect target module driver this leads into device
+failure with PM runtime failing with "failed to enable" clkctrl error.
+
+Let's fix the issue with a delay of two times the desired delay as in
+often done for udelay() to account for the inaccuracy.
+
+Fixes: 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if timekeeping is suspended")
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lkml.kernel.org/r/20190930154001.46581-1-tony@atomide.com
+Tested-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clkctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index dfaa5aad06927..2c2564acad227 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -100,11 +100,12 @@ static bool _omap4_is_timeout(union omap4_timeout *time, u32 timeout)
+ * can be from a timer that requires pm_runtime access, which
+ * will eventually bring us here with timekeeping_suspended,
+ * during both suspend entry and resume paths. This happens
+- * at least on am43xx platform.
++ * at least on am43xx platform. Account for flakeyness
++ * with udelay() by multiplying the timeout value by 2.
+ */
+ if (unlikely(_early_timeout || timekeeping_suspended)) {
+ if (time->cycles++ < timeout) {
+- udelay(1);
++ udelay(1 * 2);
+ return false;
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From b5c1305e5f18ea811c3048ffcd50c627f7e75f8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 11:34:36 +0300
+Subject: clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 9982b0f69b49931b652d35f86f519be2ccfc7027 ]
+
+ti_clk_register() calls it already so the driver should not create
+duplicated alias.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lkml.kernel.org/r/20191002083436.10194-1-peter.ujfalusi@ti.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-dra7-atl.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index 1488154704313..beb672a215b6c 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ struct clk_init_data init = { NULL };
+ const char **parent_names = NULL;
+ struct clk *clk;
+- int ret;
+
+ clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
+ if (!clk_hw) {
+@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
+
+ if (!IS_ERR(clk)) {
+- ret = ti_clk_add_alias(NULL, clk, node->name);
+- if (ret) {
+- clk_unregister(clk);
+- goto cleanup;
+- }
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ kfree(parent_names);
+ return;
+--
+2.20.1
+
--- /dev/null
+From 8406524c0657182537feaf10b64dc2b38f3597ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 14:53:50 -0700
+Subject: clocksource/drivers/fttmr010: Fix invalid interrupt register access
+
+From: Tao Ren <taoren@fb.com>
+
+[ Upstream commit 86fe57fc47b17b3528fa5497fc57e158d846c4ea ]
+
+TIMER_INTR_MASK register (Base Address of Timer + 0x38) is not designed
+for masking interrupts on ast2500 chips, and it's not even listed in
+ast2400 datasheet, so it's not safe to access TIMER_INTR_MASK on aspeed
+chips.
+
+Similarly, TIMER_INTR_STATE register (Base Address of Timer + 0x34) is
+not interrupt status register on ast2400 and ast2500 chips. Although
+there is no side effect to reset the register in fttmr010_common_init(),
+it's just misleading to do so.
+
+Besides, "count_down" is renamed to "is_aspeed" in "fttmr010" structure,
+and more comments are added so the code is more readble.
+
+Signed-off-by: Tao Ren <taoren@fb.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-fttmr010.c | 73 ++++++++++++++++------------
+ 1 file changed, 42 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/clocksource/timer-fttmr010.c b/drivers/clocksource/timer-fttmr010.c
+index cf93f6419b514..fadff7915dd9c 100644
+--- a/drivers/clocksource/timer-fttmr010.c
++++ b/drivers/clocksource/timer-fttmr010.c
+@@ -21,7 +21,7 @@
+ #include <linux/delay.h>
+
+ /*
+- * Register definitions for the timers
++ * Register definitions common for all the timer variants.
+ */
+ #define TIMER1_COUNT (0x00)
+ #define TIMER1_LOAD (0x04)
+@@ -36,9 +36,10 @@
+ #define TIMER3_MATCH1 (0x28)
+ #define TIMER3_MATCH2 (0x2c)
+ #define TIMER_CR (0x30)
+-#define TIMER_INTR_STATE (0x34)
+-#define TIMER_INTR_MASK (0x38)
+
++/*
++ * Control register (TMC30) bit fields for fttmr010/gemini/moxart timers.
++ */
+ #define TIMER_1_CR_ENABLE BIT(0)
+ #define TIMER_1_CR_CLOCK BIT(1)
+ #define TIMER_1_CR_INT BIT(2)
+@@ -53,8 +54,9 @@
+ #define TIMER_3_CR_UPDOWN BIT(11)
+
+ /*
+- * The Aspeed AST2400 moves bits around in the control register
+- * and lacks bits for setting the timer to count upwards.
++ * Control register (TMC30) bit fields for aspeed ast2400/ast2500 timers.
++ * The aspeed timers move bits around in the control register and lacks
++ * bits for setting the timer to count upwards.
+ */
+ #define TIMER_1_CR_ASPEED_ENABLE BIT(0)
+ #define TIMER_1_CR_ASPEED_CLOCK BIT(1)
+@@ -66,6 +68,18 @@
+ #define TIMER_3_CR_ASPEED_CLOCK BIT(9)
+ #define TIMER_3_CR_ASPEED_INT BIT(10)
+
++/*
++ * Interrupt status/mask register definitions for fttmr010/gemini/moxart
++ * timers.
++ * The registers don't exist and they are not needed on aspeed timers
++ * because:
++ * - aspeed timer overflow interrupt is controlled by bits in Control
++ * Register (TMC30).
++ * - aspeed timers always generate interrupt when either one of the
++ * Match registers equals to Status register.
++ */
++#define TIMER_INTR_STATE (0x34)
++#define TIMER_INTR_MASK (0x38)
+ #define TIMER_1_INT_MATCH1 BIT(0)
+ #define TIMER_1_INT_MATCH2 BIT(1)
+ #define TIMER_1_INT_OVERFLOW BIT(2)
+@@ -80,7 +94,7 @@
+ struct fttmr010 {
+ void __iomem *base;
+ unsigned int tick_rate;
+- bool count_down;
++ bool is_aspeed;
+ u32 t1_enable_val;
+ struct clock_event_device clkevt;
+ #ifdef CONFIG_ARM
+@@ -130,7 +144,7 @@ static int fttmr010_timer_set_next_event(unsigned long cycles,
+ cr &= ~fttmr010->t1_enable_val;
+ writel(cr, fttmr010->base + TIMER_CR);
+
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ /*
+ * ASPEED Timer Controller will load TIMER1_LOAD register
+ * into TIMER1_COUNT register when the timer is re-enabled.
+@@ -175,16 +189,17 @@ static int fttmr010_timer_set_oneshot(struct clock_event_device *evt)
+
+ /* Setup counter start from 0 or ~0 */
+ writel(0, fttmr010->base + TIMER1_COUNT);
+- if (fttmr010->count_down)
++ if (fttmr010->is_aspeed) {
+ writel(~0, fttmr010->base + TIMER1_LOAD);
+- else
++ } else {
+ writel(0, fttmr010->base + TIMER1_LOAD);
+
+- /* Enable interrupt */
+- cr = readl(fttmr010->base + TIMER_INTR_MASK);
+- cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
+- cr |= TIMER_1_INT_MATCH1;
+- writel(cr, fttmr010->base + TIMER_INTR_MASK);
++ /* Enable interrupt */
++ cr = readl(fttmr010->base + TIMER_INTR_MASK);
++ cr &= ~(TIMER_1_INT_OVERFLOW | TIMER_1_INT_MATCH2);
++ cr |= TIMER_1_INT_MATCH1;
++ writel(cr, fttmr010->base + TIMER_INTR_MASK);
++ }
+
+ return 0;
+ }
+@@ -201,9 +216,8 @@ static int fttmr010_timer_set_periodic(struct clock_event_device *evt)
+ writel(cr, fttmr010->base + TIMER_CR);
+
+ /* Setup timer to fire at 1/HZ intervals. */
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ writel(period, fttmr010->base + TIMER1_LOAD);
+- writel(0, fttmr010->base + TIMER1_MATCH1);
+ } else {
+ cr = 0xffffffff - (period - 1);
+ writel(cr, fttmr010->base + TIMER1_COUNT);
+@@ -281,23 +295,21 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ }
+
+ /*
+- * The Aspeed AST2400 moves bits around in the control register,
+- * otherwise it works the same.
++ * The Aspeed timers move bits around in the control register.
+ */
+ if (is_aspeed) {
+ fttmr010->t1_enable_val = TIMER_1_CR_ASPEED_ENABLE |
+ TIMER_1_CR_ASPEED_INT;
+- /* Downward not available */
+- fttmr010->count_down = true;
++ fttmr010->is_aspeed = true;
+ } else {
+ fttmr010->t1_enable_val = TIMER_1_CR_ENABLE | TIMER_1_CR_INT;
+- }
+
+- /*
+- * Reset the interrupt mask and status
+- */
+- writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
+- writel(0, fttmr010->base + TIMER_INTR_STATE);
++ /*
++ * Reset the interrupt mask and status
++ */
++ writel(TIMER_INT_ALL_MASK, fttmr010->base + TIMER_INTR_MASK);
++ writel(0, fttmr010->base + TIMER_INTR_STATE);
++ }
+
+ /*
+ * Enable timer 1 count up, timer 2 count up, except on Aspeed,
+@@ -306,9 +318,8 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ if (is_aspeed)
+ val = TIMER_2_CR_ASPEED_ENABLE;
+ else {
+- val = TIMER_2_CR_ENABLE;
+- if (!fttmr010->count_down)
+- val |= TIMER_1_CR_UPDOWN | TIMER_2_CR_UPDOWN;
++ val = TIMER_2_CR_ENABLE | TIMER_1_CR_UPDOWN |
++ TIMER_2_CR_UPDOWN;
+ }
+ writel(val, fttmr010->base + TIMER_CR);
+
+@@ -321,7 +332,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+ writel(0, fttmr010->base + TIMER2_MATCH1);
+ writel(0, fttmr010->base + TIMER2_MATCH2);
+
+- if (fttmr010->count_down) {
++ if (fttmr010->is_aspeed) {
+ writel(~0, fttmr010->base + TIMER2_LOAD);
+ clocksource_mmio_init(fttmr010->base + TIMER2_COUNT,
+ "FTTMR010-TIMER2",
+@@ -371,7 +382,7 @@ static int __init fttmr010_common_init(struct device_node *np, bool is_aspeed)
+
+ #ifdef CONFIG_ARM
+ /* Also use this timer for delays */
+- if (fttmr010->count_down)
++ if (fttmr010->is_aspeed)
+ fttmr010->delay_timer.read_current_timer =
+ fttmr010_read_current_timer_down;
+ else
+--
+2.20.1
+
--- /dev/null
+From 1f5934b503d06f931767da46890eb0c63e69b147 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 21:13:15 +0200
+Subject: clocksource/drivers/mediatek: Fix error handling
+
+From: Fabien Parent <fparent@baylibre.com>
+
+[ Upstream commit 41d49e7939de5ec532d86494185b2ca2e99c848a ]
+
+When timer_of_init fails, it cleans up after itself by undoing
+everything it did during the initialization function.
+
+mtk_syst_init and mtk_gpt_init both call timer_of_cleanup if
+timer_of_init fails. timer_of_cleanup try to release the resource
+taken. Since these resources have already been cleaned up by
+timer_of_init, we end up getting a few warnings printed:
+
+[ 0.001935] WARNING: CPU: 0 PID: 0 at __clk_put+0xe8/0x128
+[ 0.002650] Modules linked in:
+[ 0.003058] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.67+ #1
+[ 0.003852] Hardware name: MediaTek MT8183 (DT)
+[ 0.004446] pstate: 20400085 (nzCv daIf +PAN -UAO)
+[ 0.005073] pc : __clk_put+0xe8/0x128
+[ 0.005555] lr : clk_put+0xc/0x14
+[ 0.005988] sp : ffffff80090b3ea0
+[ 0.006422] x29: ffffff80090b3ea0 x28: 0000000040e20018
+[ 0.007121] x27: ffffffc07bfff780 x26: 0000000000000001
+[ 0.007819] x25: ffffff80090bda80 x24: ffffff8008ec5828
+[ 0.008517] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
+[ 0.009216] x21: 0000000000000001 x20: fffffffffffffdfb
+[ 0.009914] x19: ffffff8009166180 x18: 00000000002bffa8
+[ 0.010612] x17: ffffffc012996980 x16: 0000000000000000
+[ 0.011311] x15: ffffffbf004a6800 x14: 3536343038393334
+[ 0.012009] x13: 2079726576652073 x12: 7eb9c62c5c38f100
+[ 0.012707] x11: ffffff80090b3ba0 x10: ffffff80090b3ba0
+[ 0.013405] x9 : 0000000000000004 x8 : 0000000000000040
+[ 0.014103] x7 : ffffffc079400270 x6 : 0000000000000000
+[ 0.014801] x5 : ffffffc079400248 x4 : 0000000000000000
+[ 0.015499] x3 : 0000000000000000 x2 : 0000000000000000
+[ 0.016197] x1 : ffffff80091661c0 x0 : fffffffffffffdfb
+[ 0.016896] Call trace:
+[ 0.017218] __clk_put+0xe8/0x128
+[ 0.017654] clk_put+0xc/0x14
+[ 0.018048] timer_of_cleanup+0x60/0x7c
+[ 0.018551] mtk_syst_init+0x8c/0x9c
+[ 0.019020] timer_probe+0x6c/0xe0
+[ 0.019469] time_init+0x14/0x44
+[ 0.019893] start_kernel+0x2d0/0x46c
+[ 0.020378] ---[ end trace 8c1efabea1267649 ]---
+[ 0.020982] ------------[ cut here ]------------
+[ 0.021586] Trying to vfree() nonexistent vm area ((____ptrval____))
+[ 0.022427] WARNING: CPU: 0 PID: 0 at __vunmap+0xd0/0xd8
+[ 0.023119] Modules linked in:
+[ 0.023524] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 4.19.67+ #1
+[ 0.024498] Hardware name: MediaTek MT8183 (DT)
+[ 0.025091] pstate: 60400085 (nZCv daIf +PAN -UAO)
+[ 0.025718] pc : __vunmap+0xd0/0xd8
+[ 0.026176] lr : __vunmap+0xd0/0xd8
+[ 0.026632] sp : ffffff80090b3e90
+[ 0.027066] x29: ffffff80090b3e90 x28: 0000000040e20018
+[ 0.027764] x27: ffffffc07bfff780 x26: 0000000000000001
+[ 0.028462] x25: ffffff80090bda80 x24: ffffff8008ec5828
+[ 0.029160] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
+[ 0.029858] x21: 0000000000000000 x20: 0000000000000000
+[ 0.030556] x19: ffffff800800d000 x18: 00000000002bffa8
+[ 0.031254] x17: 0000000000000000 x16: 0000000000000000
+[ 0.031952] x15: ffffffbf004a6800 x14: 3536343038393334
+[ 0.032651] x13: 2079726576652073 x12: 7eb9c62c5c38f100
+[ 0.033349] x11: ffffff80090b3b40 x10: ffffff80090b3b40
+[ 0.034047] x9 : 0000000000000005 x8 : 5f5f6c6176727470
+[ 0.034745] x7 : 5f5f5f5f28282061 x6 : ffffff80091c86ef
+[ 0.035443] x5 : ffffff800852b690 x4 : 0000000000000000
+[ 0.036141] x3 : 0000000000000002 x2 : 0000000000000002
+[ 0.036839] x1 : 7eb9c62c5c38f100 x0 : 7eb9c62c5c38f100
+[ 0.037536] Call trace:
+[ 0.037859] __vunmap+0xd0/0xd8
+[ 0.038271] vunmap+0x24/0x30
+[ 0.038664] __iounmap+0x2c/0x34
+[ 0.039088] timer_of_cleanup+0x70/0x7c
+[ 0.039591] mtk_syst_init+0x8c/0x9c
+[ 0.040060] timer_probe+0x6c/0xe0
+[ 0.040507] time_init+0x14/0x44
+[ 0.040932] start_kernel+0x2d0/0x46c
+
+This commit remove the calls to timer_of_cleanup when timer_of_init
+fails since it is unnecessary and actually cause warnings to be printed.
+
+Fixes: a0858f937960 ("mediatek: Convert the driver to timer-of")
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/linux-arm-kernel/20190919191315.25190-1-fparent@baylibre.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-mediatek.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c
+index eb10321f85178..8e7894a026ace 100644
+--- a/drivers/clocksource/timer-mediatek.c
++++ b/drivers/clocksource/timer-mediatek.c
+@@ -277,15 +277,12 @@ static int __init mtk_syst_init(struct device_node *node)
+
+ ret = timer_of_init(node, &to);
+ if (ret)
+- goto err;
++ return ret;
+
+ clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
+ TIMER_SYNC_TICKS, 0xffffffff);
+
+ return 0;
+-err:
+- timer_of_cleanup(&to);
+- return ret;
+ }
+
+ static int __init mtk_gpt_init(struct device_node *node)
+@@ -302,7 +299,7 @@ static int __init mtk_gpt_init(struct device_node *node)
+
+ ret = timer_of_init(node, &to);
+ if (ret)
+- goto err;
++ return ret;
+
+ /* Configure clock source */
+ mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN);
+@@ -320,9 +317,6 @@ static int __init mtk_gpt_init(struct device_node *node)
+ mtk_gpt_enable_irq(&to, TIMER_CLK_EVT);
+
+ return 0;
+-err:
+- timer_of_cleanup(&to);
+- return ret;
+ }
+ TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init);
+ TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init);
+--
+2.20.1
+
--- /dev/null
+From dbcab1d73068b76c9d4aad2806d82b3b930daf55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 02:20:26 -0800
+Subject: crypto/chelsio/chtls: listen fails with multiadapt
+
+From: Atul Gupta <atul.gupta@chelsio.com>
+
+[ Upstream commit 6422ccc5fbefbd219f3fab133f698e58f5aa44eb ]
+
+listen fails when more than one tls capable device is
+registered. tls_hw_hash is called for each dev which loops
+again for each cdev_list causing listen failure. Hence
+call chtls_listen_start/stop for specific device than loop over all
+devices.
+
+Signed-off-by: Atul Gupta <atul.gupta@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/chelsio/chtls/chtls.h | 5 +++
+ drivers/crypto/chelsio/chtls/chtls_main.c | 50 ++++++++++++++---------
+ 2 files changed, 36 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls.h b/drivers/crypto/chelsio/chtls/chtls.h
+index 7725b6ee14efb..fcb6747ed29ea 100644
+--- a/drivers/crypto/chelsio/chtls/chtls.h
++++ b/drivers/crypto/chelsio/chtls/chtls.h
+@@ -153,6 +153,11 @@ struct chtls_dev {
+ unsigned int cdev_state;
+ };
+
++struct chtls_listen {
++ struct chtls_dev *cdev;
++ struct sock *sk;
++};
++
+ struct chtls_hws {
+ struct sk_buff_head sk_recv_queue;
+ u8 txqid;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_main.c b/drivers/crypto/chelsio/chtls/chtls_main.c
+index f59b044ebd255..2bf084afe9b58 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_main.c
++++ b/drivers/crypto/chelsio/chtls/chtls_main.c
+@@ -55,24 +55,19 @@ static void unregister_listen_notifier(struct notifier_block *nb)
+ static int listen_notify_handler(struct notifier_block *this,
+ unsigned long event, void *data)
+ {
+- struct chtls_dev *cdev;
+- struct sock *sk;
+- int ret;
++ struct chtls_listen *clisten;
++ int ret = NOTIFY_DONE;
+
+- sk = data;
+- ret = NOTIFY_DONE;
++ clisten = (struct chtls_listen *)data;
+
+ switch (event) {
+ case CHTLS_LISTEN_START:
++ ret = chtls_listen_start(clisten->cdev, clisten->sk);
++ kfree(clisten);
++ break;
+ case CHTLS_LISTEN_STOP:
+- mutex_lock(&cdev_list_lock);
+- list_for_each_entry(cdev, &cdev_list, list) {
+- if (event == CHTLS_LISTEN_START)
+- ret = chtls_listen_start(cdev, sk);
+- else
+- chtls_listen_stop(cdev, sk);
+- }
+- mutex_unlock(&cdev_list_lock);
++ chtls_listen_stop(clisten->cdev, clisten->sk);
++ kfree(clisten);
+ break;
+ }
+ return ret;
+@@ -90,8 +85,9 @@ static int listen_backlog_rcv(struct sock *sk, struct sk_buff *skb)
+ return 0;
+ }
+
+-static int chtls_start_listen(struct sock *sk)
++static int chtls_start_listen(struct chtls_dev *cdev, struct sock *sk)
+ {
++ struct chtls_listen *clisten;
+ int err;
+
+ if (sk->sk_protocol != IPPROTO_TCP)
+@@ -102,21 +98,33 @@ static int chtls_start_listen(struct sock *sk)
+ return -EADDRNOTAVAIL;
+
+ sk->sk_backlog_rcv = listen_backlog_rcv;
++ clisten = kmalloc(sizeof(*clisten), GFP_KERNEL);
++ if (!clisten)
++ return -ENOMEM;
++ clisten->cdev = cdev;
++ clisten->sk = sk;
+ mutex_lock(¬ify_mutex);
+ err = raw_notifier_call_chain(&listen_notify_list,
+- CHTLS_LISTEN_START, sk);
++ CHTLS_LISTEN_START, clisten);
+ mutex_unlock(¬ify_mutex);
+ return err;
+ }
+
+-static void chtls_stop_listen(struct sock *sk)
++static void chtls_stop_listen(struct chtls_dev *cdev, struct sock *sk)
+ {
++ struct chtls_listen *clisten;
++
+ if (sk->sk_protocol != IPPROTO_TCP)
+ return;
+
++ clisten = kmalloc(sizeof(*clisten), GFP_KERNEL);
++ if (!clisten)
++ return;
++ clisten->cdev = cdev;
++ clisten->sk = sk;
+ mutex_lock(¬ify_mutex);
+ raw_notifier_call_chain(&listen_notify_list,
+- CHTLS_LISTEN_STOP, sk);
++ CHTLS_LISTEN_STOP, clisten);
+ mutex_unlock(¬ify_mutex);
+ }
+
+@@ -138,15 +146,19 @@ static int chtls_inline_feature(struct tls_device *dev)
+
+ static int chtls_create_hash(struct tls_device *dev, struct sock *sk)
+ {
++ struct chtls_dev *cdev = to_chtls_dev(dev);
++
+ if (sk->sk_state == TCP_LISTEN)
+- return chtls_start_listen(sk);
++ return chtls_start_listen(cdev, sk);
+ return 0;
+ }
+
+ static void chtls_destroy_hash(struct tls_device *dev, struct sock *sk)
+ {
++ struct chtls_dev *cdev = to_chtls_dev(dev);
++
+ if (sk->sk_state == TCP_LISTEN)
+- chtls_stop_listen(sk);
++ chtls_stop_listen(cdev, sk);
+ }
+
+ static void chtls_register_dev(struct chtls_dev *cdev)
+--
+2.20.1
+
--- /dev/null
+From 6a6858fdf7d378b4656e38c89d1059fd76e7d81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 07:52:32 -0200
+Subject: crypto: mxc-scc - fix build warnings on ARM64
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 2326828ee40357b3d2b1359b8ca7526af201495b ]
+
+The following build warnings are seen when building for ARM64 allmodconfig:
+
+drivers/crypto/mxc-scc.c:181:20: warning: format '%d' expects argument of type 'int', but argument 5 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:186:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:277:21: warning: format '%d' expects argument of type 'int', but argument 4 has type 'size_t' {aka 'long unsigned int'} [-Wformat=]
+drivers/crypto/mxc-scc.c:339:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+drivers/crypto/mxc-scc.c:340:3: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
+
+Fix them by using the %zu specifier to print a size_t variable and using
+a plain %x to print the result of a readl().
+
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/mxc-scc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/crypto/mxc-scc.c b/drivers/crypto/mxc-scc.c
+index e01c46387df8d..519086730791b 100644
+--- a/drivers/crypto/mxc-scc.c
++++ b/drivers/crypto/mxc-scc.c
+@@ -178,12 +178,12 @@ static int mxc_scc_get_data(struct mxc_scc_ctx *ctx,
+ else
+ from = scc->black_memory;
+
+- dev_dbg(scc->dev, "pcopy: from 0x%p %d bytes\n", from,
++ dev_dbg(scc->dev, "pcopy: from 0x%p %zu bytes\n", from,
+ ctx->dst_nents * 8);
+ len = sg_pcopy_from_buffer(ablkreq->dst, ctx->dst_nents,
+ from, ctx->size, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err from 0x%p (len=%d)\n", from, len);
++ dev_err(scc->dev, "pcopy err from 0x%p (len=%zu)\n", from, len);
+ return -EINVAL;
+ }
+
+@@ -274,7 +274,7 @@ static int mxc_scc_put_data(struct mxc_scc_ctx *ctx,
+ len = sg_pcopy_to_buffer(req->src, ctx->src_nents,
+ to, len, ctx->offset);
+ if (!len) {
+- dev_err(scc->dev, "pcopy err to 0x%p (len=%d)\n", to, len);
++ dev_err(scc->dev, "pcopy err to 0x%p (len=%zu)\n", to, len);
+ return -EINVAL;
+ }
+
+@@ -335,9 +335,9 @@ static void mxc_scc_ablkcipher_next(struct mxc_scc_ctx *ctx,
+ return;
+ }
+
+- dev_dbg(scc->dev, "Start encryption (0x%p/0x%p)\n",
+- (void *)readl(scc->base + SCC_SCM_RED_START),
+- (void *)readl(scc->base + SCC_SCM_BLACK_START));
++ dev_dbg(scc->dev, "Start encryption (0x%x/0x%x)\n",
++ readl(scc->base + SCC_SCM_RED_START),
++ readl(scc->base + SCC_SCM_BLACK_START));
+
+ /* clear interrupt control registers */
+ writel(SCC_SCM_INTR_CTRL_CLR_INTR,
+--
+2.20.1
+
--- /dev/null
+From d8d4a6117bc419fb85f7473d8de62ac40e339dfb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 15:55:41 -0800
+Subject: crypto: user - support incremental algorithm dumps
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 0ac6b8fb23c724b015d9ca70a89126e8d1563166 ]
+
+CRYPTO_MSG_GETALG in NLM_F_DUMP mode sometimes doesn't return all
+registered crypto algorithms, because it doesn't support incremental
+dumps. crypto_dump_report() only permits itself to be called once, yet
+the netlink subsystem allocates at most ~64 KiB for the skb being dumped
+to. Thus only the first recvmsg() returns data, and it may only include
+a subset of the crypto algorithms even if the user buffer passed to
+recvmsg() is large enough to hold all of them.
+
+Fix this by using one of the arguments in the netlink_callback structure
+to keep track of the current position in the algorithm list. Then
+userspace can do multiple recvmsg() on the socket after sending the dump
+request. This is the way netlink dumps work elsewhere in the kernel;
+it's unclear why this was different (probably just an oversight).
+
+Also fix an integer overflow when calculating the dump buffer size hint.
+
+Fixes: a38f7907b926 ("crypto: Add userspace configuration API")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/crypto_user.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 3cca814348a26..74cb166097cd2 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -296,30 +296,33 @@ drop_alg:
+
+ static int crypto_dump_report(struct sk_buff *skb, struct netlink_callback *cb)
+ {
+- struct crypto_alg *alg;
++ const size_t start_pos = cb->args[0];
++ size_t pos = 0;
+ struct crypto_dump_info info;
+- int err;
+-
+- if (cb->args[0])
+- goto out;
+-
+- cb->args[0] = 1;
++ struct crypto_alg *alg;
++ int res;
+
+ info.in_skb = cb->skb;
+ info.out_skb = skb;
+ info.nlmsg_seq = cb->nlh->nlmsg_seq;
+ info.nlmsg_flags = NLM_F_MULTI;
+
++ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list) {
+- err = crypto_report_alg(alg, &info);
+- if (err)
+- goto out_err;
++ if (pos >= start_pos) {
++ res = crypto_report_alg(alg, &info);
++ if (res == -EMSGSIZE)
++ break;
++ if (res)
++ goto out;
++ }
++ pos++;
+ }
+-
++ cb->args[0] = pos;
++ res = skb->len;
+ out:
+- return skb->len;
+-out_err:
+- return err;
++ up_read(&crypto_alg_sem);
++ return res;
+ }
+
+ static int crypto_dump_report_done(struct netlink_callback *cb)
+@@ -503,7 +506,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) &&
+ (nlh->nlmsg_flags & NLM_F_DUMP))) {
+ struct crypto_alg *alg;
+- u16 dump_alloc = 0;
++ unsigned long dump_alloc = 0;
+
+ if (link->dump == NULL)
+ return -EINVAL;
+@@ -511,16 +514,16 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ down_read(&crypto_alg_sem);
+ list_for_each_entry(alg, &crypto_alg_list, cra_list)
+ dump_alloc += CRYPTO_REPORT_MAXSIZE;
++ up_read(&crypto_alg_sem);
+
+ {
+ struct netlink_dump_control c = {
+ .dump = link->dump,
+ .done = link->done,
+- .min_dump_alloc = dump_alloc,
++ .min_dump_alloc = min(dump_alloc, 65535UL),
+ };
+ err = netlink_dump_start(crypto_nlsk, skb, nlh, &c);
+ }
+- up_read(&crypto_alg_sem);
+
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From 093c8cdfbc33307014c2c1bdafc31a23d6c1f0f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 21:12:19 +0100
+Subject: decnet: fix DN_IFREQ_SIZE
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 50c2936634bcb1db78a8ca63249236810c11a80f ]
+
+Digging through the ioctls with Al because of the previous
+patches, we found that on 64-bit decnet's dn_dev_ioctl()
+is wrong, because struct ifreq::ifr_ifru is actually 24
+bytes (not 16 as expected from struct sockaddr) due to the
+ifru_map and ifru_settings members.
+
+Clearly, decnet expects the ioctl to be called with a struct
+like
+ struct ifreq_dn {
+ char ifr_name[IFNAMSIZ];
+ struct sockaddr_dn ifr_addr;
+ };
+
+since it does
+ struct ifreq *ifr = ...;
+ struct sockaddr_dn *sdn = (struct sockaddr_dn *)&ifr->ifr_addr;
+
+This means that DN_IFREQ_SIZE is too big for what it wants on
+64-bit, as it is
+ sizeof(struct ifreq) - sizeof(struct sockaddr) +
+ sizeof(struct sockaddr_dn)
+
+This assumes that sizeof(struct sockaddr) is the size of ifr_ifru
+but that isn't true.
+
+Fix this to use offsetof(struct ifreq, ifr_ifru).
+
+This indeed doesn't really matter much - the result is that we
+copy in/out 8 bytes more than we should on 64-bit platforms. In
+case the "struct ifreq_dn" lands just on the end of a page though
+it might lead to faults.
+
+As far as I can tell, it has been like this forever, so it seems
+very likely that nobody cares.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/decnet/dn_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
+index bfd43e8f2c06e..3235540f6adff 100644
+--- a/net/decnet/dn_dev.c
++++ b/net/decnet/dn_dev.c
+@@ -56,7 +56,7 @@
+ #include <net/dn_neigh.h>
+ #include <net/dn_fib.h>
+
+-#define DN_IFREQ_SIZE (sizeof(struct ifreq) - sizeof(struct sockaddr) + sizeof(struct sockaddr_dn))
++#define DN_IFREQ_SIZE (offsetof(struct ifreq, ifr_ifru) + sizeof(struct sockaddr_dn))
+
+ static char dn_rt_all_end_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x04,0x00,0x00};
+ static char dn_rt_all_rt_mcast[ETH_ALEN] = {0xAB,0x00,0x00,0x03,0x00,0x00};
+--
+2.20.1
+
--- /dev/null
+From c365aae8fac7ec7daaf04a15b823e5d67688fa1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 08:04:24 -0500
+Subject: dm flakey: Properly corrupt multi-page bios.
+
+From: Sweet Tea <sweettea@redhat.com>
+
+[ Upstream commit a00f5276e26636cbf72f24f79831026d2e2868e7 ]
+
+The flakey target is documented to be able to corrupt the Nth byte in
+a bio, but does not corrupt byte indices after the first biovec in the
+bio. Change the corrupting function to actually corrupt the Nth byte
+no matter in which biovec that index falls.
+
+A test device generating two-page bios, atop a flakey device configured
+to corrupt a byte index on the second page, verified both the failure
+to corrupt before this patch and the expected corruption after this
+change.
+
+Signed-off-by: John Dorminy <jdorminy@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-flakey.c | 33 ++++++++++++++++++++++-----------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
+index b86d2439ffc76..2fcf62fb2844f 100644
+--- a/drivers/md/dm-flakey.c
++++ b/drivers/md/dm-flakey.c
+@@ -287,20 +287,31 @@ static void flakey_map_bio(struct dm_target *ti, struct bio *bio)
+
+ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc)
+ {
+- unsigned bio_bytes = bio_cur_bytes(bio);
+- char *data = bio_data(bio);
++ unsigned int corrupt_bio_byte = fc->corrupt_bio_byte - 1;
++
++ struct bvec_iter iter;
++ struct bio_vec bvec;
++
++ if (!bio_has_data(bio))
++ return;
+
+ /*
+- * Overwrite the Nth byte of the data returned.
++ * Overwrite the Nth byte of the bio's data, on whichever page
++ * it falls.
+ */
+- if (data && bio_bytes >= fc->corrupt_bio_byte) {
+- data[fc->corrupt_bio_byte - 1] = fc->corrupt_bio_value;
+-
+- DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
+- "(rw=%c bi_opf=%u bi_sector=%llu cur_bytes=%u)\n",
+- bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
+- (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
+- (unsigned long long)bio->bi_iter.bi_sector, bio_bytes);
++ bio_for_each_segment(bvec, bio, iter) {
++ if (bio_iter_len(bio, iter) > corrupt_bio_byte) {
++ char *segment = (page_address(bio_iter_page(bio, iter))
++ + bio_iter_offset(bio, iter));
++ segment[corrupt_bio_byte] = fc->corrupt_bio_value;
++ DMDEBUG("Corrupting data bio=%p by writing %u to byte %u "
++ "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n",
++ bio, fc->corrupt_bio_value, fc->corrupt_bio_byte,
++ (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf,
++ (unsigned long long)bio->bi_iter.bi_sector, bio->bi_iter.bi_size);
++ break;
++ }
++ corrupt_bio_byte -= bio_iter_len(bio, iter);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f23b5dcf25d9aa39f49bb0a1455d2f7fca94b368 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 17:35:41 +0100
+Subject: dm raid: fix false -EBUSY when handling check/repair message
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+[ Upstream commit 74694bcbdf7e28a5ad548cdda9ac56d30be00d13 ]
+
+Sending a check/repair message infrequently leads to -EBUSY instead of
+properly identifying an active resync. This occurs because
+raid_message() is testing recovery bits in a racy way.
+
+Fix by calling decipher_sync_action() from raid_message() to properly
+identify the idle state of the RAID device.
+
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-raid.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index 6c9b542882613..23de59a692c51 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -3690,8 +3690,7 @@ static int raid_message(struct dm_target *ti, unsigned int argc, char **argv,
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ md_reap_sync_thread(mddev);
+ }
+- } else if (test_bit(MD_RECOVERY_RUNNING, &mddev->recovery) ||
+- test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
++ } else if (decipher_sync_action(mddev, mddev->recovery) != st_idle)
+ return -EBUSY;
+ else if (!strcasecmp(argv[0], "resync"))
+ ; /* MD_RECOVERY_NEEDED set below */
+--
+2.20.1
+
--- /dev/null
+From 7e4d4bdd575ad29a86c03744b1b828ed9a0e9b8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:37 +0100
+Subject: drbd: do not block when adjusting "disk-options" while IO is frozen
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit f708bd08ecbdc23d03aaedf5b3311ebe44cfdb50 ]
+
+"suspending" IO is overloaded.
+It can mean "do not allow new requests" (obviously),
+but it also may mean "must not complete pending IO",
+for example while the fencing handlers do their arbitration.
+
+When adjusting disk options, we suspend io (disallow new requests), then
+wait for the activity-log to become unused (drain all IO completions),
+and possibly replace it with a new activity log of different size.
+
+If the other "suspend IO" aspect is active, pending IO completions won't
+happen, and we would block forever (unkillable drbdsetup process).
+
+Fix this by skipping the activity log adjustment if the "al-extents"
+setting did not change. Also, in case it did change, fail early without
+blocking if it looks like we would block forever.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 37 ++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 3366c1a91ee00..5b15ffd0c7f57 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1515,6 +1515,30 @@ static void sanitize_disk_conf(struct drbd_device *device, struct disk_conf *dis
+ }
+ }
+
++static int disk_opts_check_al_size(struct drbd_device *device, struct disk_conf *dc)
++{
++ int err = -EBUSY;
++
++ if (device->act_log &&
++ device->act_log->nr_elements == dc->al_extents)
++ return 0;
++
++ drbd_suspend_io(device);
++ /* If IO completion is currently blocked, we would likely wait
++ * "forever" for the activity log to become unused. So we don't. */
++ if (atomic_read(&device->ap_bio_cnt))
++ goto out;
++
++ wait_event(device->al_wait, lc_try_lock(device->act_log));
++ drbd_al_shrink(device);
++ err = drbd_check_al_size(device, dc);
++ lc_unlock(device->act_log);
++ wake_up(&device->al_wait);
++out:
++ drbd_resume_io(device);
++ return err;
++}
++
+ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ {
+ struct drbd_config_context adm_ctx;
+@@ -1577,15 +1601,12 @@ int drbd_adm_disk_opts(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- drbd_suspend_io(device);
+- wait_event(device->al_wait, lc_try_lock(device->act_log));
+- drbd_al_shrink(device);
+- err = drbd_check_al_size(device, new_disk_conf);
+- lc_unlock(device->act_log);
+- wake_up(&device->al_wait);
+- drbd_resume_io(device);
+-
++ err = disk_opts_check_al_size(device, new_disk_conf);
+ if (err) {
++ /* Could be just "busy". Ignore?
++ * Introduce dedicated error code? */
++ drbd_msg_put_info(adm_ctx.reply_skb,
++ "Try again without changing current al-extents setting");
+ retcode = ERR_NOMEM;
+ goto fail_unlock;
+ }
+--
+2.20.1
+
--- /dev/null
+From e4692a848107c77f1f4984bb6830042f6ea8f485 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:39 +0100
+Subject: drbd: fix print_st_err()'s prototype to match the definition
+
+From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+
+[ Upstream commit 2c38f035117331eb78d0504843c79ea7c7fabf37 ]
+
+print_st_err() is defined with its 4th argument taking an
+'enum drbd_state_rv' but its prototype use an int for it.
+
+Fix this by using 'enum drbd_state_rv' in the prototype too.
+
+Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
+Signed-off-by: Roland Kammerer <roland.kammerer@linbit.com>
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_state.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index ea58301d0895c..b2a390ba73a05 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -131,7 +131,7 @@ extern enum drbd_state_rv _drbd_set_state(struct drbd_device *, union drbd_state
+ enum chg_state_flags,
+ struct completion *done);
+ extern void print_st_err(struct drbd_device *, union drbd_state,
+- union drbd_state, int);
++ union drbd_state, enum drbd_state_rv);
+
+ enum drbd_state_rv
+ _conn_request_state(struct drbd_connection *connection, union drbd_state mask, union drbd_state val,
+--
+2.20.1
+
--- /dev/null
+From c5926cca3e98a0f7ed50bfebd77e13c9fc80f57c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:31 +0100
+Subject: drbd: ignore "all zero" peer volume sizes in handshake
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit 94c43a13b8d6e3e0dd77b3536b5e04a84936b762 ]
+
+During handshake, if we are diskless ourselves, we used to accept any size
+presented by the peer.
+
+Which could be zero if that peer was just brought up and connected
+to us without having a disk attached first, in which case both
+peers would just "flip" their volume sizes.
+
+Now, even a diskless node will ignore "zero" sizes
+presented by a diskless peer.
+
+Also a currently Diskless Primary will refuse to shrink during handshake:
+it may be frozen, and waiting for a "suitable" local disk or peer to
+re-appear (on-no-data-accessible suspend-io). If the peer is smaller
+than what we used to be, it is not suitable.
+
+The logic for a diskless node during handshake is now supposed to be:
+believe the peer, if
+ - I don't have a current size myself
+ - we agree on the size anyways
+ - I do have a current size, am Secondary, and he has the only disk
+ - I do have a current size, am Primary, and he has the only disk,
+ which is larger than my current size
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_receiver.c | 33 +++++++++++++++++++++++++++---
+ 1 file changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 3cdadf75c82da..c9e8d61dea248 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -3980,6 +3980,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ struct o_qlim *o = (connection->agreed_features & DRBD_FF_WSAME) ? p->qlim : NULL;
+ enum determine_dev_size dd = DS_UNCHANGED;
+ sector_t p_size, p_usize, p_csize, my_usize;
++ sector_t new_size, cur_size;
+ int ldsc = 0; /* local disk size changed */
+ enum dds_flags ddsf;
+
+@@ -3987,6 +3988,7 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ if (!peer_device)
+ return config_unknown_volume(connection, pi);
+ device = peer_device->device;
++ cur_size = drbd_get_capacity(device->this_bdev);
+
+ p_size = be64_to_cpu(p->d_size);
+ p_usize = be64_to_cpu(p->u_size);
+@@ -3997,7 +3999,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ device->p_size = p_size;
+
+ if (get_ldev(device)) {
+- sector_t new_size, cur_size;
+ rcu_read_lock();
+ my_usize = rcu_dereference(device->ldev->disk_conf)->disk_size;
+ rcu_read_unlock();
+@@ -4015,7 +4016,6 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ /* Never shrink a device with usable data during connect.
+ But allow online shrinking if we are connected. */
+ new_size = drbd_new_dev_size(device, device->ldev, p_usize, 0);
+- cur_size = drbd_get_capacity(device->this_bdev);
+ if (new_size < cur_size &&
+ device->state.disk >= D_OUTDATED &&
+ device->state.conn < C_CONNECTED) {
+@@ -4080,9 +4080,36 @@ static int receive_sizes(struct drbd_connection *connection, struct packet_info
+ *
+ * However, if he sends a zero current size,
+ * take his (user-capped or) backing disk size anyways.
++ *
++ * Unless of course he does not have a disk himself.
++ * In which case we ignore this completely.
+ */
++ sector_t new_size = p_csize ?: p_usize ?: p_size;
+ drbd_reconsider_queue_parameters(device, NULL, o);
+- drbd_set_my_capacity(device, p_csize ?: p_usize ?: p_size);
++ if (new_size == 0) {
++ /* Ignore, peer does not know nothing. */
++ } else if (new_size == cur_size) {
++ /* nothing to do */
++ } else if (cur_size != 0 && p_size == 0) {
++ drbd_warn(device, "Ignored diskless peer device size (peer:%llu != me:%llu sectors)!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ } else if (new_size < cur_size && device->state.role == R_PRIMARY) {
++ drbd_err(device, "The peer's device size is too small! (%llu < %llu sectors); demote me first!\n",
++ (unsigned long long)new_size, (unsigned long long)cur_size);
++ conn_request_state(peer_device->connection, NS(conn, C_DISCONNECTING), CS_HARD);
++ return -EIO;
++ } else {
++ /* I believe the peer, if
++ * - I don't have a current size myself
++ * - we agree on the size anyways
++ * - I do have a current size, am Secondary,
++ * and he has the only disk
++ * - I do have a current size, am Primary,
++ * and he has the only disk,
++ * which is larger than my current size
++ */
++ drbd_set_my_capacity(device, new_size);
++ }
+ }
+
+ if (get_ldev(device)) {
+--
+2.20.1
+
--- /dev/null
+From e248d55290ba0a67e4848f975fcb6d71aa32914f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:35 +0100
+Subject: drbd: reject attach of unsuitable uuids even if connected
+
+From: Lars Ellenberg <lars.ellenberg@linbit.com>
+
+[ Upstream commit fe43ed97bba3b11521abd934b83ed93143470e4f ]
+
+Multiple failure scenario:
+a) all good
+ Connected Primary/Secondary UpToDate/UpToDate
+b) lose disk on Primary,
+ Connected Primary/Secondary Diskless/UpToDate
+c) continue to write to the device,
+ changes only make it to the Secondary storage.
+d) lose disk on Secondary,
+ Connected Primary/Secondary Diskless/Diskless
+e) now try to re-attach on Primary
+
+This would have succeeded before, even though that is clearly the
+wrong data set to attach to (missing the modifications from c).
+Because we only compared our "effective" and the "to-be-attached"
+data generation uuid tags if (device->state.conn < C_CONNECTED).
+
+Fix: change that constraint to (device->state.pdsk != D_UP_TO_DATE)
+compare the uuids, and reject the attach.
+
+This patch also tries to improve the reverse scenario:
+first lose Secondary, then Primary disk,
+then try to attach the disk on Secondary.
+
+Before this patch, the attach on the Secondary succeeds, but since commit
+drbd: disconnect, if the wrong UUIDs are attached on a connected peer
+the Primary will notice unsuitable data, and drop the connection hard.
+
+Though unfortunately at a point in time during the handshake where
+we cannot easily abort the attach on the peer without more
+refactoring of the handshake.
+
+We now reject any attach to "unsuitable" uuids,
+as long as we can see a Primary role,
+unless we already have access to "good" data.
+
+Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_nl.c | 6 +++---
+ drivers/block/drbd/drbd_receiver.c | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
+index 319fabdd63a3f..3366c1a91ee00 100644
+--- a/drivers/block/drbd/drbd_nl.c
++++ b/drivers/block/drbd/drbd_nl.c
+@@ -1935,9 +1935,9 @@ int drbd_adm_attach(struct sk_buff *skb, struct genl_info *info)
+ }
+ }
+
+- if (device->state.conn < C_CONNECTED &&
+- device->state.role == R_PRIMARY && device->ed_uuid &&
+- (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
++ if (device->state.pdsk != D_UP_TO_DATE && device->ed_uuid &&
++ (device->state.role == R_PRIMARY || device->state.peer == R_PRIMARY) &&
++ (device->ed_uuid & ~((u64)1)) != (nbc->md.uuid[UI_CURRENT] & ~((u64)1))) {
+ drbd_err(device, "Can only attach to data with current UUID=%016llX\n",
+ (unsigned long long)device->ed_uuid);
+ retcode = ERR_DATA_NOT_CURRENT;
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index c9e8d61dea248..cbb6ef719978f 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -4395,6 +4395,25 @@ static int receive_state(struct drbd_connection *connection, struct packet_info
+ if (peer_state.conn == C_AHEAD)
+ ns.conn = C_BEHIND;
+
++ /* TODO:
++ * if (primary and diskless and peer uuid != effective uuid)
++ * abort attach on peer;
++ *
++ * If this node does not have good data, was already connected, but
++ * the peer did a late attach only now, trying to "negotiate" with me,
++ * AND I am currently Primary, possibly frozen, with some specific
++ * "effective" uuid, this should never be reached, really, because
++ * we first send the uuids, then the current state.
++ *
++ * In this scenario, we already dropped the connection hard
++ * when we received the unsuitable uuids (receive_uuids().
++ *
++ * Should we want to change this, that is: not drop the connection in
++ * receive_uuids() already, then we would need to add a branch here
++ * that aborts the attach of "unsuitable uuids" on the peer in case
++ * this node is currently Diskless Primary.
++ */
++
+ if (device->p_uuid && peer_state.disk >= D_NEGOTIATING &&
+ get_ldev_if_state(device, D_NEGOTIATING)) {
+ int cr; /* consider resync */
+--
+2.20.1
+
--- /dev/null
+From 8fe266d1e3044b0ab80d0ab483e2fe7650274ae4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:29:05 -0800
+Subject: drivers/base/platform.c: kmemleak ignore a known leak
+
+From: Qian Cai <cai@gmx.us>
+
+[ Upstream commit 967d3010df8b6f6f9aa95c198edc5fe3646ebf36 ]
+
+unreferenced object 0xffff808ec6dc5a80 (size 128):
+ comm "swapper/0", pid 1, jiffies 4294938063 (age 2560.530s)
+ hex dump (first 32 bytes):
+ ff ff ff ff 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b ........kkkkkkkk
+ 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
+ backtrace:
+ [<00000000476dcf8c>] kmem_cache_alloc_trace+0x430/0x500
+ [<000000004f708d37>] platform_device_register_full+0xbc/0x1e8
+ [<000000006c2a7ec7>] acpi_create_platform_device+0x370/0x450
+ [<00000000ef135642>] acpi_default_enumeration+0x34/0x78
+ [<000000003bd9a052>] acpi_bus_attach+0x2dc/0x3e0
+ [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+ [<000000003cf4f7f2>] acpi_bus_attach+0x108/0x3e0
+ [<000000002968643e>] acpi_bus_scan+0xb0/0x110
+ [<0000000010dd0bd7>] acpi_scan_init+0x1a8/0x410
+ [<00000000965b3c5a>] acpi_init+0x408/0x49c
+ [<00000000ed4b9fe2>] do_one_initcall+0x178/0x7f4
+ [<00000000a5ac5a74>] kernel_init_freeable+0x9d4/0xa9c
+ [<0000000070ea6c15>] kernel_init+0x18/0x138
+ [<00000000fb8fff06>] ret_from_fork+0x10/0x1c
+ [<0000000041273a0d>] 0xffffffffffffffff
+
+Then, faddr2line pointed out this line,
+
+/*
+ * This memory isn't freed when the device is put,
+ * I don't have a nice idea for that though. Conceptually
+ * dma_mask in struct device should not be a pointer.
+ * See http://thread.gmane.org/gmane.linux.kernel.pci/9081
+ */
+pdev->dev.dma_mask =
+ kmalloc(sizeof(*pdev->dev.dma_mask), GFP_KERNEL);
+
+Since this leak has existed for more than 8 years and it does not
+reference other parts of the memory, let kmemleak ignore it, so users
+don't need to waste time reporting this in the future.
+
+Link: http://lkml.kernel.org/r/20181206160751.36211-1-cai@gmx.us
+Signed-off-by: Qian Cai <cai@gmx.us>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J . Wysocki" <rafael.j.wysocki@intel.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index dff82a3c2caa9..e9be1f56929af 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -26,6 +26,7 @@
+ #include <linux/clk/clk-conf.h>
+ #include <linux/limits.h>
+ #include <linux/property.h>
++#include <linux/kmemleak.h>
+
+ #include "base.h"
+ #include "power/power.h"
+@@ -525,6 +526,8 @@ struct platform_device *platform_device_register_full(
+ if (!pdev->dev.dma_mask)
+ goto err;
+
++ kmemleak_ignore(pdev->dev.dma_mask);
++
+ *pdev->dev.dma_mask = pdevinfo->dma_mask;
+ pdev->dev.coherent_dma_mask = pdevinfo->dma_mask;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1d17122340135f8d29930a7c348406133062de95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 23:04:13 -0600
+Subject: drivers/regulator: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 966e927bf8cc6a44f8b72582a1d6d3ffc73b12ad ]
+
+If palmas_smps_read() fails, we should not use the read data in "reg"
+which may contain random value. The fix inserts a check for the return
+value of palmas_smps_read(): If it fails, we return the error code
+upstream and stop using "reg".
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/palmas-regulator.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index bb5ab7d78895b..c2cc392a27d40 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -443,13 +443,16 @@ static int palmas_ldo_write(struct palmas *palmas, unsigned int reg,
+ static int palmas_set_mode_smps(struct regulator_dev *dev, unsigned int mode)
+ {
+ int id = rdev_get_id(dev);
++ int ret;
+ struct palmas_pmic *pmic = rdev_get_drvdata(dev);
+ struct palmas_pmic_driver_data *ddata = pmic->palmas->pmic_ddata;
+ struct palmas_regs_info *rinfo = &ddata->palmas_regs_info[id];
+ unsigned int reg;
+ bool rail_enable = true;
+
+- palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ ret = palmas_smps_read(pmic->palmas, rinfo->ctrl_addr, ®);
++ if (ret)
++ return ret;
+
+ reg &= ~PALMAS_SMPS12_CTRL_MODE_ACTIVE_MASK;
+
+--
+2.20.1
+
--- /dev/null
+From 2efa56af85e408de89c5f13a62293f61f1fa39fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 22:26:42 -0500
+Subject: exofs_mount(): fix leaks on failure exits
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 26cb5a328c6b2bda9e859307ce4cfc60df3a2c28 ]
+
+... and don't abuse mount_nodev(), while we are at it.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exofs/super.c | 37 +++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/fs/exofs/super.c b/fs/exofs/super.c
+index 7d61e3fa378c2..8fb98bb942372 100644
+--- a/fs/exofs/super.c
++++ b/fs/exofs/super.c
+@@ -705,21 +705,18 @@ out:
+ /*
+ * Read the superblock from the OSD and fill in the fields
+ */
+-static int exofs_fill_super(struct super_block *sb, void *data, int silent)
++static int exofs_fill_super(struct super_block *sb,
++ struct exofs_mountopt *opts,
++ struct exofs_sb_info *sbi,
++ int silent)
+ {
+ struct inode *root;
+- struct exofs_mountopt *opts = data;
+- struct exofs_sb_info *sbi; /*extended info */
+ struct osd_dev *od; /* Master device */
+ struct exofs_fscb fscb; /*on-disk superblock info */
+ struct ore_comp comp;
+ unsigned table_count;
+ int ret;
+
+- sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+- if (!sbi)
+- return -ENOMEM;
+-
+ /* use mount options to fill superblock */
+ if (opts->is_osdname) {
+ struct osd_dev_info odi = {.systemid_len = 0};
+@@ -863,7 +860,9 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ int flags, const char *dev_name,
+ void *data)
+ {
++ struct super_block *s;
+ struct exofs_mountopt opts;
++ struct exofs_sb_info *sbi;
+ int ret;
+
+ ret = parse_options(data, &opts);
+@@ -872,9 +871,31 @@ static struct dentry *exofs_mount(struct file_system_type *type,
+ return ERR_PTR(ret);
+ }
+
++ sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
++ if (!sbi) {
++ kfree(opts.dev_name);
++ return ERR_PTR(-ENOMEM);
++ }
++
++ s = sget(type, NULL, set_anon_super, flags, NULL);
++
++ if (IS_ERR(s)) {
++ kfree(opts.dev_name);
++ kfree(sbi);
++ return ERR_CAST(s);
++ }
++
+ if (!opts.dev_name)
+ opts.dev_name = dev_name;
+- return mount_nodev(type, flags, &opts, exofs_fill_super);
++
++
++ ret = exofs_fill_super(s, &opts, sbi, flags & SB_SILENT ? 1 : 0);
++ if (ret) {
++ deactivate_locked_super(s);
++ return ERR_PTR(ret);
++ }
++ s->s_flags |= SB_ACTIVE;
++ return dget(s->s_root);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 360b9a14929b892e13d97ccbd07ca0310eb4f576 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 17:32:23 +0800
+Subject: f2fs: fix block address for __check_sit_bitmap
+
+From: Qiuyang Sun <sunqiuyang@huawei.com>
+
+[ Upstream commit 9249dded7b5cb539a8c8698b25d08a3c15261470 ]
+
+Should use lstart (logical start address) instead of start (in dev) here.
+This fixes a bug in multi-device scenarios.
+
+Signed-off-by: Qiuyang Sun <sunqiuyang@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 43a07514c3574..a807a8d5e38f0 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -1103,7 +1103,7 @@ submit:
+ list_move_tail(&dc->list, wait_list);
+
+ /* sanity check on discard range */
+- __check_sit_bitmap(sbi, start, start + len);
++ __check_sit_bitmap(sbi, lstart, lstart + len);
+
+ bio->bi_private = dc;
+ bio->bi_end_io = f2fs_submit_discard_endio;
+--
+2.20.1
+
--- /dev/null
+From 9db064cac1f087e2f67fcd2b60b33a8047fe4294 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 09:32:25 +0800
+Subject: f2fs: fix to data block override node segment by mistake
+
+From: zhengliang <zhengliang6@huawei.com>
+
+[ Upstream commit a0770e13c8da83bdb64738c0209ab02dd3cfff8b ]
+
+v4: Rearrange the previous three versions.
+
+The following scenario could lead to data block override by mistake.
+
+TASK A | TASK kworker | TASK B | TASK C
+ | | |
+open | | |
+write | | |
+close | | |
+ | f2fs_write_data_pages | |
+ | f2fs_write_cache_pages | |
+ | f2fs_outplace_write_data | |
+ | f2fs_allocate_data_block (get block in seg S, | |
+ | S is full, and only | |
+ | have this valid data | |
+ | block) | |
+ | allocate_segment | |
+ | locate_dirty_segment (mark S as PRE) | |
+ | f2fs_submit_page_write (submit but is not | |
+ | written on dev) | |
+unlink | | |
+ iput_final | | |
+ f2fs_drop_inode | | |
+ f2fs_truncate | | |
+ (not evict) | | |
+ | | write_checkpoint |
+ | | flush merged bio but not wait file data writeback |
+ | | set_prefree_as_free (mark S as FREE) |
+ | | | update NODE/DATA
+ | | | allocate_segment (select S)
+ | writeback done | |
+
+So we need to guarantee io complete before truncate inode in f2fs_drop_inode.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Zheng Liang <zhengliang6@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 7a9cc64f5ca37..b82b7163e0d08 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -890,6 +890,10 @@ static int f2fs_drop_inode(struct inode *inode)
+ sb_start_intwrite(inode->i_sb);
+ f2fs_i_size_write(inode, 0);
+
++ f2fs_submit_merged_write_cond(F2FS_I_SB(inode),
++ inode, NULL, 0, DATA);
++ truncate_inode_pages_final(inode->i_mapping);
++
+ if (F2FS_HAS_BLOCKS(inode))
+ f2fs_truncate(inode);
+
+--
+2.20.1
+
--- /dev/null
+From fd926d9b1cd10982a82a328c03fa7cbb34539979 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 19:20:17 +0800
+Subject: f2fs: fix to dirty inode synchronously
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit b32e019049e959ee10ec359893c9dd5d057dad55 ]
+
+If user change inode's i_flags via ioctl, let's add it into global
+dirty list, so that checkpoint can guarantee its persistence before
+fsync, it can make checkpoint keeping strong consistency.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index c7ea122997695..187bf7e260c99 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1667,7 +1667,7 @@ static int __f2fs_ioc_setflags(struct inode *inode, unsigned int flags)
+
+ inode->i_ctime = current_time(inode);
+ f2fs_set_inode_flags(inode);
+- f2fs_mark_inode_dirty_sync(inode, false);
++ f2fs_mark_inode_dirty_sync(inode, true);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fde617ac066a533e0201d9ccb56bc59ed3fd36d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 19:25:19 +0000
+Subject: firmware: arm_sdei: Fix DT platform device creation
+
+From: James Morse <james.morse@arm.com>
+
+[ Upstream commit acafce48b07bf5f9994a38e7fe237193d43d092e ]
+
+It turns out the dt-probing part of this wasn't tested properly after it
+was merged. commit 3aa0582fdb82 ("of: platform: populate /firmware/ node
+from of_platform_default_populate_init()") changed the core-code to
+generate the platform devices, meaning the driver's attempt fails, and it
+bails out.
+
+Fix this by removing the manual platform-device creation for DT systems,
+core code has always done this for us.
+
+CC: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_sdei.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index dffb47c6b4801..c64c7da738297 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -1009,7 +1009,6 @@ static struct platform_driver sdei_driver = {
+
+ static bool __init sdei_present_dt(void)
+ {
+- struct platform_device *pdev;
+ struct device_node *np, *fw_np;
+
+ fw_np = of_find_node_by_name(NULL, "firmware");
+@@ -1019,11 +1018,7 @@ static bool __init sdei_present_dt(void)
+ np = of_find_matching_node(fw_np, sdei_of_match);
+ if (!np)
+ return false;
+-
+- pdev = of_platform_device_create(np, sdei_driver.driver.name, NULL);
+ of_node_put(np);
+- if (!pdev)
+- return false;
+
+ return true;
+ }
+--
+2.20.1
+
--- /dev/null
+From 98851612b3b5240dcc3acfa3d658834867f7271c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 19:25:18 +0000
+Subject: firmware: arm_sdei: fix wrong of_node_put() in init function
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit c3790b3799f8d75d93d26f6fd7bb569fc8c8b0cb ]
+
+After finding a "firmware" dt node arm_sdei tries to match it's
+compatible string with it. To do so it's calling of_find_matching_node()
+which already takes care of decreasing the refcount on the "firmware"
+node. We are then incorrectly decreasing the refcount on that node
+again.
+
+This patch removes the unwarranted call to of_node_put().
+
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: James Morse <james.morse@arm.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_sdei.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
+index 1ea71640fdc21..dffb47c6b4801 100644
+--- a/drivers/firmware/arm_sdei.c
++++ b/drivers/firmware/arm_sdei.c
+@@ -1017,7 +1017,6 @@ static bool __init sdei_present_dt(void)
+ return false;
+
+ np = of_find_matching_node(fw_np, sdei_of_match);
+- of_node_put(fw_np);
+ if (!np)
+ return false;
+
+--
+2.20.1
+
--- /dev/null
+From 125fab5e951aac0337e47fcbc972eeeb55dffe6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:28:03 -0800
+Subject: fork: fix some -Wmissing-prototypes warnings
+
+From: Yi Wang <wang.yi59@zte.com.cn>
+
+[ Upstream commit fb5bf31722d0805a3f394f7d59f2e8cd07acccb7 ]
+
+We get a warning when building kernel with W=1:
+
+ kernel/fork.c:167:13: warning: no previous prototype for `arch_release_thread_stack' [-Wmissing-prototypes]
+ kernel/fork.c:779:13: warning: no previous prototype for `fork_init' [-Wmissing-prototypes]
+
+Add the missing declaration in head file to fix this.
+
+Also, remove arch_release_thread_stack() completely because no arch
+seems to implement it since bb9d81264 (arch: remove tile port).
+
+Link: http://lkml.kernel.org/r/1542170087-23645-1-git-send-email-wang.yi59@zte.com.cn
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched/task.h | 2 ++
+ init/main.c | 1 -
+ kernel/fork.c | 5 -----
+ 3 files changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
+index 108ede99e5335..44c6f15800ff5 100644
+--- a/include/linux/sched/task.h
++++ b/include/linux/sched/task.h
+@@ -39,6 +39,8 @@ void __noreturn do_task_dead(void);
+
+ extern void proc_caches_init(void);
+
++extern void fork_init(void);
++
+ extern void release_task(struct task_struct * p);
+
+ #ifdef CONFIG_HAVE_COPY_THREAD_TLS
+diff --git a/init/main.c b/init/main.c
+index 020972fed1171..38a603f62b7bb 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -105,7 +105,6 @@
+ static int kernel_init(void *);
+
+ extern void init_IRQ(void);
+-extern void fork_init(void);
+ extern void radix_tree_init(void);
+
+ /*
+diff --git a/kernel/fork.c b/kernel/fork.c
+index aef1430bdce0b..8cb5cd7c97e19 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -163,10 +163,6 @@ static inline void free_task_struct(struct task_struct *tsk)
+ }
+ #endif
+
+-void __weak arch_release_thread_stack(unsigned long *stack)
+-{
+-}
+-
+ #ifndef CONFIG_ARCH_THREAD_STACK_ALLOCATOR
+
+ /*
+@@ -376,7 +372,6 @@ static void release_task_stack(struct task_struct *tsk)
+ return; /* Better to leak the stack than to free prematurely */
+
+ account_kernel_stack(tsk, -1);
+- arch_release_thread_stack(tsk->stack);
+ free_thread_stack(tsk);
+ tsk->stack = NULL;
+ #ifdef CONFIG_VMAP_STACK
+--
+2.20.1
+
--- /dev/null
+From 75b724266aa5a6d8fff278d9934072f7e89ca3d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 15:32:36 +0100
+Subject: geneve: change NET_UDP_TUNNEL dependency to select
+
+From: Matteo Croce <mcroce@redhat.com>
+
+[ Upstream commit a7603ac1fc8ce1409f8ff70e6ce505f308b2c002 ]
+
+Due to the depends on NET_UDP_TUNNEL, at the moment it is impossible to
+compile GENEVE if no other protocol depending on NET_UDP_TUNNEL is
+selected.
+
+Fix this changing the depends to a select, and drop NET_IP_TUNNEL from the
+select list, as it already depends on NET_UDP_TUNNEL.
+
+Signed-off-by: Matteo Croce <mcroce@redhat.com>
+Reviewed-and-tested-by: Andrea Claudi <aclaudi@redhat.com>
+Tested-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/Kconfig | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
+index 619bf1498a662..0652caad57ec1 100644
+--- a/drivers/net/Kconfig
++++ b/drivers/net/Kconfig
+@@ -197,9 +197,9 @@ config VXLAN
+
+ config GENEVE
+ tristate "Generic Network Virtualization Encapsulation"
+- depends on INET && NET_UDP_TUNNEL
++ depends on INET
+ depends on IPV6 || !IPV6
+- select NET_IP_TUNNEL
++ select NET_UDP_TUNNEL
+ select GRO_CELLS
+ ---help---
+ This allows one to create geneve virtual interfaces that provide
+--
+2.20.1
+
--- /dev/null
+From 8e0ee84b63f5979452dd0e249d89209558123b63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 08:29:32 -0600
+Subject: gfs2: take jdata unstuff into account in do_grow
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+[ Upstream commit bc0205612bbd4dd4026d4ba6287f5643c37366ec ]
+
+Before this patch, function do_grow would not reserve enough journal
+blocks in the transaction to unstuff jdata files while growing them.
+This patch adds the logic to add one more block if the file to grow
+is jdata.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Reviewed-by: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/gfs2/bmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c
+index 52feccedd7a44..096b479721395 100644
+--- a/fs/gfs2/bmap.c
++++ b/fs/gfs2/bmap.c
+@@ -2122,6 +2122,8 @@ static int do_grow(struct inode *inode, u64 size)
+ }
+
+ error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT +
++ (unstuff &&
++ gfs2_is_jdata(ip) ? RES_JDATA : 0) +
+ (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF ?
+ 0 : RES_QUOTA), 0);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From e0f8b760d08cc44ee5101d588e7fec79de7f63d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 02:39:50 +0100
+Subject: gpio: pca953x: Fix AI overflow on PCAL6524
+
+From: Marek Vasut <marek.vasut@gmail.com>
+
+[ Upstream commit 92f45ebe68181c2d7f76633ffae55bc9447d62cd ]
+
+The PCAL_PINCTRL_MASK is too large. The extended register block on
+PCAL6524, which is the largest chip with this block, has the block
+limited to address range 0x40..0x7f. This is because the bit 7 in
+the command register is used for the Address Increment functionality.
+
+Trim the mask to 0x60 to match the datasheet and to prevent accidental
+overwrite of the AI bit.
+
+Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pca953x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
+index e0657fc72d31f..0232c25a15864 100644
+--- a/drivers/gpio/gpio-pca953x.c
++++ b/drivers/gpio/gpio-pca953x.c
+@@ -58,7 +58,7 @@
+ #define PCA_GPIO_MASK 0x00FF
+
+ #define PCAL_GPIO_MASK 0x1f
+-#define PCAL_PINCTRL_MASK 0xe0
++#define PCAL_PINCTRL_MASK 0x60
+
+ #define PCA_INT 0x0100
+ #define PCA_PCAL 0x0200
+--
+2.20.1
+
--- /dev/null
+From b56d5b1c37dc0b2b1cb01ec7c94b8c2ef1f46736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 17:50:05 +0100
+Subject: gpio: raspberrypi-exp: decrease refcount on firmware dt node
+
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+
+[ Upstream commit 85af74c474b21940e88483fd48f6094145c89d97 ]
+
+We're getting a reference RPi's firmware node in order to be able to
+communicate with it's driver. We should decrease the reference count on
+the dt node after being done with it.
+
+Fixes: a98d90e7d588 ("gpio: raspberrypi-exp: Driver for RPi3 GPIO expander via mailbox service")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-raspberrypi-exp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpio/gpio-raspberrypi-exp.c b/drivers/gpio/gpio-raspberrypi-exp.c
+index d6d36d537e373..b77ea16ffa031 100644
+--- a/drivers/gpio/gpio-raspberrypi-exp.c
++++ b/drivers/gpio/gpio-raspberrypi-exp.c
+@@ -206,6 +206,7 @@ static int rpi_exp_gpio_probe(struct platform_device *pdev)
+ }
+
+ fw = rpi_firmware_get(fw_node);
++ of_node_put(fw_node);
+ if (!fw)
+ return -EPROBE_DEFER;
+
+--
+2.20.1
+
--- /dev/null
+From d7c5c219e9bf544b08b598c8f82ebca9285166c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 10:45:49 +0100
+Subject: gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit c5510b8dafce5f3f5a039c9b262ebcae0092c462 ]
+
+If CONFIG_GPOILIB is not set, the stub of gpio_to_desc() should return
+the same type of error as regular version: NULL. All the callers
+compare the return value of gpio_to_desc() against NULL, so returned
+ERR_PTR would be treated as non-error case leading to dereferencing of
+error value.
+
+Fixes: 79a9becda894 ("gpiolib: export descriptor-based GPIO interface")
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/gpio/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
+index 412098b24f58b..8dfd8300d9c31 100644
+--- a/include/linux/gpio/consumer.h
++++ b/include/linux/gpio/consumer.h
+@@ -475,7 +475,7 @@ static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
+
+ static inline struct gpio_desc *gpio_to_desc(unsigned gpio)
+ {
+- return ERR_PTR(-EINVAL);
++ return NULL;
+ }
+
+ static inline int desc_to_gpio(const struct gpio_desc *desc)
+--
+2.20.1
+
--- /dev/null
+From 2503ad8acf4eea396bf66663f3b459bc62b99db7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 16:46:29 +0100
+Subject: gpu: ipu-v3: pre: don't trigger update if buffer address doesn't
+ change
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit eb0200a4357da100064971689d3a0e9e3cf57f33 ]
+
+On a NOP double buffer update where current buffer address is the same
+as the next buffer address, the SDW_UPDATE bit clears too late. As we
+are now using this bit to determine when it is safe to signal flip
+completion to userspace this will delay completion of atomic commits
+where one plane doesn't change the buffer by a whole frame period.
+
+Fix this by remembering the last buffer address and just skip the
+double buffer update if it would not change the buffer address.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+[p.zabel@pengutronix.de: initialize last_bufaddr in ipu_pre_configure]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/ipu-v3/ipu-pre.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c
+index 2f8db9d625514..4a28f3fbb0a28 100644
+--- a/drivers/gpu/ipu-v3/ipu-pre.c
++++ b/drivers/gpu/ipu-v3/ipu-pre.c
+@@ -106,6 +106,7 @@ struct ipu_pre {
+ void *buffer_virt;
+ bool in_use;
+ unsigned int safe_window_end;
++ unsigned int last_bufaddr;
+ };
+
+ static DEFINE_MUTEX(ipu_pre_list_mutex);
+@@ -185,6 +186,7 @@ void ipu_pre_configure(struct ipu_pre *pre, unsigned int width,
+
+ writel(bufaddr, pre->regs + IPU_PRE_CUR_BUF);
+ writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++ pre->last_bufaddr = bufaddr;
+
+ val = IPU_PRE_PREF_ENG_CTRL_INPUT_PIXEL_FORMAT(0) |
+ IPU_PRE_PREF_ENG_CTRL_INPUT_ACTIVE_BPP(active_bpp) |
+@@ -242,7 +244,11 @@ void ipu_pre_update(struct ipu_pre *pre, unsigned int bufaddr)
+ unsigned short current_yblock;
+ u32 val;
+
++ if (bufaddr == pre->last_bufaddr)
++ return;
++
+ writel(bufaddr, pre->regs + IPU_PRE_NEXT_BUF);
++ pre->last_bufaddr = bufaddr;
+
+ do {
+ if (time_after(jiffies, timeout)) {
+--
+2.20.1
+
--- /dev/null
+From dfa48b486da441488011669cb970533c03846607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 11:28:51 +1000
+Subject: HID: doc: fix wrong data structure reference for UHID_OUTPUT
+
+From: Peter Hutterer <peter.hutterer@who-t.net>
+
+[ Upstream commit 46b14eef59a8157138dc02f916a7f97c73b3ec53 ]
+
+Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/hid/uhid.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/hid/uhid.txt b/Documentation/hid/uhid.txt
+index c8656dd029a91..958fff9453044 100644
+--- a/Documentation/hid/uhid.txt
++++ b/Documentation/hid/uhid.txt
+@@ -160,7 +160,7 @@ them but you should handle them according to your needs.
+ UHID_OUTPUT:
+ This is sent if the HID device driver wants to send raw data to the I/O
+ device on the interrupt channel. You should read the payload and forward it to
+- the device. The payload is of type "struct uhid_data_req".
++ the device. The payload is of type "struct uhid_output_req".
+ This may be received even though you haven't received UHID_OPEN, yet.
+
+ UHID_GET_REPORT:
+--
+2.20.1
+
--- /dev/null
+From 5ad04712fab2a6c6027116d35bf3808bfbe8b941 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 08:52:33 +0800
+Subject: HID: intel-ish-hid: fixes incorrect error handling
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 6e0856d317440a950b17c00a9283114f025e5699 ]
+
+The memory chunk allocated by hid_allocate_device() should be released
+by hid_destroy_device(), not kfree().
+
+Fixes: 0b28cb4bcb1("HID: intel-ish-hid: ISH HID client driver")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/intel-ish-hid/ishtp-hid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/intel-ish-hid/ishtp-hid.c b/drivers/hid/intel-ish-hid/ishtp-hid.c
+index cd23903ddcf19..e918d78e541c0 100644
+--- a/drivers/hid/intel-ish-hid/ishtp-hid.c
++++ b/drivers/hid/intel-ish-hid/ishtp-hid.c
+@@ -222,7 +222,7 @@ int ishtp_hid_probe(unsigned int cur_hid_dev,
+ err_hid_device:
+ kfree(hid_data);
+ err_hid_data:
+- kfree(hid);
++ hid_destroy_device(hid);
+ return rv;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9816d58d7bbc2e6dfd309917bcfdfeeec3a37eeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 10:05:36 +0300
+Subject: IB/qib: Fix an error code in qib_sdma_verbs_send()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5050ae5fa3d54c8e83e1e447cc7e3591110a7f57 ]
+
+We accidentally return success on this error path.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sdma.c b/drivers/infiniband/hw/qib/qib_sdma.c
+index d0723d4aef5c9..7424e88b0d918 100644
+--- a/drivers/infiniband/hw/qib/qib_sdma.c
++++ b/drivers/infiniband/hw/qib/qib_sdma.c
+@@ -576,8 +576,10 @@ retry:
+ dw = (len + 3) >> 2;
+ addr = dma_map_single(&ppd->dd->pcidev->dev, sge->vaddr,
+ dw << 2, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ppd->dd->pcidev->dev, addr))
++ if (dma_mapping_error(&ppd->dd->pcidev->dev, addr)) {
++ ret = -ENOMEM;
+ goto unmap;
++ }
+ sdmadesc[0] = 0;
+ make_sdma_desc(ppd, sdmadesc, (u64) addr, dw, dwoffset);
+ /* SDmaUseLargeBuf has to be set in every descriptor */
+--
+2.20.1
+
--- /dev/null
+From 5ea5142fd9194614025871d0308ccaec8a6fdef3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 00:32:42 -0600
+Subject: IB/rxe: Make counters thread safe
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit d5108e69fe013ff47ab815b849caba9cc33ca1e5 ]
+
+Current rxe device counters are not thread safe.
+When multiple QPs are used, they can be racy.
+Make them thread safe by making it atomic64.
+
+Fixes: 0b1e5b99a48b ("IB/rxe: Add port protocol stats")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_hw_counters.c | 2 +-
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_hw_counters.c b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+index 6aeb7a165e469..ea4542a9d69e6 100644
+--- a/drivers/infiniband/sw/rxe/rxe_hw_counters.c
++++ b/drivers/infiniband/sw/rxe/rxe_hw_counters.c
+@@ -59,7 +59,7 @@ int rxe_ib_get_hw_stats(struct ib_device *ibdev,
+ return -EINVAL;
+
+ for (cnt = 0; cnt < ARRAY_SIZE(rxe_counter_name); cnt++)
+- stats->value[cnt] = dev->stats_counters[cnt];
++ stats->value[cnt] = atomic64_read(&dev->stats_counters[cnt]);
+
+ return ARRAY_SIZE(rxe_counter_name);
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index a0ec28d2b71a4..6a75f96b90962 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -409,16 +409,16 @@ struct rxe_dev {
+ spinlock_t mmap_offset_lock; /* guard mmap_offset */
+ int mmap_offset;
+
+- u64 stats_counters[RXE_NUM_OF_COUNTERS];
++ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS];
+
+ struct rxe_port port;
+ struct list_head list;
+ struct crypto_shash *tfm;
+ };
+
+-static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters cnt)
++static inline void rxe_counter_inc(struct rxe_dev *rxe, enum rxe_counters index)
+ {
+- rxe->stats_counters[cnt]++;
++ atomic64_inc(&rxe->stats_counters[index]);
+ }
+
+ static inline struct rxe_dev *to_rdev(struct ib_device *dev)
+--
+2.20.1
+
--- /dev/null
+From 8dfdfa50646659cc03c46a6bad20b5c9e11a4d36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 00:25:08 -0400
+Subject: idr: Fix idr_alloc_u32 on 32-bit systems
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit b7e9728f3d7fc5c5c8508d99f1675212af5cfd49 ]
+
+Attempting to allocate an entry at 0xffffffff when one is already
+present would succeed in allocating one at 2^32, which would confuse
+everything. Return -ENOSPC in this case, as expected.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/radix-tree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index bc03ecc4dfd2f..e5cab5c4e3830 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -2172,7 +2172,7 @@ void __rcu **idr_get_free(struct radix_tree_root *root,
+ offset = radix_tree_find_next_bit(node, IDR_FREE,
+ offset + 1);
+ start = next_index(start, node, offset);
+- if (start > max)
++ if (start > max || start == 0)
+ return ERR_PTR(-ENOSPC);
+ while (offset == RADIX_TREE_MAP_SIZE) {
+ offset = node->offset + 1;
+--
+2.20.1
+
--- /dev/null
+From d5f33257b2861b219848f1d7909aac4f26c8cf62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 06:36:43 -0500
+Subject: idr: Fix integer overflow in idr_for_each_entry
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit f6341c5af4e6e15041be39976d16deca789555fa ]
+
+If there is an entry at INT_MAX then idr_for_each_entry() will increment
+id after handling it. This is undefined behaviour, and is caught by
+UBSAN. Adding 1U to id forces the operation to be carried out as an
+unsigned addition which (when assigned to id) will result in INT_MIN.
+Since there is never an entry stored at INT_MIN, idr_get_next() will
+return NULL, ending the loop as expected.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/idr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/idr.h b/include/linux/idr.h
+index 3ec8628ce17f0..b6c6151c7446f 100644
+--- a/include/linux/idr.h
++++ b/include/linux/idr.h
+@@ -185,7 +185,7 @@ static inline void idr_preload_end(void)
+ * is convenient for a "not found" value.
+ */
+ #define idr_for_each_entry(idr, entry, id) \
+- for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id)
++ for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U)
+
+ /**
+ * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.
+--
+2.20.1
+
--- /dev/null
+From 825d5b8f96c18e24cfbe7ddce2de2fbd2bc49d76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 12:56:22 -0600
+Subject: infiniband: bnxt_re: qplib: Check the return value of send_message
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 94edd87a1c59f3efa6fdf4e98d6d492e6cec6173 ]
+
+In bnxt_qplib_map_tc2cos(), bnxt_qplib_rcfw_send_message() can return an
+error value but it is lost. Propagate this error to the callers.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Acked-By: Devesh Sharma <devesh.sharma@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/bnxt_re/qplib_sp.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+index 4097f3fa25c5f..09e7d3dd30553 100644
+--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+@@ -775,9 +775,8 @@ int bnxt_qplib_map_tc2cos(struct bnxt_qplib_res *res, u16 *cids)
+ req.cos0 = cpu_to_le16(cids[0]);
+ req.cos1 = cpu_to_le16(cids[1]);
+
+- bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp, NULL,
+- 0);
+- return 0;
++ return bnxt_qplib_rcfw_send_message(rcfw, (void *)&req, (void *)&resp,
++ NULL, 0);
+ }
+
+ int bnxt_qplib_get_roce_stats(struct bnxt_qplib_rcfw *rcfw,
+--
+2.20.1
+
--- /dev/null
+From 8cd93d4d6849c740ab0ffd722be88e64e772dc90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Dec 2018 12:24:45 -0600
+Subject: infiniband/qedr: Potential null ptr dereference of qp
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 9c6260de505b63638dd86fcc33849b17f6146d94 ]
+
+idr_find() may fail and return a NULL pointer. The fix checks the return
+value of the function and returns an error in case of NULL.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/qedr_iw_cm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+index 505fa36487629..93b16237b7677 100644
+--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+@@ -492,6 +492,8 @@ int qedr_iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ int i;
+
+ qp = idr_find(&dev->qpidr.idr, conn_param->qpn);
++ if (unlikely(!qp))
++ return -EINVAL;
+
+ laddr = (struct sockaddr_in *)&cm_id->m_local_addr;
+ raddr = (struct sockaddr_in *)&cm_id->m_remote_addr;
+--
+2.20.1
+
--- /dev/null
+From 7c59e83f124ed1c15d43d303635d00a5b78affc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Mar 2019 21:53:24 +0800
+Subject: iommu/amd: Fix NULL dereference bug in match_hid_uid
+
+From: Aaron Ma <aaron.ma@canonical.com>
+
+[ Upstream commit bb6bccba390c7d743c1e4427de4ef284c8cc6869 ]
+
+Add a non-NULL check to fix potential NULL pointer dereference
+Cleanup code to call function once.
+
+Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
+Fixes: 2bf9a0a12749b ('iommu/amd: Add iommu support for ACPI HID devices')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 1f2ed44de2438..fe18804a50083 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -139,10 +139,14 @@ static struct lock_class_key reserved_rbtree_key;
+ static inline int match_hid_uid(struct device *dev,
+ struct acpihid_map_entry *entry)
+ {
++ struct acpi_device *adev = ACPI_COMPANION(dev);
+ const char *hid, *uid;
+
+- hid = acpi_device_hid(ACPI_COMPANION(dev));
+- uid = acpi_device_uid(ACPI_COMPANION(dev));
++ if (!adev)
++ return -ENODEV;
++
++ hid = acpi_device_hid(adev);
++ uid = acpi_device_uid(adev);
+
+ if (!hid || !(*hid))
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From 8a3378a691f7cb581045282ff09d080277ea99e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 13:11:25 +0800
+Subject: ip_tunnel: Make none-tunnel-dst tunnel port work with lwtunnel
+
+From: wenxu <wenxu@ucloud.cn>
+
+[ Upstream commit d71b57532d70c03f4671dd04e84157ac6bf021b0 ]
+
+ip l add dev tun type gretap key 1000
+ip a a dev tun 10.0.0.1/24
+
+Packets with tun-id 1000 can be recived by tun dev. But packet can't
+be sent through dev tun for non-tunnel-dst
+
+With this patch: tunnel-dst can be get through lwtunnel like beflow:
+ip r a 10.0.0.7 encap ip dst 172.168.0.11 dev tun
+
+Signed-off-by: wenxu <wenxu@ucloud.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_tunnel.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index c4f5602308edc..054d01c16dc6a 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -644,13 +644,19 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ dst = tnl_params->daddr;
+ if (dst == 0) {
+ /* NBMA tunnel */
++ struct ip_tunnel_info *tun_info;
+
+ if (!skb_dst(skb)) {
+ dev->stats.tx_fifo_errors++;
+ goto tx_error;
+ }
+
+- if (skb->protocol == htons(ETH_P_IP)) {
++ tun_info = skb_tunnel_info(skb);
++ if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX) &&
++ ip_tunnel_info_af(tun_info) == AF_INET &&
++ tun_info->key.u.ipv4.dst)
++ dst = tun_info->key.u.ipv4.dst;
++ else if (skb->protocol == htons(ETH_P_IP)) {
+ rt = skb_rtable(skb);
+ dst = rt_nexthop(rt, inner_iph->daddr);
+ }
+--
+2.20.1
+
--- /dev/null
+From a71efe489f80d62f0150043110da5e10a8097a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 09:23:08 +0300
+Subject: iwlwifi: move iwl_nvm_check_version() into dvm
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit 64866e5da1eabd0c52ff45029b245f5465920031 ]
+
+This function is only half-used by mvm (i.e. only the nvm_version part
+matters, since the calibration version is irrelevant), so it's
+pointless to export it from iwlwifi. If mvm uses this function, it
+has the additional complexity of setting the calib version to a bogus
+value on all cfg structs.
+
+To avoid this, move the function to dvm and make a simple comparison
+of the nvm_version in mvm instead.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/dvm/main.c | 17 +++++++++++++++++
+ .../wireless/intel/iwlwifi/iwl-eeprom-parse.c | 19 -------------------
+ .../wireless/intel/iwlwifi/iwl-eeprom-parse.h | 5 ++---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +++-
+ 4 files changed, 22 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+index 030482b357a3c..06dd4e81b7374 100644
+--- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c
++++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c
+@@ -1227,6 +1227,23 @@ static int iwl_eeprom_init_hw_params(struct iwl_priv *priv)
+ return 0;
+ }
+
++static int iwl_nvm_check_version(struct iwl_nvm_data *data,
++ struct iwl_trans *trans)
++{
++ if (data->nvm_version >= trans->cfg->nvm_ver ||
++ data->calib_version >= trans->cfg->nvm_calib_ver) {
++ IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
++ data->nvm_version, data->calib_version);
++ return 0;
++ }
++
++ IWL_ERR(trans,
++ "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
++ data->nvm_version, trans->cfg->nvm_ver,
++ data->calib_version, trans->cfg->nvm_calib_ver);
++ return -EINVAL;
++}
++
+ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
+ const struct iwl_cfg *cfg,
+ const struct iwl_fw *fw,
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+index a4c96215933ba..a59bab8345f4e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.c
+@@ -928,22 +928,3 @@ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ return NULL;
+ }
+ IWL_EXPORT_SYMBOL(iwl_parse_eeprom_data);
+-
+-/* helper functions */
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+- struct iwl_trans *trans)
+-{
+- if (data->nvm_version >= trans->cfg->nvm_ver ||
+- data->calib_version >= trans->cfg->nvm_calib_ver) {
+- IWL_DEBUG_INFO(trans, "device EEPROM VER=0x%x, CALIB=0x%x\n",
+- data->nvm_version, data->calib_version);
+- return 0;
+- }
+-
+- IWL_ERR(trans,
+- "Unsupported (too old) EEPROM VER=0x%x < 0x%x CALIB=0x%x < 0x%x\n",
+- data->nvm_version, trans->cfg->nvm_ver,
+- data->calib_version, trans->cfg->nvm_calib_ver);
+- return -EINVAL;
+-}
+-IWL_EXPORT_SYMBOL(iwl_nvm_check_version);
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+index 8be50ed12300f..c59dd47cf15d3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-eeprom-parse.h
+@@ -7,6 +7,7 @@
+ *
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -33,6 +34,7 @@
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
++ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -122,9 +124,6 @@ struct iwl_nvm_data *
+ iwl_parse_eeprom_data(struct device *dev, const struct iwl_cfg *cfg,
+ const u8 *eeprom, size_t eeprom_size);
+
+-int iwl_nvm_check_version(struct iwl_nvm_data *data,
+- struct iwl_trans *trans);
+-
+ int iwl_init_sband_channels(struct iwl_nvm_data *data,
+ struct ieee80211_supported_band *sband,
+ int n_channels, enum nl80211_band band);
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 2eba6d6f367f8..9808d954dca29 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -547,7 +547,9 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
+ if (mvm->nvm_file_name)
+ iwl_mvm_load_nvm_to_nic(mvm);
+
+- WARN_ON(iwl_nvm_check_version(mvm->nvm_data, mvm->trans));
++ WARN_ONCE(mvm->nvm_data->nvm_version < mvm->trans->cfg->nvm_ver,
++ "Too old NVM version (0x%0x, required = 0x%0x)",
++ mvm->nvm_data->nvm_version, mvm->trans->cfg->nvm_ver);
+
+ /*
+ * abort after reading the nvm in case RF Kill is on, we will complete
+--
+2.20.1
+
--- /dev/null
+From 5f3d760983b8d42177f8b88c76ec6510845e2370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Aug 2018 12:23:39 +0300
+Subject: iwlwifi: mvm: force TCM re-evaluation on TCM resume
+
+From: Avraham Stern <avraham.stern@intel.com>
+
+[ Upstream commit 7bc2468277033e05401d5f8fd48a772f407338c2 ]
+
+When traffic load is not low or low latency is active, TCM schedules
+re-evaluation work so in case traffic stops TCM will detect that
+traffic load has become low or that low latency is no longer active.
+However, if TCM is paused when the re-evaluation work runs, it does
+not re-evaluate and the re-evaluation work is no longer scheduled.
+As a result, TCM will not indicate that low latency is no longer
+active or that traffic load is low when traffic stops.
+
+Fix this by forcing TCM re-evaluation when TCM is resumed in case
+low latency is active or traffic load is not low.
+
+Signed-off-by: Avraham Stern <avraham.stern@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/utils.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index 6a5349401aa99..00712205c05f2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -1804,6 +1804,7 @@ void iwl_mvm_pause_tcm(struct iwl_mvm *mvm, bool with_cancel)
+ void iwl_mvm_resume_tcm(struct iwl_mvm *mvm)
+ {
+ int mac;
++ bool low_latency = false;
+
+ spin_lock_bh(&mvm->tcm.lock);
+ mvm->tcm.ts = jiffies;
+@@ -1815,10 +1816,23 @@ void iwl_mvm_resume_tcm(struct iwl_mvm *mvm)
+ memset(&mdata->tx.pkts, 0, sizeof(mdata->tx.pkts));
+ memset(&mdata->rx.airtime, 0, sizeof(mdata->rx.airtime));
+ memset(&mdata->tx.airtime, 0, sizeof(mdata->tx.airtime));
++
++ if (mvm->tcm.result.low_latency[mac])
++ low_latency = true;
+ }
+ /* The TCM data needs to be reset before "paused" flag changes */
+ smp_mb();
+ mvm->tcm.paused = false;
++
++ /*
++ * if the current load is not low or low latency is active, force
++ * re-evaluation to cover the case of no traffic.
++ */
++ if (mvm->tcm.result.global_load > IWL_MVM_TRAFFIC_LOW)
++ schedule_delayed_work(&mvm->tcm.work, MVM_TCM_PERIOD);
++ else if (low_latency)
++ schedule_delayed_work(&mvm->tcm.work, MVM_LL_PERIOD);
++
+ spin_unlock_bh(&mvm->tcm.lock);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4cc76dadb8f34fc633e44420eb8289841e6455d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Aug 2018 13:01:09 +0300
+Subject: iwlwifi: pcie: fix erroneous print
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 0916224eaa77bff0fbbc747961d550ff8db45457 ]
+
+When removing the driver, the following flow can happen:
+1. host command is in progress, for example at index 68.
+2. RX interrupt is received with the response.
+3. Before it is processed, the remove flow kicks in, and
+ calls iwl_pcie_txq_unmap. The function cleans all DMA,
+ and promotes the read pointer to 69.
+4. RX thread proceeds with the processing, and is calling
+ iwl_pcie_cmdq_reclaim, which will print this error:
+ iwl_pcie_cmdq_reclaim: Read index for DMA queue txq id (0),
+ index 4 is out of range [0-256] 69 69.
+
+Detect this situation, and avoid the print. Change it to
+warning while at it, to make such issues more noticeable
+in the future.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index 2fec394a988c1..b73582ec03a08 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -1247,11 +1247,11 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
+
+ if (idx >= trans->cfg->base_params->max_tfd_queue_size ||
+ (!iwl_queue_used(txq, idx))) {
+- IWL_ERR(trans,
+- "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
+- __func__, txq_id, idx,
+- trans->cfg->base_params->max_tfd_queue_size,
+- txq->write_ptr, txq->read_ptr);
++ WARN_ONCE(test_bit(txq_id, trans_pcie->queue_used),
++ "%s: Read index for DMA queue txq id (%d), index %d is out of range [0-%d] %d %d.\n",
++ __func__, txq_id, idx,
++ trans->cfg->base_params->max_tfd_queue_size,
++ txq->write_ptr, txq->read_ptr);
+ return;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d54687dd3782d7b47855c115b55d81540cddd1e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Aug 2018 10:07:32 +0300
+Subject: iwlwifi: pcie: set cmd_len in the correct place
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 956343a61226e1af3d146386f70a059feb567d0c ]
+
+command len is set too early in the code, since when building
+AMSDU, the size changes. This causes the byte count table to
+have the wrong size.
+
+Fixes: a0ec0169b7a9 ("iwlwifi: support new tx api")
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 24 +++++++++----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 61ffa1d1a00d7..316e2ba0c34d7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -560,18 +560,6 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+
+ spin_lock(&txq->lock);
+
+- if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
+- struct iwl_tx_cmd_gen3 *tx_cmd_gen3 =
+- (void *)dev_cmd->payload;
+-
+- cmd_len = le16_to_cpu(tx_cmd_gen3->len);
+- } else {
+- struct iwl_tx_cmd_gen2 *tx_cmd_gen2 =
+- (void *)dev_cmd->payload;
+-
+- cmd_len = le16_to_cpu(tx_cmd_gen2->len);
+- }
+-
+ if (iwl_queue_space(trans, txq) < txq->high_mark) {
+ iwl_stop_queue(trans, txq);
+
+@@ -609,6 +597,18 @@ int iwl_trans_pcie_gen2_tx(struct iwl_trans *trans, struct sk_buff *skb,
+ return -1;
+ }
+
++ if (trans->cfg->device_family >= IWL_DEVICE_FAMILY_22560) {
++ struct iwl_tx_cmd_gen3 *tx_cmd_gen3 =
++ (void *)dev_cmd->payload;
++
++ cmd_len = le16_to_cpu(tx_cmd_gen3->len);
++ } else {
++ struct iwl_tx_cmd_gen2 *tx_cmd_gen2 =
++ (void *)dev_cmd->payload;
++
++ cmd_len = le16_to_cpu(tx_cmd_gen2->len);
++ }
++
+ /* Set up entry for this TFD in Tx byte-count array */
+ iwl_pcie_gen2_update_byte_tbl(trans_pcie, txq, cmd_len,
+ iwl_pcie_gen2_get_num_tbs(trans, tfd));
+--
+2.20.1
+
--- /dev/null
+From 46c8231f8e641715c9886672120d9ffe65d87691 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 17:20:55 +0900
+Subject: kprobes: Blacklist symbols in arch-defined prohibited area
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit fb1a59fae8baa3f3c69b72a87ff94fc4fa5683ec ]
+
+Blacklist symbols in arch-defined probe-prohibited areas.
+With this change, user can see all symbols which are prohibited
+to probe in debugfs.
+
+All archtectures which have custom prohibit areas should define
+its own arch_populate_kprobe_blacklist() function, but unless that,
+all symbols marked __kprobes are blacklisted.
+
+Reported-by: Andrea Righi <righi.andrea@gmail.com>
+Tested-by: Andrea Righi <righi.andrea@gmail.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yonghong Song <yhs@fb.com>
+Link: http://lkml.kernel.org/r/154503485491.26176.15823229545155174796.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/kprobes.h | 3 ++
+ kernel/kprobes.c | 67 ++++++++++++++++++++++++++++++++---------
+ 2 files changed, 56 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index 32cae0f35b9d4..9adb92ad24d3f 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -243,10 +243,13 @@ extern int arch_init_kprobes(void);
+ extern void show_registers(struct pt_regs *regs);
+ extern void kprobes_inc_nmissed_count(struct kprobe *p);
+ extern bool arch_within_kprobe_blacklist(unsigned long addr);
++extern int arch_populate_kprobe_blacklist(void);
+ extern bool arch_kprobe_on_func_entry(unsigned long offset);
+ extern bool kprobe_on_func_entry(kprobe_opcode_t *addr, const char *sym, unsigned long offset);
+
+ extern bool within_kprobe_blacklist(unsigned long addr);
++extern int kprobe_add_ksym_blacklist(unsigned long entry);
++extern int kprobe_add_area_blacklist(unsigned long start, unsigned long end);
+
+ struct kprobe_insn_cache {
+ struct mutex mutex;
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index aed90788db5c1..f4e4095ec7eae 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2096,6 +2096,47 @@ void dump_kprobe(struct kprobe *kp)
+ }
+ NOKPROBE_SYMBOL(dump_kprobe);
+
++int kprobe_add_ksym_blacklist(unsigned long entry)
++{
++ struct kprobe_blacklist_entry *ent;
++ unsigned long offset = 0, size = 0;
++
++ if (!kernel_text_address(entry) ||
++ !kallsyms_lookup_size_offset(entry, &size, &offset))
++ return -EINVAL;
++
++ ent = kmalloc(sizeof(*ent), GFP_KERNEL);
++ if (!ent)
++ return -ENOMEM;
++ ent->start_addr = entry;
++ ent->end_addr = entry + size;
++ INIT_LIST_HEAD(&ent->list);
++ list_add_tail(&ent->list, &kprobe_blacklist);
++
++ return (int)size;
++}
++
++/* Add all symbols in given area into kprobe blacklist */
++int kprobe_add_area_blacklist(unsigned long start, unsigned long end)
++{
++ unsigned long entry;
++ int ret = 0;
++
++ for (entry = start; entry < end; entry += ret) {
++ ret = kprobe_add_ksym_blacklist(entry);
++ if (ret < 0)
++ return ret;
++ if (ret == 0) /* In case of alias symbol */
++ ret = 1;
++ }
++ return 0;
++}
++
++int __init __weak arch_populate_kprobe_blacklist(void)
++{
++ return 0;
++}
++
+ /*
+ * Lookup and populate the kprobe_blacklist.
+ *
+@@ -2107,26 +2148,24 @@ NOKPROBE_SYMBOL(dump_kprobe);
+ static int __init populate_kprobe_blacklist(unsigned long *start,
+ unsigned long *end)
+ {
++ unsigned long entry;
+ unsigned long *iter;
+- struct kprobe_blacklist_entry *ent;
+- unsigned long entry, offset = 0, size = 0;
++ int ret;
+
+ for (iter = start; iter < end; iter++) {
+ entry = arch_deref_entry_point((void *)*iter);
+-
+- if (!kernel_text_address(entry) ||
+- !kallsyms_lookup_size_offset(entry, &size, &offset))
++ ret = kprobe_add_ksym_blacklist(entry);
++ if (ret == -EINVAL)
+ continue;
+-
+- ent = kmalloc(sizeof(*ent), GFP_KERNEL);
+- if (!ent)
+- return -ENOMEM;
+- ent->start_addr = entry;
+- ent->end_addr = entry + size;
+- INIT_LIST_HEAD(&ent->list);
+- list_add_tail(&ent->list, &kprobe_blacklist);
++ if (ret < 0)
++ return ret;
+ }
+- return 0;
++
++ /* Symbols in __kprobes_text are blacklisted */
++ ret = kprobe_add_area_blacklist((unsigned long)__kprobes_text_start,
++ (unsigned long)__kprobes_text_end);
++
++ return ret ? : arch_populate_kprobe_blacklist();
+ }
+
+ /* Module notifier call back, checking kprobes on the module */
+--
+2.20.1
+
--- /dev/null
+From ec4c7f31b9b1cf14a98b574cb3f356cc3b53d28c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 17:21:24 +0900
+Subject: kprobes/x86: Show x86-64 specific blacklisted symbols correctly
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit fe6e65615415987629a2dda583b4495677d8c388 ]
+
+Show x86-64 specific blacklisted symbols in debugfs.
+
+Since x86-64 prohibits probing on symbols which are in
+entry text, those should be shown.
+
+Tested-by: Andrea Righi <righi.andrea@gmail.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Yonghong Song <yhs@fb.com>
+Link: http://lkml.kernel.org/r/154503488425.26176.17136784384033608516.stgit@devbox
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kprobes/core.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index e83a057564d1b..173e915e11d54 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -1140,6 +1140,12 @@ bool arch_within_kprobe_blacklist(unsigned long addr)
+ is_in_entry_trampoline_section;
+ }
+
++int __init arch_populate_kprobe_blacklist(void)
++{
++ return kprobe_add_area_blacklist((unsigned long)__entry_text_start,
++ (unsigned long)__entry_text_end);
++}
++
+ int __init arch_init_kprobes(void)
+ {
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From e8f9335250ba29ae75f188b6796f5d9fd126280a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 16:12:57 +0100
+Subject: kprobes/x86/xen: blacklist non-attachable xen interrupt functions
+
+From: Andrea Righi <righi.andrea@gmail.com>
+
+[ Upstream commit bf9445a33ae6ac2f0822d2f1ce1365408387d568 ]
+
+Blacklist symbols in Xen probe-prohibited areas, so that user can see
+these prohibited symbols in debugfs.
+
+See also: a50480cb6d61.
+
+Signed-off-by: Andrea Righi <righi.andrea@gmail.com>
+Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/xen/xen-asm_64.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
+index 3a6feed76dfc1..a93d8a7cef26c 100644
+--- a/arch/x86/xen/xen-asm_64.S
++++ b/arch/x86/xen/xen-asm_64.S
+@@ -12,6 +12,7 @@
+ #include <asm/segment.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/thread_info.h>
++#include <asm/asm.h>
+
+ #include <xen/interface/xen.h>
+
+@@ -24,6 +25,7 @@ ENTRY(xen_\name)
+ pop %r11
+ jmp \name
+ END(xen_\name)
++_ASM_NOKPROBE(xen_\name)
+ .endm
+
+ xen_pv_trap divide_error
+--
+2.20.1
+
--- /dev/null
+From d930caf7b155c0986c2f0719bbe0da3ee1e9d70f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 16:34:37 +0100
+Subject: kvm: properly check debugfs dentry before using it
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+[ Upstream commit 8ed0579c12b2fe56a1fac2f712f58fc26c1dc49b ]
+
+debugfs can now report an error code if something went wrong instead of
+just NULL. So if the return value is to be used as a "real" dentry, it
+needs to be checked if it is an error before dereferencing it.
+
+This is now happening because of ff9fb72bc077 ("debugfs: return error
+values, not NULL"). syzbot has found a way to trigger multiple debugfs
+files attempting to be created, which fails, and then the error code
+gets passed to dentry_path_raw() which obviously does not like it.
+
+Reported-by: Eric Biggers <ebiggers@kernel.org>
+Reported-and-tested-by: syzbot+7857962b4d45e602b8ad@syzkaller.appspotmail.com
+Cc: "Radim Krčmář" <rkrcmar@redhat.com>
+Cc: kvm@vger.kernel.org
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ virt/kvm/kvm_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index df3fc0f214ece..9502b1a44232c 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3990,7 +3990,7 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm)
+ }
+ add_uevent_var(env, "PID=%d", kvm->userspace_pid);
+
+- if (kvm->debugfs_dentry) {
++ if (!IS_ERR_OR_NULL(kvm->debugfs_dentry)) {
+ char *tmp, *p = kmalloc(PATH_MAX, GFP_KERNEL);
+
+ if (p) {
+--
+2.20.1
+
--- /dev/null
+From f2ae51cb976b711f15aad8e0ef08331d969e9046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 15:32:06 +0100
+Subject: KVM: s390: unregister debug feature on failing arch init
+
+From: Michael Mueller <mimu@linux.ibm.com>
+
+[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ]
+
+Make sure the debug feature and its allocated resources get
+released upon unsuccessful architecture initialization.
+
+A related indication of the issue will be reported as kernel
+message.
+
+Signed-off-by: Michael Mueller <mimu@linux.ibm.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Pierre Morel <pmorel@linux.ibm.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 3c317bc6b7997..db3196aebaa1c 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -416,19 +416,30 @@ static void kvm_s390_cpu_feat_init(void)
+
+ int kvm_arch_init(void *opaque)
+ {
++ int rc;
++
+ kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long));
+ if (!kvm_s390_dbf)
+ return -ENOMEM;
+
+ if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) {
+- debug_unregister(kvm_s390_dbf);
+- return -ENOMEM;
++ rc = -ENOMEM;
++ goto out_debug_unreg;
+ }
+
+ kvm_s390_cpu_feat_init();
+
+ /* Register floating interrupt controller interface. */
+- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC);
++ if (rc) {
++ pr_err("Failed to register FLIC rc=%d\n", rc);
++ goto out_debug_unreg;
++ }
++ return 0;
++
++out_debug_unreg:
++ debug_unregister(kvm_s390_dbf);
++ return rc;
+ }
+
+ void kvm_arch_exit(void)
+--
+2.20.1
+
--- /dev/null
+From 5095098fd6e2cdb8167bb12c6e69297c304b860c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 15:28:58 -0800
+Subject: kvm: vmx: Set IA32_TSC_AUX for legacy mode guests
+
+From: Jim Mattson <jmattson@google.com>
+
+[ Upstream commit 0023ef39dc35c773c436eaa46ca539a26b308b55 ]
+
+RDTSCP is supported in legacy mode as well as long mode. The
+IA32_TSC_AUX MSR should be set to the correct guest value before
+entering any guest that supports RDTSCP.
+
+Fixes: 4e47c7a6d714 ("KVM: VMX: Add instruction rdtscp support for guest")
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Peter Shier <pshier@google.com>
+Reviewed-by: Marc Orr <marcorr@google.com>
+Reviewed-by: Liran Alon <liran.alon@oracle.com>
+Reviewed-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kvm/vmx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 0b7559bf15ea7..38293386db875 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3404,9 +3404,6 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ index = __find_msr_index(vmx, MSR_CSTAR);
+ if (index >= 0)
+ move_msr_up(vmx, index, save_nmsrs++);
+- index = __find_msr_index(vmx, MSR_TSC_AUX);
+- if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
+- move_msr_up(vmx, index, save_nmsrs++);
+ /*
+ * MSR_STAR is only needed on long mode guests, and only
+ * if efer.sce is enabled.
+@@ -3419,6 +3416,9 @@ static void setup_msrs(struct vcpu_vmx *vmx)
+ index = __find_msr_index(vmx, MSR_EFER);
+ if (index >= 0 && update_transition_efer(vmx, index))
+ move_msr_up(vmx, index, save_nmsrs++);
++ index = __find_msr_index(vmx, MSR_TSC_AUX);
++ if (index >= 0 && guest_cpuid_has(&vmx->vcpu, X86_FEATURE_RDTSCP))
++ move_msr_up(vmx, index, save_nmsrs++);
+
+ vmx->save_nmsrs = save_nmsrs;
+ vmx->guest_msrs_dirty = true;
+--
+2.20.1
+
--- /dev/null
+From ade05847ef0a972099d9829747ea57b3dd354f7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:44 -0800
+Subject: lib/genalloc.c: fix allocation of aligned buffer from non-aligned
+ chunk
+
+From: Alexey Skidanov <alexey.skidanov@intel.com>
+
+[ Upstream commit 52fbf1134d479234d7e64ba9dcbaea23405f229e ]
+
+gen_pool_alloc_algo() uses different allocation functions implementing
+different allocation algorithms. With gen_pool_first_fit_align()
+allocation function, the returned address should be aligned on the
+requested boundary.
+
+If chunk start address isn't aligned on the requested boundary, the
+returned address isn't aligned too. The only way to get properly
+aligned address is to initialize the pool with chunks aligned on the
+requested boundary. If want to have an ability to allocate buffers
+aligned on different boundaries (for example, 4K, 1MB, ...), the chunk
+start address should be aligned on the max possible alignment.
+
+This happens because gen_pool_first_fit_align() looks for properly
+aligned memory block without taking into account the chunk start address
+alignment.
+
+To fix this, we provide chunk start address to
+gen_pool_first_fit_align() and change its implementation such that it
+starts looking for properly aligned block with appropriate offset
+(exactly as is done in CMA).
+
+Link: https://lkml.kernel.org/lkml/a170cf65-6884-3592-1de9-4c235888cc8a@intel.com
+Link: http://lkml.kernel.org/r/1541690953-4623-1-git-send-email-alexey.skidanov@intel.com
+Signed-off-by: Alexey Skidanov <alexey.skidanov@intel.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Logan Gunthorpe <logang@deltatee.com>
+Cc: Daniel Mentz <danielmentz@google.com>
+Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Cc: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/genalloc.h | 13 +++++++------
+ lib/genalloc.c | 20 ++++++++++++--------
+ 2 files changed, 19 insertions(+), 14 deletions(-)
+
+diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h
+index 872f930f1b06d..dd0a452373e71 100644
+--- a/include/linux/genalloc.h
++++ b/include/linux/genalloc.h
+@@ -51,7 +51,8 @@ typedef unsigned long (*genpool_algo_t)(unsigned long *map,
+ unsigned long size,
+ unsigned long start,
+ unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool,
++ unsigned long start_addr);
+
+ /*
+ * General purpose special memory pool descriptor.
+@@ -131,24 +132,24 @@ extern void gen_pool_set_algo(struct gen_pool *pool, genpool_algo_t algo,
+
+ extern unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_fixed_alloc(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_first_fit_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start, unsigned int nr,
+- void *data, struct gen_pool *pool);
++ void *data, struct gen_pool *pool, unsigned long start_addr);
+
+ extern unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool);
++ struct gen_pool *pool, unsigned long start_addr);
+
+
+ extern struct gen_pool *devm_gen_pool_create(struct device *dev,
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index ca06adc4f4451..5deb25c40a5a1 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -311,7 +311,7 @@ unsigned long gen_pool_alloc_algo(struct gen_pool *pool, size_t size,
+ end_bit = chunk_size(chunk) >> order;
+ retry:
+ start_bit = algo(chunk->bits, end_bit, start_bit,
+- nbits, data, pool);
++ nbits, data, pool, chunk->start_addr);
+ if (start_bit >= end_bit)
+ continue;
+ remain = bitmap_set_ll(chunk->bits, start_bit, nbits);
+@@ -525,7 +525,7 @@ EXPORT_SYMBOL(gen_pool_set_algo);
+ */
+ unsigned long gen_pool_first_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ return bitmap_find_next_zero_area(map, size, start, nr, 0);
+ }
+@@ -543,16 +543,19 @@ EXPORT_SYMBOL(gen_pool_first_fit);
+ */
+ unsigned long gen_pool_first_fit_align(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_align *alignment;
+- unsigned long align_mask;
++ unsigned long align_mask, align_off;
+ int order;
+
+ alignment = data;
+ order = pool->min_alloc_order;
+ align_mask = ((alignment->align + (1UL << order) - 1) >> order) - 1;
+- return bitmap_find_next_zero_area(map, size, start, nr, align_mask);
++ align_off = (start_addr & (alignment->align - 1)) >> order;
++
++ return bitmap_find_next_zero_area_off(map, size, start, nr,
++ align_mask, align_off);
+ }
+ EXPORT_SYMBOL(gen_pool_first_fit_align);
+
+@@ -567,7 +570,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_align);
+ */
+ unsigned long gen_pool_fixed_alloc(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ struct genpool_data_fixed *fixed_data;
+ int order;
+@@ -601,7 +604,8 @@ EXPORT_SYMBOL(gen_pool_fixed_alloc);
+ */
+ unsigned long gen_pool_first_fit_order_align(unsigned long *map,
+ unsigned long size, unsigned long start,
+- unsigned int nr, void *data, struct gen_pool *pool)
++ unsigned int nr, void *data, struct gen_pool *pool,
++ unsigned long start_addr)
+ {
+ unsigned long align_mask = roundup_pow_of_two(nr) - 1;
+
+@@ -624,7 +628,7 @@ EXPORT_SYMBOL(gen_pool_first_fit_order_align);
+ */
+ unsigned long gen_pool_best_fit(unsigned long *map, unsigned long size,
+ unsigned long start, unsigned int nr, void *data,
+- struct gen_pool *pool)
++ struct gen_pool *pool, unsigned long start_addr)
+ {
+ unsigned long start_bit = size;
+ unsigned long len = size + 1;
+--
+2.20.1
+
--- /dev/null
+From 6abdc67f78c2246c6f3bf4c85b58716a9431cd7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 13:21:18 -0800
+Subject: lib/genalloc.c: include vmalloc.h
+
+From: Olof Johansson <olof@lixom.net>
+
+[ Upstream commit 35004f2e55807a1a1491db24ab512dd2f770a130 ]
+
+Fixes build break on most ARM/ARM64 defconfigs:
+
+ lib/genalloc.c: In function 'gen_pool_add_virt':
+ lib/genalloc.c:190:10: error: implicit declaration of function 'vzalloc_node'; did you mean 'kzalloc_node'?
+ lib/genalloc.c:190:8: warning: assignment to 'struct gen_pool_chunk *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
+ lib/genalloc.c: In function 'gen_pool_destroy':
+ lib/genalloc.c:254:3: error: implicit declaration of function 'vfree'; did you mean 'kfree'?
+
+Fixes: 6862d2fc8185 ('lib/genalloc.c: use vzalloc_node() to allocate the bitmap')
+Cc: Huang Shijie <sjhuang@iluvatar.ai>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index f365d71cdc774..7e85d1e37a6ea 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -35,6 +35,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/genalloc.h>
+ #include <linux/of_device.h>
++#include <linux/vmalloc.h>
+
+ static inline size_t chunk_size(const struct gen_pool_chunk *chunk)
+ {
+--
+2.20.1
+
--- /dev/null
+From f34ab42c1639dc51c77157151d224ca83a5cf93f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Jan 2019 15:26:51 -0800
+Subject: lib/genalloc.c: use vzalloc_node() to allocate the bitmap
+
+From: Huang Shijie <sjhuang@iluvatar.ai>
+
+[ Upstream commit 6862d2fc81859f88c1f3f660886427893f2b4f3f ]
+
+Some devices may have big memory on chip, such as over 1G. In some
+cases, the nbytes maybe bigger then 4M which is the bounday of the
+memory buddy system (4K default).
+
+So use vzalloc_node() to allocate the bitmap. Also use vfree to free
+it.
+
+Link: http://lkml.kernel.org/r/20181225015701.6289-1-sjhuang@iluvatar.ai
+Signed-off-by: Huang Shijie <sjhuang@iluvatar.ai>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Alexey Skidanov <alexey.skidanov@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/genalloc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/genalloc.c b/lib/genalloc.c
+index 5deb25c40a5a1..f365d71cdc774 100644
+--- a/lib/genalloc.c
++++ b/lib/genalloc.c
+@@ -187,7 +187,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy
+ int nbytes = sizeof(struct gen_pool_chunk) +
+ BITS_TO_LONGS(nbits) * sizeof(long);
+
+- chunk = kzalloc_node(nbytes, GFP_KERNEL, nid);
++ chunk = vzalloc_node(nbytes, nid);
+ if (unlikely(chunk == NULL))
+ return -ENOMEM;
+
+@@ -251,7 +251,7 @@ void gen_pool_destroy(struct gen_pool *pool)
+ bit = find_next_bit(chunk->bits, end_bit, 0);
+ BUG_ON(bit < end_bit);
+
+- kfree(chunk);
++ vfree(chunk);
+ }
+ kfree_const(pool->name);
+ kfree(pool);
+--
+2.20.1
+
--- /dev/null
+From e8f5171dd917f1789c237050c538ffa7fb7dfa3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 06:12:43 -0600
+Subject: mac80211: fix station inactive_time shortly after boot
+
+From: Ahmed Zaki <anzaki@gmail.com>
+
+[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ]
+
+In the first 5 minutes after boot (time of INITIAL_JIFFIES),
+ieee80211_sta_last_active() returns zero if last_ack is zero. This
+leads to "inactive time" showing jiffies_to_msecs(jiffies).
+
+ # iw wlan0 station get fc:ec:da:64:a6:dd
+ Station fc:ec:da:64:a6:dd (on wlan0)
+ inactive time: 4294894049 ms
+ .
+ .
+ connected time: 70 seconds
+
+Fix by returning last_rx if last_ack == 0.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index f34202242d24d..507409e3fd39c 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2356,7 +2356,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ {
+ struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
+
+- if (time_after(stats->last_rx, sta->status_stats.last_ack))
++ if (!sta->status_stats.last_ack ||
++ time_after(stats->last_rx, sta->status_stats.last_ack))
+ return stats->last_rx;
+ return sta->status_stats.last_ack;
+ }
+--
+2.20.1
+
--- /dev/null
+From 8455d20bc1d1edd288f680c270f399493eb0760a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 14:11:08 +0100
+Subject: memory: omap-gpmc: Get the header of the enum
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit a0752e9c3097b2c4fccd618802938e0951038dfa ]
+
+Commit 21abf103818a
+("gpio: Pass a flag to gpiochip_request_own_desc()")
+started to pass an enum gpiod_flags but this file is
+not including the header file that defines that enum
+and the compiler spits:
+
+drivers/memory/omap-gpmc.c: In function
+ 'gpmc_probe_generic_child':
+drivers/memory/omap-gpmc.c:2174:9: error: type of formal
+ parameter 4 is incomplete
+ 0);
+ ^
+
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Fixes: 21abf103818a ("gpio: Pass a flag to gpiochip_request_own_desc()")
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/memory/omap-gpmc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
+index c215287e80cf3..1c6a7c16e0c17 100644
+--- a/drivers/memory/omap-gpmc.c
++++ b/drivers/memory/omap-gpmc.c
+@@ -21,6 +21,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/io.h>
+ #include <linux/gpio/driver.h>
++#include <linux/gpio/consumer.h> /* GPIO descriptor enum */
+ #include <linux/interrupt.h>
+ #include <linux/irqdomain.h>
+ #include <linux/platform_device.h>
+--
+2.20.1
+
--- /dev/null
+From f971a4744a14f118093a113dbc0d14cd2b43f98c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:52 +0900
+Subject: microblaze: adjust the help to the real behavior
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit bafcc61d998c1ca18f556d92a0e95335ac68c7da ]
+
+"make ARCH=microblaze help" mentions simpleImage.<dt>.unstrip,
+but it is not a real Make target. It does not work because Makefile
+assumes "system.unstrip" is the name of DT.
+
+$ make ARCH=microblaze CROSS_COMPILE=microblaze-linux- simpleImage.system.unstrip
+ [ snip ]
+make[1]: *** No rule to make target 'arch/microblaze/boot/dts/system.unstrip.dtb', needed by 'arch/microblaze/boot/dts/system.dtb'. Stop.
+make: *** [Makefile;1060: arch/microblaze/boot/dts] Error 2
+make: *** Waiting for unfinished jobs....
+
+simpleImage.<dt> works like a phony target that generates multiple
+images. Reflect the real behavior. I removed the DT directory path
+information because it is already explained a few lines below.
+
+While I am here, I deleted the redundant *_defconfig explanation.
+
+The top-level Makefile caters to list available defconfig files:
+
+ mmu_defconfig - Build for mmu
+ nommu_defconfig - Build for nommu
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index 4f3ab57072652..eecf37276521c 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -91,11 +91,11 @@ define archhelp
+ echo '* linux.bin - Create raw binary'
+ echo ' linux.bin.gz - Create compressed raw binary'
+ echo ' linux.bin.ub - Create U-Boot wrapped raw binary'
+- echo ' simpleImage.<dt> - ELF image with $(arch)/boot/dts/<dt>.dts linked in'
+- echo ' - stripped elf with fdt blob'
+- echo ' simpleImage.<dt>.unstrip - full ELF image with fdt blob'
+- echo ' *_defconfig - Select default config from arch/microblaze/configs'
+- echo ''
++ echo ' simpleImage.<dt> - Create the following images with <dt>.dtb linked in'
++ echo ' simpleImage.<dt> : raw image'
++ echo ' simpleImage.<dt>.ub : raw image with U-Boot header'
++ echo ' simpleImage.<dt>.unstrip: ELF (identical to vmlinux)'
++ echo ' simpleImage.<dt>.strip : stripped ELF'
+ echo ' Targets with <dt> embed a device tree blob inside the image'
+ echo ' These targets support board with firmware that does not'
+ echo ' support passing a device tree directly. Replace <dt> with the'
+--
+2.20.1
+
--- /dev/null
+From 9c38dc523437413faa25c3415b5c7fd4e85fd406 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:54 +0900
+Subject: microblaze: fix multiple bugs in arch/microblaze/boot/Makefile
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 4722a3e6b716d9d4594c3cf3856b03bbd24a59a8 ]
+
+This commit fixes some build issues.
+
+The first issue is the breakage of linux.bin.ub target since commit
+ece97f3a5fb5 ("microblaze: Fix simpleImage format generation")
+because the addition of UIMAGE_{IN,OUT} affected it.
+
+make ARCH=microblaze CROSS_COMPILE=microblaze-linux- linux.bin.ub
+ [ snip ]
+ OBJCOPY arch/microblaze/boot/linux.bin
+ UIMAGE arch/microblaze/boot/linux.bin.ub.ub
+/usr/bin/mkimage: Can't open arch/microblaze/boot/linux.bin.ub: No such file or directory
+make[1]: *** [arch/microblaze/boot/Makefile;14: arch/microblaze/boot/linux.bin.ub] Error 1
+make: *** [arch/microblaze/Makefile;83: linux.bin.ub] Error 2
+
+The second issue is the use of the "if_changed" multiple times for
+the same target.
+
+As commit 92a4728608a8 ("x86/boot: Fix if_changed build flip/flop bug")
+pointed out, this never works properly. Moreover, generating multiple
+images as a side-effect is confusing.
+
+Let's split the build recipe for each image.
+
+simpleImage.<dt>*.unstrip is just a copy of vmlinux.
+
+simpleImage.<dt> and simpleImage.<dt>.ub are created in the same way
+as linux.bin and linux.bin.ub, respectively.
+
+I kept simpleImage.* recipes independent of linux.bin.* ones to not
+change the behavior.
+
+Lastly, this commit fixes "make ARCH=microblaze clean". Previously,
+it only cleaned up the unstrip image. Now, all the simpleImage files
+are cleaned.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 2 +-
+ arch/microblaze/boot/Makefile | 19 +++++++++----------
+ 2 files changed, 10 insertions(+), 11 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index b9808ddaf985f..548bac6c60f8c 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -86,7 +86,7 @@ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ simpleImage.%: vmlinux
+- $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ $(Q)$(MAKE) $(build)=$(boot) $(addprefix $(boot)/$@., ub unstrip strip)
+ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ define archhelp
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 96eefdca0d9b3..cff570a719461 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -3,7 +3,7 @@
+ # arch/microblaze/boot/Makefile
+ #
+
+-targets := linux.bin linux.bin.gz linux.bin.ub simpleImage.%
++targets := linux.bin linux.bin.gz linux.bin.ub simpleImage.*
+
+ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+
+@@ -16,21 +16,20 @@ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ $(call if_changed,gzip)
+
+-quiet_cmd_cp = CP $< $@$2
+- cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+-
+ quiet_cmd_strip = STRIP $< $@$2
+ cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \
+ -K _fdt_start $< -o $@$2
+
+ UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR)
+-UIMAGE_IN = $@
+-UIMAGE_OUT = $@.ub
+
+-$(obj)/simpleImage.%: vmlinux FORCE
+- $(call if_changed,cp,.unstrip)
++$(obj)/simpleImage.$(DTB): vmlinux FORCE
+ $(call if_changed,objcopy)
++
++$(obj)/simpleImage.$(DTB).ub: $(obj)/simpleImage.$(DTB) FORCE
+ $(call if_changed,uimage)
+- $(call if_changed,strip,.strip)
+
+-clean-files += simpleImage.*.unstrip linux.bin.ub
++$(obj)/simpleImage.$(DTB).unstrip: vmlinux FORCE
++ $(call if_changed,shipped)
++
++$(obj)/simpleImage.$(DTB).strip: vmlinux FORCE
++ $(call if_changed,strip)
+--
+2.20.1
+
--- /dev/null
+From fa7a09992ee94bec7768689dead408e7baa4593a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 20:33:53 +0900
+Subject: microblaze: move "... is ready" messages to arch/microblaze/Makefile
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit 2e14f94cf4bc2f15ca5362e81ca3a987c79e3062 ]
+
+To prepare for more fixes, move this to arch/microblaze/Makefile.
+Otherwise, the same "... is ready" would be printed multiple times.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/Makefile | 2 ++
+ arch/microblaze/boot/Makefile | 4 ----
+ 2 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile
+index eecf37276521c..b9808ddaf985f 100644
+--- a/arch/microblaze/Makefile
++++ b/arch/microblaze/Makefile
+@@ -83,9 +83,11 @@ archclean:
+
+ linux.bin linux.bin.gz linux.bin.ub: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ simpleImage.%: vmlinux
+ $(Q)$(MAKE) $(build)=$(boot) $(boot)/$@
++ @echo 'Kernel: $(boot)/$@ is ready' ' (#'`cat .version`')'
+
+ define archhelp
+ echo '* linux.bin - Create raw binary'
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 600e5a198bd2a..96eefdca0d9b3 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -9,15 +9,12 @@ OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+
+ $(obj)/linux.bin: vmlinux FORCE
+ $(call if_changed,objcopy)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.ub: $(obj)/linux.bin FORCE
+ $(call if_changed,uimage)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE
+ $(call if_changed,gzip)
+- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')'
+
+ quiet_cmd_cp = CP $< $@$2
+ cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
+@@ -35,6 +32,5 @@ $(obj)/simpleImage.%: vmlinux FORCE
+ $(call if_changed,objcopy)
+ $(call if_changed,uimage)
+ $(call if_changed,strip,.strip)
+- @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')'
+
+ clean-files += simpleImage.*.unstrip linux.bin.ub
+--
+2.20.1
+
--- /dev/null
+From 52d1bd966cdc025e1d10926f75a807ed89537382 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 14:20:51 -0800
+Subject: mm/hotplug: invalid PFNs from pfn_to_online_page()
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit b13bc35193d9e7a8c050a24928ca5c9e7c9a009b ]
+
+On an arm64 ThunderX2 server, the first kmemleak scan would crash [1]
+with CONFIG_DEBUG_VM_PGFLAGS=y due to page_to_nid() found a pfn that is
+not directly mapped (MEMBLOCK_NOMAP). Hence, the page->flags is
+uninitialized.
+
+This is due to the commit 9f1eb38e0e11 ("mm, kmemleak: little
+optimization while scanning") starts to use pfn_to_online_page() instead
+of pfn_valid(). However, in the CONFIG_MEMORY_HOTPLUG=y case,
+pfn_to_online_page() does not call memblock_is_map_memory() while
+pfn_valid() does.
+
+Historically, the commit 68709f45385a ("arm64: only consider memblocks
+with NOMAP cleared for linear mapping") causes pages marked as nomap
+being no long reassigned to the new zone in memmap_init_zone() by
+calling __init_single_page().
+
+Since the commit 2d070eab2e82 ("mm: consider zone which is not fully
+populated to have holes") introduced pfn_to_online_page() and was
+designed to return a valid pfn only, but it is clearly broken on arm64.
+
+Therefore, let pfn_to_online_page() call pfn_valid_within(), so it can
+handle nomap thanks to the commit f52bb98f5ade ("arm64: mm: always
+enable CONFIG_HOLES_IN_ZONE"), while it will be optimized away on
+architectures where have no HOLES_IN_ZONE.
+
+[1]
+ Unable to handle kernel NULL pointer dereference at virtual address 0000000000000006
+ Mem abort info:
+ ESR = 0x96000005
+ Exception class = DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ Data abort info:
+ ISV = 0, ISS = 0x00000005
+ CM = 0, WnR = 0
+ Internal error: Oops: 96000005 [#1] SMP
+ CPU: 60 PID: 1408 Comm: kmemleak Not tainted 5.0.0-rc2+ #8
+ pstate: 60400009 (nZCv daif +PAN -UAO)
+ pc : page_mapping+0x24/0x144
+ lr : __dump_page+0x34/0x3dc
+ sp : ffff00003a5cfd10
+ x29: ffff00003a5cfd10 x28: 000000000000802f
+ x27: 0000000000000000 x26: 0000000000277d00
+ x25: ffff000010791f56 x24: ffff7fe000000000
+ x23: ffff000010772f8b x22: ffff00001125f670
+ x21: ffff000011311000 x20: ffff000010772f8b
+ x19: fffffffffffffffe x18: 0000000000000000
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: 0000000000000000 x14: ffff802698b19600
+ x13: ffff802698b1a200 x12: ffff802698b16f00
+ x11: ffff802698b1a400 x10: 0000000000001400
+ x9 : 0000000000000001 x8 : ffff00001121a000
+ x7 : 0000000000000000 x6 : ffff0000102c53b8
+ x5 : 0000000000000000 x4 : 0000000000000003
+ x3 : 0000000000000100 x2 : 0000000000000000
+ x1 : ffff000010772f8b x0 : ffffffffffffffff
+ Process kmemleak (pid: 1408, stack limit = 0x(____ptrval____))
+ Call trace:
+ page_mapping+0x24/0x144
+ __dump_page+0x34/0x3dc
+ dump_page+0x28/0x4c
+ kmemleak_scan+0x4ac/0x680
+ kmemleak_scan_thread+0xb4/0xdc
+ kthread+0x12c/0x13c
+ ret_from_fork+0x10/0x18
+ Code: d503201f f9400660 36000040 d1000413 (f9400661)
+ ---[ end trace 4d4bd7f573490c8e ]---
+ Kernel panic - not syncing: Fatal exception
+ SMP: stopping secondary CPUs
+ Kernel Offset: disabled
+ CPU features: 0x002,20000c38
+ Memory Limit: none
+ ---[ end Kernel panic - not syncing: Fatal exception ]---
+
+Link: http://lkml.kernel.org/r/20190122132916.28360-1-cai@lca.pw
+Fixes: 9f1eb38e0e11 ("mm, kmemleak: little optimization while scanning")
+Signed-off-by: Qian Cai <cai@lca.pw>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Oscar Salvador <osalvador@suse.de>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/memory_hotplug.h | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 16487052017d5..4915e6cd7fd56 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -21,14 +21,16 @@ struct vmem_altmap;
+ * walkers which rely on the fully initialized page->flags and others
+ * should use this rather than pfn_valid && pfn_to_page
+ */
+-#define pfn_to_online_page(pfn) \
+-({ \
+- struct page *___page = NULL; \
+- unsigned long ___nr = pfn_to_section_nr(pfn); \
+- \
+- if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr))\
+- ___page = pfn_to_page(pfn); \
+- ___page; \
++#define pfn_to_online_page(pfn) \
++({ \
++ struct page *___page = NULL; \
++ unsigned long ___pfn = pfn; \
++ unsigned long ___nr = pfn_to_section_nr(___pfn); \
++ \
++ if (___nr < NR_MEM_SECTIONS && online_section_nr(___nr) && \
++ pfn_valid_within(___pfn)) \
++ ___page = pfn_to_page(___pfn); \
++ ___page; \
+ })
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 8bf842de6a0da9390dd23a5eb37b783de66c8bbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:35:26 -0800
+Subject: mm/page_alloc.c: deduplicate __memblock_free_early() and
+ memblock_free()
+
+From: Wentao Wang <witallwang@gmail.com>
+
+[ Upstream commit d31cfe7bff9109476da92c245b56083e9b48d60a ]
+
+Link: http://lkml.kernel.org/r/C8ECE1B7A767434691FEEFA3A01765D72AFB8E78@MX203CL03.corp.emc.com
+Signed-off-by: Wentao Wang <witallwang@gmail.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/memblock.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/mm/memblock.c b/mm/memblock.c
+index 237944479d25a..bb4e32c6b19e9 100644
+--- a/mm/memblock.c
++++ b/mm/memblock.c
+@@ -1537,12 +1537,7 @@ void * __init memblock_virt_alloc_try_nid(
+ */
+ void __init __memblock_free_early(phys_addr_t base, phys_addr_t size)
+ {
+- phys_addr_t end = base + size - 1;
+-
+- memblock_dbg("%s: [%pa-%pa] %pF\n",
+- __func__, &base, &end, (void *)_RET_IP_);
+- kmemleak_free_part_phys(base, size);
+- memblock_remove_range(&memblock.reserved, base, size);
++ memblock_free(base, size);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 1bcaca6e448f0f04378a13c92b053e4640376b7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:35:18 -0800
+Subject: mm/page_alloc.c: free order-0 pages through PCP in page_frag_free()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+[ Upstream commit 65895b67ad27df0f62bfaf82dd5622f95ea29196 ]
+
+page_frag_free() calls __free_pages_ok() to free the page back to Buddy.
+This is OK for high order page, but for order-0 pages, it misses the
+optimization opportunity of using Per-Cpu-Pages and can cause zone lock
+contention when called frequently.
+
+Pawel Staszewski recently shared his result of 'how Linux kernel handles
+normal traffic'[1] and from perf data, Jesper Dangaard Brouer found the
+lock contention comes from page allocator:
+
+ mlx5e_poll_tx_cq
+ |
+ --16.34%--napi_consume_skb
+ |
+ |--12.65%--__free_pages_ok
+ | |
+ | --11.86%--free_one_page
+ | |
+ | |--10.10%--queued_spin_lock_slowpath
+ | |
+ | --0.65%--_raw_spin_lock
+ |
+ |--1.55%--page_frag_free
+ |
+ --1.44%--skb_release_data
+
+Jesper explained how it happened: mlx5 driver RX-page recycle mechanism is
+not effective in this workload and pages have to go through the page
+allocator. The lock contention happens during mlx5 DMA TX completion
+cycle. And the page allocator cannot keep up at these speeds.[2]
+
+I thought that __free_pages_ok() are mostly freeing high order pages and
+thought this is an lock contention for high order pages but Jesper
+explained in detail that __free_pages_ok() here are actually freeing
+order-0 pages because mlx5 is using order-0 pages to satisfy its page pool
+allocation request.[3]
+
+The free path as pointed out by Jesper is:
+skb_free_head()
+ -> skb_free_frag()
+ -> page_frag_free()
+And the pages being freed on this path are order-0 pages.
+
+Fix this by doing similar things as in __page_frag_cache_drain() - send
+the being freed page to PCP if it's an order-0 page, or directly to Buddy
+if it is a high order page.
+
+With this change, Paweł hasn't noticed lock contention yet in his
+workload and Jesper has noticed a 7% performance improvement using a micro
+benchmark and lock contention is gone. Ilias' test on a 'low' speed 1Gbit
+interface on an cortex-a53 shows ~11% performance boost testing with
+64byte packets and __free_pages_ok() disappeared from perf top.
+
+[1]: https://www.spinics.net/lists/netdev/msg531362.html
+[2]: https://www.spinics.net/lists/netdev/msg531421.html
+[3]: https://www.spinics.net/lists/netdev/msg531556.html
+
+[akpm@linux-foundation.org: add comment]
+Link: http://lkml.kernel.org/r/20181120014544.GB10657@intel.com
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Reported-by: Pawel Staszewski <pstaszewski@itcare.pl>
+Analysed-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Acked-by: Mel Gorman <mgorman@techsingularity.net>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Tested-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Acked-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Acked-by: Tariq Toukan <tariqt@mellanox.com>
+Acked-by: Pankaj gupta <pagupta@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page_alloc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index b34348a41bfed..dcc46d955df2e 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4581,8 +4581,14 @@ void page_frag_free(void *addr)
+ {
+ struct page *page = virt_to_head_page(addr);
+
+- if (unlikely(put_page_testzero(page)))
+- __free_pages_ok(page, compound_order(page));
++ if (unlikely(put_page_testzero(page))) {
++ unsigned int order = compound_order(page);
++
++ if (order == 0) /* Via pcp? */
++ free_unref_page(page);
++ else
++ __free_pages_ok(page, order);
++ }
+ }
+ EXPORT_SYMBOL(page_frag_free);
+
+--
+2.20.1
+
--- /dev/null
+From b98addd21deb092196b8e09cdb6c6b58a51f25c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:35:22 -0800
+Subject: mm/page_alloc.c: use a single function to free page
+
+From: Aaron Lu <aaron.lu@intel.com>
+
+[ Upstream commit 742aa7fb52c56fb3b307e704f93e67b698959cc2 ]
+
+There are multiple places of freeing a page, they all do the same things
+so a common function can be used to reduce code duplicate.
+
+It also avoids bug fixed in one function but left in another.
+
+Link: http://lkml.kernel.org/r/20181119134834.17765-3-aaron.lu@intel.com
+Signed-off-by: Aaron Lu <aaron.lu@intel.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Cc: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Cc: Jesper Dangaard Brouer <brouer@redhat.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: Pankaj gupta <pagupta@redhat.com>
+Cc: Pawel Staszewski <pstaszewski@itcare.pl>
+Cc: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/page_alloc.c | 37 ++++++++++++++-----------------------
+ 1 file changed, 14 insertions(+), 23 deletions(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index dcc46d955df2e..74fb5c338e8fb 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -4451,16 +4451,19 @@ unsigned long get_zeroed_page(gfp_t gfp_mask)
+ }
+ EXPORT_SYMBOL(get_zeroed_page);
+
+-void __free_pages(struct page *page, unsigned int order)
++static inline void free_the_page(struct page *page, unsigned int order)
+ {
+- if (put_page_testzero(page)) {
+- if (order == 0)
+- free_unref_page(page);
+- else
+- __free_pages_ok(page, order);
+- }
++ if (order == 0) /* Via pcp? */
++ free_unref_page(page);
++ else
++ __free_pages_ok(page, order);
+ }
+
++void __free_pages(struct page *page, unsigned int order)
++{
++ if (put_page_testzero(page))
++ free_the_page(page, order);
++}
+ EXPORT_SYMBOL(__free_pages);
+
+ void free_pages(unsigned long addr, unsigned int order)
+@@ -4509,14 +4512,8 @@ void __page_frag_cache_drain(struct page *page, unsigned int count)
+ {
+ VM_BUG_ON_PAGE(page_ref_count(page) == 0, page);
+
+- if (page_ref_sub_and_test(page, count)) {
+- unsigned int order = compound_order(page);
+-
+- if (order == 0)
+- free_unref_page(page);
+- else
+- __free_pages_ok(page, order);
+- }
++ if (page_ref_sub_and_test(page, count))
++ free_the_page(page, compound_order(page));
+ }
+ EXPORT_SYMBOL(__page_frag_cache_drain);
+
+@@ -4581,14 +4578,8 @@ void page_frag_free(void *addr)
+ {
+ struct page *page = virt_to_head_page(addr);
+
+- if (unlikely(put_page_testzero(page))) {
+- unsigned int order = compound_order(page);
+-
+- if (order == 0) /* Via pcp? */
+- free_unref_page(page);
+- else
+- __free_pages_ok(page, order);
+- }
++ if (unlikely(put_page_testzero(page)))
++ free_the_page(page, compound_order(page));
+ }
+ EXPORT_SYMBOL(page_frag_free);
+
+--
+2.20.1
+
--- /dev/null
+From 58afa0e7a71a414fcf8532ff65d607741646742c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 00:02:11 +0800
+Subject: mmc: core: align max segment size with logical block size
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit c53336c8f5f29043fded57912cc06c24e12613d7 ]
+
+Logical block size is the lowest possible block size that the storage
+device can address. Max segment size is often related with controller's
+DMA capability. And it is reasonable to align max segment size with
+logical block size.
+
+SDHCI sets un-aligned max segment size, and causes ADMA error, so
+fix it by aligning max segment size with logical block size.
+
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
+Cc: Faiz Abbas <faiz_abbas@ti.com>
+Cc: linux-block@vger.kernel.org
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 6 ------
+ drivers/mmc/core/queue.c | 9 ++++++++-
+ 2 files changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index eee004fb3c3e3..527ab15c421f9 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2384,12 +2384,6 @@ static struct mmc_blk_data *mmc_blk_alloc_req(struct mmc_card *card,
+ snprintf(md->disk->disk_name, sizeof(md->disk->disk_name),
+ "mmcblk%u%s", card->host->index, subname ? subname : "");
+
+- if (mmc_card_mmc(card))
+- blk_queue_logical_block_size(md->queue.queue,
+- card->ext_csd.data_sector_size);
+- else
+- blk_queue_logical_block_size(md->queue.queue, 512);
+-
+ set_capacity(md->disk, size);
+
+ if (mmc_host_cmd23(card->host)) {
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 18aae28845ec9..becc6594a8a47 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -355,6 +355,7 @@ static void mmc_setup_queue(struct mmc_queue *mq, struct mmc_card *card)
+ {
+ struct mmc_host *host = card->host;
+ u64 limit = BLK_BOUNCE_HIGH;
++ unsigned block_size = 512;
+
+ if (mmc_dev(host)->dma_mask && *mmc_dev(host)->dma_mask)
+ limit = (u64)dma_max_pfn(mmc_dev(host)) << PAGE_SHIFT;
+@@ -368,7 +369,13 @@ static void mmc_setup_queue(struct mmc_queue *mq, struct mmc_card *card)
+ blk_queue_max_hw_sectors(mq->queue,
+ min(host->max_blk_count, host->max_req_size / 512));
+ blk_queue_max_segments(mq->queue, host->max_segs);
+- blk_queue_max_segment_size(mq->queue, host->max_seg_size);
++
++ if (mmc_card_mmc(card))
++ block_size = card->ext_csd.data_sector_size;
++
++ blk_queue_logical_block_size(mq->queue, block_size);
++ blk_queue_max_segment_size(mq->queue,
++ round_down(host->max_seg_size, block_size));
+
+ INIT_WORK(&mq->recovery_work, mmc_mq_recovery_handler);
+ INIT_WORK(&mq->complete_work, mmc_blk_mq_complete_work);
+--
+2.20.1
+
--- /dev/null
+From a2a6649ee1829261f2efa428057bbf4933d63fd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:18:25 +0100
+Subject: mmc: meson-gx: make sure the descriptor is stopped on errors
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 18f92bc02f1739b5c4d5b70009fbb7eada45bca3 ]
+
+On errors, if we don't stop the descriptor chain, it may continue to
+run and raise IRQ after we have called mmc_request_done(). This is bad
+because we won't be able to get cmd anymore and properly deal with the
+IRQ.
+
+This patch makes sure the descriptor chain is stopped before
+calling mmc_request_done()
+
+Fixes: 79ed05e329c3 ("mmc: meson-gx: add support for descriptor chain mode")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/meson-gx-mmc.c | 73 ++++++++++++++++++++++++++++-----
+ 1 file changed, 63 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/mmc/host/meson-gx-mmc.c b/drivers/mmc/host/meson-gx-mmc.c
+index ddd98cdd33bcd..72f34a58928ca 100644
+--- a/drivers/mmc/host/meson-gx-mmc.c
++++ b/drivers/mmc/host/meson-gx-mmc.c
+@@ -21,6 +21,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
++#include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+@@ -90,9 +91,11 @@
+ #define CFG_CLK_ALWAYS_ON BIT(18)
+ #define CFG_CHK_DS BIT(20)
+ #define CFG_AUTO_CLK BIT(23)
++#define CFG_ERR_ABORT BIT(27)
+
+ #define SD_EMMC_STATUS 0x48
+ #define STATUS_BUSY BIT(31)
++#define STATUS_DESC_BUSY BIT(30)
+ #define STATUS_DATI GENMASK(23, 16)
+
+ #define SD_EMMC_IRQ_EN 0x4c
+@@ -930,6 +933,7 @@ static void meson_mmc_start_cmd(struct mmc_host *mmc, struct mmc_command *cmd)
+
+ cmd_cfg |= FIELD_PREP(CMD_CFG_CMD_INDEX_MASK, cmd->opcode);
+ cmd_cfg |= CMD_CFG_OWNER; /* owned by CPU */
++ cmd_cfg |= CMD_CFG_ERROR; /* stop in case of error */
+
+ meson_mmc_set_response_bits(cmd, &cmd_cfg);
+
+@@ -1024,6 +1028,17 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+ u32 irq_en, status, raw_status;
+ irqreturn_t ret = IRQ_NONE;
+
++ irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
++ raw_status = readl(host->regs + SD_EMMC_STATUS);
++ status = raw_status & irq_en;
++
++ if (!status) {
++ dev_dbg(host->dev,
++ "Unexpected IRQ! irq_en 0x%08x - status 0x%08x\n",
++ irq_en, raw_status);
++ return IRQ_NONE;
++ }
++
+ if (WARN_ON(!host) || WARN_ON(!host->cmd))
+ return IRQ_NONE;
+
+@@ -1031,22 +1046,18 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)
+
+ cmd = host->cmd;
+ data = cmd->data;
+- irq_en = readl(host->regs + SD_EMMC_IRQ_EN);
+- raw_status = readl(host->regs + SD_EMMC_STATUS);
+- status = raw_status & irq_en;
+-
+ cmd->error = 0;
+ if (status & IRQ_CRC_ERR) {
+ dev_dbg(host->dev, "CRC Error - status 0x%08x\n", status);
+ cmd->error = -EILSEQ;
+- ret = IRQ_HANDLED;
++ ret = IRQ_WAKE_THREAD;
+ goto out;
+ }
+
+ if (status & IRQ_TIMEOUTS) {
+ dev_dbg(host->dev, "Timeout - status 0x%08x\n", status);
+ cmd->error = -ETIMEDOUT;
+- ret = IRQ_HANDLED;
++ ret = IRQ_WAKE_THREAD;
+ goto out;
+ }
+
+@@ -1071,17 +1082,49 @@ out:
+ /* ack all enabled interrupts */
+ writel(irq_en, host->regs + SD_EMMC_STATUS);
+
++ if (cmd->error) {
++ /* Stop desc in case of errors */
++ u32 start = readl(host->regs + SD_EMMC_START);
++
++ start &= ~START_DESC_BUSY;
++ writel(start, host->regs + SD_EMMC_START);
++ }
++
+ if (ret == IRQ_HANDLED)
+ meson_mmc_request_done(host->mmc, cmd->mrq);
+- else if (ret == IRQ_NONE)
+- dev_warn(host->dev,
+- "Unexpected IRQ! status=0x%08x, irq_en=0x%08x\n",
+- raw_status, irq_en);
+
+ spin_unlock(&host->lock);
+ return ret;
+ }
+
++static int meson_mmc_wait_desc_stop(struct meson_host *host)
++{
++ int loop;
++ u32 status;
++
++ /*
++ * It may sometimes take a while for it to actually halt. Here, we
++ * are giving it 5ms to comply
++ *
++ * If we don't confirm the descriptor is stopped, it might raise new
++ * IRQs after we have called mmc_request_done() which is bad.
++ */
++ for (loop = 50; loop; loop--) {
++ status = readl(host->regs + SD_EMMC_STATUS);
++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY))
++ udelay(100);
++ else
++ break;
++ }
++
++ if (status & (STATUS_BUSY | STATUS_DESC_BUSY)) {
++ dev_err(host->dev, "Timed out waiting for host to stop\n");
++ return -ETIMEDOUT;
++ }
++
++ return 0;
++}
++
+ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ {
+ struct meson_host *host = dev_id;
+@@ -1092,6 +1135,13 @@ static irqreturn_t meson_mmc_irq_thread(int irq, void *dev_id)
+ if (WARN_ON(!cmd))
+ return IRQ_NONE;
+
++ if (cmd->error) {
++ meson_mmc_wait_desc_stop(host);
++ meson_mmc_request_done(host->mmc, cmd->mrq);
++
++ return IRQ_HANDLED;
++ }
++
+ data = cmd->data;
+ if (meson_mmc_bounce_buf_read(data)) {
+ xfer_bytes = data->blksz * data->blocks;
+@@ -1132,6 +1182,9 @@ static void meson_mmc_cfg_init(struct meson_host *host)
+ cfg |= FIELD_PREP(CFG_RC_CC_MASK, ilog2(SD_EMMC_CFG_CMD_GAP));
+ cfg |= FIELD_PREP(CFG_BLK_LEN_MASK, ilog2(SD_EMMC_CFG_BLK_SIZE));
+
++ /* abort chain on R/W errors */
++ cfg |= CFG_ERR_ABORT;
++
+ writel(cfg, host->regs + SD_EMMC_CFG);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From eb345f2d4393aeca4e34fe9bb2913b0166a7817d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Jan 2019 15:36:54 +0100
+Subject: mtd: Check add_mtd_device() ret code
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit 2b6f0090a3335b7bdd03ca520c35591159463041 ]
+
+add_mtd_device() can fail. We should always check its return value
+and gracefully handle the failure case. Fix the call sites where this
+not done (in mtdpart.c) and add a __must_check attribute to the
+prototype to avoid this kind of mistakes.
+
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdcore.h | 2 +-
+ drivers/mtd/mtdpart.c | 36 +++++++++++++++++++++++++++++++-----
+ 2 files changed, 32 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/mtd/mtdcore.h b/drivers/mtd/mtdcore.h
+index 9887bda317cd9..b31c868019ada 100644
+--- a/drivers/mtd/mtdcore.h
++++ b/drivers/mtd/mtdcore.h
+@@ -7,7 +7,7 @@
+ extern struct mutex mtd_table_mutex;
+
+ struct mtd_info *__mtd_next_device(int i);
+-int add_mtd_device(struct mtd_info *mtd);
++int __must_check add_mtd_device(struct mtd_info *mtd);
+ int del_mtd_device(struct mtd_info *mtd);
+ int add_mtd_partitions(struct mtd_info *, const struct mtd_partition *, int);
+ int del_mtd_partitions(struct mtd_info *);
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 0bbb23b014f1b..b9b308cde0a5d 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -612,10 +612,22 @@ int mtd_add_partition(struct mtd_info *parent, const char *name,
+ list_add(&new->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&new->mtd);
++ ret = add_mtd_device(&new->mtd);
++ if (ret)
++ goto err_remove_part;
+
+ mtd_add_partition_attrs(new);
+
++ return 0;
++
++err_remove_part:
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&new->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(new);
++ pr_info("%s:%i\n", __func__, __LINE__);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(mtd_add_partition);
+@@ -706,22 +718,31 @@ int add_mtd_partitions(struct mtd_info *master,
+ {
+ struct mtd_part *slave;
+ uint64_t cur_offset = 0;
+- int i;
++ int i, ret;
+
+ printk(KERN_NOTICE "Creating %d MTD partitions on \"%s\":\n", nbparts, master->name);
+
+ for (i = 0; i < nbparts; i++) {
+ slave = allocate_partition(master, parts + i, i, cur_offset);
+ if (IS_ERR(slave)) {
+- del_mtd_partitions(master);
+- return PTR_ERR(slave);
++ ret = PTR_ERR(slave);
++ goto err_del_partitions;
+ }
+
+ mutex_lock(&mtd_partitions_mutex);
+ list_add(&slave->list, &mtd_partitions);
+ mutex_unlock(&mtd_partitions_mutex);
+
+- add_mtd_device(&slave->mtd);
++ ret = add_mtd_device(&slave->mtd);
++ if (ret) {
++ mutex_lock(&mtd_partitions_mutex);
++ list_del(&slave->list);
++ mutex_unlock(&mtd_partitions_mutex);
++
++ free_partition(slave);
++ goto err_del_partitions;
++ }
++
+ mtd_add_partition_attrs(slave);
+ /* Look for subpartitions */
+ parse_mtd_partitions(&slave->mtd, parts[i].types, NULL);
+@@ -730,6 +751,11 @@ int add_mtd_partitions(struct mtd_info *master,
+ }
+
+ return 0;
++
++err_del_partitions:
++ del_mtd_partitions(master);
++
++ return ret;
+ }
+
+ static DEFINE_SPINLOCK(part_parser_lock);
+--
+2.20.1
+
--- /dev/null
+From 5aaf829d93bcd4b15fe4c2cc18a7c7827496a558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 16 Dec 2018 09:34:17 +0100
+Subject: mtd: rawnand: sunxi: Write pageprog related opcodes to WCMD_SET
+
+From: Boris Brezillon <boris.brezillon@bootlin.com>
+
+[ Upstream commit 732774437ae01d9882e60314e303898e63c7f038 ]
+
+The opcodes used by the controller when doing batched page prog should
+be written in NFC_REG_WCMD_SET not FC_REG_RCMD_SET. Luckily, the
+default NFC_REG_WCMD_SET value matches the one we set in the driver
+which explains why we didn't notice the problem.
+
+Fixes: 614049a8d904 ("mtd: nand: sunxi: add support for DMA assisted operations")
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
+index 1f0b7ee38df56..5b5f4d25a3e12 100644
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -1397,7 +1397,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct mtd_info *mtd,
+ sunxi_nfc_randomizer_enable(mtd);
+
+ writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG,
+- nfc->regs + NFC_REG_RCMD_SET);
++ nfc->regs + NFC_REG_WCMD_SET);
+
+ dma_async_issue_pending(nfc->dmac);
+
+--
+2.20.1
+
--- /dev/null
+From 2a95073ead157b0906379fa0820dda1e196518f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 09:47:00 +0100
+Subject: mtd: Remove a debug trace in mtdpart.c
+
+From: Boris Brezillon <bbrezillon@kernel.org>
+
+[ Upstream commit bda2ab56356b9acdfab150f31c4bac9846253092 ]
+
+Commit 2b6f0090a333 ("mtd: Check add_mtd_device() ret code") contained
+a leftover of the debug session that led to this bug fix. Remove this
+pr_info().
+
+Fixes: 2b6f0090a333 ("mtd: Check add_mtd_device() ret code")
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/mtdpart.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index b9b308cde0a5d..10c53364aa70c 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -626,7 +626,6 @@ err_remove_part:
+ mutex_unlock(&mtd_partitions_mutex);
+
+ free_partition(new);
+- pr_info("%s:%i\n", __func__, __LINE__);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From c6db9b05b3a3d017b4f994fdaed01f271b518446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 14:26:55 -0800
+Subject: mwifiex: debugfs: correct histogram spacing, formatting
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 4cb777c64e030778c569f605398d7604d8aabc0f ]
+
+Currently, snippets of this file look like:
+
+rx rates (in Mbps): 0=1M 1=2M2=5.5M 3=11M 4=6M 5=9M 6=12M
+7=18M 8=24M 9=36M 10=48M 11=54M12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)
+44-53=MCS0-9(VHT:BW20)54-63=MCS0-9(VHT:BW40)64-73=MCS0-9(VHT:BW80)
+...
+noise_flr[--96dBm] = 22
+noise_flr[--95dBm] = 149
+noise_flr[--94dBm] = 9
+noise_flr[--93dBm] = 2
+
+We're missing some spaces, and we're adding a minus sign ('-') on values
+that are already negative signed integers.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/debugfs.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+index cce70252fd96b..cbe4493b32664 100644
+--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
++++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
+@@ -273,15 +273,13 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ "total samples = %d\n",
+ atomic_read(&phist_data->num_samples));
+
+- p += sprintf(p, "rx rates (in Mbps): 0=1M 1=2M");
+- p += sprintf(p, "2=5.5M 3=11M 4=6M 5=9M 6=12M\n");
+- p += sprintf(p, "7=18M 8=24M 9=36M 10=48M 11=54M");
+- p += sprintf(p, "12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
++ p += sprintf(p,
++ "rx rates (in Mbps): 0=1M 1=2M 2=5.5M 3=11M 4=6M 5=9M 6=12M\n"
++ "7=18M 8=24M 9=36M 10=48M 11=54M 12-27=MCS0-15(BW20) 28-43=MCS0-15(BW40)\n");
+
+ if (ISSUPP_11ACENABLED(priv->adapter->fw_cap_info)) {
+- p += sprintf(p, "44-53=MCS0-9(VHT:BW20)");
+- p += sprintf(p, "54-63=MCS0-9(VHT:BW40)");
+- p += sprintf(p, "64-73=MCS0-9(VHT:BW80)\n\n");
++ p += sprintf(p,
++ "44-53=MCS0-9(VHT:BW20) 54-63=MCS0-9(VHT:BW40) 64-73=MCS0-9(VHT:BW80)\n\n");
+ } else {
+ p += sprintf(p, "\n");
+ }
+@@ -310,7 +308,7 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
+ for (i = 0; i < MWIFIEX_MAX_NOISE_FLR; i++) {
+ value = atomic_read(&phist_data->noise_flr[i]);
+ if (value)
+- p += sprintf(p, "noise_flr[-%02ddBm] = %d\n",
++ p += sprintf(p, "noise_flr[%02ddBm] = %d\n",
+ (int)(i-128), value);
+ }
+ for (i = 0; i < MWIFIEX_MAX_SIG_STRENGTH; i++) {
+--
+2.20.1
+
--- /dev/null
+From 85496989543f48305fab072efda68e42e1c40929 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:25:19 +0800
+Subject: mwifiex: fix potential NULL dereference and use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ]
+
+There are two defects: (1) passing a NULL bss to
+mwifiex_save_hidden_ssid_channels will result in NULL dereference,
+(2) using bss after dropping the reference to it via cfg80211_put_bss.
+To fix them, the patch moves the buggy code to the branch that bss is
+not NULL and puts it before cfg80211_put_bss.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/mwifiex/scan.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
+index ed27147efcb37..dd02bbd9544e7 100644
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1906,15 +1906,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
+ ETH_ALEN))
+ mwifiex_update_curr_bss_params(priv,
+ bss);
+- cfg80211_put_bss(priv->wdev.wiphy, bss);
+- }
+
+- if ((chan->flags & IEEE80211_CHAN_RADAR) ||
+- (chan->flags & IEEE80211_CHAN_NO_IR)) {
+- mwifiex_dbg(adapter, INFO,
+- "radar or passive channel %d\n",
+- channel);
+- mwifiex_save_hidden_ssid_channels(priv, bss);
++ if ((chan->flags & IEEE80211_CHAN_RADAR) ||
++ (chan->flags & IEEE80211_CHAN_NO_IR)) {
++ mwifiex_dbg(adapter, INFO,
++ "radar or passive channel %d\n",
++ channel);
++ mwifiex_save_hidden_ssid_channels(priv,
++ bss);
++ }
++
++ cfg80211_put_bss(priv->wdev.wiphy, bss);
+ }
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 4c87e1e683d5f7f5cdddd77549aa7c98f582a7eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 11:07:26 -0800
+Subject: net: bcmgenet: reapply manual settings to the PHY
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 0686bd9d5e6863f60e4bb1e78e6fe7bb217a0890 ]
+
+The phy_init_hw() function may reset the PHY to a configuration
+that does not match manual network settings stored in the phydev
+structure. If the phy state machine is polled rather than event
+driven this can create a timing hazard where the phy state machine
+might alter the settings stored in the phydev structure from the
+value read from the BMCR.
+
+This commit follows invocations of phy_init_hw() by the bcmgenet
+driver with invocations of the genphy_config_aneg() function to
+ensure that the BMCR is written to match the settings held in the
+phydev structure. This prevents the risk of manual settings being
+accidentally altered.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 6f7278d2ce4f2..b7d75011cede5 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2619,8 +2619,10 @@ static void bcmgenet_irq_task(struct work_struct *work)
+ spin_unlock_irq(&priv->lock);
+
+ if (status & UMAC_IRQ_PHY_DET_R &&
+- priv->dev->phydev->autoneg != AUTONEG_ENABLE)
++ priv->dev->phydev->autoneg != AUTONEG_ENABLE) {
+ phy_init_hw(priv->dev->phydev);
++ genphy_config_aneg(priv->dev->phydev);
++ }
+
+ /* Link UP/DOWN event */
+ if (status & UMAC_IRQ_LINK_EVENT)
+@@ -3673,6 +3675,7 @@ static int bcmgenet_resume(struct device *d)
+ phy_init_hw(dev->phydev);
+
+ /* Speed settings must be restored */
++ genphy_config_aneg(dev->phydev);
+ bcmgenet_mii_config(priv->dev, false);
+
+ bcmgenet_set_hw_addr(priv, dev->dev_addr);
+--
+2.20.1
+
--- /dev/null
+From b5e62023bb24c8924d6875f2aeabd738c7f9e7de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 11:07:24 -0800
+Subject: net: bcmgenet: use RGMII loopback for MAC reset
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 3a55402c93877d291b0a612d25edb03d1b4b93ac ]
+
+As noted in commit 28c2d1a7a0bf ("net: bcmgenet: enable loopback
+during UniMAC sw_reset") the UniMAC must be clocked while sw_reset
+is asserted for its state machines to reset cleanly.
+
+The transmit and receive clocks used by the UniMAC are derived from
+the signals used on its PHY interface. The bcmgenet MAC can be
+configured to work with different PHY interfaces including MII,
+GMII, RGMII, and Reverse MII on internal and external interfaces.
+Unfortunately for the UniMAC, when configured for MII the Tx clock
+is always driven from the PHY which places it outside of the direct
+control of the MAC.
+
+The earlier commit enabled a local loopback mode within the UniMAC
+so that the receive clock would be derived from the transmit clock
+which addressed the observed issue with an external GPHY disabling
+it's Rx clock. However, when a Tx clock is not available this
+loopback is insufficient.
+
+This commit implements a workaround that leverages the fact that
+the MAC can reliably generate all of its necessary clocking by
+enterring the external GPHY RGMII interface mode with the UniMAC in
+local loopback during the sw_reset interval. Unfortunately, this
+has the undesirable side efect of the RGMII GTXCLK signal being
+driven during the same window.
+
+In most configurations this is a benign side effect as the signal
+is either not routed to a pin or is already expected to drive the
+pin. The one exception is when an external MII PHY is expected to
+drive the same pin with its TX_CLK output creating output driver
+contention.
+
+This commit exploits the IEEE 802.3 clause 22 standard defined
+isolate mode to force an external MII PHY to present a high
+impedance on its TX_CLK output during the window to prevent any
+contention at the pin.
+
+The MII interface is used internally with the 40nm internal EPHY
+which agressively disables its clocks for power savings leading to
+incomplete resets of the UniMAC and many instabilities observed
+over the years. The workaround of this commit is expected to put
+an end to those problems.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/genet/bcmgenet.c | 2 --
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 33 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 338d223804343..6f7278d2ce4f2 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1998,8 +1998,6 @@ static void reset_umac(struct bcmgenet_priv *priv)
+
+ /* issue soft reset with (rg)mii loopback to ensure a stable rxclk */
+ bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD);
+- udelay(2);
+- bcmgenet_umac_writel(priv, 0, UMAC_CMD);
+ }
+
+ static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index b0592fd4135b3..a5049d637791d 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -184,8 +184,38 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ const char *phy_name = NULL;
+ u32 id_mode_dis = 0;
+ u32 port_ctrl;
++ int bmcr = -1;
++ int ret;
+ u32 reg;
+
++ /* MAC clocking workaround during reset of umac state machines */
++ reg = bcmgenet_umac_readl(priv, UMAC_CMD);
++ if (reg & CMD_SW_RESET) {
++ /* An MII PHY must be isolated to prevent TXC contention */
++ if (priv->phy_interface == PHY_INTERFACE_MODE_MII) {
++ ret = phy_read(phydev, MII_BMCR);
++ if (ret >= 0) {
++ bmcr = ret;
++ ret = phy_write(phydev, MII_BMCR,
++ bmcr | BMCR_ISOLATE);
++ }
++ if (ret) {
++ netdev_err(dev, "failed to isolate PHY\n");
++ return ret;
++ }
++ }
++ /* Switch MAC clocking to RGMII generated clock */
++ bcmgenet_sys_writel(priv, PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
++ /* Ensure 5 clks with Rx disabled
++ * followed by 5 clks with Reset asserted
++ */
++ udelay(4);
++ reg &= ~(CMD_SW_RESET | CMD_LCL_LOOP_EN);
++ bcmgenet_umac_writel(priv, reg, UMAC_CMD);
++ /* Ensure 5 more clocks before Rx is enabled */
++ udelay(2);
++ }
++
+ priv->ext_phy = !priv->internal_phy &&
+ (priv->phy_interface != PHY_INTERFACE_MODE_MOCA);
+
+@@ -217,6 +247,9 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ phydev->supported &= PHY_BASIC_FEATURES;
+ bcmgenet_sys_writel(priv,
+ PORT_MODE_EXT_EPHY, SYS_PORT_CTRL);
++ /* Restore the MII PHY after isolation */
++ if (bmcr >= 0)
++ phy_write(phydev, MII_BMCR, bmcr);
+ break;
+
+ case PHY_INTERFACE_MODE_REVMII:
+--
+2.20.1
+
--- /dev/null
+From 0dd2324effe7aacfc107cb0ea664fb17bfe2ee1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:38:43 +0300
+Subject: net/core/neighbour: fix kmemleak minimal reference count for hash
+ tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 01b833ab44c9e484060aad72267fc7e71beb559b ]
+
+This should be 1 for normal allocations, 0 disables leak reporting.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
+Fixes: 85704cb8dcfd ("net/core/neighbour: tell kmemleak about hash tables")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 4721793babed5..7597afee70680 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -370,7 +370,7 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
+- kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
+ }
+ if (!buckets) {
+ kfree(ret);
+--
+2.20.1
+
--- /dev/null
+From da97bd74d18a10e3c5f58569bd32d8f176a80670 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 8 Jan 2019 12:30:00 +0300
+Subject: net/core/neighbour: tell kmemleak about hash tables
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 85704cb8dcfd88d351bfc87faaeba1c8214f3177 ]
+
+This fixes false-positive kmemleak reports about leaked neighbour entries:
+
+unreferenced object 0xffff8885c6e4d0a8 (size 1024):
+ comm "softirq", pid 0, jiffies 4294922664 (age 167640.804s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 20 2c f3 83 ff ff ff ff ........ ,......
+ 08 c0 ef 5f 84 88 ff ff 01 8c 7d 02 01 00 00 00 ..._......}.....
+ backtrace:
+ [<00000000748509fe>] ip6_finish_output2+0x887/0x1e40
+ [<0000000036d7a0d8>] ip6_output+0x1ba/0x600
+ [<0000000027ea7dba>] ip6_send_skb+0x92/0x2f0
+ [<00000000d6e2111d>] udp_v6_send_skb.isra.24+0x680/0x15e0
+ [<000000000668a8be>] udpv6_sendmsg+0x18c9/0x27a0
+ [<000000004bd5fa90>] sock_sendmsg+0xb3/0xf0
+ [<000000008227b29f>] ___sys_sendmsg+0x745/0x8f0
+ [<000000008698009d>] __sys_sendmsg+0xde/0x170
+ [<00000000889dacf1>] do_syscall_64+0x9b/0x400
+ [<0000000081cdb353>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [<000000005767ed39>] 0xffffffffffffffff
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index c52d6e6b341cf..4721793babed5 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -18,6 +18,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+ #include <linux/slab.h>
++#include <linux/kmemleak.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+@@ -363,12 +364,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
+ ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
+ if (!ret)
+ return NULL;
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ buckets = kzalloc(size, GFP_ATOMIC);
+- else
++ } else {
+ buckets = (struct neighbour __rcu **)
+ __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
+ get_order(size));
++ kmemleak_alloc(buckets, size, 0, GFP_ATOMIC);
++ }
+ if (!buckets) {
+ kfree(ret);
+ return NULL;
+@@ -388,10 +391,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
+ size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
+ struct neighbour __rcu **buckets = nht->hash_buckets;
+
+- if (size <= PAGE_SIZE)
++ if (size <= PAGE_SIZE) {
+ kfree(buckets);
+- else
++ } else {
++ kmemleak_free(buckets);
+ free_pages((unsigned long)buckets, get_order(size));
++ }
+ kfree(nht);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5838680681280a765a44e43763a9c94ab1f9bc6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:55:37 -0600
+Subject: net: (cpts) fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 2d822f2dbab7f4c820f72eb8570aacf3f35855bd ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index b96b93c686bf1..4f644ac314fe8 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -572,7 +572,9 @@ struct cpts *cpts_create(struct device *dev, void __iomem *regs,
+ return ERR_CAST(cpts->refclk);
+ }
+
+- clk_prepare(cpts->refclk);
++ ret = clk_prepare(cpts->refclk);
++ if (ret)
++ return ERR_PTR(ret);
+
+ cpts->cc.read = cpts_systim_read;
+ cpts->cc.mask = CLOCKSOURCE_MASK(32);
+--
+2.20.1
+
--- /dev/null
+From 05b7ac13642e87440995d08c906502997dd9dd70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 13:37:26 +0300
+Subject: net: dev: Use unsigned integer as an argument to left-shift
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit f4d7b3e23d259c44f1f1c39645450680fcd935d6 ]
+
+1 << 31 is Undefined Behaviour according to the C standard.
+Use U type modifier to avoid theoretical overflow.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/netdevice.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 8c2fec0bcb265..5ada5fd9652dd 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3790,7 +3790,7 @@ static inline u32 netif_msg_init(int debug_value, int default_msg_enable_bits)
+ if (debug_value == 0) /* no output */
+ return 0;
+ /* set low N bits */
+- return (1 << debug_value) - 1;
++ return (1U << debug_value) - 1;
+ }
+
+ static inline void __netif_tx_lock(struct netdev_queue *txq, int cpu)
+--
+2.20.1
+
--- /dev/null
+From 7dcbb8d2cbf4907dca9321a0e8705ebbb02f3252 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 22:08:18 -0600
+Subject: net: dsa: bcm_sf2: Propagate error value from mdio_write
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit e49505f7255be8ced695919c08a29bf2c3d79616 ]
+
+Both bcm_sf2_sw_indir_rw and mdiobus_write_nested could fail, so let's
+return their error codes upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 17cec68e56b4f..02a4187d81bd0 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -309,11 +309,10 @@ static int bcm_sf2_sw_mdio_write(struct mii_bus *bus, int addr, int regnum,
+ * send them to our master MDIO bus controller
+ */
+ if (addr == BRCM_PSEUDO_PHY_ADDR && priv->indir_phy_mask & BIT(addr))
+- bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
++ return bcm_sf2_sw_indir_rw(priv, 0, addr, regnum, val);
+ else
+- mdiobus_write_nested(priv->master_mii_bus, addr, regnum, val);
+-
+- return 0;
++ return mdiobus_write_nested(priv->master_mii_bus, addr,
++ regnum, val);
+ }
+
+ static irqreturn_t bcm_sf2_switch_0_isr(int irq, void *dev_id)
+--
+2.20.1
+
--- /dev/null
+From abb2b4ec34f1de2974c36d53e326c8a61722e8d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 23:50:00 +0800
+Subject: net: fec: add missed clk_disable_unprepare in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ]
+
+This driver forgets to disable and unprepare clks when remove.
+Add calls to clk_disable_unprepare to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index 4cf80de4c471c..1c62a102a223c 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3606,6 +3606,8 @@ fec_drv_remove(struct platform_device *pdev)
+ regulator_disable(fep->reg_phy);
+ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ clk_disable_unprepare(fep->clk_ahb);
++ clk_disable_unprepare(fep->clk_ipg);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+--
+2.20.1
+
--- /dev/null
+From e45bd5dce6a6fd97539a7c56d47ed78348dce44c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 12:26:27 -0800
+Subject: net: fix possible overflow in __sk_mem_raise_allocated()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 5bf325a53202b8728cf7013b72688c46071e212e ]
+
+With many active TCP sockets, fat TCP sockets could fool
+__sk_mem_raise_allocated() thanks to an overflow.
+
+They would increase their share of the memory, instead
+of decreasing it.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sock.h | 2 +-
+ net/core/sock.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 0252c0d003104..4545a9ecc2193 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1272,7 +1272,7 @@ static inline void sk_sockets_allocated_inc(struct sock *sk)
+ percpu_counter_inc(sk->sk_prot->sockets_allocated);
+ }
+
+-static inline int
++static inline u64
+ sk_sockets_allocated_read_positive(struct sock *sk)
+ {
+ return percpu_counter_read_positive(sk->sk_prot->sockets_allocated);
+diff --git a/net/core/sock.c b/net/core/sock.c
+index ba4f843cdd1d1..bbde5f6a7dc91 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2435,7 +2435,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
+ }
+
+ if (sk_has_memory_pressure(sk)) {
+- int alloc;
++ u64 alloc;
+
+ if (!sk_under_memory_pressure(sk))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From 63847c1df2b89b78fc5ce98942e146fb870b8150 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 16:57:50 +0100
+Subject: net/fq_impl: Switch to kvmalloc() for memory allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 71e67c3bd127cfe7863f54e4b087eba1cc8f9a7a ]
+
+The FQ implementation used by mac80211 allocates memory using kmalloc(),
+which can fail; and Johannes reported that this actually happens in
+practice.
+
+To avoid this, switch the allocation to kvmalloc() instead; this also
+brings fq_impl in line with all the FQ qdiscs.
+
+Fixes: 557fc4a09803 ("fq: add fair queuing framework")
+Reported-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20191105155750.547379-1-toke@redhat.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/fq_impl.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
+index 89a012905ef0b..4b3e18ff8e6f2 100644
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -312,7 +312,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
+ fq->limit = 8192;
+ fq->memory_limit = 16 << 20; /* 16 MBytes */
+
+- fq->flows = kcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
++ fq->flows = kvcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
+ if (!fq->flows)
+ return -ENOMEM;
+
+@@ -330,7 +330,7 @@ static void fq_reset(struct fq *fq,
+ for (i = 0; i < fq->flows_cnt; i++)
+ fq_flow_reset(fq, &fq->flows[i], free_func);
+
+- kfree(fq->flows);
++ kvfree(fq->flows);
+ fq->flows = NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 952c5401b9c14e71272911beeea7b404cec43c15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 07:39:34 +0800
+Subject: net: hns3: Change fw error code NOT_EXEC to NOT_SUPPORTED
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 4a402f47cfce904051cd8b31bef4fe2910d9dce9 ]
+
+According to firmware error code definition, the error code of 2
+means NOT_SUPPORTED, this patch changes it to NOT_SUPPORTED.
+
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 2 ++
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+index 690f62ed87dca..09a4d87429cea 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c
+@@ -260,6 +260,8 @@ int hclge_cmd_send(struct hclge_hw *hw, struct hclge_desc *desc, int num)
+
+ if (desc_ret == HCLGE_CMD_EXEC_SUCCESS)
+ retval = 0;
++ else if (desc_ret == HCLGE_CMD_NOT_SUPPORTED)
++ retval = -EOPNOTSUPP;
+ else
+ retval = -EIO;
+ hw->cmq.last_status = desc_ret;
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+index 821d4c2f84bd3..d7520686509fd 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h
+@@ -39,7 +39,7 @@ struct hclge_cmq_ring {
+ enum hclge_cmd_return_status {
+ HCLGE_CMD_EXEC_SUCCESS = 0,
+ HCLGE_CMD_NO_AUTH = 1,
+- HCLGE_CMD_NOT_EXEC = 2,
++ HCLGE_CMD_NOT_SUPPORTED = 2,
+ HCLGE_CMD_QUEUE_FULL = 3,
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 1d5bb8f6ec16b782f6e0372df844558c0467251c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Jan 2019 04:55:50 +0800
+Subject: net: hns3: fix an issue for hclgevf_ae_get_hdev
+
+From: Peng Li <lipeng321@huawei.com>
+
+[ Upstream commit eed9535f9f716a532ec0c5d6cc7a48584acdf435 ]
+
+HNS3 VF driver support NIC and Roce, hdev stores NIC
+handle and Roce handle, should use correct parameter for
+container_of.
+
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+index beae1e2cd59b1..67db19709deaa 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c
+@@ -26,7 +26,12 @@ MODULE_DEVICE_TABLE(pci, ae_algovf_pci_tbl);
+ static inline struct hclgevf_dev *hclgevf_ae_get_hdev(
+ struct hnae3_handle *handle)
+ {
+- return container_of(handle, struct hclgevf_dev, nic);
++ if (!handle->client)
++ return container_of(handle, struct hclgevf_dev, nic);
++ else if (handle->client->type == HNAE3_CLIENT_ROCE)
++ return container_of(handle, struct hclgevf_dev, roce);
++ else
++ return container_of(handle, struct hclgevf_dev, nic);
+ }
+
+ static int hclgevf_tqps_update_stats(struct hnae3_handle *handle)
+--
+2.20.1
+
--- /dev/null
+From 1cf675a1adf7ea2d11553055e5e4b8aeded7ccae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Feb 2019 22:39:27 +0800
+Subject: net: hns3: fix an issue for hns3_update_new_int_gl
+
+From: Peng Li <lipeng321@huawei.com>
+
+[ Upstream commit 6241e71e7207102ffc733991f7a00f74098d7da0 ]
+
+HNS3 supports setting rx-usecs|tx-usecs as 0, but it will not
+update dynamically when adaptive-tx or adaptive-rx is enable.
+This patch removes the Redundant check.
+
+Fixes: a95e1f8666e9 ("net: hns3: change the time interval of int_gl calculating")
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 3708f149d0a6a..b2860087a7dc7 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -2366,7 +2366,7 @@ static bool hns3_get_new_int_gl(struct hns3_enet_ring_group *ring_group)
+ u32 time_passed_ms;
+ u16 new_int_gl;
+
+- if (!ring_group->coal.int_gl || !tqp_vector->last_jiffies)
++ if (!tqp_vector->last_jiffies)
+ return false;
+
+ if (ring_group->total_packets == 0) {
+--
+2.20.1
+
--- /dev/null
+From 19c8ce9a07c38837935e999ddcc46bb2657a07f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 07:39:38 +0800
+Subject: net: hns3: fix PFC not setting problem for DCB module
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit d3ad430ac531e65f29c9737f86744c425c9173ef ]
+
+The PFC enabling is based on user priority, currently it is
+based on TC, which may cause PFC not setting correctly when pri
+to TC mapping is not one to one relation.
+
+This patch adds pfc_en in tm_info to fix it.
+
+Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Peng Li <lipeng321@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 7 ++++---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 1 +
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +-
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+index 92f19384e2585..a75d7c826fc2b 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c
+@@ -245,6 +245,9 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ hdev->flag & HCLGE_FLAG_MQPRIO_ENABLE)
+ return -EINVAL;
+
++ if (pfc->pfc_en == hdev->tm_info.pfc_en)
++ return 0;
++
+ prio_tc = hdev->tm_info.prio_tc;
+ pfc_map = 0;
+
+@@ -257,10 +260,8 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)
+ }
+ }
+
+- if (pfc_map == hdev->tm_info.hw_pfc_map)
+- return 0;
+-
+ hdev->tm_info.hw_pfc_map = pfc_map;
++ hdev->tm_info.pfc_en = pfc->pfc_en;
+
+ return hclge_pause_setup_hw(hdev);
+ }
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index 1528fb3fa6be6..260b1e7796908 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -249,6 +249,7 @@ struct hclge_tm_info {
+ struct hclge_tc_info tc_info[HNAE3_MAX_TC];
+ enum hclge_fc_mode fc_mode;
+ u8 hw_pfc_map; /* Allow for packet drop or not on this TC */
++ u8 pfc_en; /* PFC enabled or not for user priority */
+ };
+
+ struct hclge_comm_stats_str {
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+index 0d45d045706c7..3180ae4528895 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c
+@@ -1162,7 +1162,7 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev)
+ HCLGE_RX_MAC_PAUSE_EN_MSK;
+
+ return hclge_pfc_pause_en_cfg(hdev, enable_bitmap,
+- hdev->tm_info.hw_pfc_map);
++ hdev->tm_info.pfc_en);
+ }
+
+ /* Each Tc has a 1024 queue sets to backpress, it divides to
+--
+2.20.1
+
--- /dev/null
+From 239a6dffce156e5b2db8fd434d956d65f9eced08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 17:42:06 +0100
+Subject: net: ip6_gre: do not report erspan_ver for ip6gre or ip6gretap
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+[ Upstream commit 103d0244d29fcaf38f1339d4538919bbbc051490 ]
+
+Report erspan version field to userspace in ip6gre_fill_info just for
+erspan_v6 tunnels. Moreover report IFLA_GRE_ERSPAN_INDEX only for
+erspan version 1.
+The issue can be triggered with the following reproducer:
+
+$ip link add name gre6 type ip6gre local 2001::1 remote 2002::2
+$ip link set gre6 up
+$ip -d link sh gre6
+14: grep6@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1448 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
+ link/gre6 2001::1 peer 2002::2 promiscuity 0 minmtu 0 maxmtu 0
+ ip6gre remote 2002::2 local 2001::1 hoplimit 64 encaplimit 4 tclass 0x00 flowlabel 0x00000 erspan_index 0 erspan_ver 0 addrgenmode eui64
+
+Fixes: 94d7d8f29287 ("ip6_gre: add erspan v2 support")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/ip6_gre.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index dee4113f21a9a..8fd28edd6ac57 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -2135,9 +2135,23 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ struct __ip6_tnl_parm *p = &t->parms;
+ __be16 o_flags = p->o_flags;
+
+- if ((p->erspan_ver == 1 || p->erspan_ver == 2) &&
+- !p->collect_md)
+- o_flags |= TUNNEL_KEY;
++ if (p->erspan_ver == 1 || p->erspan_ver == 2) {
++ if (!p->collect_md)
++ o_flags |= TUNNEL_KEY;
++
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
++ goto nla_put_failure;
++
++ if (p->erspan_ver == 1) {
++ if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
++ goto nla_put_failure;
++ } else {
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
++ goto nla_put_failure;
++ if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
++ goto nla_put_failure;
++ }
++ }
+
+ if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ nla_put_be16(skb, IFLA_GRE_IFLAGS,
+@@ -2152,8 +2166,7 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
+ nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) ||
+ nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags) ||
+- nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark) ||
+- nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
++ nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark))
+ goto nla_put_failure;
+
+ if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
+@@ -2171,19 +2184,6 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ goto nla_put_failure;
+ }
+
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
+- goto nla_put_failure;
+-
+- if (p->erspan_ver == 1) {
+- if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
+- goto nla_put_failure;
+- } else if (p->erspan_ver == 2) {
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
+- goto nla_put_failure;
+- if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
+- goto nla_put_failure;
+- }
+-
+ return 0;
+
+ nla_put_failure:
+--
+2.20.1
+
--- /dev/null
+From 4c25ec8ebdc981b61c77cd132524a5061888ff8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 17:42:05 +0100
+Subject: net: ip_gre: do not report erspan_ver for gre or gretap
+
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+
+[ Upstream commit 2bdf700e538828d6456150b9319e5f689b062d54 ]
+
+Report erspan version field to userspace in ipgre_fill_info just for
+erspan tunnels. The issue can be triggered with the following reproducer:
+
+$ip link add name gre1 type gre local 192.168.0.1 remote 192.168.1.1
+$ip link set dev gre1 up
+$ip -d link sh gre1
+13: gre1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1476 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
+ link/gre 192.168.0.1 peer 192.168.1.1 promiscuity 0 minmtu 0 maxmtu 0
+ gre remote 192.168.1.1 local 192.168.0.1 ttl inherit erspan_ver 0 addrgenmode eui64 numtxqueues 1 numrxqueues 1
+
+Fixes: f551c91de262 ("net: erspan: introduce erspan v2 for ip_gre")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_gre.c | 33 +++++++++++++++++----------------
+ 1 file changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index 681276111310b..a3f77441f3e69 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1466,9 +1466,23 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ struct ip_tunnel_parm *p = &t->parms;
+ __be16 o_flags = p->o_flags;
+
+- if ((t->erspan_ver == 1 || t->erspan_ver == 2) &&
+- !t->collect_md)
+- o_flags |= TUNNEL_KEY;
++ if (t->erspan_ver == 1 || t->erspan_ver == 2) {
++ if (!t->collect_md)
++ o_flags |= TUNNEL_KEY;
++
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
++ goto nla_put_failure;
++
++ if (t->erspan_ver == 1) {
++ if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
++ goto nla_put_failure;
++ } else {
++ if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
++ goto nla_put_failure;
++ if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
++ goto nla_put_failure;
++ }
++ }
+
+ if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
+ nla_put_be16(skb, IFLA_GRE_IFLAGS,
+@@ -1504,19 +1518,6 @@ static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
+ goto nla_put_failure;
+ }
+
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
+- goto nla_put_failure;
+-
+- if (t->erspan_ver == 1) {
+- if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
+- goto nla_put_failure;
+- } else if (t->erspan_ver == 2) {
+- if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
+- goto nla_put_failure;
+- if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
+- goto nla_put_failure;
+- }
+-
+ return 0;
+
+ nla_put_failure:
+--
+2.20.1
+
--- /dev/null
+From 10d27ac18c74c7cd863d1b49c5639ae8697f2c00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 00:31:08 -0600
+Subject: net: marvell: fix a missing check of acpi_match_device
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 92ee77d148bf06d8c52664be4d1b862583fd5c0e ]
+
+When acpi_match_device fails, its return value is NULL. Directly using
+the return value without a check may result in a NULL-pointer
+dereference. The fix checks if acpi_match_device fails, and if so,
+returns -EINVAL.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 1cc0e8fda4d5e..a50977ce40766 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -5132,6 +5132,8 @@ static int mvpp2_probe(struct platform_device *pdev)
+ if (has_acpi_companion(&pdev->dev)) {
+ acpi_id = acpi_match_device(pdev->dev.driver->acpi_match_table,
+ &pdev->dev);
++ if (!acpi_id)
++ return -EINVAL;
+ priv->hw_version = (unsigned long)acpi_id->driver_data;
+ } else {
+ priv->hw_version =
+--
+2.20.1
+
--- /dev/null
+From 80aeac70414858b17f941ae33a2b69b1e2cf9946 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 13:15:11 +0200
+Subject: net/mlx5: Continue driver initialization despite debugfs failure
+
+From: Leon Romanovsky <leonro@mellanox.com>
+
+[ Upstream commit 199fa087dc6b503baad06712716fac645a983e8a ]
+
+The failure to create debugfs entry is unpleasant event, but not enough
+to abort drier initialization. Align the mlx5_core code to debugfs design
+and continue execution whenever debugfs_create_dir() successes or not.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Reviewed-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+index 231ed508c240a..5fac00ea62457 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -859,11 +859,9 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv)
+
+ priv->numa_node = dev_to_node(&dev->pdev->dev);
+
+- priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root);
+- if (!priv->dbg_root) {
+- dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n");
+- return -ENOMEM;
+- }
++ if (mlx5_debugfs_root)
++ priv->dbg_root =
++ debugfs_create_dir(pci_name(pdev), mlx5_debugfs_root);
+
+ err = mlx5_pci_enable_device(dev);
+ if (err) {
+--
+2.20.1
+
--- /dev/null
+From d90354e0f1e9b03a3adb48931276c9f1042f250c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 00:01:40 +0200
+Subject: net: mscc: ocelot: fix __ocelot_rmw_ix prototype
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit 17fdd7638cb687cd7f15a48545f25d738f0101e0 ]
+
+The "read-modify-write register index" function is declared with a
+confusing prototype: the "mask" and "reg" arguments are swapped.
+
+Fortunately, this does not affect callers so far. Both arguments are
+u32, and the wrapper macros (ocelot_rmw_ix etc) have the arguments in
+the correct order (the one from ocelot_io.c).
+
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.h b/drivers/net/ethernet/mscc/ocelot.h
+index 616bec30dfa3f..3d8c6f38e76b9 100644
+--- a/drivers/net/ethernet/mscc/ocelot.h
++++ b/drivers/net/ethernet/mscc/ocelot.h
+@@ -541,7 +541,7 @@ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset);
+ #define ocelot_write_rix(ocelot, val, reg, ri) __ocelot_write_ix(ocelot, val, reg, reg##_RSZ * (ri))
+ #define ocelot_write(ocelot, val, reg) __ocelot_write_ix(ocelot, val, reg, 0)
+
+-void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 mask,
++void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg,
+ u32 offset);
+ #define ocelot_rmw_ix(ocelot, val, m, reg, gi, ri) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi) + reg##_RSZ * (ri))
+ #define ocelot_rmw_gix(ocelot, val, m, reg, gi) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi))
+--
+2.20.1
+
--- /dev/null
+From a3c3a75042af710b18637b4b5716a9a6f8949bda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 19:42:38 -0600
+Subject: net/net_namespace: Check the return value of register_pernet_subsys()
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 0eb987c874dc93f9c9d85a6465dbde20fdd3884c ]
+
+In net_ns_init(), register_pernet_subsys() could fail while registering
+network namespace subsystems. The fix checks the return value and
+sends a panic() on failure.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/net_namespace.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 6dab186d4b8f6..c60123dff8039 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -913,7 +913,8 @@ static int __init net_ns_init(void)
+ init_net_initialized = true;
+ up_write(&pernet_ops_rwsem);
+
+- register_pernet_subsys(&net_ns_ops);
++ if (register_pernet_subsys(&net_ns_ops))
++ panic("Could not register network namespace subsystems");
+
+ rtnl_register(PF_UNSPEC, RTM_NEWNSID, rtnl_net_newid, NULL,
+ RTNL_FLAG_DOIT_UNLOCKED);
+--
+2.20.1
+
--- /dev/null
+From adecf35e9f15ad9a9d4e431c640dbca0aace0b1b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 18:54:53 -0600
+Subject: net/netlink_compat: Fix a missing check of nla_parse_nested
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 89dfd0083751d00d5d7ead36f6d8b045bf89c5e1 ]
+
+In tipc_nl_compat_sk_dump(), if nla_parse_nested() fails, it could return
+an error. To be consistent with other invocations of the function call,
+on error, the fix passes the return value upstream.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 318c541970ecd..6494d6b5e1b24 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -1030,8 +1030,11 @@ static int tipc_nl_compat_sk_dump(struct tipc_nl_compat_msg *msg,
+ u32 node;
+ struct nlattr *con[TIPC_NLA_CON_MAX + 1];
+
+- nla_parse_nested(con, TIPC_NLA_CON_MAX,
+- sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++ err = nla_parse_nested(con, TIPC_NLA_CON_MAX,
++ sock[TIPC_NLA_SOCK_CON], NULL, NULL);
++
++ if (err)
++ return err;
+
+ node = nla_get_u32(con[TIPC_NLA_CON_NODE]);
+ tipc_tlv_sprintf(msg->rep, " connected to <%u.%u.%u:%u>",
+--
+2.20.1
+
--- /dev/null
+From 7973fe904744bcf31f1384ddb6ffaf038617dc77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:51:03 +0100
+Subject: net/smc: don't wait for send buffer space when data was already sent
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 6889b36da78a21a312d8b462c1fa25a03c2ff192 ]
+
+When there is no more send buffer space and at least 1 byte was already
+sent then return to user space. The wait is only done when no data was
+sent by the sendmsg() call.
+This fixes smc_tx_sendmsg() which tried to always send all user data and
+started to wait for free send buffer space when needed. During this wait
+the user space program was blocked in the sendmsg() call and hence not
+able to receive incoming data. When both sides were in such a situation
+then the connection stalled forever.
+
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_tx.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index 28361aef99825..f1f621675db01 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -163,12 +163,11 @@ int smc_tx_sendmsg(struct smc_sock *smc, struct msghdr *msg, size_t len)
+ conn->local_tx_ctrl.prod_flags.urg_data_pending = 1;
+
+ if (!atomic_read(&conn->sndbuf_space) || conn->urg_tx_pend) {
++ if (send_done)
++ return send_done;
+ rc = smc_tx_wait(smc, msg->msg_flags);
+- if (rc) {
+- if (send_done)
+- return send_done;
++ if (rc)
+ goto out_err;
+- }
+ continue;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d06a79be0f801f2c5d0e8164b5be10d149d4d9bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Feb 2019 14:52:54 +0100
+Subject: net/smc: fix byte_order for rx_curs_confirmed
+
+From: Ursula Braun <ubraun@linux.ibm.com>
+
+[ Upstream commit ccc8ca9b90acb45a3309f922b2591b07b4e070ec ]
+
+The recent change in the rx_curs_confirmed assignment disregards
+byte order, which causes problems on little endian architectures.
+This patch fixes it.
+
+Fixes: b8649efad879 ("net/smc: fix sender_free computation") (net-tree)
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_cdc.c | 4 +---
+ net/smc/smc_cdc.h | 19 ++++++++++---------
+ 2 files changed, 11 insertions(+), 12 deletions(-)
+
+diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
+index 8f691b5a44ddf..333e4353498f8 100644
+--- a/net/smc/smc_cdc.c
++++ b/net/smc/smc_cdc.c
+@@ -106,9 +106,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+
+ conn->tx_cdc_seq++;
+ conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
+- smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
+- &conn->local_tx_ctrl, conn);
+- smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
++ smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf, conn, &cfed);
+ rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
+ if (!rc)
+ smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
+diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
+index 2377a51772d51..34d2e1450320a 100644
+--- a/net/smc/smc_cdc.h
++++ b/net/smc/smc_cdc.h
+@@ -186,26 +186,27 @@ static inline int smc_curs_diff_large(unsigned int size,
+
+ static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
+ union smc_host_cursor *local,
++ union smc_host_cursor *save,
+ struct smc_connection *conn)
+ {
+- union smc_host_cursor temp;
+-
+- smc_curs_copy(&temp, local, conn);
+- peer->count = htonl(temp.count);
+- peer->wrap = htons(temp.wrap);
++ smc_curs_copy(save, local, conn);
++ peer->count = htonl(save->count);
++ peer->wrap = htons(save->wrap);
+ /* peer->reserved = htons(0); must be ensured by caller */
+ }
+
+ static inline void smc_host_msg_to_cdc(struct smc_cdc_msg *peer,
+- struct smc_host_cdc_msg *local,
+- struct smc_connection *conn)
++ struct smc_connection *conn,
++ union smc_host_cursor *save)
+ {
++ struct smc_host_cdc_msg *local = &conn->local_tx_ctrl;
++
+ peer->common.type = local->common.type;
+ peer->len = local->len;
+ peer->seqno = htons(local->seqno);
+ peer->token = htonl(local->token);
+- smc_host_cursor_to_cdc(&peer->prod, &local->prod, conn);
+- smc_host_cursor_to_cdc(&peer->cons, &local->cons, conn);
++ smc_host_cursor_to_cdc(&peer->prod, &local->prod, save, conn);
++ smc_host_cursor_to_cdc(&peer->cons, &local->cons, save, conn);
+ peer->prod_flags = local->prod_flags;
+ peer->conn_state_flags = local->conn_state_flags;
+ }
+--
+2.20.1
+
--- /dev/null
+From 4c79ee99ac3591b5cc63d9ce346e81135a9855f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Feb 2019 13:44:45 +0100
+Subject: net/smc: fix sender_free computation
+
+From: Ursula Braun <ubraun@linux.ibm.com>
+
+[ Upstream commit b8649efad879c69c7ab1f19ce8814fcabef1f72b ]
+
+In some scenarios a separate consumer cursor update is necessary.
+The decision is made in smc_tx_consumer_cursor_update(). The
+sender_free computation could be wrong:
+
+The rx confirmed cursor is always smaller than or equal to the
+rx producer cursor. The parameters in the smc_curs_diff() call
+have to be exchanged, otherwise sender_free might even be negative.
+
+And if more data arrives local_rx_ctrl.prod might be updated, enabling
+a cursor difference between local_rx_ctrl.prod and rx confirmed cursor
+larger than the RMB size. This case is not covered by smc_curs_diff().
+Thus function smc_curs_diff_large() is introduced here.
+
+If a recvmsg() is processed in parallel, local_tx_ctrl.cons might
+change during smc_cdc_msg_send. Make sure rx_curs_confirmed is updated
+with the actually sent local_tx_ctrl.cons value.
+
+Fixes: e82f2e31f559 ("net/smc: optimize consumer cursor updates")
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_cdc.c | 5 +++--
+ net/smc/smc_cdc.h | 26 +++++++++++++++++++++++++-
+ net/smc/smc_tx.c | 3 ++-
+ 3 files changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
+index ed5dcf03fe0b6..8f691b5a44ddf 100644
+--- a/net/smc/smc_cdc.c
++++ b/net/smc/smc_cdc.c
+@@ -96,6 +96,7 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+ struct smc_wr_buf *wr_buf,
+ struct smc_cdc_tx_pend *pend)
+ {
++ union smc_host_cursor cfed;
+ struct smc_link *link;
+ int rc;
+
+@@ -107,10 +108,10 @@ int smc_cdc_msg_send(struct smc_connection *conn,
+ conn->local_tx_ctrl.seqno = conn->tx_cdc_seq;
+ smc_host_msg_to_cdc((struct smc_cdc_msg *)wr_buf,
+ &conn->local_tx_ctrl, conn);
++ smc_curs_copy(&cfed, &((struct smc_host_cdc_msg *)wr_buf)->cons, conn);
+ rc = smc_wr_tx_send(link, (struct smc_wr_tx_pend_priv *)pend);
+ if (!rc)
+- smc_curs_copy(&conn->rx_curs_confirmed,
+- &conn->local_tx_ctrl.cons, conn);
++ smc_curs_copy(&conn->rx_curs_confirmed, &cfed, conn);
+
+ return rc;
+ }
+diff --git a/net/smc/smc_cdc.h b/net/smc/smc_cdc.h
+index 934df4473a7ce..2377a51772d51 100644
+--- a/net/smc/smc_cdc.h
++++ b/net/smc/smc_cdc.h
+@@ -135,7 +135,9 @@ static inline void smc_curs_copy_net(union smc_cdc_cursor *tgt,
+ #endif
+ }
+
+-/* calculate cursor difference between old and new, where old <= new */
++/* calculate cursor difference between old and new, where old <= new and
++ * difference cannot exceed size
++ */
+ static inline int smc_curs_diff(unsigned int size,
+ union smc_host_cursor *old,
+ union smc_host_cursor *new)
+@@ -160,6 +162,28 @@ static inline int smc_curs_comp(unsigned int size,
+ return smc_curs_diff(size, old, new);
+ }
+
++/* calculate cursor difference between old and new, where old <= new and
++ * difference may exceed size
++ */
++static inline int smc_curs_diff_large(unsigned int size,
++ union smc_host_cursor *old,
++ union smc_host_cursor *new)
++{
++ if (old->wrap < new->wrap)
++ return min_t(int,
++ (size - old->count) + new->count +
++ (new->wrap - old->wrap - 1) * size,
++ size);
++
++ if (old->wrap > new->wrap) /* wrap has switched from 0xffff to 0x0000 */
++ return min_t(int,
++ (size - old->count) + new->count +
++ (new->wrap + 0xffff - old->wrap) * size,
++ size);
++
++ return max_t(int, 0, (new->count - old->count));
++}
++
+ static inline void smc_host_cursor_to_cdc(union smc_cdc_cursor *peer,
+ union smc_host_cursor *local,
+ struct smc_connection *conn)
+diff --git a/net/smc/smc_tx.c b/net/smc/smc_tx.c
+index f1f621675db01..0ecbbdc337b82 100644
+--- a/net/smc/smc_tx.c
++++ b/net/smc/smc_tx.c
+@@ -595,7 +595,8 @@ void smc_tx_consumer_update(struct smc_connection *conn, bool force)
+ if (to_confirm > conn->rmbe_update_limit) {
+ smc_curs_copy(&prod, &conn->local_rx_ctrl.prod, conn);
+ sender_free = conn->rmb_desc->len -
+- smc_curs_diff(conn->rmb_desc->len, &prod, &cfed);
++ smc_curs_diff_large(conn->rmb_desc->len,
++ &cfed, &prod);
+ }
+
+ if (conn->local_rx_ctrl.prod_flags.cons_curs_upd_req ||
+--
+2.20.1
+
--- /dev/null
+From c888405948f1d04eda384205e7023a6dc3e3b81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:51:02 +0100
+Subject: net/smc: prevent races between smc_lgr_terminate() and
+ smc_conn_free()
+
+From: Karsten Graul <kgraul@linux.ibm.com>
+
+[ Upstream commit 77f838ace755d2f466536c44dac6c856f62cd901 ]
+
+To prevent races between smc_lgr_terminate() and smc_conn_free() add an
+extra check of the lgr field before accessing it, and cancel a delayed
+free_work when a new smc connection is created.
+This fixes the problem that free_work cleared the lgr variable but
+smc_lgr_terminate() or smc_conn_free() still access it in parallel.
+
+Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
+index 18daebcef1813..2c9baf8bf1189 100644
+--- a/net/smc/smc_core.c
++++ b/net/smc/smc_core.c
+@@ -128,6 +128,8 @@ static void smc_lgr_unregister_conn(struct smc_connection *conn)
+ {
+ struct smc_link_group *lgr = conn->lgr;
+
++ if (!lgr)
++ return;
+ write_lock_bh(&lgr->conns_lock);
+ if (conn->alert_token_local) {
+ __smc_lgr_unregister_conn(conn);
+@@ -612,6 +614,8 @@ int smc_conn_create(struct smc_sock *smc, bool is_smcd, int srv_first_contact,
+ local_contact = SMC_REUSE_CONTACT;
+ conn->lgr = lgr;
+ smc_lgr_register_conn(conn); /* add smc conn to lgr */
++ if (delayed_work_pending(&lgr->free_work))
++ cancel_delayed_work(&lgr->free_work);
+ write_unlock_bh(&lgr->conns_lock);
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From e7ba8f7e8e5650d8c51588e7e09394bec1765e3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Dec 2018 20:57:14 -0600
+Subject: net: stmicro: fix a missing check of clk_prepare
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit f86a3b83833e7cfe558ca4d70b64ebc48903efec ]
+
+clk_prepare() could fail, so let's check its status, and if it fails,
+return its error code upstream.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+index d07520fb969e6..62ccbd47c1db2 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c
+@@ -59,7 +59,9 @@ static int sun7i_gmac_init(struct platform_device *pdev, void *priv)
+ gmac->clk_enabled = 1;
+ } else {
+ clk_set_rate(gmac->tx_clk, SUN7I_GMAC_MII_RATE);
+- clk_prepare(gmac->tx_clk);
++ ret = clk_prepare(gmac->tx_clk);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From d12eeef772de889d1e82435c8e3229f653b3ee41 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 16:28:30 +0800
+Subject: net/wan/fsl_ucc_hdlc: Avoid double free in ucc_hdlc_probe()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit 40752b3eae29f8ca2378e978a02bd6dbeeb06d16 ]
+
+This patch fixes potential double frees if register_hdlc_device() fails.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Reviewed-by: Peng Hao <peng.hao2@zte.com.cn>
+CC: Zhao Qiang <qiang.zhao@nxp.com>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: netdev@vger.kernel.org
+CC: linuxppc-dev@lists.ozlabs.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index 5f0366a125e26..0212f576a838c 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -1113,7 +1113,6 @@ static int ucc_hdlc_probe(struct platform_device *pdev)
+ if (register_hdlc_device(dev)) {
+ ret = -ENOBUFS;
+ pr_err("ucc_hdlc: unable to register hdlc device\n");
+- free_netdev(dev);
+ goto free_dev;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 49c84e51ece78ff87d1ba6ce2277c25e31dcf56a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 11:10:37 +0100
+Subject: netfilter: nf_nat_sip: fix RTP/RTCP source port translations
+
+From: Alin Nastac <alin.nastac@gmail.com>
+
+[ Upstream commit 8294059931448aa1ca112615bdffa3eab552c382 ]
+
+Each media stream negotiation between 2 SIP peers will trigger creation
+of 4 different expectations (2 RTP and 2 RTCP):
+ - INVITE will create expectations for the media packets sent by the
+ called peer
+ - reply to the INVITE will create expectations for media packets sent
+ by the caller
+
+The dport used by these expectations usually match the ones selected
+by the SIP peers, but they might get translated due to conflicts with
+another expectation. When such event occur, it is important to do
+this translation in both directions, dport translation on the receiving
+path and sport translation on the sending path.
+
+This commit fixes the sport translation when the peer requiring it is
+also the one that starts the media stream. In this scenario, first media
+stream packet is forwarded from LAN to WAN and will rely on
+nf_nat_sip_expected() to do the necessary sport translation. However, the
+expectation matched by this packet does not contain the necessary information
+for doing SNAT, this data being stored in the paired expectation created by
+the sender's SIP message (INVITE or reply to it).
+
+Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_nat_sip.c | 39 ++++++++++++++++++++++++++++++++++----
+ 1 file changed, 35 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
+index 1f30860749817..aa1be643d7a09 100644
+--- a/net/netfilter/nf_nat_sip.c
++++ b/net/netfilter/nf_nat_sip.c
+@@ -18,6 +18,7 @@
+
+ #include <net/netfilter/nf_nat.h>
+ #include <net/netfilter/nf_nat_helper.h>
++#include <net/netfilter/nf_conntrack_core.h>
+ #include <net/netfilter/nf_conntrack_helper.h>
+ #include <net/netfilter/nf_conntrack_expect.h>
+ #include <net/netfilter/nf_conntrack_seqadj.h>
+@@ -316,6 +317,9 @@ static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
+ static void nf_nat_sip_expected(struct nf_conn *ct,
+ struct nf_conntrack_expect *exp)
+ {
++ struct nf_conn_help *help = nfct_help(ct->master);
++ struct nf_conntrack_expect *pair_exp;
++ int range_set_for_snat = 0;
+ struct nf_nat_range2 range;
+
+ /* This must be a fresh one. */
+@@ -327,15 +331,42 @@ static void nf_nat_sip_expected(struct nf_conn *ct,
+ range.min_addr = range.max_addr = exp->saved_addr;
+ nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
+
+- /* Change src to where master sends to, but only if the connection
+- * actually came from the same source. */
+- if (nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
++ /* Do media streams SRC manip according with the parameters
++ * found in the paired expectation.
++ */
++ if (exp->class != SIP_EXPECT_SIGNALLING) {
++ spin_lock_bh(&nf_conntrack_expect_lock);
++ hlist_for_each_entry(pair_exp, &help->expectations, lnode) {
++ if (pair_exp->tuple.src.l3num == nf_ct_l3num(ct) &&
++ pair_exp->tuple.dst.protonum == ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.protonum &&
++ nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3, &pair_exp->saved_addr) &&
++ ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u.all == pair_exp->saved_proto.all) {
++ range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
++ range.min_proto.all = range.max_proto.all = pair_exp->tuple.dst.u.all;
++ range.min_addr = range.max_addr = pair_exp->tuple.dst.u3;
++ range_set_for_snat = 1;
++ break;
++ }
++ }
++ spin_unlock_bh(&nf_conntrack_expect_lock);
++ }
++
++ /* When no paired expectation has been found, change src to
++ * where master sends to, but only if the connection actually came
++ * from the same source.
++ */
++ if (!range_set_for_snat &&
++ nf_inet_addr_cmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
+ &ct->master->tuplehash[exp->dir].tuple.src.u3)) {
+ range.flags = NF_NAT_RANGE_MAP_IPS;
+ range.min_addr = range.max_addr
+ = ct->master->tuplehash[!exp->dir].tuple.dst.u3;
+- nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
++ range_set_for_snat = 1;
+ }
++
++ /* Perform SRC manip. */
++ if (range_set_for_snat)
++ nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
+ }
+
+ static unsigned int nf_nat_sip_expect(struct sk_buff *skb, unsigned int protoff,
+--
+2.20.1
+
--- /dev/null
+From 712bbf11e2aebabe8764bae47fa9c5412c0987e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:46:23 -0600
+Subject: netfilter: nf_tables: fix a missing check of nla_put_failure
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit eb8950861c1bfd3eecc8f6faad213e3bca0dc395 ]
+
+If nla_nest_start() may fail. The fix checks its return value and goes
+to nla_put_failure if it fails.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 289d079008ee8..ec0f8b5bde0aa 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -5737,6 +5737,8 @@ static int nf_tables_fill_flowtable_info(struct sk_buff *skb, struct net *net,
+ goto nla_put_failure;
+
+ nest = nla_nest_start(skb, NFTA_FLOWTABLE_HOOK);
++ if (!nest)
++ goto nla_put_failure;
+ if (nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_NUM, htonl(flowtable->hooknum)) ||
+ nla_put_be32(skb, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(flowtable->priority)))
+ goto nla_put_failure;
+--
+2.20.1
+
--- /dev/null
+From 69af1f53d59fe9d42fb6d9093a2793a94950eb96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 12:34:07 -0800
+Subject: nvme: fix kernel paging oops
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 092ff0520070fad8407b196f3bb6156ce77a6f98 ]
+
+free the controller discard_page correctly.
+
+Fixes: cb5b7262b011 ("nvme: provide fallback for discard alloc failure")
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 250ccf3108e98..c4ff4f079448e 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3569,7 +3569,7 @@ static void nvme_free_ctrl(struct device *dev)
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ kfree(ctrl->effects);
+ nvme_mpath_uninit(ctrl);
+- kfree(ctrl->discard_page);
++ __free_page(ctrl->discard_page);
+
+ if (subsys) {
+ mutex_lock(&subsys->lock);
+--
+2.20.1
+
--- /dev/null
+From bb4ead48deb7d079ff61459e4398b1933716f2b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 09:18:11 -0700
+Subject: nvme: provide fallback for discard alloc failure
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit cb5b7262b011cfb793519bf97e54dff5282da23c ]
+
+When boxes are run near (or to) OOM, we have a problem with the discard
+page allocation in nvme. If we fail allocating the special page, we
+return busy, and it'll get retried. But since ordering is honored for
+dispatch requests, we can keep retrying this same IO and failing. Behind
+that IO could be requests that want to free memory, but they never get
+the chance.
+
+Allocate a fixed discard page per controller for a safe fallback, and use
+that if the initial allocation fails.
+
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 41 ++++++++++++++++++++++++++++++++++------
+ drivers/nvme/host/nvme.h | 3 +++
+ 2 files changed, 38 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 44da9fe5b27b8..250ccf3108e98 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -551,9 +551,19 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ struct nvme_dsm_range *range;
+ struct bio *bio;
+
+- range = kmalloc_array(segments, sizeof(*range), GFP_ATOMIC);
+- if (!range)
+- return BLK_STS_RESOURCE;
++ range = kmalloc_array(segments, sizeof(*range),
++ GFP_ATOMIC | __GFP_NOWARN);
++ if (!range) {
++ /*
++ * If we fail allocation our range, fallback to the controller
++ * discard page. If that's also busy, it's safe to return
++ * busy, as we know we can make progress once that's freed.
++ */
++ if (test_and_set_bit_lock(0, &ns->ctrl->discard_page_busy))
++ return BLK_STS_RESOURCE;
++
++ range = page_address(ns->ctrl->discard_page);
++ }
+
+ __rq_for_each_bio(bio, req) {
+ u64 slba = nvme_block_nr(ns, bio->bi_iter.bi_sector);
+@@ -568,7 +578,10 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req,
+ }
+
+ if (WARN_ON_ONCE(n != segments)) {
+- kfree(range);
++ if (virt_to_page(range) == ns->ctrl->discard_page)
++ clear_bit_unlock(0, &ns->ctrl->discard_page_busy);
++ else
++ kfree(range);
+ return BLK_STS_IOERR;
+ }
+
+@@ -653,8 +666,13 @@ void nvme_cleanup_cmd(struct request *req)
+ blk_rq_bytes(req) >> ns->lba_shift);
+ }
+ if (req->rq_flags & RQF_SPECIAL_PAYLOAD) {
+- kfree(page_address(req->special_vec.bv_page) +
+- req->special_vec.bv_offset);
++ struct nvme_ns *ns = req->rq_disk->private_data;
++ struct page *page = req->special_vec.bv_page;
++
++ if (page == ns->ctrl->discard_page)
++ clear_bit_unlock(0, &ns->ctrl->discard_page_busy);
++ else
++ kfree(page_address(page) + req->special_vec.bv_offset);
+ }
+ }
+ EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);
+@@ -3551,6 +3569,7 @@ static void nvme_free_ctrl(struct device *dev)
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ kfree(ctrl->effects);
+ nvme_mpath_uninit(ctrl);
++ kfree(ctrl->discard_page);
+
+ if (subsys) {
+ mutex_lock(&subsys->lock);
+@@ -3592,6 +3611,14 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+ memset(&ctrl->ka_cmd, 0, sizeof(ctrl->ka_cmd));
+ ctrl->ka_cmd.common.opcode = nvme_admin_keep_alive;
+
++ BUILD_BUG_ON(NVME_DSM_MAX_RANGES * sizeof(struct nvme_dsm_range) >
++ PAGE_SIZE);
++ ctrl->discard_page = alloc_page(GFP_KERNEL);
++ if (!ctrl->discard_page) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
+ ret = ida_simple_get(&nvme_instance_ida, 0, 0, GFP_KERNEL);
+ if (ret < 0)
+ goto out;
+@@ -3629,6 +3656,8 @@ out_free_name:
+ out_release_instance:
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ out:
++ if (ctrl->discard_page)
++ __free_page(ctrl->discard_page);
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(nvme_init_ctrl);
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index 2653e1f4196d5..cc4273f119894 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -238,6 +238,9 @@ struct nvme_ctrl {
+ u16 maxcmd;
+ int nr_reconnects;
+ struct nvmf_ctrl_options *opts;
++
++ struct page *discard_page;
++ unsigned long discard_page_busy;
+ };
+
+ struct nvme_subsystem {
+--
+2.20.1
+
--- /dev/null
+From 7ebd358cb418b77cf5fc225bd33ac7ea749e3b7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:32:53 -0800
+Subject: ocfs2: clear journal dirty flag after shutdown journal
+
+From: Junxiao Bi <junxiao.bi@oracle.com>
+
+[ Upstream commit d85400af790dba2aa294f0a77e712f166681f977 ]
+
+Dirty flag of the journal should be cleared at the last stage of umount,
+if do it before jbd2_journal_destroy(), then some metadata in uncommitted
+transaction could be lost due to io error, but as dirty flag of journal
+was already cleared, we can't find that until run a full fsck. This may
+cause system panic or other corruption.
+
+Link: http://lkml.kernel.org/r/20181121020023.3034-3-junxiao.bi@oracle.com
+Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
+Reviewed-by: Yiwen Jiang <jiangyiwen@huawei.com>
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Cc: Changwei Ge <ge.changwei@h3c.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
+index babb0ec76d676..fc1f209e5db06 100644
+--- a/fs/ocfs2/journal.c
++++ b/fs/ocfs2/journal.c
+@@ -1018,7 +1018,8 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ mlog_errno(status);
+ }
+
+- if (status == 0) {
++ /* Shutdown the kernel journal system */
++ if (!jbd2_journal_destroy(journal->j_journal) && !status) {
+ /*
+ * Do not toggle if flush was unsuccessful otherwise
+ * will leave dirty metadata in a "clean" journal
+@@ -1027,9 +1028,6 @@ void ocfs2_journal_shutdown(struct ocfs2_super *osb)
+ if (status < 0)
+ mlog_errno(status);
+ }
+-
+- /* Shutdown the kernel journal system */
+- jbd2_journal_destroy(journal->j_journal);
+ journal->j_journal = NULL;
+
+ OCFS2_I(inode)->ip_open_count--;
+--
+2.20.1
+
--- /dev/null
+From 0cddd1f0a84821cc921a8f5b6d5162b2197dd969 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 13:20:47 +0100
+Subject: openrisc: Fix broken paths to arch/or32
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit 57ce8ba0fd3a95bf29ed741df1c52bd591bf43ff ]
+
+OpenRISC was mainlined as "openrisc", not "or32".
+vmlinux.lds is generated from vmlinux.lds.S.
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Stafford Horne <shorne@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/openrisc/kernel/entry.S | 2 +-
+ arch/openrisc/kernel/head.S | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/openrisc/kernel/entry.S b/arch/openrisc/kernel/entry.S
+index 0c826ad6e994c..ee6159d2ed22e 100644
+--- a/arch/openrisc/kernel/entry.S
++++ b/arch/openrisc/kernel/entry.S
+@@ -240,7 +240,7 @@ handler: ;\
+ * occured. in fact they never do. if you need them use
+ * values saved on stack (for SPR_EPC, SPR_ESR) or content
+ * of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE()
+- * in 'arch/or32/kernel/head.S'
++ * in 'arch/openrisc/kernel/head.S'
+ */
+
+ /* =====================================================[ exceptions] === */
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index 9fc6b60140f00..31ed257ff0618 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -1728,7 +1728,7 @@ _string_nl:
+
+ /*
+ * .data section should be page aligned
+- * (look into arch/or32/kernel/vmlinux.lds)
++ * (look into arch/openrisc/kernel/vmlinux.lds.S)
+ */
+ .section .data,"aw"
+ .align 8192
+--
+2.20.1
+
--- /dev/null
+From 681b9c6ec593cc1901555b3fbef9f02a2a17344b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:06:34 +0100
+Subject: parisc: Fix HP SDC hpa address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit c4bff35ca1bfba886da6223c9fed76a2b1382b8e ]
+
+Show the hpa address of the HP SDC instead of a hashed value, e.g.:
+HP SDC: HP SDC at 0xf0201000, IRQ 23 (NMI IRQ 24)
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/hp_sdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
+index 0b8a25c58d02e..654252361653d 100644
+--- a/drivers/input/serio/hp_sdc.c
++++ b/drivers/input/serio/hp_sdc.c
+@@ -884,8 +884,8 @@ static int __init hp_sdc_init(void)
+ "HP SDC NMI", &hp_sdc))
+ goto err2;
+
+- printk(KERN_INFO PREFIX "HP SDC at 0x%p, IRQ %d (NMI IRQ %d)\n",
+- (void *)hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
++ pr_info(PREFIX "HP SDC at 0x%08lx, IRQ %d (NMI IRQ %d)\n",
++ hp_sdc.base_io, hp_sdc.irq, hp_sdc.nmi);
+
+ hp_sdc_status_in8();
+ hp_sdc_data_in8();
+--
+2.20.1
+
--- /dev/null
+From a515fef7320a72ad52ed0288e6953982ad4e898b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 21:09:59 +0100
+Subject: parisc: Fix serio address output
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 785145171d17af2554128becd6a7c8f89e101141 ]
+
+We want the hpa addresses printed in the serio modules, not some
+virtual ioremap()ed address, e.g.:
+
+ serio: gsc-ps2-keyboard port at 0xf0108000 irq 22 @ 2:0:11
+ serio: gsc-ps2-mouse port at 0xf0108100 irq 22 @ 2:0:12
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/gscps2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/serio/gscps2.c b/drivers/input/serio/gscps2.c
+index 49d8d53e50b7b..96f9b5397367f 100644
+--- a/drivers/input/serio/gscps2.c
++++ b/drivers/input/serio/gscps2.c
+@@ -381,9 +381,9 @@ static int __init gscps2_probe(struct parisc_device *dev)
+ goto fail;
+ #endif
+
+- printk(KERN_INFO "serio: %s port at 0x%p irq %d @ %s\n",
++ pr_info("serio: %s port at 0x%08lx irq %d @ %s\n",
+ ps2port->port->name,
+- ps2port->addr,
++ hpa,
+ ps2port->padev->irq,
+ ps2port->port->phys);
+
+--
+2.20.1
+
--- /dev/null
+From 6c3232ba9ff0fe46aa228a90c27bdcc9cfc7748d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jan 2019 17:31:29 -0600
+Subject: PCI/MSI: Return -ENOSPC from pci_alloc_irq_vectors_affinity()
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 77f88abd4a6f73a1a68dbdc0e3f21575fd508fc3 ]
+
+The API of pci_alloc_irq_vectors_affinity() says it returns -ENOSPC if
+fewer than @min_vecs interrupt vectors are available for @dev.
+
+However, if a device supports MSI-X but not MSI and a caller requests
+@min_vecs that can't be satisfied by MSI-X, we previously returned -EINVAL
+(from the failed attempt to enable MSI), not -ENOSPC.
+
+When -ENOSPC is returned, callers may reduce the number IRQs they request
+and try again. Most callers can use the @min_vecs and @max_vecs
+parameters to avoid this retry loop, but that doesn't work when using IRQ
+affinity "nr_sets" because rebalancing the sets is driver-specific.
+
+This return value bug has been present since pci_alloc_irq_vectors() was
+added in v4.10 by aff171641d18 ("PCI: Provide sensible IRQ vector
+alloc/free routines"), but it wasn't an issue because @min_vecs/@max_vecs
+removed the need for callers to iteratively reduce the number of IRQs
+requested and retry the allocation, so they didn't need to distinguish
+-ENOSPC from -EINVAL.
+
+In v5.0, 6da4b3ab9a6e ("genirq/affinity: Add support for allocating
+interrupt sets") added IRQ sets to the interface, which reintroduced the
+need to check for -ENOSPC and possibly reduce the number of IRQs requested
+and retry the allocation.
+
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+[bhelgaas: changelog]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Jens Axboe <axboe@fb.com>
+Cc: Keith Busch <keith.busch@intel.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/msi.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
+index af24ed50a2452..971dddf62374f 100644
+--- a/drivers/pci/msi.c
++++ b/drivers/pci/msi.c
+@@ -1155,7 +1155,8 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ const struct irq_affinity *affd)
+ {
+ static const struct irq_affinity msi_default_affd;
+- int vecs = -ENOSPC;
++ int msix_vecs = -ENOSPC;
++ int msi_vecs = -ENOSPC;
+
+ if (flags & PCI_IRQ_AFFINITY) {
+ if (!affd)
+@@ -1166,16 +1167,17 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ }
+
+ if (flags & PCI_IRQ_MSIX) {
+- vecs = __pci_enable_msix_range(dev, NULL, min_vecs, max_vecs,
+- affd);
+- if (vecs > 0)
+- return vecs;
++ msix_vecs = __pci_enable_msix_range(dev, NULL, min_vecs,
++ max_vecs, affd);
++ if (msix_vecs > 0)
++ return msix_vecs;
+ }
+
+ if (flags & PCI_IRQ_MSI) {
+- vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs, affd);
+- if (vecs > 0)
+- return vecs;
++ msi_vecs = __pci_enable_msi_range(dev, min_vecs, max_vecs,
++ affd);
++ if (msi_vecs > 0)
++ return msi_vecs;
+ }
+
+ /* use legacy irq if allowed */
+@@ -1186,7 +1188,9 @@ int pci_alloc_irq_vectors_affinity(struct pci_dev *dev, unsigned int min_vecs,
+ }
+ }
+
+- return vecs;
++ if (msix_vecs == -ENOSPC)
++ return -ENOSPC;
++ return msi_vecs;
+ }
+ EXPORT_SYMBOL(pci_alloc_irq_vectors_affinity);
+
+--
+2.20.1
+
--- /dev/null
+From bdcc5bb6466c51deca858b1e086002fdee1941aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 16:34:41 +0300
+Subject: pinctrl: cherryview: Allocate IRQ chip dynamic
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 67d33aecd030226f0a577eb683aaa6853ecf8f91 ]
+
+Keeping the IRQ chip definition static shares it with multiple instances
+of the GPIO chip in the system. This is bad and now we get this warning
+from GPIO library:
+
+"detected irqchip that is shared with multiple gpiochips: please fix the driver."
+
+Hence, move the IRQ chip definition from being driver static into the struct
+intel_pinctrl. So a unique IRQ chip is used for each GPIO chip instance.
+
+This patch is heavily based on the attachment to the bug by Christoph Marz.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=202543
+Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support")
+Depends-on: 83b9dc11312f ("pinctrl: cherryview: Associate IRQ descriptors to irqdomain")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 24 +++++++++++-----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 9eab508395814..f16baf9b86962 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -157,6 +157,7 @@ struct chv_pin_context {
+ * @pctldesc: Pin controller description
+ * @pctldev: Pointer to the pin controller device
+ * @chip: GPIO chip in this pin controller
++ * @irqchip: IRQ chip in this pin controller
+ * @regs: MMIO registers
+ * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
+ * offset (in GPIO number space)
+@@ -170,6 +171,7 @@ struct chv_pinctrl {
+ struct pinctrl_desc pctldesc;
+ struct pinctrl_dev *pctldev;
+ struct gpio_chip chip;
++ struct irq_chip irqchip;
+ void __iomem *regs;
+ unsigned intr_lines[16];
+ const struct chv_community *community;
+@@ -1477,16 +1479,6 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned type)
+ return 0;
+ }
+
+-static struct irq_chip chv_gpio_irqchip = {
+- .name = "chv-gpio",
+- .irq_startup = chv_gpio_irq_startup,
+- .irq_ack = chv_gpio_irq_ack,
+- .irq_mask = chv_gpio_irq_mask,
+- .irq_unmask = chv_gpio_irq_unmask,
+- .irq_set_type = chv_gpio_irq_type,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
+-};
+-
+ static void chv_gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct gpio_chip *gc = irq_desc_get_handler_data(desc);
+@@ -1626,7 +1618,15 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ }
+ }
+
+- ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
++ pctrl->irqchip.name = "chv-gpio";
++ pctrl->irqchip.irq_startup = chv_gpio_irq_startup;
++ pctrl->irqchip.irq_ack = chv_gpio_irq_ack;
++ pctrl->irqchip.irq_mask = chv_gpio_irq_mask;
++ pctrl->irqchip.irq_unmask = chv_gpio_irq_unmask;
++ pctrl->irqchip.irq_set_type = chv_gpio_irq_type;
++ pctrl->irqchip.flags = IRQCHIP_SKIP_SET_WAKE;
++
++ ret = gpiochip_irqchip_add(chip, &pctrl->irqchip, 0,
+ handle_bad_irq, IRQ_TYPE_NONE);
+ if (ret) {
+ dev_err(pctrl->dev, "failed to add IRQ chip\n");
+@@ -1643,7 +1643,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ }
+ }
+
+- gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq,
++ gpiochip_set_chained_irqchip(chip, &pctrl->irqchip, irq,
+ chv_gpio_irq_handler);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 5317d8b2ed09e72f7e6fb19e71cdb151ca37313e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 10:53:11 +0100
+Subject: pinctrl: sh-pfc: r8a77990: Fix MOD_SEL0 SEL_I2C1 field width
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 755a5b805fa7ff22e2934d67501efd92109f41ea ]
+
+The SEL_I2C1 (MOD_SEL0[21:20]) field in Module Select Register 0 has a
+width of 2 bits, i.e. it allows programming one out of 4 different
+configurations.
+However, the MOD_SEL0_21_20 macro contains 8 values instead of 4,
+overflowing into the subsequent fields in the register, and thus breaking
+the configuration of the latter.
+
+Fix this by dropping the bogus last 4 values, including the non-existent
+SEL_I2C1_4 configuration.
+
+Fixes: 6d4036a1e3b3ac0f ("pinctrl: sh-pfc: Initial R8A77990 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77990.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+index b81c807ac54d5..d2fcf7f7b9668 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77990.c
+@@ -395,7 +395,7 @@ FM(IP12_31_28) IP12_31_28 FM(IP13_31_28) IP13_31_28 FM(IP14_31_28) IP14_31_28 FM
+ #define MOD_SEL0_24 FM(SEL_HSCIF0_0) FM(SEL_HSCIF0_1)
+ #define MOD_SEL0_23 FM(SEL_HSCIF1_0) FM(SEL_HSCIF1_1)
+ #define MOD_SEL0_22 FM(SEL_HSCIF2_0) FM(SEL_HSCIF2_1)
+-#define MOD_SEL0_21_20 FM(SEL_I2C1_0) FM(SEL_I2C1_1) FM(SEL_I2C1_2) FM(SEL_I2C1_3) FM(SEL_I2C1_4) F_(0, 0) F_(0, 0) F_(0, 0)
++#define MOD_SEL0_21_20 FM(SEL_I2C1_0) FM(SEL_I2C1_1) FM(SEL_I2C1_2) FM(SEL_I2C1_3)
+ #define MOD_SEL0_19_18_17 FM(SEL_I2C2_0) FM(SEL_I2C2_1) FM(SEL_I2C2_2) FM(SEL_I2C2_3) FM(SEL_I2C2_4) F_(0, 0) F_(0, 0) F_(0, 0)
+ #define MOD_SEL0_16 FM(SEL_NDFC_0) FM(SEL_NDFC_1)
+ #define MOD_SEL0_15 FM(SEL_PWM0_0) FM(SEL_PWM0_1)
+--
+2.20.1
+
--- /dev/null
+From 9174901b74b52b744f6155519d5cb309029ec7dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:09:56 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1b99d0c80bbe1810572c2cb77b90f67886adfa8d ]
+
+The Port F Control Register 3 (PFCR3) contains only a single field.
+However, counting from left to right, it is the fourth field, not the
+first field.
+Insert the missing dummy configuration values (3 fields of 16 values) to
+fix this.
+
+The descriptor for the Port F Control Register 0 (PFCR0) lacks the
+description for the 4th field (PF0 Mode, PF0MD[2:0]).
+Add the missing configuration values to fix this.
+
+Fixes: a8d42fc4217b1ea1 ("sh-pfc: Add sh7264 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index 8070765311dbf..e1c34e19222ee 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -1716,6 +1716,9 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PFCR3", 0xfffe38a8, 16, 4) {
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PF12MD_000, PF12MD_001, 0, PF12MD_011,
+ PF12MD_100, PF12MD_101, 0, 0,
+ 0, 0, 0, 0, 0, 0, 0, 0 }
+@@ -1759,8 +1762,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ PF1MD_000, PF1MD_001, PF1MD_010, PF1MD_011,
+ PF1MD_100, PF1MD_101, 0, 0,
+- 0, 0, 0, 0, 0, 0, 0, 0
+- }
++ 0, 0, 0, 0, 0, 0, 0, 0,
++ PF0MD_000, PF0MD_001, PF0MD_010, PF0MD_011,
++ PF0MD_100, PF0MD_101, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0 }
+ },
+
+ { PINMUX_CFG_REG("PFIOR0", 0xfffe38b2, 16, 1) {
+--
+2.20.1
+
--- /dev/null
+From 7f491b2237291efb8eace46cdef426f14d0af862 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:41:11 +0100
+Subject: pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 054f2400f706327f96770219c3065b5131f8f154 ]
+
+Some values in the Peripheral Function Select Register 10 descriptor are
+shifted by one position, which may cause a peripheral function to be
+programmed incorrectly.
+
+Fixing this makes all HSCIF0 pins use Function 4 (value 3), like was
+already the case for the HSCK0 pin in field IP10[5:3].
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 6502e676d3686..33232041ee86d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2213,22 +2213,22 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ /* IP10_22 [1] */
+ FN_CAN_CLK_A, FN_RX4_D,
+ /* IP10_21_19 [3] */
+- FN_AUDIO_CLKOUT, FN_TX1_E, FN_HRTS0_C, FN_FSE_B,
+- FN_LCD_M_DISP_B, 0, 0, 0,
++ FN_AUDIO_CLKOUT, FN_TX1_E, 0, FN_HRTS0_C, FN_FSE_B,
++ FN_LCD_M_DISP_B, 0, 0,
+ /* IP10_18_16 [3] */
+- FN_AUDIO_CLKC, FN_SCK1_E, FN_HCTS0_C, FN_FRB_B,
+- FN_LCD_VEPWC_B, 0, 0, 0,
++ FN_AUDIO_CLKC, FN_SCK1_E, 0, FN_HCTS0_C, FN_FRB_B,
++ FN_LCD_VEPWC_B, 0, 0,
+ /* IP10_15 [1] */
+ FN_AUDIO_CLKB_A, FN_LCD_CLK_B,
+ /* IP10_14_12 [3] */
+ FN_AUDIO_CLKA_A, FN_VI1_CLK_B, FN_SCK1_D, FN_IECLK_B,
+ FN_LCD_FLM_B, 0, 0, 0,
+ /* IP10_11_9 [3] */
+- FN_SSI_SDATA3, FN_VI1_7_B, FN_HTX0_C, FN_FWE_B,
+- FN_LCD_CL2_B, 0, 0, 0,
++ FN_SSI_SDATA3, FN_VI1_7_B, 0, FN_HTX0_C, FN_FWE_B,
++ FN_LCD_CL2_B, 0, 0,
+ /* IP10_8_6 [3] */
+- FN_SSI_SDATA2, FN_VI1_6_B, FN_HRX0_C, FN_FRE_B,
+- FN_LCD_CL1_B, 0, 0, 0,
++ FN_SSI_SDATA2, FN_VI1_6_B, 0, FN_HRX0_C, FN_FRE_B,
++ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+ FN_LCD_DON_B, 0, 0, 0,
+--
+2.20.1
+
--- /dev/null
+From 1f772932eb41d00e0656ce4d1c5b66a67ee314ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 08:48:25 +0100
+Subject: pinctrl: xway: fix gpio-hog related boot issues
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 9b4924da4711674e62d97d4f5360446cc78337af ]
+
+This patch is based on commit a86caa9ba5d7 ("pinctrl: msm: fix gpio-hog
+related boot issues").
+
+It fixes the issue that the gpio ranges needs to be defined before
+gpiochip_add().
+
+Therefore, we also have to swap the order of registering the pinctrl
+driver and registering the gpio chip.
+
+You also have to add the "gpio-ranges" property to the pinctrl device
+node to get it finally working.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Acked-by: John Crispin <john@phrozen.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/pinctrl-xway.c | 39 +++++++++++++++++++++++-----------
+ 1 file changed, 27 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/pinctrl-xway.c b/drivers/pinctrl/pinctrl-xway.c
+index 93f8bd04e7fe6..ae74b260b014b 100644
+--- a/drivers/pinctrl/pinctrl-xway.c
++++ b/drivers/pinctrl/pinctrl-xway.c
+@@ -1746,14 +1746,6 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ }
+ xway_pctrl_desc.pins = xway_info.pads;
+
+- /* register the gpio chip */
+- xway_chip.parent = &pdev->dev;
+- ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
+- if (ret) {
+- dev_err(&pdev->dev, "Failed to register gpio chip\n");
+- return ret;
+- }
+-
+ /* setup the data needed by pinctrl */
+ xway_pctrl_desc.name = dev_name(&pdev->dev);
+ xway_pctrl_desc.npins = xway_chip.ngpio;
+@@ -1775,10 +1767,33 @@ static int pinmux_xway_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- /* finish with registering the gpio range in pinctrl */
+- xway_gpio_range.npins = xway_chip.ngpio;
+- xway_gpio_range.base = xway_chip.base;
+- pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ /* register the gpio chip */
++ xway_chip.parent = &pdev->dev;
++ xway_chip.owner = THIS_MODULE;
++ xway_chip.of_node = pdev->dev.of_node;
++ ret = devm_gpiochip_add_data(&pdev->dev, &xway_chip, NULL);
++ if (ret) {
++ dev_err(&pdev->dev, "Failed to register gpio chip\n");
++ return ret;
++ }
++
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pdev->dev.of_node, "gpio-ranges")) {
++ /* finish with registering the gpio range in pinctrl */
++ xway_gpio_range.npins = xway_chip.ngpio;
++ xway_gpio_range.base = xway_chip.base;
++ pinctrl_add_gpio_range(xway_info.pctrl, &xway_gpio_range);
++ }
++
+ dev_info(&pdev->dev, "Init done\n");
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From c70829ff595a1f60d9525e6c56600cb1ea790702 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 17:26:57 +0000
+Subject: platform/x86: mlx-platform: Fix LED configuration
+
+From: Vadim Pasternak <vadimp@mellanox.com>
+
+[ Upstream commit 440f343df1996302d9a3904647ff11b689bf27bc ]
+
+Exchange LED configuration between msn201x and next generation systems
+types.
+
+Bug was introduced when LED driver activation was added to mlx-platform.
+LED configuration for the three new system MQMB7, MSN37, MSN34 was
+assigned to MSN21 and vice versa. This bug affects MSN21 only and
+likely requires backport to v4.19.
+
+Fixes: 1189456b1cce ("platform/x86: mlx-platform: Add LED platform driver activation")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/mlx-platform.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c
+index d17db140cb1fc..69e28c12d5915 100644
+--- a/drivers/platform/x86/mlx-platform.c
++++ b/drivers/platform/x86/mlx-platform.c
+@@ -1421,7 +1421,7 @@ static int __init mlxplat_dmi_msn201x_matched(const struct dmi_system_id *dmi)
+ mlxplat_hotplug = &mlxplat_mlxcpld_msn201x_data;
+ mlxplat_hotplug->deferred_nr =
+ mlxplat_default_channels[i - 1][MLXPLAT_CPLD_GRP_CHNL_NUM - 1];
+- mlxplat_led = &mlxplat_default_ng_led_data;
++ mlxplat_led = &mlxplat_msn21xx_led_data;
+ mlxplat_regs_io = &mlxplat_msn21xx_regs_io_data;
+
+ return 1;
+@@ -1439,7 +1439,7 @@ static int __init mlxplat_dmi_qmb7xx_matched(const struct dmi_system_id *dmi)
+ mlxplat_hotplug = &mlxplat_mlxcpld_default_ng_data;
+ mlxplat_hotplug->deferred_nr =
+ mlxplat_msn21xx_channels[MLXPLAT_CPLD_GRP_CHNL_NUM - 1];
+- mlxplat_led = &mlxplat_msn21xx_led_data;
++ mlxplat_led = &mlxplat_default_ng_led_data;
+ mlxplat_fan = &mlxplat_default_fan_data;
+
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From 1ab6add9819546c3732824a24ebd05f91ebd81bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 21:52:11 +0100
+Subject: PM / AVS: SmartReflex: NULL check before some freeing functions is
+ not needed
+
+From: Thomas Meyer <thomas@m3y3r.de>
+
+[ Upstream commit 14d338a857f05f894ba3badd9e6d3039c68b8180 ]
+
+NULL check before some freeing functions is not needed.
+
+Signed-off-by: Thomas Meyer <thomas@m3y3r.de>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/avs/smartreflex.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/power/avs/smartreflex.c b/drivers/power/avs/smartreflex.c
+index 1360a7fa542c5..8760477d0e8af 100644
+--- a/drivers/power/avs/smartreflex.c
++++ b/drivers/power/avs/smartreflex.c
+@@ -1010,8 +1010,7 @@ static int omap_sr_remove(struct platform_device *pdev)
+
+ if (sr_info->autocomp_active)
+ sr_stop_vddautocomp(sr_info);
+- if (sr_info->dbg_dir)
+- debugfs_remove_recursive(sr_info->dbg_dir);
++ debugfs_remove_recursive(sr_info->dbg_dir);
+
+ pm_runtime_disable(&pdev->dev);
+ list_del(&sr_info->node);
+--
+2.20.1
+
--- /dev/null
+From 1148dc5331b461df1ea331b4894a91eb26d12dc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 15:58:06 +1030
+Subject: powerpc/32: Avoid unsupported flags with clang
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit 72e7bcc2cdf82bf03caaa5e6c9b0134c2fc2ee7d ]
+
+When building for ppc32 with clang these flags are unsupported:
+
+ -ffixed-r2 and -mmultiple
+
+llvm's lib/Target/PowerPC/PPCRegisterInfo.cpp marks r2 as reserved on
+when building for SVR4ABI and !ppc64:
+
+ // The SVR4 ABI reserves r2 and r13
+ if (Subtarget.isSVR4ABI()) {
+ // We only reserve r2 if we need to use the TOC pointer. If we have no
+ // explicit uses of the TOC pointer (meaning we're a leaf function with
+ // no constant-pool loads, etc.) and we have no potential uses inside an
+ // inline asm block, then we can treat r2 has an ordinary callee-saved
+ // register.
+ const PPCFunctionInfo *FuncInfo = MF.getInfo<PPCFunctionInfo>();
+ if (!TM.isPPC64() || FuncInfo->usesTOCBasePtr() || MF.hasInlineAsm())
+ markSuperRegs(Reserved, PPC::R2); // System-reserved register
+ markSuperRegs(Reserved, PPC::R13); // Small Data Area pointer register
+ }
+
+This means we can safely omit -ffixed-r2 when building for 32-bit
+targets.
+
+The -mmultiple/-mno-multiple flags are not supported by clang, so
+platforms that might support multiple miss out on using multiple word
+instructions.
+
+We wrap these flags in cc-option so that when Clang gains support the
+kernel will be able use these flags.
+
+Clang 8 can then build a ppc44x_defconfig which boots in Qemu:
+
+ make CC=clang-8 ARCH=powerpc CROSS_COMPILE=powerpc-linux-gnu- ppc44x_defconfig
+ ./scripts/config -e CONFIG_DEVTMPFS -d DEVTMPFS_MOUNT
+ make CC=clang-8 ARCH=powerpc CROSS_COMPILE=powerpc-linux-gnu-
+
+ qemu-system-ppc -M bamboo \
+ -kernel arch/powerpc/boot/zImage \
+ -dtb arch/powerpc/boot/dts/bamboo.dtb \
+ -initrd ~/ppc32-440-rootfs.cpio \
+ -nographic -serial stdio -monitor pty -append "console=ttyS0"
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/261
+Link: https://bugs.llvm.org/show_bug.cgi?id=39556
+Link: https://bugs.llvm.org/show_bug.cgi?id=39555
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index c4c03992ee828..dfcb698ec8f3b 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -145,7 +145,14 @@ endif
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mcmodel=medium,$(call cc-option,-mminimal-toc))
+ CFLAGS-$(CONFIG_PPC64) += $(call cc-option,-mno-pointers-to-nested-functions)
+
+-CFLAGS-$(CONFIG_PPC32) := -ffixed-r2 $(MULTIPLEWORD)
++# Clang unconditionally reserves r2 on ppc32 and does not support the flag
++# https://bugs.llvm.org/show_bug.cgi?id=39555
++CFLAGS-$(CONFIG_PPC32) := $(call cc-option, -ffixed-r2)
++
++# Clang doesn't support -mmultiple / -mno-multiple
++# https://bugs.llvm.org/show_bug.cgi?id=39556
++CFLAGS-$(CONFIG_PPC32) += $(call cc-option, $(MULTIPLEWORD))
++
+ CFLAGS-$(CONFIG_PPC32) += $(call cc-option,-mno-readonly-in-sdata)
+
+ ifdef CONFIG_PPC_BOOK3S_64
+--
+2.20.1
+
--- /dev/null
+From 036e85e694f91fc643bd48a49bea7bd3eed182a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 13:27:33 +1100
+Subject: powerpc/44x/bamboo: Fix PCI range
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit 3cfb9ebe906b51f2942b1e251009bb251efd2ba6 ]
+
+The bamboo dts has a bug: it uses a non-naturally aligned range
+for PCI memory space. This isnt' supported by the code, thus
+causing PCI to break on this system.
+
+This is due to the fact that while the chip memory map has 1G
+reserved for PCI memory, it's only 512M aligned. The code doesn't
+know how to split that into 2 different PMMs and fails, so limit
+the region to 512M.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/bamboo.dts | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/boot/dts/bamboo.dts b/arch/powerpc/boot/dts/bamboo.dts
+index 538e42b1120d8..b5861fa3836c1 100644
+--- a/arch/powerpc/boot/dts/bamboo.dts
++++ b/arch/powerpc/boot/dts/bamboo.dts
+@@ -268,8 +268,10 @@
+ /* Outbound ranges, one memory and one IO,
+ * later cannot be changed. Chip supports a second
+ * IO range but we don't use it for now
++ * The chip also supports a larger memory range but
++ * it's not naturally aligned, so our code will break
+ */
+- ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x40000000
++ ranges = <0x02000000 0x00000000 0xa0000000 0x00000000 0xa0000000 0x00000000 0x20000000
+ 0x02000000 0x00000000 0x00000000 0x00000000 0xe0000000 0x00000000 0x00100000
+ 0x01000000 0x00000000 0x00000000 0x00000000 0xe8000000 0x00000000 0x00010000>;
+
+--
+2.20.1
+
--- /dev/null
+From baa07d8bc754517270e37131c824c75e54b958e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:41:29 +0000
+Subject: powerpc/83xx: handle machine check caused by watchdog timer
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 0deae39cec6dab3a66794f3e9e83ca4dc30080f1 ]
+
+When the watchdog timer is set in interrupt mode, it causes a
+machine check when it times out. The purpose of this mode is to
+ease debugging, not to crash the kernel and reboot the machine.
+
+This patch implements a special handling for that, in order to not
+crash the kernel if the watchdog times out while in interrupt or
+within the idle task.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[scottwood: added missing #include]
+Signed-off-by: Scott Wood <oss@buserror.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/cputable.h | 1 +
+ arch/powerpc/include/asm/reg.h | 2 ++
+ arch/powerpc/kernel/cputable.c | 10 ++++++----
+ arch/powerpc/platforms/83xx/misc.c | 17 +++++++++++++++++
+ 4 files changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h
+index 3ce690e5f345c..59b35b93eadec 100644
+--- a/arch/powerpc/include/asm/cputable.h
++++ b/arch/powerpc/include/asm/cputable.h
+@@ -44,6 +44,7 @@ extern int machine_check_e500(struct pt_regs *regs);
+ extern int machine_check_e200(struct pt_regs *regs);
+ extern int machine_check_47x(struct pt_regs *regs);
+ int machine_check_8xx(struct pt_regs *regs);
++int machine_check_83xx(struct pt_regs *regs);
+
+ extern void cpu_down_flush_e500v2(void);
+ extern void cpu_down_flush_e500mc(void);
+diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
+index 640a4d818772a..af99716615122 100644
+--- a/arch/powerpc/include/asm/reg.h
++++ b/arch/powerpc/include/asm/reg.h
+@@ -768,6 +768,8 @@
+ #define SRR1_PROGTRAP 0x00020000 /* Trap */
+ #define SRR1_PROGADDR 0x00010000 /* SRR0 contains subsequent addr */
+
++#define SRR1_MCE_MCP 0x00080000 /* Machine check signal caused interrupt */
++
+ #define SPRN_HSRR0 0x13A /* Save/Restore Register 0 */
+ #define SPRN_HSRR1 0x13B /* Save/Restore Register 1 */
+ #define HSRR1_DENORM 0x00100000 /* Denorm exception */
+diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
+index 2da01340c84c3..1eab54bc6ee93 100644
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -1141,6 +1141,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .machine_check = machine_check_generic,
+ .platform = "ppc603",
+ },
++#ifdef CONFIG_PPC_83xx
+ { /* e300c1 (a 603e core, plus some) on 83xx */
+ .pvr_mask = 0x7fff0000,
+ .pvr_value = 0x00830000,
+@@ -1151,7 +1152,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c2 (an e300c1 core, plus some, minus FPU) on 83xx */
+@@ -1165,7 +1166,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .platform = "ppc603",
+ },
+ { /* e300c3 (e300c1, plus one IU, half cache size) on 83xx */
+@@ -1179,7 +1180,7 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+@@ -1196,12 +1197,13 @@ static struct cpu_spec __initdata cpu_specs[] = {
+ .icache_bsize = 32,
+ .dcache_bsize = 32,
+ .cpu_setup = __setup_cpu_603,
+- .machine_check = machine_check_generic,
++ .machine_check = machine_check_83xx,
+ .num_pmcs = 4,
+ .oprofile_cpu_type = "ppc/e300",
+ .oprofile_type = PPC_OPROFILE_FSL_EMB,
+ .platform = "ppc603",
+ },
++#endif
+ { /* default match, we assume split I/D cache & TB (non-601)... */
+ .pvr_mask = 0x00000000,
+ .pvr_value = 0x00000000,
+diff --git a/arch/powerpc/platforms/83xx/misc.c b/arch/powerpc/platforms/83xx/misc.c
+index d75c9816a5c92..2b6589fe812dd 100644
+--- a/arch/powerpc/platforms/83xx/misc.c
++++ b/arch/powerpc/platforms/83xx/misc.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_platform.h>
+ #include <linux/pci.h>
+
++#include <asm/debug.h>
+ #include <asm/io.h>
+ #include <asm/hw_irq.h>
+ #include <asm/ipic.h>
+@@ -150,3 +151,19 @@ void __init mpc83xx_setup_arch(void)
+
+ mpc83xx_setup_pci();
+ }
++
++int machine_check_83xx(struct pt_regs *regs)
++{
++ u32 mask = 1 << (31 - IPIC_MCP_WDT);
++
++ if (!(regs->msr & SRR1_MCE_MCP) || !(ipic_get_mcp_status() & mask))
++ return machine_check_generic(regs);
++ ipic_clear_mcp_status(mask);
++
++ if (debugger_fault_handler(regs))
++ return 1;
++
++ die("Watchdog NMI Reset", regs, 0);
++
++ return 1;
++}
+--
+2.20.1
+
--- /dev/null
+From 0f2d7c67fb5bca83e8bdc45931d6cb72c6132e65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:27:42 +0000
+Subject: powerpc/book3s/32: fix number of bats in p/v_block_mapped()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit e93ba1b7eb5b188c749052df7af1c90821c5f320 ]
+
+This patch fixes the loop in p_block_mapped() and v_block_mapped()
+to scan the entire bat_addrs[] array.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/ppc_mmu_32.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/ppc_mmu_32.c b/arch/powerpc/mm/ppc_mmu_32.c
+index bea6c544e38f9..06783270a1242 100644
+--- a/arch/powerpc/mm/ppc_mmu_32.c
++++ b/arch/powerpc/mm/ppc_mmu_32.c
+@@ -52,7 +52,7 @@ struct batrange { /* stores address ranges mapped by BATs */
+ phys_addr_t v_block_mapped(unsigned long va)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (va >= bat_addrs[b].start && va < bat_addrs[b].limit)
+ return bat_addrs[b].phys + (va - bat_addrs[b].start);
+ return 0;
+@@ -64,7 +64,7 @@ phys_addr_t v_block_mapped(unsigned long va)
+ unsigned long p_block_mapped(phys_addr_t pa)
+ {
+ int b;
+- for (b = 0; b < 4; ++b)
++ for (b = 0; b < ARRAY_SIZE(bat_addrs); ++b)
+ if (pa >= bat_addrs[b].phys
+ && pa < (bat_addrs[b].limit-bat_addrs[b].start)
+ +bat_addrs[b].phys)
+--
+2.20.1
+
--- /dev/null
+From 9ba25b3b6b147967e15d9df47f7eb757e56aed75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 20:34:44 -0700
+Subject: powerpc/bpf: Fix tail call implementation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 7de086909365cd60a5619a45af3f4152516fd75c ]
+
+We have seen many crashes on powerpc hosts while loading bpf programs.
+
+The problem here is that bpf_int_jit_compile() does a first pass
+to compute the program length.
+
+Then it allocates memory to store the generated program and
+calls bpf_jit_build_body() a second time (and a third time
+later)
+
+What I have observed is that the second bpf_jit_build_body()
+could end up using few more words than expected.
+
+If bpf_jit_binary_alloc() put the space for the program
+at the end of the allocated page, we then write on
+a non mapped memory.
+
+It appears that bpf_jit_emit_tail_call() calls
+bpf_jit_emit_common_epilogue() while ctx->seen might not
+be stable.
+
+Only after the second pass we can be sure ctx->seen wont be changed.
+
+Trying to avoid a second pass seems quite complex and probably
+not worth it.
+
+Fixes: ce0761419faef ("powerpc/bpf: Implement support for tail calls")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Naveen N. Rao <naveen.n.rao@linux.ibm.com>
+Cc: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20191101033444.143741-1-edumazet@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/net/bpf_jit_comp64.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 279a51bf94d05..7e3ab477f67fe 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -949,6 +949,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+ goto out_addrs;
+ }
+
++ /*
++ * If we have seen a tail call, we need a second pass.
++ * This is because bpf_jit_emit_common_epilogue() is called
++ * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen.
++ */
++ if (cgctx.seen & SEEN_TAILCALL) {
++ cgctx.idx = 0;
++ if (bpf_jit_build_body(fp, 0, &cgctx, addrs, false)) {
++ fp = org_fp;
++ goto out_addrs;
++ }
++ }
++
+ /*
+ * Pretend to build prologue, given the features we've seen. This will
+ * update ctgtx.idx as it pretends to output instructions, then we can
+--
+2.20.1
+
--- /dev/null
+From b996e829dbba621173e3eea17f1a75a9d1cac101 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Oct 2018 15:08:31 +1100
+Subject: powerpc: Fix HMIs on big-endian with CONFIG_RELOCATABLE=y
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+[ Upstream commit 505a314fb28ce122091691c51426fa85c084e115 ]
+
+HMIs will crash the kernel due to
+
+ BRANCH_LINK_TO_FAR(hmi_exception_realmode)
+
+Calling into the OPD instead of the actual code.
+
+Fixes: 2337d207288f ("powerpc/64: CONFIG_RELOCATABLE support for hmi interrupts")
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+[mpe: Use DOTSYM() rather than #ifdef]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/exceptions-64s.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 90af86f143a91..e1dab9b1e4478 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1123,7 +1123,7 @@ TRAMP_REAL_BEGIN(hmi_exception_early)
+ EXCEPTION_PROLOG_COMMON_2(PACA_EXGEN)
+ EXCEPTION_PROLOG_COMMON_3(0xe60)
+ addi r3,r1,STACK_FRAME_OVERHEAD
+- BRANCH_LINK_TO_FAR(hmi_exception_realmode) /* Function call ABI */
++ BRANCH_LINK_TO_FAR(DOTSYM(hmi_exception_realmode)) /* Function call ABI */
+ cmpdi cr0,r3,0
+
+ /* Windup the stack. */
+--
+2.20.1
+
--- /dev/null
+From 5a248786bd599f016bd24b0ed8893fdb349981b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 15:23:33 +0000
+Subject: powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 49a502ea23bf9dec47f8f3c3960909ff409cd1bb ]
+
+As several other arches including x86, this patch makes it explicit
+that a bad page fault is a NULL pointer dereference when the fault
+address is lower than PAGE_SIZE
+
+In the mean time, this page makes all bad_page_fault() messages
+shorter so that they remain on one single line. And it prefixes them
+by "BUG: " so that they get easily grepped.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Avoid pr_cont()]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/fault.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 365526ee29b88..6e0ff8b600ced 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -633,21 +633,22 @@ void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
+ switch (TRAP(regs)) {
+ case 0x300:
+ case 0x380:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "data at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: %s at 0x%08lx\n",
++ regs->dar < PAGE_SIZE ? "Kernel NULL pointer dereference" :
++ "Unable to handle kernel data access", regs->dar);
+ break;
+ case 0x400:
+ case 0x480:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "instruction fetch\n");
++ pr_alert("BUG: Unable to handle kernel instruction fetch%s",
++ regs->nip < PAGE_SIZE ? " (NULL pointer?)\n" : "\n");
+ break;
+ case 0x600:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unaligned access at address 0x%08lx\n", regs->dar);
++ pr_alert("BUG: Unable to handle kernel unaligned access at 0x%08lx\n",
++ regs->dar);
+ break;
+ default:
+- printk(KERN_ALERT "Unable to handle kernel paging request for "
+- "unknown fault\n");
++ pr_alert("BUG: Unable to handle unknown paging fault at 0x%08lx\n",
++ regs->dar);
+ break;
+ }
+ printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
+--
+2.20.1
+
--- /dev/null
+From 94e48d2016faf4b31638cf1272527c092993a274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Oct 2017 19:42:40 +0530
+Subject: powerpc/perf: Fix unit_sel/cache_sel checks
+
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+
+[ Upstream commit 2d46d4877b1afd14059393a48bdb8ce27955174c ]
+
+Raw event code has couple of fields "unit" and "cache" in it, to capture
+the "unit" to monitor for a given pmcxsel and cache reload qualifier to
+program in MMCR1.
+
+isa207_get_constraint() refers "unit" field to update the MMCRC (L2/L3)
+Event bus control fields with "cache" bits of the raw event code.
+These are power8 specific and not supported by PowerISA v3.0 pmu. So wrap
+the checks to be power8 specific. Also, "cache" bit field is referred to
+update MMCR1[16:17] and this check can be power8 specific.
+
+Fixes: 7ffd948fae4cd ('powerpc/perf: factor out power8 pmu functions')
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/perf/isa207-common.c | 25 ++++++++++++++++++-------
+ arch/powerpc/perf/isa207-common.h | 4 ++--
+ 2 files changed, 20 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 6a2f65d3d088c..053b8e9aa9e75 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -148,6 +148,14 @@ static bool is_thresh_cmp_valid(u64 event)
+ return true;
+ }
+
++static unsigned int dc_ic_rld_quad_l1_sel(u64 event)
++{
++ unsigned int cache;
++
++ cache = (event >> EVENT_CACHE_SEL_SHIFT) & MMCR1_DC_IC_QUAL_MASK;
++ return cache;
++}
++
+ static inline u64 isa207_find_source(u64 idx, u32 sub_idx)
+ {
+ u64 ret = PERF_MEM_NA;
+@@ -288,10 +296,10 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ * have a cache selector of zero. The bank selector (bit 3) is
+ * irrelevant, as long as the rest of the value is 0.
+ */
+- if (cache & 0x7)
++ if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7))
+ return -1;
+
+- } else if (event & EVENT_IS_L1) {
++ } else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) {
+ mask |= CNST_L1_QUAL_MASK;
+ value |= CNST_L1_QUAL_VAL(cache);
+ }
+@@ -394,11 +402,14 @@ int isa207_compute_mmcr(u64 event[], int n_ev,
+ /* In continuous sampling mode, update SDAR on TLB miss */
+ mmcra_sdar_mode(event[i], &mmcra);
+
+- if (event[i] & EVENT_IS_L1) {
+- cache = event[i] >> EVENT_CACHE_SEL_SHIFT;
+- mmcr1 |= (cache & 1) << MMCR1_IC_QUAL_SHIFT;
+- cache >>= 1;
+- mmcr1 |= (cache & 1) << MMCR1_DC_QUAL_SHIFT;
++ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++ cache = dc_ic_rld_quad_l1_sel(event[i]);
++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++ } else {
++ if (event[i] & EVENT_IS_L1) {
++ cache = dc_ic_rld_quad_l1_sel(event[i]);
++ mmcr1 |= (cache) << MMCR1_DC_IC_QUAL_SHIFT;
++ }
+ }
+
+ if (is_event_marked(event[i])) {
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index 0028f4b9490db..e5a621699a6d8 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -163,8 +163,8 @@
+ #define MMCR1_COMBINE_SHIFT(pmc) (35 - ((pmc) - 1))
+ #define MMCR1_PMCSEL_SHIFT(pmc) (24 - (((pmc) - 1)) * 8)
+ #define MMCR1_FAB_SHIFT 36
+-#define MMCR1_DC_QUAL_SHIFT 47
+-#define MMCR1_IC_QUAL_SHIFT 46
++#define MMCR1_DC_IC_QUAL_MASK 0x3
++#define MMCR1_DC_IC_QUAL_SHIFT 46
+
+ /* MMCR1 Combine bits macro for power9 */
+ #define p9_MMCR1_COMBINE_SHIFT(pmc) (38 - ((pmc - 1) * 2))
+--
+2.20.1
+
--- /dev/null
+From 299cbd871ab7d66d95a97eac289bc137970d5afb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 15:25:17 +1100
+Subject: powerpc/powernv/eeh/npu: Fix uninitialized variables in
+ opal_pci_eeh_freeze_status
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit c20577014f85f36d4e137d3d52a1f61225b4a3d2 ]
+
+The current implementation of the OPAL_PCI_EEH_FREEZE_STATUS call in
+skiboot's NPU driver does not touch the pci_error_type parameter so
+it might have garbage but the powernv code analyzes it nevertheless.
+
+This initializes pcierr and fstate to zero in all call sites.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/eeh-powernv.c | 8 ++++----
+ arch/powerpc/platforms/powernv/pci-ioda.c | 4 ++--
+ arch/powerpc/platforms/powernv/pci.c | 4 ++--
+ 3 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/eeh-powernv.c b/arch/powerpc/platforms/powernv/eeh-powernv.c
+index 3c1beae29f2d8..9dd5b8909178b 100644
+--- a/arch/powerpc/platforms/powernv/eeh-powernv.c
++++ b/arch/powerpc/platforms/powernv/eeh-powernv.c
+@@ -578,8 +578,8 @@ static void pnv_eeh_get_phb_diag(struct eeh_pe *pe)
+ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result = 0;
+
+@@ -617,8 +617,8 @@ static int pnv_eeh_get_phb_state(struct eeh_pe *pe)
+ static int pnv_eeh_get_pe_state(struct eeh_pe *pe)
+ {
+ struct pnv_phb *phb = pe->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ s64 rc;
+ int result;
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 326ca6288bb12..ee63749a2d47e 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -605,8 +605,8 @@ static int pnv_ioda_unfreeze_pe(struct pnv_phb *phb, int pe_no, int opt)
+ static int pnv_ioda_get_pe_state(struct pnv_phb *phb, int pe_no)
+ {
+ struct pnv_ioda_pe *slave, *pe;
+- u8 fstate, state;
+- __be16 pcierr;
++ u8 fstate = 0, state;
++ __be16 pcierr = 0;
+ s64 rc;
+
+ /* Sanity check on PE number */
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index 13aef2323bbca..db230a35609bf 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -602,8 +602,8 @@ static void pnv_pci_handle_eeh_config(struct pnv_phb *phb, u32 pe_no)
+ static void pnv_pci_config_check_eeh(struct pci_dn *pdn)
+ {
+ struct pnv_phb *phb = pdn->phb->private_data;
+- u8 fstate;
+- __be16 pcierr;
++ u8 fstate = 0;
++ __be16 pcierr = 0;
+ unsigned int pe_no;
+ s64 rc;
+
+--
+2.20.1
+
--- /dev/null
+From e266e3f1433fafd8f5d2882094c009f8592507f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 10:27:47 +0000
+Subject: powerpc/prom: fix early DEBUG messages
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit b18f0ae92b0a1db565c3e505fa87b6971ad3b641 ]
+
+This patch fixes early DEBUG messages in prom.c:
+- Use %px instead of %p to see the addresses
+- Cast memblock_phys_mem_size() with (unsigned long long) to
+avoid build failure when phys_addr_t is not 64 bits.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/prom.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kernel/prom.c b/arch/powerpc/kernel/prom.c
+index c4d7078e5295f..8e88f78e57dba 100644
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -129,7 +129,7 @@ static void __init move_device_tree(void)
+ p = __va(memblock_alloc(size, PAGE_SIZE));
+ memcpy(p, initial_boot_params, size);
+ initial_boot_params = p;
+- DBG("Moved device tree to 0x%p\n", p);
++ DBG("Moved device tree to 0x%px\n", p);
+ }
+
+ DBG("<- move_device_tree\n");
+@@ -689,7 +689,7 @@ void __init early_init_devtree(void *params)
+ {
+ phys_addr_t limit;
+
+- DBG(" -> early_init_devtree(%p)\n", params);
++ DBG(" -> early_init_devtree(%px)\n", params);
+
+ /* Too early to BUG_ON(), do it by hand */
+ if (!early_init_dt_verify(params))
+@@ -749,7 +749,7 @@ void __init early_init_devtree(void *params)
+ memblock_allow_resize();
+ memblock_dump_all();
+
+- DBG("Phys. mem: %llx\n", memblock_phys_mem_size());
++ DBG("Phys. mem: %llx\n", (unsigned long long)memblock_phys_mem_size());
+
+ /* We may need to relocate the flat tree, do it now.
+ * FIXME .. and the initrd too? */
+--
+2.20.1
+
--- /dev/null
+From fe09bad60431b2a4725d8f8ea9170fd2c5669ae5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 May 2019 10:42:40 +0800
+Subject: powerpc/pseries/dlpar: Fix a missing check in
+ dlpar_parse_cc_property()
+
+From: Gen Zhang <blackgod016574@gmail.com>
+
+[ Upstream commit efa9ace68e487ddd29c2b4d6dd23242158f1f607 ]
+
+In dlpar_parse_cc_property(), 'prop->name' is allocated by kstrdup().
+kstrdup() may return NULL, so it should be checked and handle error.
+And prop should be freed if 'prop->name' is NULL.
+
+Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index e3010b14aea51..c5ffcadab7302 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -63,6 +63,10 @@ static struct property *dlpar_parse_cc_property(struct cc_workarea *ccwa)
+
+ name = (char *)ccwa + be32_to_cpu(ccwa->name_offset);
+ prop->name = kstrdup(name, GFP_KERNEL);
++ if (!prop->name) {
++ dlpar_free_cc_property(prop);
++ return NULL;
++ }
+
+ prop->length = be32_to_cpu(ccwa->prop_length);
+ value = (char *)ccwa + be32_to_cpu(ccwa->prop_offset);
+--
+2.20.1
+
--- /dev/null
+From 7364d9a357d685e84629c35dc16be46d9abb89ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 19:16:44 +1100
+Subject: powerpc/pseries: Fix node leak in update_lmb_associativity_index()
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 47918bc68b7427e961035949cc1501a864578a69 ]
+
+In update_lmb_associativity_index() we lookup dr_node using
+of_find_node_by_path() which takes a reference for us. In the
+non-error case we forget to drop the reference. Note that
+find_aa_index() does modify properties of the node, but doesn't need
+an extra reference held once it's returned.
+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/hotplug-memory.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
+index d93ff494e7781..7f86bc3eaadec 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
+@@ -202,6 +202,7 @@ static int update_lmb_associativity_index(struct drmem_lmb *lmb)
+
+ aa_index = find_aa_index(dr_node, ala_prop, lmb_assoc);
+
++ of_node_put(dr_node);
+ dlpar_free_cc_nodes(lmb_node);
+
+ if (aa_index < 0) {
+--
+2.20.1
+
--- /dev/null
+From afedceec3b90abcb6fe06362d2c0686f645edd52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 17:31:08 +0000
+Subject: powerpc/xmon: fix dump_segments()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 32c8c4c621897199e690760c2d57054f8b84b6e6 ]
+
+mfsrin() takes segment num from bits 31-28 (IBM bits 0-3).
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+[mpe: Clarify bit numbering]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/xmon/xmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index bb5db7bfd8539..f0fa22e7d36c7 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -3493,7 +3493,7 @@ void dump_segments(void)
+
+ printf("sr0-15 =");
+ for (i = 0; i < 16; ++i)
+- printf(" %x", mfsrin(i));
++ printf(" %x", mfsrin(i << 28));
+ printf("\n");
+ }
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 44f311a221a978a2501ea3b64465a98ab8c25c21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 21:22:18 +0200
+Subject: pwm: bcm-iproc: Prevent unloading the driver module while in use
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ]
+
+The owner member of struct pwm_ops must be set to THIS_MODULE to
+increase the reference count of the module such that the module cannot
+be removed while its code is in use.
+
+Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm-iproc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index d961a8207b1cb..31b01035d0ab3 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ static const struct pwm_ops iproc_pwm_ops = {
+ .apply = iproc_pwmc_apply,
+ .get_state = iproc_pwmc_get_state,
++ .owner = THIS_MODULE,
+ };
+
+ static int iproc_pwmc_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 3d5a5713fdf3f2cec73f7683ac948772adb9475b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 13:39:24 +0300
+Subject: pwm: clps711x: Fix period calculation
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit b0f17570b8203c22f139459c86cfbaa0311313ed ]
+
+Commit e39c0df1be5a ("pwm: Introduce the pwm_args concept") has
+changed the variable for the period for clps711x-pwm driver, so now
+pwm_get/set_period() works with pwm->state.period variable instead
+of pwm->args.period.
+This patch changes the period variable in other places where it is used.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-clps711x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-clps711x.c b/drivers/pwm/pwm-clps711x.c
+index 26ec24e457b12..7e16b7def0dcb 100644
+--- a/drivers/pwm/pwm-clps711x.c
++++ b/drivers/pwm/pwm-clps711x.c
+@@ -48,7 +48,7 @@ static void clps711x_pwm_update_val(struct clps711x_chip *priv, u32 n, u32 v)
+ static unsigned int clps711x_get_duty(struct pwm_device *pwm, unsigned int v)
+ {
+ /* Duty cycle 0..15 max */
+- return DIV_ROUND_CLOSEST(v * 0xf, pwm_get_period(pwm));
++ return DIV_ROUND_CLOSEST(v * 0xf, pwm->args.period);
+ }
+
+ static int clps711x_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)
+@@ -71,7 +71,7 @@ static int clps711x_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
+ struct clps711x_chip *priv = to_clps711x_chip(chip);
+ unsigned int duty;
+
+- if (period_ns != pwm_get_period(pwm))
++ if (period_ns != pwm->args.period)
+ return -EINVAL;
+
+ duty = clps711x_get_duty(pwm, duty_ns);
+--
+2.20.1
+
--- /dev/null
+From 415598fb850673ccb6cf41a1b4e4c2d84a1e22dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 17:49:07 +0800
+Subject: RDMA/hns: Bugfix for the scene without receiver queue
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 4d103905eb1e4f14cb62fcf962c9d35da7005dea ]
+
+In some application scenario, the user could not have receive queue when
+run rdma write or read operation.
+
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 54d22868ffba5..af24698ff2262 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -522,7 +522,8 @@ static int hns_roce_qp_has_sq(struct ib_qp_init_attr *attr)
+ static int hns_roce_qp_has_rq(struct ib_qp_init_attr *attr)
+ {
+ if (attr->qp_type == IB_QPT_XRC_INI ||
+- attr->qp_type == IB_QPT_XRC_TGT || attr->srq)
++ attr->qp_type == IB_QPT_XRC_TGT || attr->srq ||
++ !attr->cap.max_recv_wr)
+ return 0;
+
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From b88c5027f53d17a476421fb2978d928fd8c83b20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 Dec 2018 18:40:09 +0800
+Subject: RDMA/hns: Fix the bug while use multi-hop of pbl
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 4af07f01f7a787ba5158352b98c9e3cb74995a1c ]
+
+It will prevent multiply overflow when defines the pbl for u64 type.
+
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_mr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
+index 41a538d23b802..c68596d4e8037 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
+@@ -1017,14 +1017,14 @@ struct ib_mr *hns_roce_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
+ goto err_umem;
+ }
+ } else {
+- int pbl_size = 1;
++ u64 pbl_size = 1;
+
+ bt_size = (1 << (hr_dev->caps.pbl_ba_pg_sz + PAGE_SHIFT)) / 8;
+ for (i = 0; i < hr_dev->caps.pbl_hop_num; i++)
+ pbl_size *= bt_size;
+ if (n > pbl_size) {
+ dev_err(dev,
+- " MR len %lld err. MR page num is limited to %d!\n",
++ " MR len %lld err. MR page num is limited to %lld!\n",
+ length, pbl_size);
+ ret = -EINVAL;
+ goto err_umem;
+--
+2.20.1
+
--- /dev/null
+From 83f1151da24e7ded344f918e039193a9ccb16154 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 17:49:06 +0800
+Subject: RDMA/hns: Fix the bug with updating rq head pointer when flush cqe
+
+From: Lijun Ou <oulijun@huawei.com>
+
+[ Upstream commit 9c6ccc035c209dda07685e8dba829a203ba17499 ]
+
+When flush cqe with srq, the driver disable to update the rq head pointer
+into the hardware.
+
+Signed-off-by: Lijun Ou <oulijun@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 9e7923cf85773..1eda8a22a4252 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -3503,13 +3503,16 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
+ roce_set_field(qpc_mask->byte_160_sq_ci_pi,
+ V2_QPC_BYTE_160_SQ_PRODUCER_IDX_M,
+ V2_QPC_BYTE_160_SQ_PRODUCER_IDX_S, 0);
+- roce_set_field(context->byte_84_rq_ci_pi,
++
++ if (!ibqp->srq) {
++ roce_set_field(context->byte_84_rq_ci_pi,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_M,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_S,
+ hr_qp->rq.head);
+- roce_set_field(qpc_mask->byte_84_rq_ci_pi,
++ roce_set_field(qpc_mask->byte_84_rq_ci_pi,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_M,
+ V2_QPC_BYTE_84_RQ_PRODUCER_IDX_S, 0);
++ }
+ }
+
+ if (attr_mask & IB_QP_AV) {
+@@ -3971,7 +3974,8 @@ static void hns_roce_set_qps_to_err(struct hns_roce_dev *hr_dev, u32 qpn)
+ if (hr_qp->ibqp.uobject) {
+ if (hr_qp->sdb_en == 1) {
+ hr_qp->sq.head = *(int *)(hr_qp->sdb.virt_addr);
+- hr_qp->rq.head = *(int *)(hr_qp->rdb.virt_addr);
++ if (hr_qp->rdb_en == 1)
++ hr_qp->rq.head = *(int *)(hr_qp->rdb.virt_addr);
+ } else {
+ dev_warn(hr_dev->dev, "flush cqe is unsupported in userspace!\n");
+ return;
+--
+2.20.1
+
--- /dev/null
+From d34c01927bdafc60aa24e047990985eceb36951b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Feb 2019 16:13:04 +0800
+Subject: RDMA/hns: Fix the state of rereg mr
+
+From: Yixian Liu <liuyixian@huawei.com>
+
+[ Upstream commit ab22bf05216a6bb4812448f3a8609489047cf311 ]
+
+The state of mr after reregister operation should be set to valid
+state. Otherwise, it will keep the same as the state before reregistered.
+
+Signed-off-by: Yixian Liu <liuyixian@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index 1eda8a22a4252..a5ec900a14ae9 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -1776,6 +1776,9 @@ static int hns_roce_v2_rereg_write_mtpt(struct hns_roce_dev *hr_dev,
+ struct hns_roce_v2_mpt_entry *mpt_entry = mb_buf;
+ int ret = 0;
+
++ roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_MPT_ST_M,
++ V2_MPT_BYTE_4_MPT_ST_S, V2_MPT_ST_VALID);
++
+ if (flags & IB_MR_REREG_PD) {
+ roce_set_field(mpt_entry->byte_4_pd_hop_st, V2_MPT_BYTE_4_PD_M,
+ V2_MPT_BYTE_4_PD_S, pdn);
+--
+2.20.1
+
--- /dev/null
+From 672d6765c1d98deafaa2b9a3098d6e62db968fdb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 10:56:20 +0800
+Subject: RDMA/hns: Use GFP_ATOMIC in hns_roce_v2_modify_qp
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 4e69cf1fe2c52d189acdd06c1fd99cc258aba61f ]
+
+The the below commit, hns_roce_v2_modify_qp is called inside spinlock
+while using GFP_KERNEL. Change it to GFP_ATOMIC.
+
+Fixes: 0425e3e6e0c7 ("RDMA/hns: Support flush cqe for hip08 in kernel space")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+index a5ec900a14ae9..7021444f18b46 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+@@ -3446,7 +3446,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,
+ struct device *dev = hr_dev->dev;
+ int ret = -EINVAL;
+
+- context = kcalloc(2, sizeof(*context), GFP_KERNEL);
++ context = kcalloc(2, sizeof(*context), GFP_ATOMIC);
+ if (!context)
+ return -ENOMEM;
+
+--
+2.20.1
+
--- /dev/null
+From db1499030fbf01544fb3ba571cadf6a0c0cf8317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 13:20:36 -0800
+Subject: RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 2ee00f6a98c36f7e4ba07cc33f24cc5a69060cc9 ]
+
+This patch avoids that the SCSI mid-layer keeps retrying forever if
+ib_post_send() fails. This was discovered while testing immediate
+data support and passing a too large num_sge value to ib_post_send().
+
+Cc: Sergey Gorenko <sergeygo@mellanox.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index bc6a44a16445c..03ee53adaacd2 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2357,6 +2357,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
+
+ if (srp_post_send(ch, iu, len)) {
+ shost_printk(KERN_ERR, target->scsi_host, PFX "Send failed\n");
++ scmnd->result = DID_ERROR << 16;
+ goto err_unmap;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ce9a72eedd33cc3205fb7099b9ab190bb7683867 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 17:17:25 +0200
+Subject: RDMA/vmw_pvrdma: Use atomic memory allocation in create AH
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit a276a4d93bf1580d737f38d1810e5f4b166f3edd ]
+
+Create address handle callback should not sleep, use GFP_ATOMIC instead of
+GFP_KERNEL for memory allocation.
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Cc: Adit Ranadive <aditr@vmware.com>
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+index b65d10b0a8759..f4cb5cf26006f 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+@@ -555,7 +555,7 @@ struct ib_ah *pvrdma_create_ah(struct ib_pd *pd, struct rdma_ah_attr *ah_attr,
+ if (!atomic_add_unless(&dev->num_ahs, 1, dev->dsr->caps.max_ah))
+ return ERR_PTR(-ENOMEM);
+
+- ah = kzalloc(sizeof(*ah), GFP_KERNEL);
++ ah = kzalloc(sizeof(*ah), GFP_ATOMIC);
+ if (!ah) {
+ atomic_dec(&dev->num_ahs);
+ return ERR_PTR(-ENOMEM);
+--
+2.20.1
+
--- /dev/null
+From 0322aff18b2460ed9e86d1dc9b94a22b3e0318b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:29:19 -0600
+Subject: regulator: tps65910: fix a missing check of return value
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit cd07e3701fa6a4c68f8493ee1d12caa18d46ec6a ]
+
+tps65910_reg_set_bits() may fail. The fix checks if it fails, and if so,
+returns with its error code.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65910-regulator.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
+index 02ccdaa226a73..5ebb6ee73f077 100644
+--- a/drivers/regulator/tps65910-regulator.c
++++ b/drivers/regulator/tps65910-regulator.c
+@@ -1102,8 +1102,10 @@ static int tps65910_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, pmic);
+
+ /* Give control of all register to control port */
+- tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
++ err = tps65910_reg_set_bits(pmic->mfd, TPS65910_DEVCTRL,
+ DEVCTRL_SR_CTL_I2C_SEL_MASK);
++ if (err < 0)
++ return err;
+
+ switch (tps65910_chip_id(tps65910)) {
+ case TPS65910:
+--
+2.20.1
+
--- /dev/null
+From 9fce0af22cf3c1d6aec155e58879c8cb2fa2a847 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 14:06:23 +0530
+Subject: reset: Fix memory leak in reset_control_array_put()
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 532f9cd6ee994ed10403e856ca27501428048597 ]
+
+Memory allocated for 'struct reset_control_array' in
+of_reset_control_array_get() is never freed in
+reset_control_array_put() resulting in kmemleak showing
+the following backtrace.
+
+ backtrace:
+ [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0
+ [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180
+ [<000000004cc02754>] 0xffff800008c669e4
+ [<0000000050a83b24>] platform_drv_probe+0x50/0xa0
+ [<00000000d3a0b0bc>] really_probe+0x108/0x348
+ [<000000005aa458ac>] driver_probe_device+0x58/0x100
+ [<000000008853626c>] device_driver_attach+0x6c/0x90
+ [<0000000085308d19>] __driver_attach+0x84/0xc8
+ [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8
+ [<00000000dd7f015b>] driver_attach+0x20/0x28
+ [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0
+ [<0000000061473b66>] driver_register+0x60/0x110
+ [<00000000c5bec167>] __platform_driver_register+0x40/0x48
+ [<000000007c764b4f>] 0xffff800008c6c020
+ [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0
+ [<0000000093d4b50d>] do_init_module+0x54/0x1d0
+
+Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index d1887c0ed5d3f..f7bf20493f23e 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -607,6 +607,7 @@ static void reset_control_array_put(struct reset_control_array *resets)
+ for (i = 0; i < resets->num_rstcs; i++)
+ __reset_control_put_internal(resets->rstc[i]);
+ mutex_unlock(&reset_list_mutex);
++ kfree(resets);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 11c3b3efc4379eba01d48a3470b5a7ad408e3032 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 20:57:06 -0700
+Subject: reset: fix reset_control_ops kerneldoc comment
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ]
+
+Add a missing short description to the reset_control_ops documentation.
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[p.zabel@pengutronix.de: rebased and updated commit message]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset-controller.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
+index 9326d671b6e6c..8675ec64987bb 100644
+--- a/include/linux/reset-controller.h
++++ b/include/linux/reset-controller.h
+@@ -7,7 +7,7 @@
+ struct reset_controller_dev;
+
+ /**
+- * struct reset_control_ops
++ * struct reset_control_ops - reset controller driver callbacks
+ *
+ * @reset: for self-deasserting resets, does all necessary
+ * things to reset the device
+--
+2.20.1
+
--- /dev/null
+From 0e0dd2672ea2f4ef11fddde46c2c84bcee8ac5f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:48:10 +0800
+Subject: rtl818x: fix potential use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit afbb1947db94eacc5a13302eee88a9772fb78935 ]
+
+entry is released via usb_put_urb just after calling usb_submit_urb.
+However, entry is used if the submission fails, resulting in a use after
+free bug. The patch fixes this.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+index 9a1d15b3ce453..518caaaf8a987 100644
+--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
+@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
+ skb_queue_tail(&priv->rx_queue, skb);
+ usb_anchor_urb(entry, &priv->anchored);
+ ret = usb_submit_urb(entry, GFP_KERNEL);
+- usb_put_urb(entry);
+ if (ret) {
+ skb_unlink(skb, &priv->rx_queue);
+ usb_unanchor_urb(entry);
++ usb_put_urb(entry);
+ goto err;
+ }
++ usb_put_urb(entry);
+ }
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From a7bce247a0c6857989c1548f2412a4331634e050 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 15:50:04 +0100
+Subject: s390/zcrypt: make sysfs reset attribute trigger queue reset
+
+From: Harald Freudenberger <freude@linux.ibm.com>
+
+[ Upstream commit 42a87d4103ae365e18c3be1333592ab583b8ad9d ]
+
+Until now there is no way to reset a AP queue or card. Driving a card
+or queue offline and online again does only toggle the 'software'
+online state. The only way to trigger a (hardware) reset is by running
+hot-unplug/hot-plug for example on the HMC.
+
+This patch makes the queue reset attribute in sysfs writable.
+Writing into this attribute triggers a reset on the AP queue's state
+machine. So the AP queue is flushed and state machine runs through the
+initial states which cause a reset (PQAP(RAPQ)) and a re-registration
+to interrupts (PQAP(AQIC)) if available.
+
+The reset sysfs attribute is writable by root only. So only an
+administrator is allowed to initiate a reset of AP queues. Please note
+that the queue's counter values are left untouched by the reset.
+
+Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/crypto/ap_queue.c | 23 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
+index 0aa4b3ccc948c..576ac08777c50 100644
+--- a/drivers/s390/crypto/ap_queue.c
++++ b/drivers/s390/crypto/ap_queue.c
+@@ -14,6 +14,9 @@
+ #include <asm/facility.h>
+
+ #include "ap_bus.h"
++#include "ap_debug.h"
++
++static void __ap_flush_queue(struct ap_queue *aq);
+
+ /**
+ * ap_queue_enable_interruption(): Enable interruption on an AP queue.
+@@ -541,7 +544,25 @@ static ssize_t reset_show(struct device *dev,
+ return rc;
+ }
+
+-static DEVICE_ATTR_RO(reset);
++static ssize_t reset_store(struct device *dev,
++ struct device_attribute *attr,
++ const char *buf, size_t count)
++{
++ struct ap_queue *aq = to_ap_queue(dev);
++
++ spin_lock_bh(&aq->lock);
++ __ap_flush_queue(aq);
++ aq->state = AP_STATE_RESET_START;
++ ap_wait(ap_sm_event(aq, AP_EVENT_POLL));
++ spin_unlock_bh(&aq->lock);
++
++ AP_DBF(DBF_INFO, "reset queue=%02x.%04x triggered by user\n",
++ AP_QID_CARD(aq->qid), AP_QID_QUEUE(aq->qid));
++
++ return count;
++}
++
++static DEVICE_ATTR_RW(reset);
+
+ static ssize_t interrupt_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+--
+2.20.1
+
--- /dev/null
+From 3d865796d03ee66710ad6905218abad3b2f799d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 13:33:07 +0200
+Subject: samples/bpf: fix build by setting HAVE_ATTR_TEST to zero
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 04ec044b7d30800296824783df7d9728d16d7567 ]
+
+To remove that test_attr__{enabled/open} are used by perf-sys.h, we
+set HAVE_ATTR_TEST to zero.
+
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: KP Singh <kpsingh@google.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: bpf@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: http://lore.kernel.org/bpf/20191001113307.27796-3-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index 36f9f41d094b2..75d4b48601aaa 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -172,6 +172,7 @@ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/testing/selftests/bpf/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/ -I$(srctree)/tools/include
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/perf
++KBUILD_HOSTCFLAGS += -DHAVE_ATTR_TEST=0
+
+ HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable
+ HOSTCFLAGS_trace_helpers.o += -I$(srctree)/tools/lib/bpf/
+--
+2.20.1
+
--- /dev/null
+From 0c749aace086e67b4210d3ce8b8f93f716c0c1c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 21:17:06 -0800
+Subject: scripts/gdb: fix debugging modules compiled with hot/cold
+ partitioning
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ]
+
+gcc's -freorder-blocks-and-partition option makes it group frequently
+and infrequently used code in .text.hot and .text.unlikely sections
+respectively. At least when building modules on s390, this option is
+used by default.
+
+gdb assumes that all code is located in .text section, and that .text
+section is located at module load address. With such modules this is no
+longer the case: there is code in .text.hot and .text.unlikely, and
+either of them might precede .text.
+
+Fix by explicitly telling gdb the addresses of code sections.
+
+It might be tempting to do this for all sections, not only the ones in
+the white list. Unfortunately, gdb appears to have an issue, when
+telling it about e.g. loadable .note.gnu.build-id section causes it to
+think that non-loadable .note.Linux section is loaded at address 0,
+which in turn causes NULL pointers to be resolved to bogus symbols. So
+keep using the white list approach for the time being.
+
+Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/symbols.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 004b0ac7fa72d..4644f1a83b578 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -99,7 +99,8 @@ lx-symbols command."""
+ attrs[n]['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
++ ".text", ".text.hot", ".text.unlikely"]:
+ address = section_name_to_address.get(section_name)
+ if address:
+ args.append(" -s {name} {addr}".format(
+--
+2.20.1
+
--- /dev/null
+From d1dc820de8538501dc4265627c2ecb26a688cfbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:42:50 +0530
+Subject: scsi: csiostor: fix incorrect dma device in case of vport
+
+From: Varun Prakash <varun@chelsio.com>
+
+[ Upstream commit 9934613edcb40b92a216122876cd3b7e76d08390 ]
+
+In case of ->vport_create() call scsi_add_host_with_dma() instead of
+scsi_add_host() to pass correct dma device.
+
+Signed-off-by: Varun Prakash <varun@chelsio.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/csiostor/csio_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/csiostor/csio_init.c b/drivers/scsi/csiostor/csio_init.c
+index ed2dae657964b..1793981337dd9 100644
+--- a/drivers/scsi/csiostor/csio_init.c
++++ b/drivers/scsi/csiostor/csio_init.c
+@@ -649,7 +649,7 @@ csio_shost_init(struct csio_hw *hw, struct device *dev,
+ if (csio_lnode_init(ln, hw, pln))
+ goto err_shost_put;
+
+- if (scsi_add_host(shost, dev))
++ if (scsi_add_host_with_dma(shost, dev, &hw->pdev->dev))
+ goto err_lnode_exit;
+
+ return ln;
+--
+2.20.1
+
--- /dev/null
+From 38658e7a19948122fcfe3580181c3f926c08bd4f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 22:22:31 +0800
+Subject: scsi: hisi_sas: shutdown axi bus to avoid exception CQ returned
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit 5c31b0c677531c2b8b4e29b3cfb923df663f39b7 ]
+
+When injecting 2 bit ECC error, it will cause fatal AXI interrupts. Before
+the recovery of SAS controller reset, the internal of SAS controller is in
+error. If CQ interrupts return at the time, actually it is exception CQ
+interrupt, and it may cause resource release in disorder.
+
+To avoid the exception situation, shutdown AXI bus after fatal AXI
+interrupt. In SAS controller reset, it will restart AXI bus. For later
+version of v3 hw, hardware will shutdown AXI bus for this situation, so
+just fix current ver of v3 hw.
+
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+index fb2a5969181b5..a7407d5376ba2 100644
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -1520,6 +1520,7 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p)
+ u32 irq_value, irq_msk;
+ struct hisi_hba *hisi_hba = p;
+ struct device *dev = hisi_hba->dev;
++ struct pci_dev *pdev = hisi_hba->pci_dev;
+ int i;
+
+ irq_msk = hisi_sas_read32(hisi_hba, ENT_INT_SRC_MSK3);
+@@ -1551,6 +1552,17 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p)
+ error->msg, irq_value);
+ queue_work(hisi_hba->wq, &hisi_hba->rst_work);
+ }
++
++ if (pdev->revision < 0x21) {
++ u32 reg_val;
++
++ reg_val = hisi_sas_read32(hisi_hba,
++ AXI_MASTER_CFG_BASE +
++ AM_CTRL_GLOBAL);
++ reg_val |= AM_CTRL_SHUTDOWN_REQ_MSK;
++ hisi_sas_write32(hisi_hba, AXI_MASTER_CFG_BASE +
++ AM_CTRL_GLOBAL, reg_val);
++ }
+ }
+
+ if (irq_value & BIT(ENT_INT_SRC3_ITC_INT_OFF)) {
+--
+2.20.1
+
--- /dev/null
+From dfd748071294479cb793ce00861151311414bfa2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:27 +0800
+Subject: scsi: libsas: Check SMP PHY control function result
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 01929a65dfa13e18d89264ab1378854a91857e59 ]
+
+Currently the SMP PHY control execution result is checked, however the
+function result for the command is not.
+
+As such, we may be missing all potential errors, like SMP FUNCTION FAILED,
+INVALID REQUEST FRAME LENGTH, etc., meaning the PHY control request has
+failed.
+
+In some scenarios we need to ensure the function result is accepted, so add
+a check for this.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index f9d4a24c14b5a..3e74fe9257617 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -614,7 +614,14 @@ int sas_smp_phy_control(struct domain_device *dev, int phy_id,
+ }
+
+ res = smp_execute_task(dev, pc_req, PC_REQ_SIZE, pc_resp,PC_RESP_SIZE);
+-
++ if (res) {
++ pr_err("ex %016llx phy%02d PHY control failed: %d\n",
++ SAS_ADDR(dev->sas_addr), phy_id, res);
++ } else if (pc_resp[2] != SMP_RESP_FUNC_ACC) {
++ pr_err("ex %016llx phy%02d PHY control failed: function result 0x%x\n",
++ SAS_ADDR(dev->sas_addr), phy_id, pc_resp[2]);
++ res = pc_resp[2];
++ }
+ kfree(pc_resp);
+ kfree(pc_req);
+ return res;
+--
+2.20.1
+
--- /dev/null
+From f45557a12b10654a42b4aa47d72bc02265f0727b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 00:01:28 +0800
+Subject: scsi: libsas: Support SATA PHY connection rate unmatch fixing during
+ discovery
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit cec9771d2e954650095aa37a6a97722c8194e7d2 ]
+
+ +----------+ +----------+
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SAS disk
+ |initiator | | |
+ | device |--- 3.0 G ---| Expander |--- 6.0 G --- SAS disk
+ | | | |
+ | |--- 3.0 G ---| |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ | | | |--- 6.0 G --- SATA disk -->failed to connect
+ | | | |
+ +----------+ +----------+
+
+According to Serial Attached SCSI - 1.1 (SAS-1.1):
+If an expander PHY attached to a SATA PHY is using a physical link rate
+greater than the maximum connection rate supported by the pathway from an
+STP initiator port, a management application client should use the SMP PHY
+CONTROL function (see 10.4.3.10) to set the PROGRAMMED MAXIMUM PHYSICAL
+LINK RATE field of the expander PHY to the maximum connection rate
+supported by the pathway from that STP initiator port.
+
+Currently libsas does not support checking if this condition occurs, nor
+rectifying when it does.
+
+Such a condition is not at all common, however it has been seen on some
+pre-silicon environments where the initiator PHY only supports a 1.5 Gbit
+maximum linkrate, mated with 12G expander PHYs and 3/6G SATA phy.
+
+This patch adds support for checking and rectifying this condition during
+initial device discovery only.
+
+We do support checking min pathway connection rate during revalidation phase,
+when new devices can be detected in the topology. However we do not
+support in the case of the the user reprogramming PHY linkrates, such that
+min pathway condition is not met/maintained.
+
+A note on root port PHY rates:
+The libsas root port PHY rates calculation is broken. Libsas sets the
+rates (min, max, and current linkrate) of a root port to the same linkrate
+of the first PHY member of that same port. In doing so, it assumes that
+all other PHYs which subsequently join the port to have the same
+negotiated linkrate, when they could actually be different.
+
+In practice this doesn't happen, as initiator and expander PHYs are
+normally initialised with consistent min/max linkrates.
+
+This has not caused an issue so far, so leave alone for now.
+
+Tested-by: Jian Luo <luojian5@huawei.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libsas/sas_expander.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
+index 2ee9c4ec7a541..f9d4a24c14b5a 100644
+--- a/drivers/scsi/libsas/sas_expander.c
++++ b/drivers/scsi/libsas/sas_expander.c
+@@ -817,6 +817,26 @@ static struct domain_device *sas_ex_discover_end_dev(
+
+ #ifdef CONFIG_SCSI_SAS_ATA
+ if ((phy->attached_tproto & SAS_PROTOCOL_STP) || phy->attached_sata_dev) {
++ if (child->linkrate > parent->min_linkrate) {
++ struct sas_phy_linkrates rates = {
++ .maximum_linkrate = parent->min_linkrate,
++ .minimum_linkrate = parent->min_linkrate,
++ };
++ int ret;
++
++ pr_notice("ex %016llx phy%02d SATA device linkrate > min pathway connection rate, attempting to lower device linkrate\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ ret = sas_smp_phy_control(parent, phy_id,
++ PHY_FUNC_LINK_RESET, &rates);
++ if (ret) {
++ pr_err("ex %016llx phy%02d SATA device could not set linkrate (%d)\n",
++ SAS_ADDR(child->sas_addr), phy_id, ret);
++ goto out_free;
++ }
++ pr_notice("ex %016llx phy%02d SATA device set linkrate successfully\n",
++ SAS_ADDR(child->sas_addr), phy_id);
++ child->linkrate = child->min_linkrate;
++ }
+ res = sas_get_ata_info(child, phy);
+ if (res)
+ goto out_free;
+--
+2.20.1
+
--- /dev/null
+From 9ccc9ccc5800991f9bb2d02c0f5843ba03ab5bb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 19:37:01 -0800
+Subject: scsi: lpfc: Enable Management features for IF_TYPE=6
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 719162bd5bb968203397b9b1d0dd30a9797bbd09 ]
+
+Addition of support for if_type=6 missed several checks for interface type,
+resulting in the failure of several key management features such as
+firmware dump and loopback testing.
+
+Correct the checks on the if_type so that both SLI4 IF_TYPE's 2 and 6 are
+supported.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_attr.c | 4 ++--
+ drivers/scsi/lpfc/lpfc_bsg.c | 6 +++---
+ drivers/scsi/lpfc/lpfc_els.c | 2 +-
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 2 +-
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index 55cd96e2469c6..3f69a5e4e470a 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -1332,7 +1332,7 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode)
+ return -EACCES;
+
+ if ((phba->sli_rev < LPFC_SLI_REV4) ||
+- (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2))
+ return -EPERM;
+
+@@ -4264,7 +4264,7 @@ lpfc_link_speed_store(struct device *dev, struct device_attribute *attr,
+ uint32_t prev_val, if_type;
+
+ if_type = bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf);
+- if (if_type == LPFC_SLI_INTF_IF_TYPE_2 &&
++ if (if_type >= LPFC_SLI_INTF_IF_TYPE_2 &&
+ phba->hba_flag & HBA_FORCED_LINK_SPEED)
+ return -EPERM;
+
+diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
+index 90745feca8080..99aea52e584b0 100644
+--- a/drivers/scsi/lpfc/lpfc_bsg.c
++++ b/drivers/scsi/lpfc/lpfc_bsg.c
+@@ -2221,7 +2221,7 @@ lpfc_bsg_diag_loopback_mode(struct bsg_job *job)
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+ rc = lpfc_sli3_bsg_diag_loopback_mode(phba, job);
+- else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) ==
++ else if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=
+ LPFC_SLI_INTF_IF_TYPE_2)
+ rc = lpfc_sli4_bsg_diag_loopback_mode(phba, job);
+ else
+@@ -2261,7 +2261,7 @@ lpfc_sli4_bsg_diag_mode_end(struct bsg_job *job)
+
+ if (phba->sli_rev < LPFC_SLI_REV4)
+ return -ENODEV;
+- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2)
+ return -ENODEV;
+
+@@ -2353,7 +2353,7 @@ lpfc_sli4_bsg_link_diag_test(struct bsg_job *job)
+ rc = -ENODEV;
+ goto job_error;
+ }
+- if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2) {
+ rc = -ENODEV;
+ goto job_error;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index ea2aa5f55ca44..4f4d1b3b3bbc4 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -5559,7 +5559,7 @@ lpfc_els_rcv_rdp(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb,
+ struct ls_rjt stat;
+
+ if (phba->sli_rev < LPFC_SLI_REV4 ||
+- bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) !=
++ bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) <
+ LPFC_SLI_INTF_IF_TYPE_2) {
+ rjt_err = LSRJT_UNABLE_TPC;
+ rjt_expl = LSEXP_REQ_UNSUPPORTED;
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 68f223882d96b..b36b3da323a0a 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4780,7 +4780,7 @@ lpfc_unreg_rpi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp)
+ if (phba->sli_rev == LPFC_SLI_REV4 &&
+ (!(vport->load_flag & FC_UNLOADING)) &&
+ (bf_get(lpfc_sli_intf_if_type,
+- &phba->sli4_hba.sli_intf) ==
++ &phba->sli4_hba.sli_intf) >=
+ LPFC_SLI_INTF_IF_TYPE_2) &&
+ (kref_read(&ndlp->kref) > 0)) {
+ mbox->context1 = lpfc_nlp_get(ndlp);
+--
+2.20.1
+
--- /dev/null
+From 92092f49c32f2bb7529e143bde2632c9023cd731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:40 -0800
+Subject: scsi: lpfc: Fix dif and first burst use in write commands
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 7c4042a4d0b7532cfbc90478fd3084b2dab5849e ]
+
+When dif and first burst is used in a write command wqe, the driver was not
+properly setting fields in the io command request. This resulted in no dif
+bytes being sent and invalid xfer_rdy's, resulting in the io being aborted
+by the hardware.
+
+Correct the wqe initializaton when both dif and first burst are used.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 666495f21c246..425b83618a2e5 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -2732,6 +2732,7 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the bpl beyond fcp_cmnd
+@@ -2837,6 +2838,14 @@ lpfc_bg_scsi_prep_dma_buf_s3(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ return 0;
+ err:
+ if (lpfc_cmd->seg_cnt)
+@@ -3401,6 +3410,7 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ int datasegcnt, protsegcnt, datadir = scsi_cmnd->sc_data_direction;
+ int prot_group_type = 0;
+ int fcpdl;
++ struct lpfc_vport *vport = phba->pport;
+
+ /*
+ * Start the lpfc command prep by bumping the sgl beyond fcp_cmnd
+@@ -3516,6 +3526,14 @@ lpfc_bg_scsi_prep_dma_buf_s4(struct lpfc_hba *phba,
+ */
+ iocb_cmd->un.fcpi.fcpi_parm = fcpdl;
+
++ /*
++ * For First burst, we may need to adjust the initial transfer
++ * length for DIF
++ */
++ if (iocb_cmd->un.fcpi.fcpi_XRdy &&
++ (fcpdl < vport->cfg_first_burst_size))
++ iocb_cmd->un.fcpi.fcpi_XRdy = fcpdl;
++
+ /*
+ * If the OAS driver feature is enabled and the lun is enabled for
+ * OAS, set the oas iocb related flags.
+--
+2.20.1
+
--- /dev/null
+From 92ba8124a71e41e20ff6c994a0ad737e68f72a71 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:32 -0800
+Subject: scsi: lpfc: Fix kernel Oops due to null pring pointers
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 5a9eeff57f340238c39c95d8e7e54c96fc722de7 ]
+
+Driver is hitting null pring pointers in lpfc_do_work().
+
+Pointer assignment occurs based on SLI-revision. If recovering after an
+error, its possible the sli revision for the port was cleared, making the
+lpfc_phba_elsring() not return a ring pointer, thus the null pointer.
+
+Add SLI revision checking to lpfc_phba_elsring() and status checking to all
+callers.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc.h | 6 ++++++
+ drivers/scsi/lpfc/lpfc_els.c | 2 ++
+ drivers/scsi/lpfc/lpfc_init.c | 7 ++++++-
+ drivers/scsi/lpfc/lpfc_sli.c | 2 ++
+ 4 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index ebcfcbb8b4ccc..a62e85cb62eb2 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -1236,6 +1236,12 @@ lpfc_sli_read_hs(struct lpfc_hba *phba)
+ static inline struct lpfc_sli_ring *
+ lpfc_phba_elsring(struct lpfc_hba *phba)
+ {
++ /* Return NULL if sli_rev has become invalid due to bad fw */
++ if (phba->sli_rev != LPFC_SLI_REV4 &&
++ phba->sli_rev != LPFC_SLI_REV3 &&
++ phba->sli_rev != LPFC_SLI_REV2)
++ return NULL;
++
+ if (phba->sli_rev == LPFC_SLI_REV4) {
+ if (phba->sli4_hba.els_wq)
+ return phba->sli4_hba.els_wq->pring;
+diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
+index 222fa9b7f4788..ea2aa5f55ca44 100644
+--- a/drivers/scsi/lpfc/lpfc_els.c
++++ b/drivers/scsi/lpfc/lpfc_els.c
+@@ -1343,6 +1343,8 @@ lpfc_els_abort_flogi(struct lpfc_hba *phba)
+ Fabric_DID);
+
+ pring = lpfc_phba_elsring(phba);
++ if (unlikely(!pring))
++ return -EIO;
+
+ /*
+ * Check the txcmplq for an iocb that matches the nport the driver is
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index a7d3e532e0f58..da63c026ba460 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -1801,7 +1801,12 @@ lpfc_sli4_port_sta_fn_reset(struct lpfc_hba *phba, int mbx_action,
+ lpfc_offline(phba);
+ /* release interrupt for possible resource change */
+ lpfc_sli4_disable_intr(phba);
+- lpfc_sli_brdrestart(phba);
++ rc = lpfc_sli_brdrestart(phba);
++ if (rc) {
++ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
++ "6309 Failed to restart board\n");
++ return rc;
++ }
+ /* request and enable interrupt */
+ intr_mode = lpfc_sli4_enable_intr(phba, phba->intr_mode);
+ if (intr_mode == LPFC_INTR_ERROR) {
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 3361ae75578f2..755803ff6cfef 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -4640,6 +4640,8 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba)
+ hba_aer_enabled = phba->hba_flag & HBA_AER_ENABLED;
+
+ rc = lpfc_sli4_brdreset(phba);
++ if (rc)
++ return rc;
+
+ spin_lock_irq(&phba->hbalock);
+ phba->pport->stopped = 0;
+--
+2.20.1
+
--- /dev/null
+From 9e1b45a33d0e60b52ae190876e03356c8425b606 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 16:48:45 -0700
+Subject: scsi: qla2xxx: deadlock by configfs_depend_item
+
+From: Anatoliy Glagolev <glagolig@gmail.com>
+
+[ Upstream commit 17b18eaa6f59044a5172db7d07149e31ede0f920 ]
+
+The intent of invoking configfs_depend_item in commit 7474f52a82d51
+("tcm_qla2xxx: Perform configfs depend/undepend for base_tpg")
+was to prevent a physical Fibre Channel port removal when
+virtual (NPIV) ports announced through that physical port are active.
+The change does not work as expected: it makes enabled physical port
+dependent on target configfs subsystem (the port's parent), something
+the configfs guarantees anyway.
+
+Besides, scheduling work in a worker thread and waiting for the work's
+completion is not really a valid workaround for the requirement not to call
+configfs_depend_item from a configfs callback: the call occasionally
+deadlocks.
+
+Thus, removing configfs_depend_item calls does not break anything and fixes
+the deadlock problem.
+
+Signed-off-by: Anatoliy Glagolev <glagolig@gmail.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/tcm_qla2xxx.c | 48 +++++-------------------------
+ drivers/scsi/qla2xxx/tcm_qla2xxx.h | 3 --
+ 2 files changed, 8 insertions(+), 43 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index b8c1a739dfbd1..654e1af7f542c 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -926,38 +926,14 @@ static ssize_t tcm_qla2xxx_tpg_enable_show(struct config_item *item,
+ atomic_read(&tpg->lport_tpg_enabled));
+ }
+
+-static void tcm_qla2xxx_depend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!target_depend_item(&se_tpg->tpg_group.cg_item)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 1);
+- qlt_enable_vha(base_vha);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+-static void tcm_qla2xxx_undepend_tpg(struct work_struct *work)
+-{
+- struct tcm_qla2xxx_tpg *base_tpg = container_of(work,
+- struct tcm_qla2xxx_tpg, tpg_base_work);
+- struct se_portal_group *se_tpg = &base_tpg->se_tpg;
+- struct scsi_qla_host *base_vha = base_tpg->lport->qla_vha;
+-
+- if (!qlt_stop_phase1(base_vha->vha_tgt.qla_tgt)) {
+- atomic_set(&base_tpg->lport_tpg_enabled, 0);
+- target_undepend_item(&se_tpg->tpg_group.cg_item);
+- }
+- complete(&base_tpg->tpg_base_comp);
+-}
+-
+ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ const char *page, size_t count)
+ {
+ struct se_portal_group *se_tpg = to_tpg(item);
++ struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
++ struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
++ struct tcm_qla2xxx_lport, lport_wwn);
++ struct scsi_qla_host *vha = lport->qla_vha;
+ struct tcm_qla2xxx_tpg *tpg = container_of(se_tpg,
+ struct tcm_qla2xxx_tpg, se_tpg);
+ unsigned long op;
+@@ -976,24 +952,16 @@ static ssize_t tcm_qla2xxx_tpg_enable_store(struct config_item *item,
+ if (atomic_read(&tpg->lport_tpg_enabled))
+ return -EEXIST;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_depend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 1);
++ qlt_enable_vha(vha);
+ } else {
+ if (!atomic_read(&tpg->lport_tpg_enabled))
+ return count;
+
+- INIT_WORK(&tpg->tpg_base_work, tcm_qla2xxx_undepend_tpg);
++ atomic_set(&tpg->lport_tpg_enabled, 0);
++ qlt_stop_phase1(vha->vha_tgt.qla_tgt);
+ }
+- init_completion(&tpg->tpg_base_comp);
+- schedule_work(&tpg->tpg_base_work);
+- wait_for_completion(&tpg->tpg_base_comp);
+
+- if (op) {
+- if (!atomic_read(&tpg->lport_tpg_enabled))
+- return -ENODEV;
+- } else {
+- if (atomic_read(&tpg->lport_tpg_enabled))
+- return -EPERM;
+- }
+ return count;
+ }
+
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.h b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+index 7550ba2831c36..147cf6c903666 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.h
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.h
+@@ -48,9 +48,6 @@ struct tcm_qla2xxx_tpg {
+ struct tcm_qla2xxx_tpg_attrib tpg_attrib;
+ /* Returned by tcm_qla2xxx_make_tpg() */
+ struct se_portal_group se_tpg;
+- /* Items for dealing with configfs_depend_item */
+- struct completion tpg_base_comp;
+- struct work_struct tpg_base_work;
+ };
+
+ struct tcm_qla2xxx_fc_loopid {
+--
+2.20.1
+
--- /dev/null
+From 03f547859df0e1c029c99a50987c520f3b83b167 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 12:36:24 -0800
+Subject: scsi: qla2xxx: Fix for FC-NVMe discovery for NPIV port
+
+From: Giridhar Malavali <gmalavali@marvell.com>
+
+[ Upstream commit 835aa4f2691e4ed4ed16de81f3cabf17a87a164f ]
+
+This patch fixes NVMe discovery by setting SKIP_PRLI flag, so that PRLI is
+driven by driver and is retried when the NPIV port is detected to have NVMe
+capability.
+
+Signed-off-by: Giridhar Malavali <gmalavali@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_attr.c | 2 ++
+ drivers/scsi/qla2xxx/qla_init.c | 10 ++++------
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 15d493f30810f..3e9c49b3184f1 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -2161,6 +2161,8 @@ qla24xx_vport_delete(struct fc_vport *fc_vport)
+ test_bit(FCPORT_UPDATE_NEEDED, &vha->dpc_flags))
+ msleep(1000);
+
++ qla_nvme_delete(vha);
++
+ qla24xx_disable_vp(vha);
+ qla2x00_wait_for_sess_deletion(vha);
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 653d535e3052f..f7dd289779b14 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -242,15 +242,13 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport,
+ qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2);
+
+ sp->done = qla2x00_async_login_sp_done;
+- if (N2N_TOPO(fcport->vha->hw) && fcport_is_bigger(fcport)) {
++ if (N2N_TOPO(fcport->vha->hw) && fcport_is_bigger(fcport))
+ lio->u.logio.flags |= SRB_LOGIN_PRLI_ONLY;
+- } else {
++ else
+ lio->u.logio.flags |= SRB_LOGIN_COND_PLOGI;
+
+- if (fcport->fc4f_nvme)
+- lio->u.logio.flags |= SRB_LOGIN_SKIP_PRLI;
+-
+- }
++ if (fcport->fc4f_nvme)
++ lio->u.logio.flags |= SRB_LOGIN_SKIP_PRLI;
+
+ ql_dbg(ql_dbg_disc, vha, 0x2072,
+ "Async-login - %8phC hdl=%x, loopid=%x portid=%02x%02x%02x "
+--
+2.20.1
+
--- /dev/null
+From e5f625e66c39dba60d8cd1d017227c7f20eec604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 12:36:23 -0800
+Subject: scsi: qla2xxx: Fix NPIV handling for FC-NVMe
+
+From: Himanshu Madhani <hmadhani@marvell.com>
+
+[ Upstream commit 5e6803b409ba3c18434de6693062d98a470bcb1e ]
+
+This patch fixes issues with NPIV port with FC-NVMe. Clean up code for
+remoteport delete and also call nvme_delete when deleting VPs.
+
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_nvme.c | 16 +++-------------
+ drivers/scsi/qla2xxx/qla_os.c | 2 ++
+ 2 files changed, 5 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
+index e6545cb9a2c19..5590d6e8b5762 100644
+--- a/drivers/scsi/qla2xxx/qla_nvme.c
++++ b/drivers/scsi/qla2xxx/qla_nvme.c
+@@ -474,21 +474,10 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ int rval = -ENODEV;
+ srb_t *sp;
+ struct qla_qpair *qpair = hw_queue_handle;
+- struct nvme_private *priv;
++ struct nvme_private *priv = fd->private;
+ struct qla_nvme_rport *qla_rport = rport->private;
+
+- if (!fd || !qpair) {
+- ql_log(ql_log_warn, NULL, 0x2134,
+- "NO NVMe request or Queue Handle\n");
+- return rval;
+- }
+-
+- priv = fd->private;
+ fcport = qla_rport->fcport;
+- if (!fcport) {
+- ql_log(ql_log_warn, NULL, 0x210e, "No fcport ptr\n");
+- return rval;
+- }
+
+ vha = fcport->vha;
+
+@@ -517,6 +506,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,
+ sp->name = "nvme_cmd";
+ sp->done = qla_nvme_sp_done;
+ sp->qpair = qpair;
++ sp->vha = vha;
+ nvme = &sp->u.iocb_cmd;
+ nvme->u.nvme.desc = fd;
+
+@@ -564,7 +554,7 @@ static void qla_nvme_remoteport_delete(struct nvme_fc_remote_port *rport)
+ schedule_work(&fcport->free_work);
+ }
+
+- fcport->nvme_flag &= ~(NVME_FLAG_REGISTERED | NVME_FLAG_DELETING);
++ fcport->nvme_flag &= ~NVME_FLAG_DELETING;
+ ql_log(ql_log_info, fcport->vha, 0x2110,
+ "remoteport_delete of %p completed.\n", fcport);
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 3e892e013658d..183bfda8f5d11 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -3538,6 +3538,8 @@ qla2x00_delete_all_vps(struct qla_hw_data *ha, scsi_qla_host_t *base_vha)
+ spin_unlock_irqrestore(&ha->vport_slock, flags);
+ mutex_unlock(&ha->vport_lock);
+
++ qla_nvme_delete(vha);
++
+ fc_vport_terminate(vha->fc_vport);
+ scsi_host_put(vha->host);
+
+--
+2.20.1
+
--- /dev/null
+From 35cc0333187fcdf47c9c8e2d343b9019c9641d4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 15:51:55 -0800
+Subject: scsi: target/tcmu: Fix queue_cmd_ring() declaration
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit e7f411049f5164ee6db6c3434c07302846f09990 ]
+
+This patch does not change any functionality but avoids that sparse
+complains about the queue_cmd_ring() function and its callers.
+
+Fixes: 6fd0ce79724d ("tcmu: prep queue_cmd_ring to be used by unmap wq")
+Reviewed-by: David Disseldorp <ddiss@suse.de>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_user.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
+index 7159e8363b83b..7ee0a75ce4526 100644
+--- a/drivers/target/target_core_user.c
++++ b/drivers/target/target_core_user.c
+@@ -962,7 +962,7 @@ static int add_to_qfull_queue(struct tcmu_cmd *tcmu_cmd)
+ * 0 success
+ * 1 internally queued to wait for ring memory to free.
+ */
+-static sense_reason_t queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, int *scsi_err)
++static int queue_cmd_ring(struct tcmu_cmd *tcmu_cmd, sense_reason_t *scsi_err)
+ {
+ struct tcmu_dev *udev = tcmu_cmd->tcmu_dev;
+ struct se_cmd *se_cmd = tcmu_cmd->se_cmd;
+--
+2.20.1
+
--- /dev/null
+From ed332e9cfd229ebfaa91b384ba5e91bbd1481475 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 09:45:26 +0100
+Subject: sctp: don't compare hb_timer expire date before starting it
+
+From: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+
+[ Upstream commit d1f20c03f48102e52eb98b8651d129b83134cae4 ]
+
+hb_timer might not start at all for a particular transport because its
+start is conditional. In a result a node is not sending heartbeats.
+
+Function sctp_transport_reset_hb_timer has two roles:
+ - initial start of hb_timer for a given transport,
+ - update expire date of hb_timer for a given transport.
+The function is optimized to update timer's expire only if it is before
+a new calculated one but this comparison is invalid for a timer which
+has not yet started. Such a timer has expire == 0 and if a new expire
+value is bigger than (MAX_JIFFIES / 2 + 2) then "time_before" macro will
+fail and timer will not start resulting in no heartbeat packets send by
+the node.
+
+This was found when association was initialized within first 5 mins
+after system boot due to jiffies init value which is near to MAX_JIFFIES.
+
+Test kernel version: 4.9.154 (ARCH=arm)
+hb_timer.expire = 0; //initialized, not started timer
+new_expire = MAX_JIFFIES / 2 + 2; //or more
+time_before(hb_timer.expire, new_expire) == false
+
+Fixes: ba6f5e33bdbb ("sctp: avoid refreshing heartbeat timer too often")
+Reported-by: Marcin Stojek <marcin.stojek@nokia.com>
+Tested-by: Marcin Stojek <marcin.stojek@nokia.com>
+Signed-off-by: Maciej Kwiecien <maciej.kwiecien@nokia.com>
+Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/transport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c
+index 033696e6f74fb..ad158d311ffae 100644
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -207,7 +207,8 @@ void sctp_transport_reset_hb_timer(struct sctp_transport *transport)
+
+ /* When a data chunk is sent, reset the heartbeat interval. */
+ expires = jiffies + sctp_transport_timeout(transport);
+- if (time_before(transport->hb_timer.expires, expires) &&
++ if ((time_before(transport->hb_timer.expires, expires) ||
++ !timer_pending(&transport->hb_timer)) &&
+ !mod_timer(&transport->hb_timer,
+ expires + prandom_u32_max(transport->rto)))
+ sctp_transport_hold(transport);
+--
+2.20.1
+
--- /dev/null
+From 166454c55033fafea0411b77d88cbdf70db3718a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 17:00:19 +0800
+Subject: serial: 8250: Fix serial8250 initialization crash
+
+From: He Zhe <zhe.he@windriver.com>
+
+[ Upstream commit 352c4cf40c4a7d439fa5d30aa2160f54b394da82 ]
+
+The initialization code of interrupt backoff work might reference NULL
+pointer and cause the following crash, if no port was found.
+
+[ 10.017727] CPU 0 Unable to handle kernel paging request at virtual address 000001b0, epc == 807088e0, ra == 8070863c
+---- snip ----
+[ 11.704470] [<807088e0>] serial8250_register_8250_port+0x318/0x4ac
+[ 11.747251] [<80708d74>] serial8250_probe+0x148/0x1c0
+[ 11.789301] [<80728450>] platform_drv_probe+0x40/0x94
+[ 11.830515] [<807264f8>] really_probe+0xf8/0x318
+[ 11.870876] [<80726b7c>] __driver_attach+0x110/0x12c
+[ 11.910960] [<80724374>] bus_for_each_dev+0x78/0xcc
+[ 11.951134] [<80725958>] bus_add_driver+0x200/0x234
+[ 11.989756] [<807273d8>] driver_register+0x84/0x148
+[ 12.029832] [<80d72f84>] serial8250_init+0x138/0x198
+[ 12.070447] [<80100e6c>] do_one_initcall+0x5c/0x2a0
+[ 12.110104] [<80d3a208>] kernel_init_freeable+0x370/0x484
+[ 12.150722] [<80a49420>] kernel_init+0x10/0xf8
+[ 12.191517] [<8010756c>] ret_from_kernel_thread+0x14/0x1c
+
+This patch makes sure the initialization code can be reached only if a port
+is found.
+
+Fixes: 6d7f677a2afa ("serial: 8250: Rate limit serial port rx interrupts during input overruns")
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Reviewed-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_core.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 0e65d4261f94c..69aaee5d7fe14 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1074,15 +1074,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+
+ ret = 0;
+ }
+- }
+
+- /* Initialise interrupt backoff work if required */
+- if (up->overrun_backoff_time_ms > 0) {
+- uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
+- INIT_DELAYED_WORK(&uart->overrun_backoff,
+- serial_8250_overrun_backoff_work);
+- } else {
+- uart->overrun_backoff_time_ms = 0;
++ /* Initialise interrupt backoff work if required */
++ if (up->overrun_backoff_time_ms > 0) {
++ uart->overrun_backoff_time_ms =
++ up->overrun_backoff_time_ms;
++ INIT_DELAYED_WORK(&uart->overrun_backoff,
++ serial_8250_overrun_backoff_work);
++ } else {
++ uart->overrun_backoff_time_ms = 0;
++ }
+ }
+
+ mutex_unlock(&serial_mutex);
+--
+2.20.1
+
--- /dev/null
+From cff23ff58f30810f9563a89a6c82ef972027485d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 11:29:09 +1300
+Subject: serial: 8250: Rate limit serial port rx interrupts during input
+ overruns
+
+From: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+
+[ Upstream commit 6d7f677a2afa1c82d7fc7af7f9159cbffd5dc010 ]
+
+When a serial port gets faulty or gets flooded with inputs, its interrupt
+handler starts to work double time to get the characters to the workqueue
+for the tty layer to handle them. When this busy time on the serial/tty
+subsystem happens during boot, where it is also busy on the userspace
+trying to initialise, some processes can continuously get preempted
+and will be on hold until the interrupts subside.
+
+The fix is to backoff on processing received characters for a specified
+amount of time when an input overrun is seen (received a new character
+before the previous one is processed). This only stops receive and will
+continue to transmit characters to serial port. After the backoff period
+is done, it receive will be re-enabled. This is optional and will only
+be enabled by setting 'overrun-throttle-ms' in the dts.
+
+Signed-off-by: Darwin Dingel <darwin.dingel@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_core.c | 25 +++++++++++++++++++++++++
+ drivers/tty/serial/8250/8250_fsl.c | 23 ++++++++++++++++++++++-
+ drivers/tty/serial/8250/8250_of.c | 5 +++++
+ include/linux/serial_8250.h | 4 ++++
+ 4 files changed, 56 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index 8fe3d0ed229ed..0e65d4261f94c 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -946,6 +946,21 @@ static struct uart_8250_port *serial8250_find_match_or_unused(struct uart_port *
+ return NULL;
+ }
+
++static void serial_8250_overrun_backoff_work(struct work_struct *work)
++{
++ struct uart_8250_port *up =
++ container_of(to_delayed_work(work), struct uart_8250_port,
++ overrun_backoff);
++ struct uart_port *port = &up->port;
++ unsigned long flags;
++
++ spin_lock_irqsave(&port->lock, flags);
++ up->ier |= UART_IER_RLSI | UART_IER_RDI;
++ up->port.read_status_mask |= UART_LSR_DR;
++ serial_out(up, UART_IER, up->ier);
++ spin_unlock_irqrestore(&port->lock, flags);
++}
++
+ /**
+ * serial8250_register_8250_port - register a serial port
+ * @up: serial port template
+@@ -1060,6 +1075,16 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ ret = 0;
+ }
+ }
++
++ /* Initialise interrupt backoff work if required */
++ if (up->overrun_backoff_time_ms > 0) {
++ uart->overrun_backoff_time_ms = up->overrun_backoff_time_ms;
++ INIT_DELAYED_WORK(&uart->overrun_backoff,
++ serial_8250_overrun_backoff_work);
++ } else {
++ uart->overrun_backoff_time_ms = 0;
++ }
++
+ mutex_unlock(&serial_mutex);
+
+ return ret;
+diff --git a/drivers/tty/serial/8250/8250_fsl.c b/drivers/tty/serial/8250/8250_fsl.c
+index 6640a4c7ddd1d..bb9571eed275d 100644
+--- a/drivers/tty/serial/8250/8250_fsl.c
++++ b/drivers/tty/serial/8250/8250_fsl.c
+@@ -45,8 +45,29 @@ int fsl8250_handle_irq(struct uart_port *port)
+
+ lsr = orig_lsr = up->port.serial_in(&up->port, UART_LSR);
+
+- if (lsr & (UART_LSR_DR | UART_LSR_BI))
++ /* Process incoming characters first */
++ if ((lsr & (UART_LSR_DR | UART_LSR_BI)) &&
++ (up->ier & (UART_IER_RLSI | UART_IER_RDI))) {
+ lsr = serial8250_rx_chars(up, lsr);
++ }
++
++ /* Stop processing interrupts on input overrun */
++ if ((orig_lsr & UART_LSR_OE) && (up->overrun_backoff_time_ms > 0)) {
++ unsigned long delay;
++
++ up->ier = port->serial_in(port, UART_IER);
++ if (up->ier & (UART_IER_RLSI | UART_IER_RDI)) {
++ port->ops->stop_rx(port);
++ } else {
++ /* Keep restarting the timer until
++ * the input overrun subsides.
++ */
++ cancel_delayed_work(&up->overrun_backoff);
++ }
++
++ delay = msecs_to_jiffies(up->overrun_backoff_time_ms);
++ schedule_delayed_work(&up->overrun_backoff, delay);
++ }
+
+ serial8250_modem_status(up);
+
+diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c
+index 98125de2f0a6c..2488de1c4bc4b 100644
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -244,6 +244,11 @@ static int of_platform_serial_probe(struct platform_device *ofdev)
+ if (of_property_read_bool(ofdev->dev.of_node, "auto-flow-control"))
+ port8250.capabilities |= UART_CAP_AFE;
+
++ if (of_property_read_u32(ofdev->dev.of_node,
++ "overrun-throttle-ms",
++ &port8250.overrun_backoff_time_ms) != 0)
++ port8250.overrun_backoff_time_ms = 0;
++
+ ret = serial8250_register_8250_port(&port8250);
+ if (ret < 0)
+ goto err_dispose;
+diff --git a/include/linux/serial_8250.h b/include/linux/serial_8250.h
+index 18e21427bce43..5a655ba8d2730 100644
+--- a/include/linux/serial_8250.h
++++ b/include/linux/serial_8250.h
+@@ -134,6 +134,10 @@ struct uart_8250_port {
+ void (*dl_write)(struct uart_8250_port *, int);
+
+ struct uart_8250_em485 *em485;
++
++ /* Serial port overrun backoff */
++ struct delayed_work overrun_backoff;
++ u32 overrun_backoff_time_ms;
+ };
+
+ static inline struct uart_8250_port *up_to_u8250p(struct uart_port *up)
+--
+2.20.1
+
--- /dev/null
+From c889b3e91c8b9f6050d4f29a6731ae53816a21c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 14:19:20 +0300
+Subject: serial: max310x: Fix tx_empty() callback
+
+From: Alexander Shiyan <shc_work@mail.ru>
+
+[ Upstream commit a8da3c7873ea57acb8f9cea58c0af477522965aa ]
+
+Function max310x_tx_empty() accesses the IRQSTS register, which is
+cleared by IC when reading, so if there is an interrupt status, we
+will lose it. This patch implement the transmitter check only by
+the current FIFO level.
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/max310x.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
+index bd3e6cf81af5c..0c35c3c5e3734 100644
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -844,12 +844,9 @@ static void max310x_wq_proc(struct work_struct *ws)
+
+ static unsigned int max310x_tx_empty(struct uart_port *port)
+ {
+- unsigned int lvl, sts;
++ u8 lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+
+- lvl = max310x_port_read(port, MAX310X_TXFIFOLVL_REG);
+- sts = max310x_port_read(port, MAX310X_IRQSTS_REG);
+-
+- return ((sts & MAX310X_IRQ_TXEMPTY_BIT) && !lvl) ? TIOCSER_TEMT : 0;
++ return lvl ? 0 : TIOCSER_TEMT;
+ }
+
+ static unsigned int max310x_get_mctrl(struct uart_port *port)
+--
+2.20.1
+
--- /dev/null
+From 8b766b4ac773be3e7019e21d4893f6684aec5006 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 19:44:42 +0100
+Subject: serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 2e948218b7c1262a3830823d6620eb227e3d4e3a ]
+
+When falling back to PIO, active_rx must be set to a different value
+than cookie_rx[i], else sci_dma_rx_find_active() will incorrectly find a
+match, leading to a NULL pointer dereference in rx_timer_fn() later.
+
+Use zero instead, which is the same value as after driver
+initialization.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/sh-sci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
+index 5550289e6678b..9e1a6af23ca2b 100644
+--- a/drivers/tty/serial/sh-sci.c
++++ b/drivers/tty/serial/sh-sci.c
+@@ -1359,7 +1359,7 @@ fail:
+ dmaengine_terminate_async(chan);
+ for (i = 0; i < 2; i++)
+ s->cookie_rx[i] = -EINVAL;
+- s->active_rx = -EINVAL;
++ s->active_rx = 0;
+ s->chan_rx = NULL;
+ sci_start_rx(port);
+ if (!port_lock_held)
+--
+2.20.1
+
--- /dev/null
+clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch
+clocksource-drivers-mediatek-fix-error-handling.patch
+asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch
+asoc-compress-fix-unsigned-integer-overflow-check.patch
+reset-fix-memory-leak-in-reset_control_array_put.patch
+clk-samsung-exynos5433-fix-error-paths.patch
+asoc-kirkwood-fix-external-clock-probe-defer.patch
+asoc-kirkwood-fix-device-remove-ordering.patch
+clk-samsung-exynos5420-preserve-pll-configuration-du.patch
+pinctrl-cherryview-allocate-irq-chip-dynamic.patch
+arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch
+reset-fix-reset_control_ops-kerneldoc-comment.patch
+clk-at91-avoid-sleeping-early.patch
+clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch
+clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch
+arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch
+samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch
+powerpc-bpf-fix-tail-call-implementation.patch
+idr-fix-integer-overflow-in-idr_for_each_entry.patch
+idr-fix-idr_alloc_u32-on-32-bit-systems.patch
+x86-resctrl-prevent-null-pointer-dereference-when-re.patch
+clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch
+clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch
+net-fec-add-missed-clk_disable_unprepare-in-remove.patch
+bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch
+can-peak_usb-report-bus-recovery-as-well.patch
+can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
+can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch
+can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch
+can-rx-offload-can_rx_offload_offload_one-increment-.patch
+can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch
+can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch
+can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch
+can-flexcan-increase-error-counters-if-skb-enqueuein.patch
+can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch
+watchdog-meson-fix-the-wrong-value-of-left-time.patch
+asoc-stm32-sai-add-restriction-on-mmap-support.patch
+scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
+net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch
+net-bcmgenet-reapply-manual-settings-to-the-phy.patch
+net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch
+ceph-return-einval-if-given-fsc-mount-option-on-kern.patch
+net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch
+mac80211-fix-station-inactive_time-shortly-after-boo.patch
+block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
+pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
+scsi-target-tcmu-fix-queue_cmd_ring-declaration.patch
+scsi-lpfc-fix-kernel-oops-due-to-null-pring-pointers.patch
+scsi-lpfc-fix-dif-and-first-burst-use-in-write-comma.patch
+arm64-dts-marvell-armada-37xx-enable-emmc-on-espress.patch
+arm-dts-fix-up-sq201-flash-access.patch
+tracing-lock-event_mutex-before-synth_event_mutex.patch
+arm-debug-imx-only-define-debug_imx_uart_port-if-nee.patch
+arm-dts-imx51-fix-memory-node-duplication.patch
+arm-dts-imx53-fix-memory-node-duplication.patch
+arm-dts-imx31-fix-memory-node-duplication.patch
+arm-dts-imx35-fix-memory-node-duplication.patch
+arm-dts-imx7-fix-memory-node-duplication.patch
+arm-dts-imx6ul-fix-memory-node-duplication.patch
+arm-dts-imx6sx-fix-memory-node-duplication.patch
+arm-dts-imx6sl-fix-memory-node-duplication.patch
+arm-dts-imx50-fix-memory-node-duplication.patch
+arm-dts-imx23-fix-memory-node-duplication.patch
+arm-dts-imx1-fix-memory-node-duplication.patch
+arm-dts-imx27-fix-memory-node-duplication.patch
+arm-dts-imx25-fix-memory-node-duplication.patch
+arm-dts-imx53-voipac-dmm-668-fix-memory-node-duplica.patch
+parisc-fix-serio-address-output.patch
+parisc-fix-hp-sdc-hpa-address-output.patch
+arm-dts-fix-hsi-gdd-range-for-omap4.patch
+arm64-mm-prevent-mismatched-52-bit-va-support.patch
+arm64-smp-handle-errors-reported-by-the-firmware.patch
+bus-ti-sysc-check-for-no-reset-and-no-idle-flags-at-.patch
+platform-x86-mlx-platform-fix-led-configuration.patch
+arm-omap1-fix-usb-configuration-for-device-only-setu.patch
+rdma-hns-fix-the-bug-while-use-multi-hop-of-pbl.patch
+arm64-preempt-fix-big-endian-when-checking-preempt-c.patch
+rdma-vmw_pvrdma-use-atomic-memory-allocation-in-crea.patch
+pm-avs-smartreflex-null-check-before-some-freeing-fu.patch
+xfs-zero-length-symlinks-are-not-valid.patch
+arm-ks8695-fix-section-mismatch-warning.patch
+acpi-lpss-ignore-acpi_device_fix_up_power-return-val.patch
+scsi-lpfc-enable-management-features-for-if_type-6.patch
+scsi-qla2xxx-fix-npiv-handling-for-fc-nvme.patch
+scsi-qla2xxx-fix-for-fc-nvme-discovery-for-npiv-port.patch
+nvme-provide-fallback-for-discard-alloc-failure.patch
+s390-zcrypt-make-sysfs-reset-attribute-trigger-queue.patch
+crypto-user-support-incremental-algorithm-dumps.patch
+arm64-dts-renesas-draak-fix-cvbs-input.patch
+mwifiex-fix-potential-null-dereference-and-use-after.patch
+mwifiex-debugfs-correct-histogram-spacing-formatting.patch
+brcmfmac-set-f2-watermark-to-256-for-4373.patch
+brcmfmac-set-sdio-f1-mesbusyctrl-for-cyw4373.patch
+rtl818x-fix-potential-use-after-free.patch
+bcache-do-not-check-if-debug-dentry-is-err-or-null-e.patch
+bcache-do-not-mark-writeback_running-too-early.patch
+xfs-require-both-realtime-inodes-to-mount.patch
+nvme-fix-kernel-paging-oops.patch
+ubifs-fix-default-compression-selection-in-ubifs.patch
+ubi-put-mtd-device-after-it-is-not-used.patch
+ubi-do-not-drop-ubi-device-reference-before-using.patch
+microblaze-adjust-the-help-to-the-real-behavior.patch
+microblaze-move-.-is-ready-messages-to-arch-microbla.patch
+microblaze-fix-multiple-bugs-in-arch-microblaze-boot.patch
+iwlwifi-move-iwl_nvm_check_version-into-dvm.patch
+iwlwifi-mvm-force-tcm-re-evaluation-on-tcm-resume.patch
+iwlwifi-pcie-fix-erroneous-print.patch
+iwlwifi-pcie-set-cmd_len-in-the-correct-place.patch
+gpio-pca953x-fix-ai-overflow-on-pcal6524.patch
+gpiolib-fix-return-value-of-gpio_to_desc-stub-if-gpi.patch
+kvm-vmx-set-ia32_tsc_aux-for-legacy-mode-guests.patch
+crypto-chelsio-chtls-listen-fails-with-multiadapt.patch
+vsock-bind-to-random-port-for-vmaddr_port_any.patch
+mmc-meson-gx-make-sure-the-descriptor-is-stopped-on-.patch
+mtd-rawnand-sunxi-write-pageprog-related-opcodes-to-.patch
+usb-ehci-omap-fix-deferred-probe-for-phy-handling.patch
+btrfs-check-for-missing-device-before-bio-submission.patch
+btrfs-fix-ncopies-raid_attr-for-raid56.patch
+btrfs-dev-replace-set-result-code-of-cancel-by-statu.patch
+btrfs-allow-clear_extent_dirty-to-receive-a-cached-e.patch
+btrfs-only-track-ref_heads-in-delayed_ref_updates.patch
+serial-sh-sci-fix-crash-in-rx_timer_fn-on-pio-fallba.patch
+hid-intel-ish-hid-fixes-incorrect-error-handling.patch
+gpio-raspberrypi-exp-decrease-refcount-on-firmware-d.patch
+serial-8250-rate-limit-serial-port-rx-interrupts-dur.patch
+kprobes-x86-xen-blacklist-non-attachable-xen-interru.patch
+xen-pciback-check-dev_data-before-using-it.patch
+kprobes-blacklist-symbols-in-arch-defined-prohibited.patch
+kprobes-x86-show-x86-64-specific-blacklisted-symbols.patch
+vfio-mdev-samples-use-u8-instead-of-char-for-handle-.patch
+memory-omap-gpmc-get-the-header-of-the-enum.patch
+pinctrl-xway-fix-gpio-hog-related-boot-issues.patch
+net-mlx5-continue-driver-initialization-despite-debu.patch
+netfilter-nf_nat_sip-fix-rtp-rtcp-source-port-transl.patch
+exofs_mount-fix-leaks-on-failure-exits.patch
+bnxt_en-return-linux-standard-errors-in-bnxt_ethtool.patch
+bnxt_en-save-ring-statistics-before-reset.patch
+bnxt_en-query-force-speeds-before-disabling-autoneg-.patch
+kvm-s390-unregister-debug-feature-on-failing-arch-in.patch
+pinctrl-sh-pfc-r8a77990-fix-mod_sel0-sel_i2c1-field-.patch
+pinctrl-sh-pfc-sh7264-fix-pfcr3-and-pfcr0-register-c.patch
+pinctrl-sh-pfc-sh7734-fix-shifted-values-in-ipsr10.patch
+hid-doc-fix-wrong-data-structure-reference-for-uhid_.patch
+dm-flakey-properly-corrupt-multi-page-bios.patch
+gfs2-take-jdata-unstuff-into-account-in-do_grow.patch
+dm-raid-fix-false-ebusy-when-handling-check-repair-m.patch
+xfs-align-compat-attrlist_by_handle-with-native-impl.patch
+xfs-fix-bulkstat-compat-ioctls-on-x32-userspace.patch
+ib-qib-fix-an-error-code-in-qib_sdma_verbs_send.patch
+clocksource-drivers-fttmr010-fix-invalid-interrupt-r.patch
+vxlan-fix-error-path-in-__vxlan_dev_create.patch
+powerpc-book3s-32-fix-number-of-bats-in-p-v_block_ma.patch
+powerpc-xmon-fix-dump_segments.patch
+drivers-regulator-fix-a-missing-check-of-return-valu.patch
+bluetooth-hci_bcm-handle-specific-unknown-packets-af.patch
+serial-max310x-fix-tx_empty-callback.patch
+openrisc-fix-broken-paths-to-arch-or32.patch
+rdma-srp-propagate-ib_post_send-failures-to-the-scsi.patch
+scsi-qla2xxx-deadlock-by-configfs_depend_item.patch
+scsi-csiostor-fix-incorrect-dma-device-in-case-of-vp.patch
+brcmfmac-fix-access-point-mode.patch
+ath6kl-only-use-match-sets-when-firmware-supports-it.patch
+ath6kl-fix-off-by-one-error-in-scan-completion.patch
+powerpc-perf-fix-unit_sel-cache_sel-checks.patch
+powerpc-32-avoid-unsupported-flags-with-clang.patch
+powerpc-prom-fix-early-debug-messages.patch
+powerpc-mm-make-null-pointer-deferences-explicit-on-.patch
+powerpc-44x-bamboo-fix-pci-range.patch
+vfio-spapr_tce-get-rid-of-possible-infinite-loop.patch
+powerpc-powernv-eeh-npu-fix-uninitialized-variables-.patch
+drbd-ignore-all-zero-peer-volume-sizes-in-handshake.patch
+drbd-reject-attach-of-unsuitable-uuids-even-if-conne.patch
+drbd-do-not-block-when-adjusting-disk-options-while-.patch
+drbd-fix-print_st_err-s-prototype-to-match-the-defin.patch
+ib-rxe-make-counters-thread-safe.patch
+bpf-cpumap-make-sure-frame_size-for-build_skb-is-ali.patch
+regulator-tps65910-fix-a-missing-check-of-return-val.patch
+powerpc-83xx-handle-machine-check-caused-by-watchdog.patch
+powerpc-pseries-fix-node-leak-in-update_lmb_associat.patch
+powerpc-fix-hmis-on-big-endian-with-config_relocatab.patch
+crypto-mxc-scc-fix-build-warnings-on-arm64.patch
+pwm-clps711x-fix-period-calculation.patch
+net-netlink_compat-fix-a-missing-check-of-nla_parse_.patch
+net-net_namespace-check-the-return-value-of-register.patch
+f2fs-fix-block-address-for-__check_sit_bitmap.patch
+f2fs-fix-to-dirty-inode-synchronously.patch
+um-include-sys-uio.h-to-have-writev.patch
+um-make-gcov-depend-on-kcov.patch
+net-cpts-fix-a-missing-check-of-clk_prepare.patch
+net-stmicro-fix-a-missing-check-of-clk_prepare.patch
+net-dsa-bcm_sf2-propagate-error-value-from-mdio_writ.patch
+atl1e-checking-the-status-of-atl1e_write_phy_reg.patch
+tipc-fix-a-missing-check-of-genlmsg_put.patch
+net-marvell-fix-a-missing-check-of-acpi_match_device.patch
+net-wan-fsl_ucc_hdlc-avoid-double-free-in-ucc_hdlc_p.patch
+ocfs2-clear-journal-dirty-flag-after-shutdown-journa.patch
+vmscan-return-node_reclaim_noscan-in-node_reclaim-wh.patch
+mm-page_alloc.c-free-order-0-pages-through-pcp-in-pa.patch
+mm-page_alloc.c-use-a-single-function-to-free-page.patch
+mm-page_alloc.c-deduplicate-__memblock_free_early-an.patch
+tools-vm-page-types.c-fix-kpagecount-returned-fewer-.patch
+netfilter-nf_tables-fix-a-missing-check-of-nla_put_f.patch
+xprtrdma-prevent-leak-of-rpcrdma_rep-objects.patch
+infiniband-bnxt_re-qplib-check-the-return-value-of-s.patch
+infiniband-qedr-potential-null-ptr-dereference-of-qp.patch
+firmware-arm_sdei-fix-wrong-of_node_put-in-init-func.patch
+firmware-arm_sdei-fix-dt-platform-device-creation.patch
+lib-genalloc.c-fix-allocation-of-aligned-buffer-from.patch
+lib-genalloc.c-use-vzalloc_node-to-allocate-the-bitm.patch
+fork-fix-some-wmissing-prototypes-warnings.patch
+drivers-base-platform.c-kmemleak-ignore-a-known-leak.patch
+lib-genalloc.c-include-vmalloc.h.patch
+mtd-check-add_mtd_device-ret-code.patch
+tipc-fix-memory-leak-in-tipc_nl_compat_publ_dump.patch
+net-core-neighbour-tell-kmemleak-about-hash-tables.patch
+ata-ahci-mvebu-do-armada-38x-configuration-only-on-r.patch
+pci-msi-return-enospc-from-pci_alloc_irq_vectors_aff.patch
+net-core-neighbour-fix-kmemleak-minimal-reference-co.patch
+serial-8250-fix-serial8250-initialization-crash.patch
+gpu-ipu-v3-pre-don-t-trigger-update-if-buffer-addres.patch
+sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch
+ip_tunnel-make-none-tunnel-dst-tunnel-port-work-with.patch
+decnet-fix-dn_ifreq_size.patch
+net-smc-prevent-races-between-smc_lgr_terminate-and-.patch
+net-smc-don-t-wait-for-send-buffer-space-when-data-w.patch
+mm-hotplug-invalid-pfns-from-pfn_to_online_page.patch
+xfs-end-sync-buffer-i-o-properly-on-shutdown-error.patch
+net-smc-fix-sender_free-computation.patch
+blktrace-show-requests-without-sector.patch
+net-smc-fix-byte_order-for-rx_curs_confirmed.patch
+tipc-fix-skb-may-be-leaky-in-tipc_link_input.patch
+asoc-samsung-i2s-fix-prescaler-setting-for-the-secon.patch
+sfc-initialise-found-bitmap-in-efx_ef10_mtd_probe.patch
+geneve-change-net_udp_tunnel-dependency-to-select.patch
+net-fix-possible-overflow-in-__sk_mem_raise_allocate.patch
+net-ip_gre-do-not-report-erspan_ver-for-gre-or-greta.patch
+net-ip6_gre-do-not-report-erspan_ver-for-ip6gre-or-i.patch
+sctp-don-t-compare-hb_timer-expire-date-before-start.patch
+bpf-decrease-usercnt-if-bpf_map_new_fd-fails-in-bpf_.patch
+mmc-core-align-max-segment-size-with-logical-block-s.patch
+net-dev-use-unsigned-integer-as-an-argument-to-left-.patch
+kvm-properly-check-debugfs-dentry-before-using-it.patch
+bpf-drop-refcount-if-bpf_map_new_fd-fails-in-map_cre.patch
+net-hns3-change-fw-error-code-not_exec-to-not_suppor.patch
+net-hns3-fix-pfc-not-setting-problem-for-dcb-module.patch
+net-hns3-fix-an-issue-for-hclgevf_ae_get_hdev.patch
+net-hns3-fix-an-issue-for-hns3_update_new_int_gl.patch
+iommu-amd-fix-null-dereference-bug-in-match_hid_uid.patch
+apparmor-delete-the-dentry-in-aafs_remove-to-avoid-a.patch
+scsi-libsas-support-sata-phy-connection-rate-unmatch.patch
+acpi-apei-don-t-wait-to-serialise-with-oops-messages.patch
+acpi-apei-switch-estatus-pool-to-use-vmalloc-memory.patch
+scsi-hisi_sas-shutdown-axi-bus-to-avoid-exception-cq.patch
+scsi-libsas-check-smp-phy-control-function-result.patch
+rdma-hns-fix-the-bug-with-updating-rq-head-pointer-w.patch
+rdma-hns-bugfix-for-the-scene-without-receiver-queue.patch
+rdma-hns-fix-the-state-of-rereg-mr.patch
+rdma-hns-use-gfp_atomic-in-hns_roce_v2_modify_qp.patch
+asoc-rt5645-headphone-jack-sense-inverts-on-the-latt.patch
+f2fs-fix-to-data-block-override-node-segment-by-mist.patch
+powerpc-pseries-dlpar-fix-a-missing-check-in-dlpar_p.patch
+xdp-fix-cpumap-redirect-skb-creation-bug.patch
+mtd-remove-a-debug-trace-in-mtdpart.c.patch
--- /dev/null
+From 983b94a5dc05e3538327f0f7af79cad042eedf73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 13:10:00 +0000
+Subject: sfc: initialise found bitmap in efx_ef10_mtd_probe
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+[ Upstream commit c65285428b6e7797f1bb063f33b0ae7e93397b7b ]
+
+The bitmap of found partitions in efx_ef10_mtd_probe was not
+initialised, causing partitions to be suppressed based off whatever
+value was in the bitmap at the start.
+
+Fixes: 3366463513f5 ("sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe")
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index a497aace7e4f4..1f971d31ec302 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -6108,7 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
+- DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT) = { 0 };
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+--
+2.20.1
+
--- /dev/null
+From cb2d06da17365471ab7bf973b1f334abb7829bc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Jan 2019 19:02:17 +0000
+Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
+
+From: Edward Cree <ecree@solarflare.com>
+
+[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ]
+
+Use a bitmap to keep track of which partition types we've already seen;
+ for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and
+ thus skip adding that partition.
+Duplicate partitions occur because of the A/B backup scheme used by newer
+ sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because
+ they have the same name, causing us not to expose any MTDs at all.
+
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
+index 7eeac3d6cfe89..a497aace7e4f4 100644
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -6042,22 +6042,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = {
+ { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" },
+ { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" },
+ };
++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types)
+
+ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ struct efx_mcdi_mtd_partition *part,
+- unsigned int type)
++ unsigned int type,
++ unsigned long *found)
+ {
+ MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN);
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX);
+ const struct efx_ef10_nvram_type_info *info;
+ size_t size, erase_size, outlen;
++ int type_idx = 0;
+ bool protected;
+ int rc;
+
+- for (info = efx_ef10_nvram_types; ; info++) {
+- if (info ==
+- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types))
++ for (type_idx = 0; ; type_idx++) {
++ if (type_idx == EF10_NVRAM_PARTITION_COUNT)
+ return -ENODEV;
++ info = efx_ef10_nvram_types + type_idx;
+ if ((type & ~info->type_mask) == info->type)
+ break;
+ }
+@@ -6070,6 +6073,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ if (protected)
+ return -ENODEV; /* hide it */
+
++ /* If we've already exposed a partition of this type, hide this
++ * duplicate. All operations on MTDs are keyed by the type anyway,
++ * so we can't act on the duplicate.
++ */
++ if (__test_and_set_bit(type_idx, found))
++ return -EEXIST;
++
+ part->nvram_type = type;
+
+ MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type);
+@@ -6098,6 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx,
+ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ {
+ MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX);
++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT);
+ struct efx_mcdi_mtd_partition *parts;
+ size_t outlen, n_parts_total, i, n_parts;
+ unsigned int type;
+@@ -6126,11 +6137,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx)
+ for (i = 0; i < n_parts_total; i++) {
+ type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID,
+ i);
+- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type);
+- if (rc == 0)
+- n_parts++;
+- else if (rc != -ENODEV)
++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type,
++ found);
++ if (rc == -EEXIST || rc == -ENODEV)
++ continue;
++ if (rc)
+ goto fail;
++ n_parts++;
+ }
+
+ rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts));
+--
+2.20.1
+
--- /dev/null
+From 03fc11d867f429facf5922d898b7d2bf4c073010 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 00:09:04 -0600
+Subject: tipc: fix a missing check of genlmsg_put
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 46273cf7e009231d2b6bc10a926e82b8928a9fb2 ]
+
+genlmsg_put could fail. The fix inserts a check of its return value, and
+if it fails, returns -EMSGSIZE.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index 6494d6b5e1b24..fab0384d2b4b3 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -983,6 +983,8 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
++ if (!hdr)
++ return -EMSGSIZE;
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From 4df94008dc3e717b41a04774d3dcf2e521e8fa6c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 5 Jan 2019 10:52:23 -0600
+Subject: tipc: fix memory leak in tipc_nl_compat_publ_dump
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit f87d8ad9233f115db92c6c087d58403b0009ed36 ]
+
+There is a memory leak in case genlmsg_put fails.
+
+Fix this by freeing *args* before return.
+
+Addresses-Coverity-ID: 1476406 ("Resource leak")
+Fixes: 46273cf7e009 ("tipc: fix a missing check of genlmsg_put")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/netlink_compat.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index fab0384d2b4b3..b4860084a8f56 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -983,8 +983,10 @@ static int tipc_nl_compat_publ_dump(struct tipc_nl_compat_msg *msg, u32 sock)
+
+ hdr = genlmsg_put(args, 0, 0, &tipc_genl_family, NLM_F_MULTI,
+ TIPC_NL_PUBL_GET);
+- if (!hdr)
++ if (!hdr) {
++ kfree_skb(args);
+ return -EMSGSIZE;
++ }
+
+ nest = nla_nest_start(args, TIPC_NLA_SOCK);
+ if (!nest) {
+--
+2.20.1
+
--- /dev/null
+From 84768ca2b05768ceed502c0c9418222a17944854 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 09:18:28 +0700
+Subject: tipc: fix skb may be leaky in tipc_link_input
+
+From: Hoang Le <hoang.h.le@dektech.com.au>
+
+[ Upstream commit 7384b538d3aed2ed49d3575483d17aeee790fb06 ]
+
+When we free skb at tipc_data_input, we return a 'false' boolean.
+Then, skb passed to subcalling tipc_link_input in tipc_link_rcv,
+
+<snip>
+1303 int tipc_link_rcv:
+...
+1354 if (!tipc_data_input(l, skb, l->inputq))
+1355 rc |= tipc_link_input(l, skb, l->inputq);
+</snip>
+
+Fix it by simple changing to a 'true' boolean when skb is being free-ed.
+Then, tipc_link_rcv will bypassed to subcalling tipc_link_input as above
+condition.
+
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <maloy@donjonn.com>
+Signed-off-by: Hoang Le <hoang.h.le@dektech.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index 6344aca4487b6..0fbf8ea18ce04 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -1114,7 +1114,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
+ default:
+ pr_warn("Dropping received illegal msg type\n");
+ kfree_skb(skb);
+- return false;
++ return true;
+ };
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f670bac067f9ab6e70ab148603d5c41cdab881c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:37:27 -0800
+Subject: tools/vm/page-types.c: fix "kpagecount returned fewer pages than
+ expected" failures
+
+From: Anthony Yznaga <anthony.yznaga@oracle.com>
+
+[ Upstream commit b6fb87b8e3ff1ef6bcf68470f24a97c984554d5a ]
+
+Because kpagecount_read() fakes success if map counts are not being
+collected, clamp the page count passed to it by walk_pfn() to the pages
+value returned by the preceding call to kpageflags_read().
+
+Link: http://lkml.kernel.org/r/1543962269-26116-1-git-send-email-anthony.yznaga@oracle.com
+Fixes: 7f1d23e60718 ("tools/vm/page-types.c: include shared map counts")
+Signed-off-by: Anthony Yznaga <anthony.yznaga@oracle.com>
+Reviewed-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: David Rientjes <rientjes@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/vm/page-types.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
+index 37908a83ddc27..1ff3a6c0367b0 100644
+--- a/tools/vm/page-types.c
++++ b/tools/vm/page-types.c
+@@ -701,7 +701,7 @@ static void walk_pfn(unsigned long voffset,
+ if (kpagecgroup_read(cgi, index, pages) != pages)
+ fatal("kpagecgroup returned fewer pages than expected");
+
+- if (kpagecount_read(cnt, index, batch) != pages)
++ if (kpagecount_read(cnt, index, pages) != pages)
+ fatal("kpagecount returned fewer pages than expected");
+
+ for (i = 0; i < pages; i++)
+--
+2.20.1
+
--- /dev/null
+From df40fa2e4a4b41cdbc312b4d6a529cd36c081e58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 18:00:43 +0900
+Subject: tracing: Lock event_mutex before synth_event_mutex
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit fc800a10be26017f8f338bc8e500d48e3e6429d9 ]
+
+synthetic event is using synth_event_mutex for protecting
+synth_event_list, and event_trigger_write() path acquires
+locks as below order.
+
+event_trigger_write(event_mutex)
+ ->trigger_process_regex(trigger_cmd_mutex)
+ ->event_hist_trigger_func(synth_event_mutex)
+
+On the other hand, synthetic event creation and deletion paths
+call trace_add_event_call() and trace_remove_event_call()
+which acquires event_mutex. In that case, if we keep the
+synth_event_mutex locked while registering/unregistering synthetic
+events, its dependency will be inversed.
+
+To avoid this issue, current synthetic event is using a 2 phase
+process to create/delete events. For example, it searches existing
+events under synth_event_mutex to check for event-name conflicts, and
+unlocks synth_event_mutex, then registers a new event under event_mutex
+locked. Finally, it locks synth_event_mutex and tries to add the
+new event to the list. But it can introduce complexity and a chance
+for name conflicts.
+
+To solve this simpler, this introduces trace_add_event_call_nolock()
+and trace_remove_event_call_nolock() which don't acquire
+event_mutex inside. synthetic event can lock event_mutex before
+synth_event_mutex to solve the lock dependency issue simpler.
+
+Link: http://lkml.kernel.org/r/154140844377.17322.13781091165954002713.stgit@devbox
+
+Reviewed-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Tested-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/trace_events.h | 2 ++
+ kernel/trace/trace_events.c | 34 ++++++++++++++++++++++++++------
+ kernel/trace/trace_events_hist.c | 24 ++++++++++------------
+ 3 files changed, 40 insertions(+), 20 deletions(-)
+
+diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
+index 78a010e19ed41..0643c083ed862 100644
+--- a/include/linux/trace_events.h
++++ b/include/linux/trace_events.h
+@@ -529,6 +529,8 @@ extern int trace_event_raw_init(struct trace_event_call *call);
+ extern int trace_define_field(struct trace_event_call *call, const char *type,
+ const char *name, int offset, int size,
+ int is_signed, int filter_type);
++extern int trace_add_event_call_nolock(struct trace_event_call *call);
++extern int trace_remove_event_call_nolock(struct trace_event_call *call);
+ extern int trace_add_event_call(struct trace_event_call *call);
+ extern int trace_remove_event_call(struct trace_event_call *call);
+ extern int trace_event_get_offsets(struct trace_event_call *call);
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 7345f5f8f3fe6..017f737237e60 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -2302,11 +2302,11 @@ __trace_early_add_new_event(struct trace_event_call *call,
+ struct ftrace_module_file_ops;
+ static void __add_event_to_tracers(struct trace_event_call *call);
+
+-/* Add an additional event_call dynamically */
+-int trace_add_event_call(struct trace_event_call *call)
++int trace_add_event_call_nolock(struct trace_event_call *call)
+ {
+ int ret;
+- mutex_lock(&event_mutex);
++ lockdep_assert_held(&event_mutex);
++
+ mutex_lock(&trace_types_lock);
+
+ ret = __register_event(call, NULL);
+@@ -2314,6 +2314,16 @@ int trace_add_event_call(struct trace_event_call *call)
+ __add_event_to_tracers(call);
+
+ mutex_unlock(&trace_types_lock);
++ return ret;
++}
++
++/* Add an additional event_call dynamically */
++int trace_add_event_call(struct trace_event_call *call)
++{
++ int ret;
++
++ mutex_lock(&event_mutex);
++ ret = trace_add_event_call_nolock(call);
+ mutex_unlock(&event_mutex);
+ return ret;
+ }
+@@ -2363,17 +2373,29 @@ static int probe_remove_event_call(struct trace_event_call *call)
+ return 0;
+ }
+
+-/* Remove an event_call */
+-int trace_remove_event_call(struct trace_event_call *call)
++/* no event_mutex version */
++int trace_remove_event_call_nolock(struct trace_event_call *call)
+ {
+ int ret;
+
+- mutex_lock(&event_mutex);
++ lockdep_assert_held(&event_mutex);
++
+ mutex_lock(&trace_types_lock);
+ down_write(&trace_event_sem);
+ ret = probe_remove_event_call(call);
+ up_write(&trace_event_sem);
+ mutex_unlock(&trace_types_lock);
++
++ return ret;
++}
++
++/* Remove an event_call */
++int trace_remove_event_call(struct trace_event_call *call)
++{
++ int ret;
++
++ mutex_lock(&event_mutex);
++ ret = trace_remove_event_call_nolock(call);
+ mutex_unlock(&event_mutex);
+
+ return ret;
+diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
+index dac518977e7d0..11d952650fa72 100644
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -914,7 +914,7 @@ static int register_synth_event(struct synth_event *event)
+ call->data = event;
+ call->tp = event->tp;
+
+- ret = trace_add_event_call(call);
++ ret = trace_add_event_call_nolock(call);
+ if (ret) {
+ pr_warn("Failed to register synthetic event: %s\n",
+ trace_event_name(call));
+@@ -938,7 +938,7 @@ static int unregister_synth_event(struct synth_event *event)
+ struct trace_event_call *call = &event->call;
+ int ret;
+
+- ret = trace_remove_event_call(call);
++ ret = trace_remove_event_call_nolock(call);
+
+ return ret;
+ }
+@@ -1015,12 +1015,10 @@ static void add_or_delete_synth_event(struct synth_event *event, int delete)
+ if (delete)
+ free_synth_event(event);
+ else {
+- mutex_lock(&synth_event_mutex);
+ if (!find_synth_event(event->name))
+ list_add(&event->list, &synth_event_list);
+ else
+ free_synth_event(event);
+- mutex_unlock(&synth_event_mutex);
+ }
+ }
+
+@@ -1032,6 +1030,7 @@ static int create_synth_event(int argc, char **argv)
+ int i, consumed = 0, n_fields = 0, ret = 0;
+ char *name;
+
++ mutex_lock(&event_mutex);
+ mutex_lock(&synth_event_mutex);
+
+ /*
+@@ -1104,8 +1103,6 @@ static int create_synth_event(int argc, char **argv)
+ goto err;
+ }
+ out:
+- mutex_unlock(&synth_event_mutex);
+-
+ if (event) {
+ if (delete_event) {
+ ret = unregister_synth_event(event);
+@@ -1115,10 +1112,13 @@ static int create_synth_event(int argc, char **argv)
+ add_or_delete_synth_event(event, ret);
+ }
+ }
++ mutex_unlock(&synth_event_mutex);
++ mutex_unlock(&event_mutex);
+
+ return ret;
+ err:
+ mutex_unlock(&synth_event_mutex);
++ mutex_unlock(&event_mutex);
+
+ for (i = 0; i < n_fields; i++)
+ free_synth_field(fields[i]);
+@@ -1129,12 +1129,10 @@ static int create_synth_event(int argc, char **argv)
+
+ static int release_all_synth_events(void)
+ {
+- struct list_head release_events;
+ struct synth_event *event, *e;
+ int ret = 0;
+
+- INIT_LIST_HEAD(&release_events);
+-
++ mutex_lock(&event_mutex);
+ mutex_lock(&synth_event_mutex);
+
+ list_for_each_entry(event, &synth_event_list, list) {
+@@ -1144,16 +1142,14 @@ static int release_all_synth_events(void)
+ }
+ }
+
+- list_splice_init(&event->list, &release_events);
+-
+- mutex_unlock(&synth_event_mutex);
+-
+- list_for_each_entry_safe(event, e, &release_events, list) {
++ list_for_each_entry_safe(event, e, &synth_event_list, list) {
+ list_del(&event->list);
+
+ ret = unregister_synth_event(event);
+ add_or_delete_synth_event(event, !ret);
+ }
++ mutex_unlock(&synth_event_mutex);
++ mutex_unlock(&event_mutex);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From b83a0a7db50129280676531ce68d266fe4c60ac4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 11:20:03 +0800
+Subject: ubi: Do not drop UBI device reference before using
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit e542087701f09418702673631a908429feb3eae0 ]
+
+The UBI device reference is dropped but then the device is used as a
+parameter of ubi_err. The bug is introduced in changing ubi_err's
+behavior. The old ubi_err does not require a UBI device as its first
+parameter, but the new one does.
+
+Fixes: 32608703310 ("UBI: Extend UBI layer debug/messaging capabilities")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/kapi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
+index e9e9ecbcedcc3..0b8f0c46268da 100644
+--- a/drivers/mtd/ubi/kapi.c
++++ b/drivers/mtd/ubi/kapi.c
+@@ -227,9 +227,9 @@ out_unlock:
+ out_free:
+ kfree(desc);
+ out_put_ubi:
+- ubi_put_device(ubi);
+ ubi_err(ubi, "cannot open device %d, volume %d, error %d",
+ ubi_num, vol_id, err);
++ ubi_put_device(ubi);
+ return ERR_PTR(err);
+ }
+ EXPORT_SYMBOL_GPL(ubi_open_volume);
+--
+2.20.1
+
--- /dev/null
+From 0b8b3ccb11c36f81f52c37942283ac153e3e2134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:57:33 +0800
+Subject: ubi: Put MTD device after it is not used
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit b95f83ab762dd6211351b9140f99f43644076ca8 ]
+
+The MTD device reference is dropped via put_mtd_device, however its
+field ->index is read and passed to ubi_msg. To fix this, the patch
+moves the reference dropping after calling ubi_msg.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mtd/ubi/build.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
+index d2a726654ff11..c120c8761fcd2 100644
+--- a/drivers/mtd/ubi/build.c
++++ b/drivers/mtd/ubi/build.c
+@@ -1101,10 +1101,10 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
+ ubi_wl_close(ubi);
+ ubi_free_internal_volumes(ubi);
+ vfree(ubi->vtbl);
+- put_mtd_device(ubi->mtd);
+ vfree(ubi->peb_buf);
+ vfree(ubi->fm_buf);
+ ubi_msg(ubi, "mtd%d is detached", ubi->mtd->index);
++ put_mtd_device(ubi->mtd);
+ put_device(&ubi->dev);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 9d65242f1aa336d359820dd6327893fcc5219e6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Dec 2018 18:12:13 +0100
+Subject: ubifs: Fix default compression selection in ubifs
+
+From: Gabor Juhos <juhosg@openwrt.org>
+
+[ Upstream commit d62e98ed1efcaa94caa004f622944afdce5f1c3c ]
+
+When ubifs is build without the LZO compressor and no compressor is
+given the creation of the default file system will fail. before
+selection the LZO compressor check if it is present and if not fall back
+to the zlib or none.
+
+Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ubifs/sb.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
+index bf17f58908ff9..11dc3977fb64f 100644
+--- a/fs/ubifs/sb.c
++++ b/fs/ubifs/sb.c
+@@ -63,6 +63,17 @@
+ /* Default time granularity in nanoseconds */
+ #define DEFAULT_TIME_GRAN 1000000000
+
++static int get_default_compressor(struct ubifs_info *c)
++{
++ if (ubifs_compr_present(c, UBIFS_COMPR_LZO))
++ return UBIFS_COMPR_LZO;
++
++ if (ubifs_compr_present(c, UBIFS_COMPR_ZLIB))
++ return UBIFS_COMPR_ZLIB;
++
++ return UBIFS_COMPR_NONE;
++}
++
+ /**
+ * create_default_filesystem - format empty UBI volume.
+ * @c: UBIFS file-system description object
+@@ -186,7 +197,7 @@ static int create_default_filesystem(struct ubifs_info *c)
+ if (c->mount_opts.override_compr)
+ sup->default_compr = cpu_to_le16(c->mount_opts.compr_type);
+ else
+- sup->default_compr = cpu_to_le16(UBIFS_COMPR_LZO);
++ sup->default_compr = cpu_to_le16(get_default_compressor(c));
+
+ generate_random_uuid(sup->uuid);
+
+--
+2.20.1
+
--- /dev/null
+From 604a8bbc11f0216649456704838f818ff9cbe901 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 12:58:11 +0100
+Subject: um: Include sys/uio.h to have writev()
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 0053102a869f1b909904b1b85ac282e2744deaab ]
+
+sys/uio.h gives us writev(), otherwise the build might fail on
+some systems.
+
+Fixes: 49da7e64f33e ("High Performance UML Vector Network Driver")
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/drivers/vector_user.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/drivers/vector_user.c b/arch/um/drivers/vector_user.c
+index 4d6a78e31089f..00c4c2735a5f7 100644
+--- a/arch/um/drivers/vector_user.c
++++ b/arch/um/drivers/vector_user.c
+@@ -30,6 +30,7 @@
+ #include <stdlib.h>
+ #include <os.h>
+ #include <um_malloc.h>
++#include <sys/uio.h>
+ #include "vector_user.h"
+
+ #define ID_GRE 0
+--
+2.20.1
+
--- /dev/null
+From cae72101138b77573e14564edf86928a68740b7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 12:58:12 +0100
+Subject: um: Make GCOV depend on !KCOV
+
+From: Richard Weinberger <richard@nod.at>
+
+[ Upstream commit 550ed0e2036663b35cec12374b835444f9c60454 ]
+
+Both do more or less the same thing and are mutually exclusive.
+If both are enabled the build will fail.
+Sooner or later we can kill UML's GCOV.
+
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/um/Kconfig.debug | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/um/Kconfig.debug b/arch/um/Kconfig.debug
+index 2014597605ea9..85726eeec3451 100644
+--- a/arch/um/Kconfig.debug
++++ b/arch/um/Kconfig.debug
+@@ -16,6 +16,7 @@ config GPROF
+ config GCOV
+ bool "Enable gcov support"
+ depends on DEBUG_INFO
++ depends on !KCOV
+ help
+ This option allows developers to retrieve coverage data from a UML
+ session.
+--
+2.20.1
+
--- /dev/null
+From 68a535ede8dd925e923a79b447491ab52327a7ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 11:36:15 +0200
+Subject: usb: ehci-omap: Fix deferred probe for phy handling
+
+From: Roger Quadros <rogerq@ti.com>
+
+[ Upstream commit 8dc7623bf608495b6e6743e805807c7840673573 ]
+
+PHY model is being used on omap5 platforms even if port mode
+is not OMAP_EHCI_PORT_MODE_PHY. So don't guess if PHY is required
+or not based on PHY mode.
+
+If PHY is provided in device tree, it must be required. So, if
+devm_usb_get_phy_by_phandle() gives us an error code other
+than -ENODEV (no PHY) then error out.
+
+This fixes USB Ethernet on omap5-uevm if PHY happens to
+probe after EHCI thus causing a -EPROBE_DEFER.
+
+Cc: Johan Hovold <johan@kernel.org>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Tested-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/ehci-omap.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
+index 7e4c13346a1ee..7d20296cbe9f9 100644
+--- a/drivers/usb/host/ehci-omap.c
++++ b/drivers/usb/host/ehci-omap.c
+@@ -159,11 +159,12 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
+ /* get the PHY device */
+ phy = devm_usb_get_phy_by_phandle(dev, "phys", i);
+ if (IS_ERR(phy)) {
+- /* Don't bail out if PHY is not absolutely necessary */
+- if (pdata->port_mode[i] != OMAP_EHCI_PORT_MODE_PHY)
++ ret = PTR_ERR(phy);
++ if (ret == -ENODEV) { /* no PHY */
++ phy = NULL;
+ continue;
++ }
+
+- ret = PTR_ERR(phy);
+ if (ret != -EPROBE_DEFER)
+ dev_err(dev, "Can't get PHY for port %d: %d\n",
+ i, ret);
+--
+2.20.1
+
--- /dev/null
+From 182e6ec77ae6a96f07f4cce0ee1d1406d067c7ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Oct 2018 11:04:27 -0700
+Subject: vfio-mdev/samples: Use u8 instead of char for handle functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 8ba35b3a0046d6573c98f00461d9bd1b86250d35 ]
+
+Clang warns:
+
+samples/vfio-mdev/mtty.c:592:39: warning: implicit conversion from 'int'
+to 'char' changes value from 162 to -94 [-Wconstant-conversion]
+ *buf = UART_MSR_DSR | UART_MSR_DDSR | UART_MSR_DCD;
+ ~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
+1 warning generated.
+
+Turns out that all uses of buf in this function ultimately end up stored
+or cast to an unsigned type. Just use u8, which has the same number of
+bits but can store this larger number so Clang no longer warns.
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/vfio-mdev/mtty.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
+index 7abb79d8313d9..f6732aa16bb1f 100644
+--- a/samples/vfio-mdev/mtty.c
++++ b/samples/vfio-mdev/mtty.c
+@@ -171,7 +171,7 @@ static struct mdev_state *find_mdev_state_by_uuid(uuid_le uuid)
+ return NULL;
+ }
+
+-void dump_buffer(char *buf, uint32_t count)
++void dump_buffer(u8 *buf, uint32_t count)
+ {
+ #if defined(DEBUG)
+ int i;
+@@ -250,7 +250,7 @@ static void mtty_create_config_space(struct mdev_state *mdev_state)
+ }
+
+ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+- char *buf, u32 count)
++ u8 *buf, u32 count)
+ {
+ u32 cfg_addr, bar_mask, bar_index = 0;
+
+@@ -304,7 +304,7 @@ static void handle_pci_cfg_write(struct mdev_state *mdev_state, u16 offset,
+ }
+
+ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+- u16 offset, char *buf, u32 count)
++ u16 offset, u8 *buf, u32 count)
+ {
+ u8 data = *buf;
+
+@@ -475,7 +475,7 @@ static void handle_bar_write(unsigned int index, struct mdev_state *mdev_state,
+ }
+
+ static void handle_bar_read(unsigned int index, struct mdev_state *mdev_state,
+- u16 offset, char *buf, u32 count)
++ u16 offset, u8 *buf, u32 count)
+ {
+ /* Handle read requests by guest */
+ switch (offset) {
+@@ -650,7 +650,7 @@ static void mdev_read_base(struct mdev_state *mdev_state)
+ }
+ }
+
+-static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
++static ssize_t mdev_access(struct mdev_device *mdev, u8 *buf, size_t count,
+ loff_t pos, bool is_write)
+ {
+ struct mdev_state *mdev_state;
+@@ -698,7 +698,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ pr_info("%s: BAR%d WR @0x%llx %s val:0x%02x dlab:%d\n",
+ __func__, index, offset, wr_reg[offset],
+- (u8)*buf, mdev_state->s[index].dlab);
++ *buf, mdev_state->s[index].dlab);
+ #endif
+ handle_bar_write(index, mdev_state, offset, buf, count);
+ } else {
+@@ -708,7 +708,7 @@ static ssize_t mdev_access(struct mdev_device *mdev, char *buf, size_t count,
+ #if defined(DEBUG_REGS)
+ pr_info("%s: BAR%d RD @0x%llx %s val:0x%02x dlab:%d\n",
+ __func__, index, offset, rd_reg[offset],
+- (u8)*buf, mdev_state->s[index].dlab);
++ *buf, mdev_state->s[index].dlab);
+ #endif
+ }
+ break;
+@@ -827,7 +827,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ if (count >= 4 && !(*ppos % 4)) {
+ u32 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -839,7 +839,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ } else if (count >= 2 && !(*ppos % 2)) {
+ u16 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -851,7 +851,7 @@ ssize_t mtty_read(struct mdev_device *mdev, char __user *buf, size_t count,
+ } else {
+ u8 val;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, false);
+ if (ret <= 0)
+ goto read_err;
+@@ -889,7 +889,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+@@ -901,7 +901,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+@@ -913,7 +913,7 @@ ssize_t mtty_write(struct mdev_device *mdev, const char __user *buf,
+ if (copy_from_user(&val, buf, sizeof(val)))
+ goto write_err;
+
+- ret = mdev_access(mdev, (char *)&val, sizeof(val),
++ ret = mdev_access(mdev, (u8 *)&val, sizeof(val),
+ *ppos, true);
+ if (ret <= 0)
+ goto write_err;
+--
+2.20.1
+
--- /dev/null
+From a09c251d5dbca41b2932af80bdf6a510e836621a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Oct 2018 13:22:31 +1000
+Subject: vfio/spapr_tce: Get rid of possible infinite loop
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit 517ad4ae8aa93dccdb9a88c27257ecb421c9e848 ]
+
+As a part of cleanup, the SPAPR TCE IOMMU subdriver releases preregistered
+memory. If there is a bug in memory release, the loop in
+tce_iommu_release() becomes infinite; this actually happened to me.
+
+This makes the loop finite and prints a warning on every failure to make
+the code more bug prone.
+
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Acked-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/vfio_iommu_spapr_tce.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c
+index 96721b154454f..ec53310f16136 100644
+--- a/drivers/vfio/vfio_iommu_spapr_tce.c
++++ b/drivers/vfio/vfio_iommu_spapr_tce.c
+@@ -371,6 +371,7 @@ static void tce_iommu_release(void *iommu_data)
+ {
+ struct tce_container *container = iommu_data;
+ struct tce_iommu_group *tcegrp;
++ struct tce_iommu_prereg *tcemem, *tmtmp;
+ long i;
+
+ while (tce_groups_attached(container)) {
+@@ -393,13 +394,8 @@ static void tce_iommu_release(void *iommu_data)
+ tce_iommu_free_table(container, tbl);
+ }
+
+- while (!list_empty(&container->prereg_list)) {
+- struct tce_iommu_prereg *tcemem;
+-
+- tcemem = list_first_entry(&container->prereg_list,
+- struct tce_iommu_prereg, next);
+- WARN_ON_ONCE(tce_iommu_prereg_free(container, tcemem));
+- }
++ list_for_each_entry_safe(tcemem, tmtmp, &container->prereg_list, next)
++ WARN_ON(tce_iommu_prereg_free(container, tcemem));
+
+ tce_iommu_disable(container);
+ if (container->mm)
+--
+2.20.1
+
--- /dev/null
+From 6daaf5612a4ce4ffc7a840f88a06dab7d54322bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Dec 2018 00:34:36 -0800
+Subject: vmscan: return NODE_RECLAIM_NOSCAN in node_reclaim() when CONFIG_NUMA
+ is n
+
+From: Wei Yang <richard.weiyang@gmail.com>
+
+[ Upstream commit 8b09549c2bfd9f3f8f4cdad74107ef4f4ff9cdd7 ]
+
+Commit fa5e084e43eb ("vmscan: do not unconditionally treat zones that
+fail zone_reclaim() as full") changed the return value of
+node_reclaim(). The original return value 0 means NODE_RECLAIM_SOME
+after this commit.
+
+While the return value of node_reclaim() when CONFIG_NUMA is n is not
+changed. This will leads to call zone_watermark_ok() again.
+
+This patch fixes the return value by adjusting to NODE_RECLAIM_NOSCAN.
+Since node_reclaim() is only called in page_alloc.c, move it to
+mm/internal.h.
+
+Link: http://lkml.kernel.org/r/20181113080436.22078-1-richard.weiyang@gmail.com
+Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: Matthew Wilcox <willy@infradead.org>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/swap.h | 6 ------
+ mm/internal.h | 10 ++++++++++
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 7bd0a6f2ac2b0..ee8f9f554a9e1 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -371,14 +371,8 @@ extern unsigned long vm_total_pages;
+ extern int node_reclaim_mode;
+ extern int sysctl_min_unmapped_ratio;
+ extern int sysctl_min_slab_ratio;
+-extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
+ #else
+ #define node_reclaim_mode 0
+-static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
+- unsigned int order)
+-{
+- return 0;
+-}
+ #endif
+
+ extern int page_evictable(struct page *page);
+diff --git a/mm/internal.h b/mm/internal.h
+index 87256ae1bef86..397183c8fe47b 100644
+--- a/mm/internal.h
++++ b/mm/internal.h
+@@ -444,6 +444,16 @@ static inline void mminit_validate_memmodel_limits(unsigned long *start_pfn,
+ #define NODE_RECLAIM_SOME 0
+ #define NODE_RECLAIM_SUCCESS 1
+
++#ifdef CONFIG_NUMA
++extern int node_reclaim(struct pglist_data *, gfp_t, unsigned int);
++#else
++static inline int node_reclaim(struct pglist_data *pgdat, gfp_t mask,
++ unsigned int order)
++{
++ return NODE_RECLAIM_NOSCAN;
++}
++#endif
++
+ extern int hwpoison_filter(struct page *p);
+
+ extern u32 hwpoison_filter_dev_major;
+--
+2.20.1
+
--- /dev/null
+From bb629d18c3e834dd003e2dec470d85286d310e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Dec 2018 11:12:55 -0800
+Subject: VSOCK: bind to random port for VMADDR_PORT_ANY
+
+From: Lepton Wu <ytht.net@gmail.com>
+
+[ Upstream commit 8236b08cf50f85bbfaf48910a0b3ee68318b7c4b ]
+
+The old code always starts from fixed port for VMADDR_PORT_ANY. Sometimes
+when VMM crashed, there is still orphaned vsock which is waiting for
+close timer, then it could cause connection time out for new started VM
+if they are trying to connect to same port with same guest cid since the
+new packets could hit that orphaned vsock. We could also fix this by doing
+more in vhost_vsock_reset_orphans, but any way, it should be better to start
+from a random local port instead of a fixed one.
+
+Signed-off-by: Lepton Wu <ytht.net@gmail.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/af_vsock.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index b2724fb06bbbb..62ec9182f234d 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -107,6 +107,7 @@
+ #include <linux/mutex.h>
+ #include <linux/net.h>
+ #include <linux/poll.h>
++#include <linux/random.h>
+ #include <linux/skbuff.h>
+ #include <linux/smp.h>
+ #include <linux/socket.h>
+@@ -480,9 +481,13 @@ out:
+ static int __vsock_bind_stream(struct vsock_sock *vsk,
+ struct sockaddr_vm *addr)
+ {
+- static u32 port = LAST_RESERVED_PORT + 1;
++ static u32 port = 0;
+ struct sockaddr_vm new_addr;
+
++ if (!port)
++ port = LAST_RESERVED_PORT + 1 +
++ prandom_u32_max(U32_MAX - LAST_RESERVED_PORT);
++
+ vsock_addr_init(&new_addr, addr->svm_cid, addr->svm_port);
+
+ if (addr->svm_port == VMADDR_PORT_ANY) {
+--
+2.20.1
+
--- /dev/null
+From bb633a21a1d5dd227f00f3b414a13ae3dc674007 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 13:16:00 +0000
+Subject: vxlan: Fix error path in __vxlan_dev_create()
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 6db9246871394b3a136cd52001a0763676563840 ]
+
+When a failure occurs in rtnl_configure_link(), the current code
+calls unregister_netdevice() to roll back the earlier call to
+register_netdevice(), and jumps to errout, which calls
+vxlan_fdb_destroy().
+
+However unregister_netdevice() calls transitively ndo_uninit, which is
+vxlan_uninit(), and that already takes care of deleting the default FDB
+entry by calling vxlan_fdb_delete_default(). Since the entry added
+earlier in __vxlan_dev_create() is exactly the default entry, the
+cleanup code in the errout block always leads to double free and thus a
+panic.
+
+Besides, since vxlan_fdb_delete_default() always destroys the FDB entry
+with notification enabled, the deletion of the default entry is notified
+even before the addition was notified.
+
+Instead, move the unregister_netdevice() call after the manual destroy,
+which solves both problems.
+
+Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 2a536f84d5f69..d8a56df3933f0 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3213,6 +3213,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ struct vxlan_net *vn = net_generic(net, vxlan_net_id);
+ struct vxlan_dev *vxlan = netdev_priv(dev);
+ struct vxlan_fdb *f = NULL;
++ bool unregister = false;
+ int err;
+
+ err = vxlan_dev_configure(net, dev, conf, false, extack);
+@@ -3238,12 +3239,11 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+ err = register_netdevice(dev);
+ if (err)
+ goto errout;
++ unregister = true;
+
+ err = rtnl_configure_link(dev, NULL);
+- if (err) {
+- unregister_netdevice(dev);
++ if (err)
+ goto errout;
+- }
+
+ /* notify default fdb entry */
+ if (f)
+@@ -3251,9 +3251,16 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev,
+
+ list_add(&vxlan->next, &vn->vxlan_list);
+ return 0;
++
+ errout:
++ /* unregister_netdevice() destroys the default FDB entry with deletion
++ * notification. But the addition notification was not sent yet, so
++ * destroy the entry by hand here.
++ */
+ if (f)
+ vxlan_fdb_destroy(vxlan, f, false);
++ if (unregister)
++ unregister_netdevice(dev);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9e87783aa25e7a3c49fb410ba84e66188014fbcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 18:53:49 +0800
+Subject: watchdog: meson: Fix the wrong value of left time
+
+From: Xingyu Chen <xingyu.chen@amlogic.com>
+
+[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ]
+
+The left time value is wrong when we get it by sysfs. The left time value
+should be equal to preset timeout value minus elapsed time value. According
+to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value
+is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved
+to BIT[16-31] of the WATCHDOG_TCNT.
+
+[0]: http://linux-meson.com
+
+Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver")
+Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/meson_gxbb_wdt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
+index 69adeab3fde70..0a6672789640c 100644
+--- a/drivers/watchdog/meson_gxbb_wdt.c
++++ b/drivers/watchdog/meson_gxbb_wdt.c
+@@ -89,8 +89,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
+
+ reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
+
+- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
+- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
+ }
+
+ static const struct watchdog_ops meson_gxbb_wdt_ops = {
+--
+2.20.1
+
--- /dev/null
+From 68a4991a326134d52b17bd328fac343744a3d9ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 13:25:02 +0800
+Subject: x86/resctrl: Prevent NULL pointer dereference when reading mondata
+
+From: Xiaochen Shen <xiaochen.shen@intel.com>
+
+[ Upstream commit 26467b0f8407cbd628fa5b7bcfd156e772004155 ]
+
+When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED
+in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed
+until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later.
+
+During the window of deleting a mon group, if an application calls
+rdtgroup_mondata_show() to read mondata under this mon group,
+'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when
+rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path:
+rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count().
+Thus it results in NULL pointer dereference in mon_event_count().
+
+Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT
+immediately when reading mondata during the window of deleting a mon
+group.
+
+Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data")
+Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: pei.p.jia@intel.com
+Cc: Reinette Chatre <reinette.chatre@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+index c8b72aff55e00..2052e1e6a11c9 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c
+@@ -459,6 +459,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
+ int ret = 0;
+
+ rdtgrp = rdtgroup_kn_lock_live(of->kn);
++ if (!rdtgrp) {
++ ret = -ENOENT;
++ goto out;
++ }
+
+ md.priv = of->kn->priv;
+ resid = md.u.rid;
+--
+2.20.1
+
--- /dev/null
+From 6e70cbf7b709e7775c9755d904d7b054174d4436 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Mar 2019 10:18:00 +0100
+Subject: xdp: fix cpumap redirect SKB creation bug
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+[ Upstream commit 676e4a6fe703f2dae699ee9d56f14516f9ada4ea ]
+
+We want to avoid leaking pointer info from xdp_frame (that is placed in
+top of frame) like commit 6dfb970d3dbd ("xdp: avoid leaking info stored in
+frame data on page reuse"), and followup commit 97e19cce05e5 ("bpf:
+reserve xdp_frame size in xdp headroom") that reserve this headroom.
+
+These changes also affected how cpumap constructed SKBs, as xdpf->headroom
+size changed, the skb data starting point were in-effect shifted with 32
+bytes (sizeof xdp_frame). This was still okay, as the cpumap frame_size
+calculation also included xdpf->headroom which were reduced by same amount.
+
+A bug was introduced in commit 77ea5f4cbe20 ("bpf/cpumap: make sure
+frame_size for build_skb is aligned if headroom isn't"), where the
+xdpf->headroom became part of the SKB_DATA_ALIGN rounding up. This
+round-up to find the frame_size is in principle still correct as it does
+not exceed the 2048 bytes frame_size (which is max for ixgbe and i40e),
+but the 32 bytes offset of pkt_data_start puts this over the 2048 bytes
+limit. This cause skb_shared_info to spill into next frame. It is a little
+hard to trigger, as the SKB need to use above 15 skb_shinfo->frags[] as
+far as I calculate. This does happen in practise for TCP streams when
+skb_try_coalesce() kicks in.
+
+KASAN can be used to detect these wrong memory accesses, I've seen:
+ BUG: KASAN: use-after-free in skb_try_coalesce+0x3cb/0x760
+ BUG: KASAN: wild-memory-access in skb_release_data+0xe2/0x250
+
+Driver veth also construct a SKB from xdp_frame in this way, but is not
+affected, as it doesn't reserve/deduct the room (used by xdp_frame) from
+the SKB headroom. Instead is clears the pointers via xdp_scrub_frame(),
+and allows SKB to use this area.
+
+The fix in this patch is to do like veth and instead allow SKB to (re)use
+the area occupied by xdp_frame, by clearing via xdp_scrub_frame(). (This
+does kill the idea of the SKB being able to access (mem) info from this
+area, but I guess it was a bad idea anyhow, and it was already killed by
+the veth changes.)
+
+Fixes: 77ea5f4cbe20 ("bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't")
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cpumap.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c
+index 8974b3755670e..3c18260403dde 100644
+--- a/kernel/bpf/cpumap.c
++++ b/kernel/bpf/cpumap.c
+@@ -162,10 +162,14 @@ static void cpu_map_kthread_stop(struct work_struct *work)
+ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ struct xdp_frame *xdpf)
+ {
++ unsigned int hard_start_headroom;
+ unsigned int frame_size;
+ void *pkt_data_start;
+ struct sk_buff *skb;
+
++ /* Part of headroom was reserved to xdpf */
++ hard_start_headroom = sizeof(struct xdp_frame) + xdpf->headroom;
++
+ /* build_skb need to place skb_shared_info after SKB end, and
+ * also want to know the memory "truesize". Thus, need to
+ * know the memory frame size backing xdp_buff.
+@@ -183,15 +187,15 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ * is not at a fixed memory location, with mixed length
+ * packets, which is bad for cache-line hotness.
+ */
+- frame_size = SKB_DATA_ALIGN(xdpf->len + xdpf->headroom) +
++ frame_size = SKB_DATA_ALIGN(xdpf->len + hard_start_headroom) +
+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+- pkt_data_start = xdpf->data - xdpf->headroom;
++ pkt_data_start = xdpf->data - hard_start_headroom;
+ skb = build_skb(pkt_data_start, frame_size);
+ if (!skb)
+ return NULL;
+
+- skb_reserve(skb, xdpf->headroom);
++ skb_reserve(skb, hard_start_headroom);
+ __skb_put(skb, xdpf->len);
+ if (xdpf->metasize)
+ skb_metadata_set(skb, xdpf->metasize);
+@@ -205,6 +209,9 @@ static struct sk_buff *cpu_map_build_skb(struct bpf_cpu_map_entry *rcpu,
+ * - RX ring dev queue index (skb_record_rx_queue)
+ */
+
++ /* Allow SKB to reuse area used by xdp_frame */
++ xdp_scrub_frame(xdpf);
++
+ return skb;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8d21a5ccff2c08995903eeab6aff9ad0cc65d899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:55:45 +0000
+Subject: xen/pciback: Check dev_data before using it
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+[ Upstream commit 1669907e3d1abfa3f7586e2d55dbbc117b5adba2 ]
+
+If pcistub_init_device fails, the release function will be called with
+dev_data set to NULL. Check it before using it to avoid a NULL pointer
+dereference.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xen-pciback/pci_stub.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
+index 59661db144e51..097410a7cdb74 100644
+--- a/drivers/xen/xen-pciback/pci_stub.c
++++ b/drivers/xen/xen-pciback/pci_stub.c
+@@ -106,7 +106,8 @@ static void pcistub_device_release(struct kref *kref)
+ * is called from "unbind" which takes a device_lock mutex.
+ */
+ __pci_reset_function_locked(dev);
+- if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
++ if (dev_data &&
++ pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
+ dev_info(&dev->dev, "Could not reload PCI state\n");
+ else
+ pci_restore_state(dev);
+--
+2.20.1
+
--- /dev/null
+From baadb150a5ef043fc9b89f8c14a1170e448cd200 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Align compat attrlist_by_handle with native implementation.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit c456d64449efe37da50832b63d91652a85ea1d20 ]
+
+While inspecting the ioctl implementations, I noticed that the compat
+implementation of XFS_IOC_ATTRLIST_BY_HANDLE does not do exactly the
+same thing as the native implementation. Specifically, the "cursor"
+does not appear to be written out to userspace on the compat path,
+like it is on the native path.
+
+This adjusts the compat implementation to copy out the cursor just
+like the native implementation does. The attrlist cursor does not
+require any special compat handling. This fixes xfstests xfs/269
+on both IA-32 and x32 userspace, when running on an amd64 kernel.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Fixes: 0facef7fb053b ("xfs: in _attrlist_by_handle, copy the cursor back to userspace")
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index fba115f4103ac..4c34efcbf7e80 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -336,6 +336,7 @@ xfs_compat_attrlist_by_handle(
+ {
+ int error;
+ attrlist_cursor_kern_t *cursor;
++ compat_xfs_fsop_attrlist_handlereq_t __user *p = arg;
+ compat_xfs_fsop_attrlist_handlereq_t al_hreq;
+ struct dentry *dentry;
+ char *kbuf;
+@@ -370,6 +371,11 @@ xfs_compat_attrlist_by_handle(
+ if (error)
+ goto out_kfree;
+
++ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) {
++ error = -EFAULT;
++ goto out_kfree;
++ }
++
+ if (copy_to_user(compat_ptr(al_hreq.buffer), kbuf, al_hreq.buflen))
+ error = -EFAULT;
+
+--
+2.20.1
+
--- /dev/null
+From a6e9f0e7d3b5e9529913dccce4657efeb5d1433f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Feb 2019 14:03:06 -0800
+Subject: xfs: end sync buffer I/O properly on shutdown error
+
+From: Brian Foster <bfoster@redhat.com>
+
+[ Upstream commit 465fa17f4a303d9fdff9eac4d45f91ece92e96ca ]
+
+As of commit e339dd8d8b ("xfs: use sync buffer I/O for sync delwri
+queue submission"), the delwri submission code uses sync buffer I/O
+for sync delwri I/O. Instead of waiting on async I/O to unlock the
+buffer, it uses the underlying sync I/O completion mechanism.
+
+If delwri buffer submission fails due to a shutdown scenario, an
+error is set on the buffer and buffer completion never occurs. This
+can cause xfs_buf_delwri_submit() to deadlock waiting on a
+completion event.
+
+We could check the error state before waiting on such buffers, but
+that doesn't serialize against the case of an error set via a racing
+I/O completion. Instead, invoke I/O completion in the shutdown case
+regardless of buffer I/O type.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_buf.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
+index e36124546d0db..c1f7c0d5d608a 100644
+--- a/fs/xfs/xfs_buf.c
++++ b/fs/xfs/xfs_buf.c
+@@ -1506,8 +1506,7 @@ __xfs_buf_submit(
+ xfs_buf_ioerror(bp, -EIO);
+ bp->b_flags &= ~XBF_DONE;
+ xfs_buf_stale(bp);
+- if (bp->b_flags & XBF_ASYNC)
+- xfs_buf_ioend(bp);
++ xfs_buf_ioend(bp);
+ return -EIO;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2287aa566516880e56e87632ddf234781edf20b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 09:35:27 -0800
+Subject: xfs: Fix bulkstat compat ioctls on x32 userspace.
+
+From: Nick Bowler <nbowler@draconx.ca>
+
+[ Upstream commit 7ca860e3c1a74ad6bd8949364073ef1044cad758 ]
+
+The bulkstat family of ioctls are problematic on x32, because there is
+a mixup of native 32-bit and 64-bit conventions. The xfs_fsop_bulkreq
+struct contains pointers and 32-bit integers so that matches the native
+32-bit layout, and that means the ioctl implementation goes into the
+regular compat path on x32.
+
+However, the 'ubuffer' member of that struct in turn refers to either
+struct xfs_inogrp or xfs_bstat (or an array of these). On x32, those
+structures match the native 64-bit layout. The compat implementation
+writes out the 32-bit version of these structures. This is not the
+expected format for x32 userspace, causing problems.
+
+Fortunately the functions which actually output these xfs_inogrp and
+xfs_bstat structures have an easy way to select which output format
+is required, so we just need a little tweak to select the right format
+on x32.
+
+Signed-off-by: Nick Bowler <nbowler@draconx.ca>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_ioctl32.c | 34 ++++++++++++++++++++++++++++++----
+ 1 file changed, 30 insertions(+), 4 deletions(-)
+
+diff --git a/fs/xfs/xfs_ioctl32.c b/fs/xfs/xfs_ioctl32.c
+index 4c34efcbf7e80..b044f7d36782c 100644
+--- a/fs/xfs/xfs_ioctl32.c
++++ b/fs/xfs/xfs_ioctl32.c
+@@ -241,6 +241,32 @@ xfs_compat_ioc_bulkstat(
+ int done;
+ int error;
+
++ /*
++ * Output structure handling functions. Depending on the command,
++ * either the xfs_bstat and xfs_inogrp structures are written out
++ * to userpace memory via bulkreq.ubuffer. Normally the compat
++ * functions and structure size are the correct ones to use ...
++ */
++ inumbers_fmt_pf inumbers_func = xfs_inumbers_fmt_compat;
++ bulkstat_one_pf bs_one_func = xfs_bulkstat_one_compat;
++ size_t bs_one_size = sizeof(struct compat_xfs_bstat);
++
++#ifdef CONFIG_X86_X32
++ if (in_x32_syscall()) {
++ /*
++ * ... but on x32 the input xfs_fsop_bulkreq has pointers
++ * which must be handled in the "compat" (32-bit) way, while
++ * the xfs_bstat and xfs_inogrp structures follow native 64-
++ * bit layout convention. So adjust accordingly, otherwise
++ * the data written out in compat layout will not match what
++ * x32 userspace expects.
++ */
++ inumbers_func = xfs_inumbers_fmt;
++ bs_one_func = xfs_bulkstat_one;
++ bs_one_size = sizeof(struct xfs_bstat);
++ }
++#endif
++
+ /* done = 1 if there are more stats to get and if bulkstat */
+ /* should be called again (unused here, but used in dmapi) */
+
+@@ -272,15 +298,15 @@ xfs_compat_ioc_bulkstat(
+
+ if (cmd == XFS_IOC_FSINUMBERS_32) {
+ error = xfs_inumbers(mp, &inlast, &count,
+- bulkreq.ubuffer, xfs_inumbers_fmt_compat);
++ bulkreq.ubuffer, inumbers_func);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_SINGLE_32) {
+ int res;
+
+- error = xfs_bulkstat_one_compat(mp, inlast, bulkreq.ubuffer,
+- sizeof(compat_xfs_bstat_t), NULL, &res);
++ error = bs_one_func(mp, inlast, bulkreq.ubuffer,
++ bs_one_size, NULL, &res);
+ } else if (cmd == XFS_IOC_FSBULKSTAT_32) {
+ error = xfs_bulkstat(mp, &inlast, &count,
+- xfs_bulkstat_one_compat, sizeof(compat_xfs_bstat_t),
++ bs_one_func, bs_one_size,
+ bulkreq.ubuffer, &done);
+ } else
+ error = -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 0545c01d4db6f06092a6ca9d4d341c6cd784104b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 15:18:52 -0800
+Subject: xfs: require both realtime inodes to mount
+
+From: Darrick J. Wong <darrick.wong@oracle.com>
+
+[ Upstream commit 64bafd2f1e484e27071e7584642005d56516cb77 ]
+
+Since mkfs always formats the filesystem with the realtime bitmap and
+summary inodes immediately after the root directory, we should expect
+that both of them are present and loadable, even if there isn't a
+realtime volume attached. There's no reason to skip this if rbmino ==
+NULLFSINO; in fact, this causes an immediate crash if the there /is/ a
+realtime volume and someone writes to it.
+
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Bill O'Donnell <billodo@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_rtalloc.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
+index 926ed314ffba1..484eb0adcefb2 100644
+--- a/fs/xfs/xfs_rtalloc.c
++++ b/fs/xfs/xfs_rtalloc.c
+@@ -1198,13 +1198,11 @@ xfs_rtmount_inodes(
+ xfs_sb_t *sbp;
+
+ sbp = &mp->m_sb;
+- if (sbp->sb_rbmino == NULLFSINO)
+- return 0;
+ error = xfs_iget(mp, NULL, sbp->sb_rbmino, 0, 0, &mp->m_rbmip);
+ if (error)
+ return error;
+ ASSERT(mp->m_rbmip != NULL);
+- ASSERT(sbp->sb_rsumino != NULLFSINO);
++
+ error = xfs_iget(mp, NULL, sbp->sb_rsumino, 0, 0, &mp->m_rsumip);
+ if (error) {
+ xfs_irele(mp->m_rbmip);
+--
+2.20.1
+
--- /dev/null
+From eba1b21139cb2f367033fdb6ba6274a4328f3b89 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 08:46:21 -0800
+Subject: xfs: zero length symlinks are not valid
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 43feeea88c9cb2955b9f7ba8152ec5abeea42810 ]
+
+A log recovery failure has been reproduced where a symlink inode has
+a zero length in extent form. It was caused by a shutdown during a
+combined fstress+fsmark workload.
+
+The underlying problem is the issue in xfs_inactive_symlink(): the
+inode is unlocked between the symlink inactivation/truncation and
+the inode being freed. This opens a window for the inode to be
+written to disk before it xfs_ifree() removes it from the unlinked
+list, marks it free in the inobt and zeros the mode.
+
+For shortform inodes, the fix is simple. xfs_ifree() clears the data
+fork state, so there's no need to do it in xfs_inactive_symlink().
+This means the shortform fork verifier will not see a zero length
+data fork as it mirrors the inode size through to xfs_ifree()), and
+hence if the inode gets written back and the fork verifiers are run
+they will still see a fork that matches the on-disk inode size.
+
+For extent form (remote) symlinks, it is a little more tricky. Here
+we explicitly set the inode size to zero, so the above race can lead
+to zero length symlinks on disk. Because the inode is unlinked at
+this point (i.e. on the unlinked list) and unreferenced, it can
+never be seen again by a user. Hence when we set the inode size to
+zeor, also change the type to S_IFREG. xfs_ifree() expects S_IFREG
+inodes to be of zero length, and so this avoids all the problems of
+zero length symlinks ever hitting the disk. It also avoids the
+problem of needing to handle zero length symlink inodes in log
+recovery to replay the extent free intents and the remaining
+deferops to free the extents the symlink used.
+
+Also add a couple of asserts to warn us if zero length symlinks end
+up in either the symlink create or inactivation paths.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/libxfs/xfs_symlink_remote.c | 14 +++++++++----
+ fs/xfs/xfs_symlink.c | 33 +++++++++++++++---------------
+ 2 files changed, 27 insertions(+), 20 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_symlink_remote.c b/fs/xfs/libxfs/xfs_symlink_remote.c
+index 95374ab2dee73..77d80106f989a 100644
+--- a/fs/xfs/libxfs/xfs_symlink_remote.c
++++ b/fs/xfs/libxfs/xfs_symlink_remote.c
+@@ -199,7 +199,10 @@ xfs_symlink_local_to_remote(
+ ifp->if_bytes - 1);
+ }
+
+-/* Verify the consistency of an inline symlink. */
++/*
++ * Verify the in-memory consistency of an inline symlink data fork. This
++ * does not do on-disk format checks.
++ */
+ xfs_failaddr_t
+ xfs_symlink_shortform_verify(
+ struct xfs_inode *ip)
+@@ -215,9 +218,12 @@ xfs_symlink_shortform_verify(
+ size = ifp->if_bytes;
+ endp = sfp + size;
+
+- /* Zero length symlinks can exist while we're deleting a remote one. */
+- if (size == 0)
+- return NULL;
++ /*
++ * Zero length symlinks should never occur in memory as they are
++ * never alllowed to exist on disk.
++ */
++ if (!size)
++ return __this_address;
+
+ /* No negative sizes or overly long symlink targets. */
+ if (size < 0 || size > XFS_SYMLINK_MAXLEN)
+diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
+index a3e98c64b6e38..b2c1177c717ff 100644
+--- a/fs/xfs/xfs_symlink.c
++++ b/fs/xfs/xfs_symlink.c
+@@ -192,6 +192,7 @@ xfs_symlink(
+ pathlen = strlen(target_path);
+ if (pathlen >= XFS_SYMLINK_MAXLEN) /* total string too long */
+ return -ENAMETOOLONG;
++ ASSERT(pathlen > 0);
+
+ udqp = gdqp = NULL;
+ prid = xfs_get_initial_prid(dp);
+@@ -378,6 +379,12 @@ out_release_inode:
+
+ /*
+ * Free a symlink that has blocks associated with it.
++ *
++ * Note: zero length symlinks are not allowed to exist. When we set the size to
++ * zero, also change it to a regular file so that it does not get written to
++ * disk as a zero length symlink. The inode is on the unlinked list already, so
++ * userspace cannot find this inode anymore, so this change is not user visible
++ * but allows us to catch corrupt zero-length symlinks in the verifiers.
+ */
+ STATIC int
+ xfs_inactive_symlink_rmt(
+@@ -412,13 +419,14 @@ xfs_inactive_symlink_rmt(
+ xfs_trans_ijoin(tp, ip, 0);
+
+ /*
+- * Lock the inode, fix the size, and join it to the transaction.
+- * Hold it so in the normal path, we still have it locked for
+- * the second transaction. In the error paths we need it
++ * Lock the inode, fix the size, turn it into a regular file and join it
++ * to the transaction. Hold it so in the normal path, we still have it
++ * locked for the second transaction. In the error paths we need it
+ * held so the cancel won't rele it, see below.
+ */
+ size = (int)ip->i_d.di_size;
+ ip->i_d.di_size = 0;
++ VFS_I(ip)->i_mode = (VFS_I(ip)->i_mode & ~S_IFMT) | S_IFREG;
+ xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+ /*
+ * Find the block(s) so we can inval and unmap them.
+@@ -494,17 +502,10 @@ xfs_inactive_symlink(
+ return -EIO;
+
+ xfs_ilock(ip, XFS_ILOCK_EXCL);
+-
+- /*
+- * Zero length symlinks _can_ exist.
+- */
+ pathlen = (int)ip->i_d.di_size;
+- if (!pathlen) {
+- xfs_iunlock(ip, XFS_ILOCK_EXCL);
+- return 0;
+- }
++ ASSERT(pathlen);
+
+- if (pathlen < 0 || pathlen > XFS_SYMLINK_MAXLEN) {
++ if (pathlen <= 0 || pathlen > XFS_SYMLINK_MAXLEN) {
+ xfs_alert(mp, "%s: inode (0x%llx) bad symlink length (%d)",
+ __func__, (unsigned long long)ip->i_ino, pathlen);
+ xfs_iunlock(ip, XFS_ILOCK_EXCL);
+@@ -512,12 +513,12 @@ xfs_inactive_symlink(
+ return -EFSCORRUPTED;
+ }
+
++ /*
++ * Inline fork state gets removed by xfs_difree() so we have nothing to
++ * do here in that case.
++ */
+ if (ip->i_df.if_flags & XFS_IFINLINE) {
+- if (ip->i_df.if_bytes > 0)
+- xfs_idata_realloc(ip, -(ip->i_df.if_bytes),
+- XFS_DATA_FORK);
+ xfs_iunlock(ip, XFS_ILOCK_EXCL);
+- ASSERT(ip->i_df.if_bytes == 0);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 186f214337896e699aa94f190a566ba6426e0bb6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 11:11:44 -0500
+Subject: xprtrdma: Prevent leak of rpcrdma_rep objects
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit 07e10308ee5da8e6132e0b737ece1c99dd651fb6 ]
+
+If a reply has been processed but the RPC is later retransmitted
+anyway, the req->rl_reply field still contains the only pointer to
+the old rpcrdma rep. When the next reply comes in, the reply handler
+will stomp on the rl_reply field, leaking the old rep.
+
+A trace event is added to capture such leaks.
+
+This problem seems to be worsened by the restructuring of the RPC
+Call path in v4.20. Fully addressing this issue will require at
+least a re-architecture of the disconnect logic, which is not
+appropriate during -rc.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/trace/events/rpcrdma.h | 28 ++++++++++++++++++++++++++++
+ net/sunrpc/xprtrdma/rpc_rdma.c | 4 ++++
+ 2 files changed, 32 insertions(+)
+
+diff --git a/include/trace/events/rpcrdma.h b/include/trace/events/rpcrdma.h
+index 53df203b8057a..4c91cadd1871d 100644
+--- a/include/trace/events/rpcrdma.h
++++ b/include/trace/events/rpcrdma.h
+@@ -917,6 +917,34 @@ TRACE_EVENT(xprtrdma_cb_setup,
+ DEFINE_CB_EVENT(xprtrdma_cb_call);
+ DEFINE_CB_EVENT(xprtrdma_cb_reply);
+
++TRACE_EVENT(xprtrdma_leaked_rep,
++ TP_PROTO(
++ const struct rpc_rqst *rqst,
++ const struct rpcrdma_rep *rep
++ ),
++
++ TP_ARGS(rqst, rep),
++
++ TP_STRUCT__entry(
++ __field(unsigned int, task_id)
++ __field(unsigned int, client_id)
++ __field(u32, xid)
++ __field(const void *, rep)
++ ),
++
++ TP_fast_assign(
++ __entry->task_id = rqst->rq_task->tk_pid;
++ __entry->client_id = rqst->rq_task->tk_client->cl_clid;
++ __entry->xid = be32_to_cpu(rqst->rq_xid);
++ __entry->rep = rep;
++ ),
++
++ TP_printk("task:%u@%u xid=0x%08x rep=%p",
++ __entry->task_id, __entry->client_id, __entry->xid,
++ __entry->rep
++ )
++);
++
+ /**
+ ** Server-side RPC/RDMA events
+ **/
+diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
+index c8ae983c6cc01..f2eaf264726be 100644
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -1360,6 +1360,10 @@ void rpcrdma_reply_handler(struct rpcrdma_rep *rep)
+ spin_unlock(&xprt->recv_lock);
+
+ req = rpcr_to_rdmar(rqst);
++ if (req->rl_reply) {
++ trace_xprtrdma_leaked_rep(rqst, req->rl_reply);
++ rpcrdma_recv_buffer_put(req->rl_reply);
++ }
+ req->rl_reply = rep;
+ rep->rr_rqst = rqst;
+ clear_bit(RPCRDMA_REQ_F_PENDING, &req->rl_flags);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
