--- /dev/null
+From deb4b83792723c23800fbca5ef28d8366921ab58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 08:24:06 +0200
+Subject: ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC
+ workaround
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 399c01aa49e548c82d40f8161915a5941dd3c60e ]
+
+We fixed the regression of the speaker volume for some Thinkpad models
+(e.g. T570) by the commit 54947cd64c1b ("ALSA: hda/realtek - Fix
+speaker output regression on Thinkpad T570"). Essentially it fixes
+the DAC / pin pairing by a static table. It was confirmed and merged
+to stable kernel later.
+
+Now, interestingly, we got another regression report for the very same
+model (T570) about the similar problem, and the commit above was the
+culprit. That is, by some reason, there are devices that prefer the
+DAC1, and another device DAC2!
+
+Unfortunately those have the same ID and we have no idea what can
+differentiate, in this patch, a new fixup model "tpt470-dock-fix" is
+provided, so that users with such a machine can apply it manually.
+When model=tpt470-dock-fix option is passed to snd-hda-intel module,
+it avoids the fixed DAC pairing and the DAC1 is assigned to the
+speaker like the earlier versions.
+
+Fixes: 54947cd64c1b ("ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570")
+BugLink: https://apibugzilla.suse.com/show_bug.cgi?id=1172017
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200526062406.9799-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 36 +++++++++++++++++++++++++----------
+ 1 file changed, 26 insertions(+), 10 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index c5bec191e003..743e2dcccb8b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5484,18 +5484,9 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ { 0x19, 0x21a11010 }, /* dock mic */
+ { }
+ };
+- /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
+- * the speaker output becomes too low by some reason on Thinkpads with
+- * ALC298 codec
+- */
+- static const hda_nid_t preferred_pairs[] = {
+- 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
+- 0
+- };
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->gen.preferred_dacs = preferred_pairs;
+ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ snd_hda_apply_pincfgs(codec, pincfgs);
+ } else if (action == HDA_FIXUP_ACT_INIT) {
+@@ -5508,6 +5499,23 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ }
+ }
+
++static void alc_fixup_tpt470_dacs(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
++ * the speaker output becomes too low by some reason on Thinkpads with
++ * ALC298 codec
++ */
++ static const hda_nid_t preferred_pairs[] = {
++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
++ 0
++ };
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ spec->gen.preferred_dacs = preferred_pairs;
++}
++
+ static void alc_shutup_dell_xps13(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+@@ -6063,6 +6071,7 @@ enum {
+ ALC700_FIXUP_INTEL_REFERENCE,
+ ALC274_FIXUP_DELL_BIND_DACS,
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
++ ALC298_FIXUP_TPT470_DOCK_FIX,
+ ALC298_FIXUP_TPT470_DOCK,
+ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+ ALC255_FIXUP_DELL_HEADSET_MIC,
+@@ -6994,12 +7003,18 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC274_FIXUP_DELL_BIND_DACS
+ },
+- [ALC298_FIXUP_TPT470_DOCK] = {
++ [ALC298_FIXUP_TPT470_DOCK_FIX] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_tpt470_dock,
+ .chained = true,
+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
+ },
++ [ALC298_FIXUP_TPT470_DOCK] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_tpt470_dacs,
++ .chained = true,
++ .chain_id = ALC298_FIXUP_TPT470_DOCK_FIX
++ },
+ [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -7638,6 +7653,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+ {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
+ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
++ {.id = ALC298_FIXUP_TPT470_DOCK_FIX, .name = "tpt470-dock-fix"},
+ {.id = ALC298_FIXUP_TPT470_DOCK, .name = "tpt470-dock"},
+ {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
+ {.id = ALC700_FIXUP_INTEL_REFERENCE, .name = "alc700-ref"},
+--
+2.25.1
+
--- /dev/null
+From 20c1a5ec94f6c72c3b79445a857c16f4781525ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 14:10:26 +0800
+Subject: ALSA: hda/realtek - Add new codec supported for ALC287
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 630e36126e420e1756378b3427b42711ce0b9ddd ]
+
+Enable new codec supported for ALC287.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/dcf5ce5507104d0589a917cbb71dc3c6@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 743e2dcccb8b..da4d21445e80 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -384,6 +384,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0282:
+ case 0x10ec0283:
+ case 0x10ec0286:
++ case 0x10ec0287:
+ case 0x10ec0288:
+ case 0x10ec0285:
+ case 0x10ec0298:
+@@ -8321,6 +8322,7 @@ static int patch_alc269(struct hda_codec *codec)
+ case 0x10ec0215:
+ case 0x10ec0245:
+ case 0x10ec0285:
++ case 0x10ec0287:
+ case 0x10ec0289:
+ spec->codec_variant = ALC269_TYPE_ALC215;
+ spec->shutup = alc225_shutup;
+@@ -9599,6 +9601,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0287, "ALC287", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0289, "ALC289", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
+--
+2.25.1
+
--- /dev/null
+From bc291e897bc1f95e14447f243fdedce6e6c97fc7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 00:39:21 +0000
+Subject: ALSA: hwdep: fix a left shifting 1 by 31 UB bug
+
+From: Changming Liu <liu.changm@northeastern.edu>
+
+[ Upstream commit fb8cd6481ffd126f35e9e146a0dcf0c4e8899f2e ]
+
+The "info.index" variable can be 31 in "1 << info.index".
+This might trigger an undefined behavior since 1 is signed.
+
+Fix this by casting 1 to 1u just to be sure "1u << 31" is defined.
+
+Signed-off-by: Changming Liu <liu.changm@northeastern.edu>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/BL0PR06MB4548170B842CB055C9AF695DE5B00@BL0PR06MB4548.namprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/hwdep.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
+index 00cb5aed10a9..28bec15b0959 100644
+--- a/sound/core/hwdep.c
++++ b/sound/core/hwdep.c
+@@ -216,12 +216,12 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
+ if (info.index >= 32)
+ return -EINVAL;
+ /* check whether the dsp was already loaded */
+- if (hw->dsp_loaded & (1 << info.index))
++ if (hw->dsp_loaded & (1u << info.index))
+ return -EBUSY;
+ err = hw->ops.dsp_load(hw, &info);
+ if (err < 0)
+ return err;
+- hw->dsp_loaded |= (1 << info.index);
++ hw->dsp_loaded |= (1u << info.index);
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From b996f202d6426b4ea4f42473253d73a0e588231e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 14:26:13 +0800
+Subject: ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
+
+From: Chris Chiu <chiu@endlessm.com>
+
+[ Upstream commit 4020d1ccbe55bdf67b31d718d2400506eaf4b43f ]
+
+The Asus USB DAC is a USB type-C audio dongle for connecting to
+the headset and headphone. The volume minimum value -23040 which
+is 0xa600 in hexadecimal with the resolution value 1 indicates
+this should be endianness issue caused by the firmware bug. Add
+a volume quirk to fix the volume control problem.
+
+Also fixes this warning:
+ Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
+ [5] FU [Headset Capture Volume] ch = 1, val = -23040/0/1
+ Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
+ [7] FU [Headset Playback Volume] ch = 1, val = -23040/0/1
+
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200526062613.55401-1-chiu@endlessm.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 583edacc9fe8..f55afe3a98e3 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1171,6 +1171,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ cval->res = 384;
+ }
+ break;
++ case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */
++ if ((strstr(kctl->id.name, "Playback Volume") != NULL) ||
++ strstr(kctl->id.name, "Capture Volume") != NULL) {
++ cval->min >>= 8;
++ cval->max = 0;
++ cval->res = 1;
++ }
++ break;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 8219fe38fb58a946e1931efae6fb61e3c998cdb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 10:28:10 +0200
+Subject: ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7f5ad9c9003425175f46c94df380e8c9e558cfb5 ]
+
+Gigabyte TRX40 Aorus Master is equipped with two USB-audio devices,
+a Realtek ALC1220-VB codec (USB ID 0414:a001) and an ESS SABRE9218 DAC
+(USB ID 0414:a000). The latter serves solely for the headphone output
+on the front panel while the former serves for the rest I/Os (mostly
+for the I/Os in the rear panel but also including the front mic).
+
+Both chips do work more or less with the unmodified USB-audio driver,
+but there are a few glitches. The ALC1220-VB returns an error for an
+inquiry to some jacks, as already seen on other TRX40-based mobos.
+However this machine has a slightly incompatible configuration, hence
+the existing mapping cannot be used as is.
+
+Meanwhile the ESS chip seems working without any quirk. But since
+both audio devices don't provide any specific names, both cards appear
+as "USB-Audio", and it's quite confusing for users.
+
+This patch is an attempt to overcome those issues:
+
+- The specific mapping table for ALC1220-VB is provided, reducing the
+ non-working nodes and renaming the badly chosen controls.
+ The connector map isn't needed here unlike other TRX40 quirks.
+
+- For both USB IDs (0414:a000 and 0414:a001), provide specific card
+ name strings, so that user-space can identify more easily; and more
+ importantly, UCM profile can be applied to each.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200526082810.29506-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_maps.c | 19 +++++++++++++++++++
+ sound/usb/quirks-table.h | 25 +++++++++++++++++++++++++
+ 2 files changed, 44 insertions(+)
+
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 2255f9abd7a5..ac84f0b2b0bc 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -387,6 +387,21 @@ static const struct usbmix_connector_map trx40_mobo_connector_map[] = {
+ {}
+ };
+
++/* Rear panel + front mic on Gigabyte TRX40 Aorus Master with ALC1220-VB */
++static const struct usbmix_name_map aorus_master_alc1220vb_map[] = {
++ { 17, NULL }, /* OT, IEC958?, disabled */
++ { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */
++ { 16, "Line Out" }, /* OT */
++ { 22, "Line Out Playback" }, /* FU */
++ { 7, "Line" }, /* IT */
++ { 19, "Line Capture" }, /* FU */
++ { 8, "Mic" }, /* IT */
++ { 20, "Mic Capture" }, /* FU */
++ { 9, "Front Mic" }, /* IT */
++ { 21, "Front Mic Capture" }, /* FU */
++ {}
++};
++
+ /*
+ * Control map entries
+ */
+@@ -506,6 +521,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
++ { /* Gigabyte TRX40 Aorus Master (rear panel + front mic) */
++ .id = USB_ID(0x0414, 0xa001),
++ .map = aorus_master_alc1220vb_map,
++ },
+ { /* Gigabyte TRX40 Aorus Pro WiFi */
+ .id = USB_ID(0x0414, 0xa002),
+ .map = trx40_mobo_map,
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index aa4c16ce0e57..bbae11605a4c 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3650,4 +3650,29 @@ ALC1220_VB_DESKTOP(0x0db0, 0x543d), /* MSI TRX40 */
+ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ #undef ALC1220_VB_DESKTOP
+
++/* Two entries for Gigabyte TRX40 Aorus Master:
++ * TRX40 Aorus Master has two USB-audio devices, one for the front headphone
++ * with ESS SABRE9218 DAC chip, while another for the rest I/O (the rear
++ * panel and the front mic) with Realtek ALC1220-VB.
++ * Here we provide two distinct names for making UCM profiles easier.
++ */
++{
++ USB_DEVICE(0x0414, 0xa000),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "Gigabyte",
++ .product_name = "Aorus Master Front Headphone",
++ .profile_name = "Gigabyte-Aorus-Master-Front-Headphone",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++{
++ USB_DEVICE(0x0414, 0xa001),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "Gigabyte",
++ .product_name = "Aorus Master Main Audio",
++ .profile_name = "Gigabyte-Aorus-Master-Main-Audio",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++
+ #undef USB_DEVICE_VENDOR_SPEC
+--
+2.25.1
+
--- /dev/null
+From 3cf6760fb13709ee3a6653e139dd53604903e4af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 20:36:11 +0100
+Subject: ARM: 8970/1: decompressor: increase tag size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Łukasz Stelmach <l.stelmach@samsung.com>
+
+[ Upstream commit 2c962369d72f286659e6446919f88d69b943cb4d ]
+
+The size field of the tag header structure is supposed to be set to the
+size of a tag structure including the header.
+
+Fixes: c772568788b5f0 ("ARM: add additional table to compressed kernel")
+Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/vmlinux.lds.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
+index fc7ed03d8b93..51b078604978 100644
+--- a/arch/arm/boot/compressed/vmlinux.lds.S
++++ b/arch/arm/boot/compressed/vmlinux.lds.S
+@@ -43,7 +43,7 @@ SECTIONS
+ }
+ .table : ALIGN(4) {
+ _table_start = .;
+- LONG(ZIMAGE_MAGIC(2))
++ LONG(ZIMAGE_MAGIC(4))
+ LONG(ZIMAGE_MAGIC(0x5a534c4b))
+ LONG(ZIMAGE_MAGIC(__piggy_size_addr - _start))
+ LONG(ZIMAGE_MAGIC(_kernel_bss_size))
+--
+2.25.1
+
--- /dev/null
+From ed3a85d792c64ac3ed303ee931988d05794f2e8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 May 2020 16:30:42 +1200
+Subject: ARM: dts: bcm: HR2: Fix PPI interrupt types
+
+From: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+
+[ Upstream commit be0ec060b54f0481fb95d59086c1484a949c903c ]
+
+These error messages are output when booting on a BCM HR2 system:
+ GIC: PPI11 is secure or misconfigured
+ GIC: PPI13 is secure or misconfigured
+
+Per ARM documentation these interrupts are triggered on a rising edge.
+See ARM Cortex A-9 MPCore Technical Reference Manual, Revision r4p1,
+Section 3.3.8 Interrupt Configuration Registers.
+
+The same issue was resolved for NSP systems in commit 5f1aa51c7a1e
+("ARM: dts: NSP: Fix PPI interrupt types").
+
+Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file")
+Signed-off-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-hr2.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index e4d49731287f..e35398cc60a0 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -75,7 +75,7 @@
+ timer@20200 {
+ compatible = "arm,cortex-a9-global-timer";
+ reg = <0x20200 0x100>;
+- interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
+ clocks = <&periph_clk>;
+ };
+
+@@ -83,7 +83,7 @@
+ compatible = "arm,cortex-a9-twd-timer";
+ reg = <0x20600 0x20>;
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) |
+- IRQ_TYPE_LEVEL_HIGH)>;
++ IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&periph_clk>;
+ };
+
+@@ -91,7 +91,7 @@
+ compatible = "arm,cortex-a9-twd-wdt";
+ reg = <0x20620 0x20>;
+ interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) |
+- IRQ_TYPE_LEVEL_HIGH)>;
++ IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&periph_clk>;
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 4d25fe44f81cd7ed46a61567ca738bd75a27e239 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Apr 2020 14:35:22 +0200
+Subject: ARM: dts: bcm2835-rpi-zero-w: Fix led polarity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit 58bb90ab415562eededb932455046924e65df342 ]
+
+The status "ACT" led on the Raspberry Pi Zero W is on when GPIO 47 is low.
+
+This has been verified on a board and somewhat confirmed by both the GPIO
+name ("STATUS_LED_N") and the reduced schematics [1].
+
+[1]: https://www.raspberrypi.org/documentation/hardware/raspberrypi/schematics/rpi_SCH_ZeroW_1p1_reduced.pdf
+
+Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Cc: Stefan Wahren <stefan.wahren@i2se.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+index 4c3f606e5b8d..f65448c01e31 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+@@ -24,7 +24,7 @@
+
+ leds {
+ act {
+- gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From fd597c9204155b22b4293a235a7705c5400e2c56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 May 2020 19:02:37 +0200
+Subject: ARM: dts/imx6q-bx50v3: Set display interface clock parents
+
+From: Robert Beckett <bob.beckett@collabora.com>
+
+[ Upstream commit 665e7c73a7724a393b4ec92d1ae1e029925ef2b7 ]
+
+Avoid LDB and IPU DI clocks both using the same parent. LDB requires
+pasthrough clock to avoid breaking timing while IPU DI does not.
+
+Force IPU DI clocks to use IMX6QDL_CLK_PLL2_PFD0_352M as parent
+and LDB to use IMX6QDL_CLK_PLL5_VIDEO_DIV.
+
+This fixes an issue where attempting atomic modeset while using
+HDMI and display port at the same time causes LDB clock programming
+to destroy the programming of HDMI that was done during the same
+modeset.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Robert Beckett <bob.beckett@collabora.com>
+[Use IMX6QDL_CLK_PLL2_PFD0_352M instead of IMX6QDL_CLK_PLL2_PFD2_396M
+ originally chosen by Robert Beckett to avoid affecting eMMC clock
+ by DRM atomic updates]
+Signed-off-by: Ian Ray <ian.ray@ge.com>
+[Squash Robert's and Ian's commits for bisectability, update patch
+ description and add stable tag]
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-b450v3.dts | 7 -------
+ arch/arm/boot/dts/imx6q-b650v3.dts | 7 -------
+ arch/arm/boot/dts/imx6q-b850v3.dts | 11 -----------
+ arch/arm/boot/dts/imx6q-bx50v3.dtsi | 15 +++++++++++++++
+ 4 files changed, 15 insertions(+), 25 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-b450v3.dts b/arch/arm/boot/dts/imx6q-b450v3.dts
+index 95b8f2d71821..fb0980190aa0 100644
+--- a/arch/arm/boot/dts/imx6q-b450v3.dts
++++ b/arch/arm/boot/dts/imx6q-b450v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b650v3.dts b/arch/arm/boot/dts/imx6q-b650v3.dts
+index 611cb7ae7e55..8f762d9c5ae9 100644
+--- a/arch/arm/boot/dts/imx6q-b650v3.dts
++++ b/arch/arm/boot/dts/imx6q-b650v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b850v3.dts b/arch/arm/boot/dts/imx6q-b850v3.dts
+index e4cb118f88c6..1ea64ecf4291 100644
+--- a/arch/arm/boot/dts/imx6q-b850v3.dts
++++ b/arch/arm/boot/dts/imx6q-b850v3.dts
+@@ -53,17 +53,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
+- <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
+- <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>;
+-};
+-
+ &ldb {
+ fsl,dual-channel;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+index fa27dcdf06f1..1938b04199c4 100644
+--- a/arch/arm/boot/dts/imx6q-bx50v3.dtsi
++++ b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+@@ -377,3 +377,18 @@
+ #interrupt-cells = <1>;
+ };
+ };
++
++&clks {
++ assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
++ <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI1_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI1_PRE_SEL>;
++ assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>;
++};
+--
+2.25.1
+
--- /dev/null
+From 2e3373cdf7c5812ebb64de1b89fa94c8f7458bd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:03:54 +0100
+Subject: ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 747ffc2fcf969eff9309d7f2d1d61cb8b9e1bb40 ]
+
+Consolidate the user access assembly code to asm/uaccess-asm.h. This
+moves the csdb, check_uaccess, uaccess_mask_range_ptr, uaccess_enable,
+uaccess_disable, uaccess_save, uaccess_restore macros, and creates two
+new ones for exception entry and exit - uaccess_entry and uaccess_exit.
+
+This makes the uaccess_save and uaccess_restore macros private to
+asm/uaccess-asm.h.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 75 +-------------------
+ arch/arm/include/asm/uaccess-asm.h | 106 +++++++++++++++++++++++++++++
+ arch/arm/kernel/entry-armv.S | 11 +--
+ arch/arm/kernel/entry-header.S | 9 +--
+ 4 files changed, 112 insertions(+), 89 deletions(-)
+ create mode 100644 arch/arm/include/asm/uaccess-asm.h
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 99929122dad7..3546d294d55f 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -18,11 +18,11 @@
+ #endif
+
+ #include <asm/ptrace.h>
+-#include <asm/domain.h>
+ #include <asm/opcodes-virt.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/page.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+
+ #define IOMEM(x) (x)
+
+@@ -446,79 +446,6 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .size \name , . - \name
+ .endm
+
+- .macro csdb
+-#ifdef CONFIG_THUMB2_KERNEL
+- .inst.w 0xf3af8014
+-#else
+- .inst 0xe320f014
+-#endif
+- .endm
+-
+- .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+-#ifndef CONFIG_CPU_USE_DOMAINS
+- adds \tmp, \addr, #\size - 1
+- sbcscc \tmp, \tmp, \limit
+- bcs \bad
+-#ifdef CONFIG_CPU_SPECTRE
+- movcs \addr, #0
+- csdb
+-#endif
+-#endif
+- .endm
+-
+- .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
+-#ifdef CONFIG_CPU_SPECTRE
+- sub \tmp, \limit, #1
+- subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+- addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+- subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+- movlo \addr, #0 @ if (tmp < 0) addr = NULL
+- csdb
+-#endif
+- .endm
+-
+- .macro uaccess_disable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_DISABLE
+- mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_enable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_ENABLE
+- mcr p15, 0, \tmp, c3, c0, 0
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_save, tmp
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- mrc p15, 0, \tmp, c3, c0, 0
+- str \tmp, [sp, #SVC_DACR]
+-#endif
+- .endm
+-
+- .macro uaccess_restore
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- ldr r0, [sp, #SVC_DACR]
+- mcr p15, 0, r0, c3, c0, 0
+-#endif
+- .endm
+-
+ .irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
+ .macro ret\c, reg
+ #if __LINUX_ARM_ARCH__ < 6
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+new file mode 100644
+index 000000000000..d475e3e8145d
+--- /dev/null
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -0,0 +1,106 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef __ASM_UACCESS_ASM_H__
++#define __ASM_UACCESS_ASM_H__
++
++#include <asm/asm-offsets.h>
++#include <asm/domain.h>
++#include <asm/memory.h>
++#include <asm/thread_info.h>
++
++ .macro csdb
++#ifdef CONFIG_THUMB2_KERNEL
++ .inst.w 0xf3af8014
++#else
++ .inst 0xe320f014
++#endif
++ .endm
++
++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
++#ifndef CONFIG_CPU_USE_DOMAINS
++ adds \tmp, \addr, #\size - 1
++ sbcscc \tmp, \tmp, \limit
++ bcs \bad
++#ifdef CONFIG_CPU_SPECTRE
++ movcs \addr, #0
++ csdb
++#endif
++#endif
++ .endm
++
++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
++#ifdef CONFIG_CPU_SPECTRE
++ sub \tmp, \limit, #1
++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
++ subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ movlo \addr, #0 @ if (tmp < 0) addr = NULL
++ csdb
++#endif
++ .endm
++
++ .macro uaccess_disable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++ .macro uaccess_enable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_ENABLE
++ mcr p15, 0, \tmp, c3, c0, 0
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++ .macro uaccess_save, tmp
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ mrc p15, 0, \tmp, c3, c0, 0
++ str \tmp, [sp, #SVC_DACR]
++#endif
++ .endm
++
++ .macro uaccess_restore
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ ldr r0, [sp, #SVC_DACR]
++ mcr p15, 0, r0, c3, c0, 0
++#endif
++ .endm
++
++ /*
++ * Save the address limit on entry to a privileged exception and
++ * if using PAN, save and disable usermode access.
++ */
++ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
++ ldr \tmp0, [\tsk, #TI_ADDR_LIMIT]
++ mov \tmp1, #TASK_SIZE
++ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ str \tmp0, [sp, #SVC_ADDR_LIMIT]
++ uaccess_save \tmp0
++ .if \disable
++ uaccess_disable \tmp0
++ .endif
++ .endm
++
++ /* Restore the user access state previously saved by uaccess_entry */
++ .macro uaccess_exit, tsk, tmp0, tmp1
++ ldr \tmp1, [sp, #SVC_ADDR_LIMIT]
++ uaccess_restore
++ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ .endm
++
++#endif /* __ASM_UACCESS_ASM_H__ */
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index 858d4e541532..a874b753397e 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -27,6 +27,7 @@
+ #include <asm/unistd.h>
+ #include <asm/tls.h>
+ #include <asm/system_info.h>
++#include <asm/uaccess-asm.h>
+
+ #include "entry-header.S"
+ #include <asm/entry-macro-multi.S>
+@@ -179,15 +180,7 @@ ENDPROC(__und_invalid)
+ stmia r7, {r2 - r6}
+
+ get_thread_info tsk
+- ldr r0, [tsk, #TI_ADDR_LIMIT]
+- mov r1, #TASK_SIZE
+- str r1, [tsk, #TI_ADDR_LIMIT]
+- str r0, [sp, #SVC_ADDR_LIMIT]
+-
+- uaccess_save r0
+- .if \uaccess
+- uaccess_disable r0
+- .endif
++ uaccess_entry tsk, r0, r1, r2, \uaccess
+
+ .if \trace
+ #ifdef CONFIG_TRACE_IRQFLAGS
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index 32051ec5b33f..40db0f9188b6 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -6,6 +6,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/errno.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+ #include <asm/v7m.h>
+
+ @ Bad Abort numbers
+@@ -217,9 +218,7 @@
+ blne trace_hardirqs_off
+ #endif
+ .endif
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode SVC restore
+@@ -263,9 +262,7 @@
+ @ on the stack remains correct).
+ @
+ .macro svc_exit_via_fiq
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode restore
+ mov r0, sp
+--
+2.25.1
+
--- /dev/null
+From 03bd1b3f79205e2aca3db993de95cc8f4393027d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:24:07 +0100
+Subject: ARM: uaccess: fix DACR mismatch with nested exceptions
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 71f8af1110101facfad68989ff91f88f8e2c3e22 ]
+
+Tomas Paukrt reports that his SAM9X60 based system (ARM926, ARMv5TJ)
+fails to fix up alignment faults, eventually resulting in a kernel
+oops.
+
+The problem occurs when using CONFIG_CPU_USE_DOMAINS with commit
+e6978e4bf181 ("ARM: save and reset the address limit when entering an
+exception"). This is because the address limit is set back to
+TASK_SIZE on exception entry, and, although it is restored on exception
+exit, the domain register is not.
+
+Hence, this sequence can occur:
+
+ interrupt
+ pt_regs->addr_limit = addr_limit // USER_DS
+ addr_limit = USER_DS
+ alignment exception
+ __probe_kernel_read()
+ old_fs = get_fs() // USER_DS
+ set_fs(KERNEL_DS)
+ addr_limit = KERNEL_DS
+ dacr.kernel = DOMAIN_MANAGER
+ interrupt
+ pt_regs->addr_limit = addr_limit // KERNEL_DS
+ addr_limit = USER_DS
+ alignment exception
+ __probe_kernel_read()
+ old_fs = get_fs() // USER_DS
+ set_fs(KERNEL_DS)
+ addr_limit = KERNEL_DS
+ dacr.kernel = DOMAIN_MANAGER
+ ...
+ set_fs(old_fs)
+ addr_limit = USER_DS
+ dacr.kernel = DOMAIN_CLIENT
+ ...
+ addr_limit = pt_regs->addr_limit // KERNEL_DS
+ interrupt returns
+
+At this point, addr_limit is correctly restored to KERNEL_DS for
+__probe_kernel_read() to continue execution, but dacr.kernel is not,
+it has been reset by the set_fs(old_fs) to DOMAIN_CLIENT.
+
+This would not have happened prior to the mentioned commit, because
+addr_limit would remain KERNEL_DS, so get_fs() would have returned
+KERNEL_DS, and so would correctly nest.
+
+This commit fixes the problem by also saving the DACR on exception
+entry if either CONFIG_CPU_SW_DOMAIN_PAN or CONFIG_CPU_USE_DOMAINS are
+enabled, and resetting the DACR appropriately on exception entry to
+match addr_limit and PAN settings.
+
+Fixes: e6978e4bf181 ("ARM: save and reset the address limit when entering an exception")
+Reported-by: Tomas Paukrt <tomas.paukrt@advantech.cz>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess-asm.h | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+index e46468b91eaa..907571fd05c6 100644
+--- a/arch/arm/include/asm/uaccess-asm.h
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -67,15 +67,21 @@
+ #endif
+ .endm
+
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++#if defined(CONFIG_CPU_SW_DOMAIN_PAN) || defined(CONFIG_CPU_USE_DOMAINS)
+ #define DACR(x...) x
+ #else
+ #define DACR(x...)
+ #endif
+
+ /*
+- * Save the address limit on entry to a privileged exception and
+- * if using PAN, save and disable usermode access.
++ * Save the address limit on entry to a privileged exception.
++ *
++ * If we are using the DACR for kernel access by the user accessors
++ * (CONFIG_CPU_USE_DOMAINS=y), always reset the DACR kernel domain
++ * back to client mode, whether or not \disable is set.
++ *
++ * If we are using SW PAN, set the DACR user domain to no access
++ * if \disable is set.
+ */
+ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
+ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT]
+@@ -84,8 +90,17 @@
+ DACR( mrc p15, 0, \tmp0, c3, c0, 0)
+ DACR( str \tmp0, [sp, #SVC_DACR])
+ str \tmp1, [sp, #SVC_ADDR_LIMIT]
+- .if \disable
+- uaccess_disable \tmp0
++ .if \disable && IS_ENABLED(CONFIG_CPU_SW_DOMAIN_PAN)
++ /* kernel=client, user=no access */
++ mov \tmp2, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
++ .elseif IS_ENABLED(CONFIG_CPU_USE_DOMAINS)
++ /* kernel=client */
++ bic \tmp2, \tmp0, #domain_mask(DOMAIN_KERNEL)
++ orr \tmp2, \tmp2, #domain_val(DOMAIN_KERNEL, DOMAIN_CLIENT)
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
+ .endif
+ .endm
+
+--
+2.25.1
+
--- /dev/null
+From 020206eca24b5a7e25ef1a9d4c074ef80afb75e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:14:09 +0100
+Subject: ARM: uaccess: integrate uaccess_save and uaccess_restore
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 8ede890b0bcebe8c760aacfe20e934d98c3dc6aa ]
+
+Integrate uaccess_save / uaccess_restore macros into the new
+uaccess_entry / uaccess_exit macros respectively.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess-asm.h | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+index d475e3e8145d..e46468b91eaa 100644
+--- a/arch/arm/include/asm/uaccess-asm.h
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -67,30 +67,23 @@
+ #endif
+ .endm
+
+- .macro uaccess_save, tmp
+ #ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- mrc p15, 0, \tmp, c3, c0, 0
+- str \tmp, [sp, #SVC_DACR]
+-#endif
+- .endm
+-
+- .macro uaccess_restore
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- ldr r0, [sp, #SVC_DACR]
+- mcr p15, 0, r0, c3, c0, 0
++#define DACR(x...) x
++#else
++#define DACR(x...)
+ #endif
+- .endm
+
+ /*
+ * Save the address limit on entry to a privileged exception and
+ * if using PAN, save and disable usermode access.
+ */
+ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
+- ldr \tmp0, [\tsk, #TI_ADDR_LIMIT]
+- mov \tmp1, #TASK_SIZE
+- str \tmp1, [\tsk, #TI_ADDR_LIMIT]
+- str \tmp0, [sp, #SVC_ADDR_LIMIT]
+- uaccess_save \tmp0
++ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ mov \tmp2, #TASK_SIZE
++ str \tmp2, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mrc p15, 0, \tmp0, c3, c0, 0)
++ DACR( str \tmp0, [sp, #SVC_DACR])
++ str \tmp1, [sp, #SVC_ADDR_LIMIT]
+ .if \disable
+ uaccess_disable \tmp0
+ .endif
+@@ -99,8 +92,11 @@
+ /* Restore the user access state previously saved by uaccess_entry */
+ .macro uaccess_exit, tsk, tmp0, tmp1
+ ldr \tmp1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
++ DACR( ldr \tmp0, [sp, #SVC_DACR])
+ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mcr p15, 0, \tmp0, c3, c0, 0)
+ .endm
+
++#undef DACR
++
+ #endif /* __ASM_UACCESS_ASM_H__ */
+--
+2.25.1
+
--- /dev/null
+From b5a74c571b71e99d9177a2066fe69a030dff5e09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 May 2020 20:44:43 +0800
+Subject: arm64: dts: mt8173: fix vcodec-enc clock
+
+From: Hsin-Yi Wang <hsinyi@chromium.org>
+
+[ Upstream commit 3b1f6c5e4dfaf767f6f2f120cd93b347b5a9f1aa ]
+
+Fix the assigned-clock-parents to higher frequency clock to avoid h264
+encode timeout:
+
+[ 134.763465] mtk_vpu 10020000.vpu: vpu ipi 4 ack time out !
+[ 134.769008] [MTK_VCODEC][ERROR][18]: vpu_enc_send_msg() vpu_ipi_send msg_id c002 len 32 fail -5
+[ 134.777707] [MTK_VCODEC][ERROR][18]: vpu_enc_encode() AP_IPIMSG_ENC_ENCODE 0 fail
+
+venc_sel is the clock used by h264 encoder, and venclt_sel is the clock
+used by vp8 encoder. Assign venc_sel to vcodecpll_ck and venclt_sel to
+vcodecpll_370p5.
+
+ vcodecpll 1482000000
+ vcodecpll_ck 494000000
+ venc_sel 494000000
+...
+ vcodecpll_370p5 370500000
+ venclt_sel 370500000
+
+Fixes: fbbad0287cec ("arm64: dts: Using standard CCF interface to set vcodec clk")
+Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
+Link: https://lore.kernel.org/r/20200504124442.208004-1-hsinyi@chromium.org
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/mediatek/mt8173.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+index 15f1842f6df3..5891b7151432 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+@@ -1397,8 +1397,8 @@
+ "venc_lt_sel";
+ assigned-clocks = <&topckgen CLK_TOP_VENC_SEL>,
+ <&topckgen CLK_TOP_VENC_LT_SEL>;
+- assigned-clock-parents = <&topckgen CLK_TOP_VENCPLL_D2>,
+- <&topckgen CLK_TOP_UNIVPLL1_D2>;
++ assigned-clock-parents = <&topckgen CLK_TOP_VCODECPLL>,
++ <&topckgen CLK_TOP_VCODECPLL_370P5>;
+ };
+
+ vencltsys: clock-controller@19000000 {
+--
+2.25.1
+
--- /dev/null
+From 291ac93e5187c65684365973bad1e12d09f540e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 May 2020 10:36:07 -0400
+Subject: ceph: flush release queue when handling caps for unknown inode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit fb33c114d3ed5bdac230716f5b0a93b56b92a90d ]
+
+It's possible for the VFS to completely forget about an inode, but for
+it to still be sitting on the cap release queue. If the MDS sends the
+client a cap message for such an inode, it just ignores it today, which
+can lead to a stall of up to 5s until the cap release queue is flushed.
+
+If we get a cap message for an inode that can't be located, then go
+ahead and flush the cap release queue.
+
+Cc: stable@vger.kernel.org
+URL: https://tracker.ceph.com/issues/45532
+Fixes: 1e9c2eb6811e ("ceph: delete stale dentry when last reference is dropped")
+Reported-and-Tested-by: Andrej Filipčič <andrej.filipcic@ijs.si>
+Suggested-by: Yan, Zheng <zyan@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/caps.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 2d602c2b0ff6..b2695919435e 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -3938,7 +3938,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
+ __ceph_queue_cap_release(session, cap);
+ spin_unlock(&session->s_cap_lock);
+ }
+- goto done;
++ goto flush_cap_releases;
+ }
+
+ /* these will work even if we don't have a cap yet */
+--
+2.25.1
+
--- /dev/null
+From dedac3c30cd2128f069c852794402652ad8f6b15 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 May 2020 10:57:28 +0530
+Subject: clk: qcom: gcc: Fix parent for gpll0_out_even
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit a76f274182f054481182c81cd62bb8794a5450a6 ]
+
+Documentation says that gpll0 is parent of gpll0_out_even, somehow
+driver coded that as bi_tcxo, so fix it
+
+Fixes: 2a1d7eb854bb ("clk: qcom: gcc: Add global clock controller driver for SM8150")
+Reported-by: Jonathan Marek <jonathan@marek.ca>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lkml.kernel.org/r/20200521052728.2141377-1-vkoul@kernel.org
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-sm8150.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c
+index 20877214acff..e3959ff5cb55 100644
+--- a/drivers/clk/qcom/gcc-sm8150.c
++++ b/drivers/clk/qcom/gcc-sm8150.c
+@@ -75,8 +75,7 @@ static struct clk_alpha_pll_postdiv gpll0_out_even = {
+ .clkr.hw.init = &(struct clk_init_data){
+ .name = "gpll0_out_even",
+ .parent_data = &(const struct clk_parent_data){
+- .fw_name = "bi_tcxo",
+- .name = "bi_tcxo",
++ .hw = &gpll0.clkr.hw,
+ },
+ .num_parents = 1,
+ .ops = &clk_trion_pll_postdiv_ops,
+--
+2.25.1
+
--- /dev/null
+From 6355fd1a3399d1220b1d3c9a588d4d46381397c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 May 2020 11:53:41 +0000
+Subject: drm/amd/display: drop cursor position check in atomic test
+
+From: Simon Ser <contact@emersion.fr>
+
+[ Upstream commit f7d5991b92ff824798693ddf231cf814c9d5a88b ]
+
+get_cursor_position already handles the case where the cursor has
+negative off-screen coordinates by not setting
+dc_cursor_position.enabled.
+
+Signed-off-by: Simon Ser <contact@emersion.fr>
+Fixes: 626bf90fe03f ("drm/amd/display: add basic atomic check for cursor plane")
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 9f30343262f3..9fd12e108a70 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -6951,13 +6951,6 @@ static int dm_update_plane_state(struct dc *dc,
+ return -EINVAL;
+ }
+
+- if (new_plane_state->crtc_x <= -new_acrtc->max_cursor_width ||
+- new_plane_state->crtc_y <= -new_acrtc->max_cursor_height) {
+- DRM_DEBUG_ATOMIC("Bad cursor position %d, %d\n",
+- new_plane_state->crtc_x, new_plane_state->crtc_y);
+- return -EINVAL;
+- }
+-
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 36f284d2ab296e95256957e0a0344603af1da842 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 May 2020 12:56:15 -0500
+Subject: exec: Always set cap_ambient in cap_bprm_set_creds
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit a4ae32c71fe90794127b32d26d7ad795813b502e ]
+
+An invariant of cap_bprm_set_creds is that every field in the new cred
+structure that cap_bprm_set_creds might set, needs to be set every
+time to ensure the fields does not get a stale value.
+
+The field cap_ambient is not set every time cap_bprm_set_creds is
+called, which means that if there is a suid or sgid script with an
+interpreter that has neither the suid nor the sgid bits set the
+interpreter should be able to accept ambient credentials.
+Unfortuantely because cap_ambient is not reset to it's original value
+the interpreter can not accept ambient credentials.
+
+Given that the ambient capability set is expected to be controlled by
+the caller, I don't think this is particularly serious. But it is
+definitely worth fixing so the code works correctly.
+
+I have tested to verify my reading of the code is correct and the
+interpreter of a sgid can receive ambient capabilities with this
+change and cannot receive ambient capabilities without this change.
+
+Cc: stable@vger.kernel.org
+Cc: Andy Lutomirski <luto@kernel.org>
+Fixes: 58319057b784 ("capabilities: ambient capabilities")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/commoncap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index f4ee0ae106b2..0ca31c8bc0b1 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -812,6 +812,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
+ int ret;
+ kuid_t root_uid;
+
++ new->cap_ambient = old->cap_ambient;
+ if (WARN_ON(!cap_ambient_invariant_ok(old)))
+ return -EPERM;
+
+--
+2.25.1
+
--- /dev/null
+From 4c6ad925f941142c19f2170182de250ac4104601 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:52 -0700
+Subject: fs/binfmt_elf.c: allocate initialized memory in
+ fill_thread_core_info()
+
+From: Alexander Potapenko <glider@google.com>
+
+[ Upstream commit 1d605416fb7175e1adf094251466caa52093b413 ]
+
+KMSAN reported uninitialized data being written to disk when dumping
+core. As a result, several kilobytes of kmalloc memory may be written
+to the core file and then read by a non-privileged user.
+
+Reported-by: sam <sunhaoyl@outlook.com>
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com
+Link: https://github.com/google/kmsan/issues/76
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/binfmt_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index c5642bcb6b46..7ce3cfd965d2 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1731,7 +1731,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
+ (!regset->active || regset->active(t->task, regset) > 0)) {
+ int ret;
+ size_t size = regset_size(t->task, regset);
+- void *data = kmalloc(size, GFP_KERNEL);
++ void *data = kzalloc(size, GFP_KERNEL);
+ if (unlikely(!data))
+ return 0;
+ ret = regset->get(t->task, regset,
+--
+2.25.1
+
--- /dev/null
+From 5649f304befc2554319fd122368906cc7942524c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 12:12:18 +0800
+Subject: gpio: bcm-kona: Fix return value of bcm_kona_gpio_probe()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 98f7d1b15e87c84488b30ecc4ec753b0690b9dbf ]
+
+Propagate the error code returned by devm_platform_ioremap_resource()
+out of probe() instead of overwriting it.
+
+Fixes: 72d8cb715477 ("drivers: gpio: bcm-kona: use devm_platform_ioremap_resource()")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+[Bartosz: tweaked the commit message]
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-bcm-kona.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpio-bcm-kona.c b/drivers/gpio/gpio-bcm-kona.c
+index 9fa6d3a967d2..100575973e1f 100644
+--- a/drivers/gpio/gpio-bcm-kona.c
++++ b/drivers/gpio/gpio-bcm-kona.c
+@@ -619,7 +619,7 @@ static int bcm_kona_gpio_probe(struct platform_device *pdev)
+
+ kona_gpio->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(kona_gpio->reg_base)) {
+- ret = -ENXIO;
++ ret = PTR_ERR(kona_gpio->reg_base);
+ goto err_irq_domain;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 87527e857233c66df78193a6de35712d36476fb4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Apr 2020 15:56:54 +0200
+Subject: gpio: exar: Fix bad handling for ida_simple_get error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 333830aa149a87cabeb5d30fbcf12eecc8040d2c ]
+
+The commit 7ecced0934e5 ("gpio: exar: add a check for the return value
+of ida_simple_get fails") added a goto jump to the common error
+handler for ida_simple_get() error, but this is wrong in two ways:
+it doesn't set the proper return code and, more badly, it invokes
+ida_simple_remove() with a negative index that shall lead to a kernel
+panic via BUG_ON().
+
+This patch addresses those two issues.
+
+Fixes: 7ecced0934e5 ("gpio: exar: add a check for the return value of ida_simple_get fails")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-exar.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
+index fae327d5b06e..6890d32d9f25 100644
+--- a/drivers/gpio/gpio-exar.c
++++ b/drivers/gpio/gpio-exar.c
+@@ -145,8 +145,10 @@ static int gpio_exar_probe(struct platform_device *pdev)
+ mutex_init(&exar_gpio->lock);
+
+ index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
+- if (index < 0)
+- goto err_destroy;
++ if (index < 0) {
++ ret = index;
++ goto err_mutex_destroy;
++ }
+
+ sprintf(exar_gpio->name, "exar_gpio%d", index);
+ exar_gpio->gpio_chip.label = exar_gpio->name;
+@@ -173,6 +175,7 @@ static int gpio_exar_probe(struct platform_device *pdev)
+
+ err_destroy:
+ ida_simple_remove(&ida_index, index);
++err_mutex_destroy:
+ mutex_destroy(&exar_gpio->lock);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 11916f69284be9d657bbd0987fe202977118ac49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:07:58 +0200
+Subject: gpio: fix locking open drain IRQ lines
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit e9bdf7e655b9ee81ee912fae1d59df48ce7311b6 ]
+
+We provided the right semantics on open drain lines being
+by definition output but incidentally the irq set up function
+would only allow IRQs on lines that were "not output".
+
+Fix the semantics to allow output open drain lines to be used
+for IRQs.
+
+Reported-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Tested-by: Hans Verkuil <hverkuil@xs4all.nl>
+Cc: Russell King <linux@armlinux.org.uk>
+Cc: stable@vger.kernel.org # v5.3+
+Link: https://lore.kernel.org/r/20200527140758.162280-1-linus.walleij@linaro.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index a8cf55eb54d8..abdf448b11a3 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3894,7 +3894,9 @@ int gpiochip_lock_as_irq(struct gpio_chip *chip, unsigned int offset)
+ }
+ }
+
+- if (test_bit(FLAG_IS_OUT, &desc->flags)) {
++ /* To be valid for IRQ the line needs to be input or open drain */
++ if (test_bit(FLAG_IS_OUT, &desc->flags) &&
++ !test_bit(FLAG_OPEN_DRAIN, &desc->flags)) {
+ chip_err(chip,
+ "%s: tried to flag a GPIO set as output for IRQ\n",
+ __func__);
+@@ -3957,7 +3959,12 @@ void gpiochip_enable_irq(struct gpio_chip *chip, unsigned int offset)
+
+ if (!IS_ERR(desc) &&
+ !WARN_ON(!test_bit(FLAG_USED_AS_IRQ, &desc->flags))) {
+- WARN_ON(test_bit(FLAG_IS_OUT, &desc->flags));
++ /*
++ * We must not be output when using IRQ UNLESS we are
++ * open drain.
++ */
++ WARN_ON(test_bit(FLAG_IS_OUT, &desc->flags) &&
++ !test_bit(FLAG_OPEN_DRAIN, &desc->flags));
+ set_bit(FLAG_IRQ_IS_ENABLED, &desc->flags);
+ }
+ }
+--
+2.25.1
+
--- /dev/null
+From 6978b2f070d90278aed64c49920fa451dea28fa4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 12:12:19 +0800
+Subject: gpio: pxa: Fix return value of pxa_gpio_probe()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 558ab2e8155e5f42ca0a6407957cd4173dc166cc ]
+
+When call function devm_platform_ioremap_resource(), we should use IS_ERR()
+to check the return value and return PTR_ERR() if failed.
+
+Fixes: 542c25b7a209 ("drivers: gpio: pxa: use devm_platform_ioremap_resource()")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-pxa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c
+index 9888b62f37af..432c487f77b4 100644
+--- a/drivers/gpio/gpio-pxa.c
++++ b/drivers/gpio/gpio-pxa.c
+@@ -663,8 +663,8 @@ static int pxa_gpio_probe(struct platform_device *pdev)
+ pchip->irq1 = irq1;
+
+ gpio_reg_base = devm_platform_ioremap_resource(pdev, 0);
+- if (!gpio_reg_base)
+- return -EINVAL;
++ if (IS_ERR(gpio_reg_base))
++ return PTR_ERR(gpio_reg_base);
+
+ clk = clk_get(&pdev->dev, NULL);
+ if (IS_ERR(clk)) {
+--
+2.25.1
+
--- /dev/null
+From 94be362c055adeed3e0058129c1cb4be580ef539 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 May 2020 23:50:50 +0200
+Subject: gpu/drm: Ingenic: Fix opaque pointer casted to wrong type
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+[ Upstream commit abf56fadf0e208abfb13ad1ac0094416058da0ad ]
+
+The opaque pointer passed to the IRQ handler is a pointer to the
+drm_device, not a pointer to our ingenic_drm structure.
+
+It still worked, because our ingenic_drm structure contains the
+drm_device as its first field, so the pointer received had the same
+value, but this was not semantically correct.
+
+Cc: stable@vger.kernel.org # v5.3
+Fixes: 90b86fcc47b4 ("DRM: Add KMS driver for the Ingenic JZ47xx SoCs")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200516215057.392609-5-paul@crapouillou.net
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ingenic/ingenic-drm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/ingenic/ingenic-drm.c b/drivers/gpu/drm/ingenic/ingenic-drm.c
+index 9e95f6fd5406..376fca6ca9f4 100644
+--- a/drivers/gpu/drm/ingenic/ingenic-drm.c
++++ b/drivers/gpu/drm/ingenic/ingenic-drm.c
+@@ -467,7 +467,7 @@ static int ingenic_drm_encoder_atomic_check(struct drm_encoder *encoder,
+
+ static irqreturn_t ingenic_drm_irq_handler(int irq, void *arg)
+ {
+- struct ingenic_drm *priv = arg;
++ struct ingenic_drm *priv = drm_device_get_priv(arg);
+ unsigned int state;
+
+ regmap_read(priv->map, JZ_REG_LCD_STATE, &state);
+--
+2.25.1
+
--- /dev/null
+From b2ffc4e7b583c3c283ed2100158b3655c4e92a7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:47:05 +0300
+Subject: IB/ipoib: Fix double free of skb in case of multicast traffic in CM
+ mode
+
+From: Valentine Fatiev <valentinef@mellanox.com>
+
+[ Upstream commit 1acba6a817852d4aa7916d5c4f2c82f702ee9224 ]
+
+When connected mode is set, and we have connected and datagram traffic in
+parallel, ipoib might crash with double free of datagram skb.
+
+The current mechanism assumes that the order in the completion queue is
+the same as the order of sent packets for all QPs. Order is kept only for
+specific QP, in case of mixed UD and CM traffic we have few QPs (one UD and
+few CM's) in parallel.
+
+The problem:
+----------------------------------------------------------
+
+Transmit queue:
+-----------------
+UD skb pointer kept in queue itself, CM skb kept in spearate queue and
+uses transmit queue as a placeholder to count the number of total
+transmitted packets.
+
+0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127
+------------------------------------------------------------
+NL ud1 UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ...........
+------------------------------------------------------------
+ ^ ^
+ tail head
+
+Completion queue (problematic scenario) - the order not the same as in
+the transmit queue:
+
+ 1 2 3 4 5 6 7 8 9
+------------------------------------
+ ud1 CM1 UD2 ud3 cm2 cm3 ud4 cm4 ud5
+------------------------------------
+
+1. CM1 'wc' processing
+ - skb freed in cm separate ring.
+ - tx_tail of transmit queue increased although UD2 is not freed.
+ Now driver assumes UD2 index is already freed and it could be used for
+ new transmitted skb.
+
+0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127
+------------------------------------------------------------
+NL NL UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ...........
+------------------------------------------------------------
+ ^ ^ ^
+ (Bad)tail head
+(Bad - Could be used for new SKB)
+
+In this case (due to heavy load) UD2 skb pointer could be replaced by new
+transmitted packet UD_NEW, as the driver assumes its free. At this point
+we will have to process two 'wc' with same index but we have only one
+pointer to free.
+
+During second attempt to free the same skb we will have NULL pointer
+exception.
+
+2. UD2 'wc' processing
+ - skb freed according the index we got from 'wc', but it was already
+ overwritten by mistake. So actually the skb that was released is the
+ skb of the new transmitted packet and not the original one.
+
+3. UD_NEW 'wc' processing
+ - attempt to free already freed skb. NUll pointer exception.
+
+The fix:
+-----------------------------------------------------------------------
+
+The fix is to stop using the UD ring as a placeholder for CM packets, the
+cyclic ring variables tx_head and tx_tail will manage the UD tx_ring, a
+new cyclic variables global_tx_head and global_tx_tail are introduced for
+managing and counting the overall outstanding sent packets, then the send
+queue will be stopped and waken based on these variables only.
+
+Note that no locking is needed since global_tx_head is updated in the xmit
+flow and global_tx_tail is updated in the NAPI flow only. A previous
+attempt tried to use one variable to count the outstanding sent packets,
+but it did not work since xmit and NAPI flows can run at the same time and
+the counter will be updated wrongly. Thus, we use the same simple cyclic
+head and tail scheme that we have today for the UD tx_ring.
+
+Fixes: 2c104ea68350 ("IB/ipoib: Get rid of the tx_outstanding variable in all modes")
+Link: https://lore.kernel.org/r/20200527134705.480068-1-leon@kernel.org
+Signed-off-by: Valentine Fatiev <valentinef@mellanox.com>
+Signed-off-by: Alaa Hleihel <alaa@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Acked-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib.h | 4 ++++
+ drivers/infiniband/ulp/ipoib/ipoib_cm.c | 15 +++++++++------
+ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 9 +++++++--
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 10 ++++++----
+ 4 files changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 2aa3457a30ce..0e5f27caf2b2 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -377,8 +377,12 @@ struct ipoib_dev_priv {
+ struct ipoib_rx_buf *rx_ring;
+
+ struct ipoib_tx_buf *tx_ring;
++ /* cyclic ring variables for managing tx_ring, for UD only */
+ unsigned int tx_head;
+ unsigned int tx_tail;
++ /* cyclic ring variables for counting overall outstanding send WRs */
++ unsigned int global_tx_head;
++ unsigned int global_tx_tail;
+ struct ib_sge tx_sge[MAX_SKB_FRAGS + 1];
+ struct ib_ud_wr tx_wr;
+ struct ib_wc send_wc[MAX_SEND_CQE];
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index c59e00a0881f..9bf0fa30df28 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -756,7 +756,8 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ return;
+ }
+
+- if ((priv->tx_head - priv->tx_tail) == ipoib_sendq_size - 1) {
++ if ((priv->global_tx_head - priv->global_tx_tail) ==
++ ipoib_sendq_size - 1) {
+ ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+ tx->qp->qp_num);
+ netif_stop_queue(dev);
+@@ -786,7 +787,7 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ } else {
+ netif_trans_update(dev);
+ ++tx->tx_head;
+- ++priv->tx_head;
++ ++priv->global_tx_head;
+ }
+ }
+
+@@ -820,10 +821,11 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
+ netif_tx_lock(dev);
+
+ ++tx->tx_tail;
+- ++priv->tx_tail;
++ ++priv->global_tx_tail;
+
+ if (unlikely(netif_queue_stopped(dev) &&
+- (priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1 &&
++ ((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)))
+ netif_wake_queue(dev);
+
+@@ -1232,8 +1234,9 @@ timeout:
+ dev_kfree_skb_any(tx_req->skb);
+ netif_tx_lock_bh(p->dev);
+ ++p->tx_tail;
+- ++priv->tx_tail;
+- if (unlikely(priv->tx_head - priv->tx_tail == ipoib_sendq_size >> 1) &&
++ ++priv->global_tx_tail;
++ if (unlikely((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ netif_queue_stopped(p->dev) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
+ netif_wake_queue(p->dev);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index c332b4761816..da3c5315bbb5 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -407,9 +407,11 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
+ dev_kfree_skb_any(tx_req->skb);
+
+ ++priv->tx_tail;
++ ++priv->global_tx_tail;
+
+ if (unlikely(netif_queue_stopped(dev) &&
+- ((priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1) &&
++ ((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)))
+ netif_wake_queue(dev);
+
+@@ -634,7 +636,8 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+ else
+ priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM;
+ /* increase the tx_head after send success, but use it for queue state */
+- if (priv->tx_head - priv->tx_tail == ipoib_sendq_size - 1) {
++ if ((priv->global_tx_head - priv->global_tx_tail) ==
++ ipoib_sendq_size - 1) {
+ ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n");
+ netif_stop_queue(dev);
+ }
+@@ -662,6 +665,7 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+
+ rc = priv->tx_head;
+ ++priv->tx_head;
++ ++priv->global_tx_head;
+ }
+ return rc;
+ }
+@@ -807,6 +811,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
+ ipoib_dma_unmap_tx(priv, tx_req);
+ dev_kfree_skb_any(tx_req->skb);
+ ++priv->tx_tail;
++ ++priv->global_tx_tail;
+ }
+
+ for (i = 0; i < ipoib_recvq_size; ++i) {
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index ac0583ff280d..4fd095fd63b6 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1188,9 +1188,11 @@ static void ipoib_timeout(struct net_device *dev)
+
+ ipoib_warn(priv, "transmit timeout: latency %d msecs\n",
+ jiffies_to_msecs(jiffies - dev_trans_start(dev)));
+- ipoib_warn(priv, "queue stopped %d, tx_head %u, tx_tail %u\n",
+- netif_queue_stopped(dev),
+- priv->tx_head, priv->tx_tail);
++ ipoib_warn(priv,
++ "queue stopped %d, tx_head %u, tx_tail %u, global_tx_head %u, global_tx_tail %u\n",
++ netif_queue_stopped(dev), priv->tx_head, priv->tx_tail,
++ priv->global_tx_head, priv->global_tx_tail);
++
+ /* XXX reset QP, etc. */
+ }
+
+@@ -1705,7 +1707,7 @@ static int ipoib_dev_init_default(struct net_device *dev)
+ goto out_rx_ring_cleanup;
+ }
+
+- /* priv->tx_head, tx_tail & tx_outstanding are already 0 */
++ /* priv->tx_head, tx_tail and global_tx_tail/head are already 0 */
+
+ if (ipoib_transport_dev_init(dev, priv->ca)) {
+ pr_warn("%s: ipoib_transport_dev_init failed\n",
+--
+2.25.1
+
--- /dev/null
+From d5c48f194a736f66c242b29359f7af78c81f4ad8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 May 2020 23:13:28 -0400
+Subject: IB/qib: Call kobject_put() when kobject_init_and_add() fails
+
+From: Kaike Wan <kaike.wan@intel.com>
+
+[ Upstream commit a35cd6447effd5c239b564c80fa109d05ff3d114 ]
+
+When kobject_init_and_add() returns an error in the function
+qib_create_port_files(), the function kobject_put() is not called for the
+corresponding kobject, which potentially leads to memory leak.
+
+This patch fixes the issue by calling kobject_put() even if
+kobject_init_and_add() fails. In addition, the ppd->diagc_kobj is released
+along with other kobjects when the sysfs is unregistered.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Link: https://lore.kernel.org/r/20200512031328.189865.48627.stgit@awfm-01.aw.intel.com
+Cc: <stable@vger.kernel.org>
+Suggested-by: Lin Yi <teroincn@gmail.com>
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sysfs.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index 568b21eb6ea1..021df0654ba7 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -760,7 +760,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping linkcontrol sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail;
++ goto bail_link;
+ }
+ kobject_uevent(&ppd->pport_kobj, KOBJ_ADD);
+
+@@ -770,7 +770,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping sl2vl sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_link;
++ goto bail_sl;
+ }
+ kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD);
+
+@@ -780,7 +780,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping diag_counters sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_sl;
++ goto bail_diagc;
+ }
+ kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD);
+
+@@ -793,7 +793,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping Congestion Control sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_diagc;
++ goto bail_cc;
+ }
+
+ kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD);
+@@ -854,6 +854,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd)
+ &cc_table_bin_attr);
+ kobject_put(&ppd->pport_cc_kobj);
+ }
++ kobject_put(&ppd->diagc_kobj);
+ kobject_put(&ppd->sl2vl_kobj);
+ kobject_put(&ppd->pport_kobj);
+ }
+--
+2.25.1
+
--- /dev/null
+From 745825e171b16b71d545cf6642bc6f90dab3fe53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:55 -0700
+Subject: include/asm-generic/topology.h: guard cpumask_of_node() macro
+ argument
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4377748c7b5187c3342a60fa2ceb60c8a57a8488 ]
+
+drivers/hwmon/amd_energy.c:195:15: error: invalid operands to binary expression ('void' and 'int')
+ (channel - data->nr_cpus));
+ ~~~~~~~~~^~~~~~~~~~~~~~~~~
+include/asm-generic/topology.h:51:42: note: expanded from macro 'cpumask_of_node'
+ #define cpumask_of_node(node) ((void)node, cpu_online_mask)
+ ^~~~
+include/linux/cpumask.h:618:72: note: expanded from macro 'cpumask_first_and'
+ #define cpumask_first_and(src1p, src2p) cpumask_next_and(-1, (src1p), (src2p))
+ ^~~~~
+
+Fixes: f0b848ce6fe9 ("cpumask: Introduce cpumask_of_{node,pcibus} to replace {node,pcibus}_to_cpumask")
+Fixes: 8abee9566b7e ("hwmon: Add amd_energy driver to report energy counters")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Guenter Roeck <linux@roeck-us.net>
+Link: http://lkml.kernel.org/r/20200527134623.930247-1-arnd@arndb.de
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h
+index 238873739550..5aa8705df87e 100644
+--- a/include/asm-generic/topology.h
++++ b/include/asm-generic/topology.h
+@@ -48,7 +48,7 @@
+ #ifdef CONFIG_NEED_MULTIPLE_NODES
+ #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask)
+ #else
+- #define cpumask_of_node(node) ((void)node, cpu_online_mask)
++ #define cpumask_of_node(node) ((void)(node), cpu_online_mask)
+ #endif
+ #endif
+ #ifndef pcibus_to_node
+--
+2.25.1
+
--- /dev/null
+From 918d2972011c9681ff44477d650dcfd0288033c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 13:58:42 -0700
+Subject: Input: dlink-dir685-touchkeys - fix a typo in driver name
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 38347374ae3f1ec4df56dd688bd603a64e79a0ed ]
+
+According to the file name and Kconfig, a 'k' is missing in this driver
+name. It should be "dlink-dir685-touchkeys".
+
+Fixes: 131b3de7016b ("Input: add D-Link DIR-685 touchkeys driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20200412213937.5287-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/dlink-dir685-touchkeys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/dlink-dir685-touchkeys.c b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+index b0ead7199c40..a69dcc3bd30c 100644
+--- a/drivers/input/keyboard/dlink-dir685-touchkeys.c
++++ b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+@@ -143,7 +143,7 @@ MODULE_DEVICE_TABLE(of, dir685_tk_of_match);
+
+ static struct i2c_driver dir685_tk_i2c_driver = {
+ .driver = {
+- .name = "dlin-dir685-touchkeys",
++ .name = "dlink-dir685-touchkeys",
+ .of_match_table = of_match_ptr(dir685_tk_of_match),
+ },
+ .probe = dir685_tk_probe,
+--
+2.25.1
+
--- /dev/null
+From 338d1d19731eb6713db7c09910d6e65e67c080dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 13:45:12 -0700
+Subject: Input: evdev - call input_flush_device() on release(), not flush()
+
+From: Brendan Shanks <bshanks@codeweavers.com>
+
+[ Upstream commit 09264098ff153f60866039d60b31d39b66f55a31 ]
+
+input_flush_device() should only be called once the struct file is being
+released and no open descriptors remain, but evdev_flush() was calling
+it whenever a file descriptor was closed.
+
+This caused uploaded force-feedback effects to be erased when a process
+did a dup()/close() on the event FD, called system(), etc.
+
+Call input_flush_device() from evdev_release() instead.
+
+Reported-by: Mathieu Maret <mathieu.maret@gmail.com>
+Signed-off-by: Brendan Shanks <bshanks@codeweavers.com>
+Link: https://lore.kernel.org/r/20200421231003.7935-1-bshanks@codeweavers.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/evdev.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index cb6e3a5f509c..0d57e51b8ba1 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -326,20 +326,6 @@ static int evdev_fasync(int fd, struct file *file, int on)
+ return fasync_helper(fd, file, on, &client->fasync);
+ }
+
+-static int evdev_flush(struct file *file, fl_owner_t id)
+-{
+- struct evdev_client *client = file->private_data;
+- struct evdev *evdev = client->evdev;
+-
+- mutex_lock(&evdev->mutex);
+-
+- if (evdev->exist && !client->revoked)
+- input_flush_device(&evdev->handle, file);
+-
+- mutex_unlock(&evdev->mutex);
+- return 0;
+-}
+-
+ static void evdev_free(struct device *dev)
+ {
+ struct evdev *evdev = container_of(dev, struct evdev, dev);
+@@ -453,6 +439,10 @@ static int evdev_release(struct inode *inode, struct file *file)
+ unsigned int i;
+
+ mutex_lock(&evdev->mutex);
++
++ if (evdev->exist && !client->revoked)
++ input_flush_device(&evdev->handle, file);
++
+ evdev_ungrab(evdev, client);
+ mutex_unlock(&evdev->mutex);
+
+@@ -1310,7 +1300,6 @@ static const struct file_operations evdev_fops = {
+ .compat_ioctl = evdev_ioctl_compat,
+ #endif
+ .fasync = evdev_fasync,
+- .flush = evdev_flush,
+ .llseek = no_llseek,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 2243e4f1fc4ab6a572a94b2133d86137ee63c68d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Apr 2020 10:02:19 -0700
+Subject: Input: i8042 - add ThinkPad S230u to i8042 nomux list
+
+From: Kevin Locke <kevin@kevinlocke.name>
+
+[ Upstream commit 18931506465a762ffd3f4803d36a18d336a67da9 ]
+
+On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version
+"GDETC1WW (1.81 ) 06/27/2019", whether booted in UEFI or Legacy/CSM mode
+the keyboard, Synaptics TouchPad, and TrackPoint either do not function
+or stop functioning a few minutes after boot. This problem has been
+noted before, perhaps only occurring on BIOS 1.57 and
+later.[1][2][3][4][5]
+
+This model does not have an external PS/2 port, so mux does not appear
+to be useful.
+
+Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago
+and although the [BIOS changelog] notes "Fixed an issue of UEFI
+touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be
+insufficient.
+
+Adding 33474HU to the nomux list avoids the issue on my system.
+
+[1]: https://bugs.launchpad.net/bugs/1210748
+[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425
+[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200
+[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115
+[5]: https://forums.lenovo.com/topic/findpost/27/1337119
+[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt
+
+Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/feb8a8339a67025dab3850e6377eb6f3a0e782ba.1587400635.git.kevin@kevinlocke.name
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 08e919dbeb5d..5bbc9152731d 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -541,6 +541,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
+ },
+ },
++ {
++ /* Lenovo ThinkPad Twist S230u */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ },
++ },
+ { }
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 134654501dd5dfbd78cef7a56a9187e8f07a719e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 18:07:20 -0700
+Subject: Input: i8042 - add ThinkPad S230u to i8042 reset list
+
+From: Kevin Locke <kevin@kevinlocke.name>
+
+[ Upstream commit 2712c91a54a1058d55c284152b4d93c979b67be6 ]
+
+On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version
+"GDETC1WW (1.81 ) 06/27/2019", the keyboard, Synaptics TouchPad, and
+TrackPoint either do not function or stop functioning a few minutes
+after boot. This problem has been noted before, perhaps only occurring
+with BIOS 1.57 and later.[1][2][3][4][5]
+
+Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago
+and although the [BIOS changelog] notes "Fixed an issue of UEFI
+touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be
+insufficient.
+
+Setting i8042.reset=1 or adding 33474HU to the reset list avoids the
+issue on my system from either warm or cold boot.
+
+[1]: https://bugs.launchpad.net/bugs/1210748
+[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425
+[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200
+[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115
+[5]: https://forums.lenovo.com/topic/findpost/27/1337119
+[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt
+
+Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/94f384b0f75f90f71425d7dce7ac82c59ddb87a8.1587702636.git.kevin@kevinlocke.name
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 5bbc9152731d..c47800176534 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -669,6 +669,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+ },
+ },
++ {
++ /* Lenovo ThinkPad Twist S230u */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ },
++ },
+ { }
+ };
+
+--
+2.25.1
+
--- /dev/null
+From e457dbc04f421829632585aace547518cba3ae43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Apr 2020 16:09:53 -0700
+Subject: Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 5caab2da63207d6d631007f592f5219459e3454d ]
+
+Fix to return a negative error code from the input_register_device()
+error handling case instead of 0, as done elsewhere in this function.
+
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20200428134948.78343-1-weiyongjun1@huawei.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index c18e1a25bca6..258d5fe3d395 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -1210,7 +1210,8 @@ static int rmi_driver_probe(struct device *dev)
+ if (data->input) {
+ rmi_driver_set_input_name(rmi_dev, data->input);
+ if (!rmi_dev->xport->input) {
+- if (input_register_device(data->input)) {
++ retval = input_register_device(data->input);
++ if (retval) {
+ dev_err(dev, "%s: Failed to register input device.\n",
+ __func__);
+ goto err_destroy_functions;
+--
+2.25.1
+
--- /dev/null
+From 652e949a62a4c5a695844f244c1f2b432f650a79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 18:08:58 -0700
+Subject: Input: synaptics-rmi4 - really fix attn_data use-after-free
+
+From: Evan Green <evgreen@chromium.org>
+
+[ Upstream commit d5a5e5b5fa7b86c05bf073acc0ba98fa280174ec ]
+
+Fix a use-after-free noticed by running with KASAN enabled. If
+rmi_irq_fn() is run twice in a row, then rmi_f11_attention() (among
+others) will end up reading from drvdata->attn_data.data, which was
+freed and left dangling in rmi_irq_fn().
+
+Commit 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by
+KASAN") correctly identified and analyzed this bug. However the attempted
+fix only NULLed out a local variable, missing the fact that
+drvdata->attn_data is a struct, not a pointer.
+
+NULL out the correct pointer in the driver data to prevent the attention
+functions from copying from it.
+
+Fixes: 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by KASAN")
+Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data")
+Signed-off-by: Evan Green <evgreen@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200427145537.1.Ic8f898e0147beeee2c005ee7b20f1aebdef1e7eb@changeid
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 190b9974526b..c18e1a25bca6 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -205,7 +205,7 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
+
+ if (count) {
+ kfree(attn_data.data);
+- attn_data.data = NULL;
++ drvdata->attn_data.data = NULL;
+ }
+
+ if (!kfifo_is_empty(&drvdata->attn_fifo))
+--
+2.25.1
+
--- /dev/null
+From 1510dde033b0dada8043776e4b7095068507daf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Apr 2020 21:17:12 -0700
+Subject: Input: usbtouchscreen - add support for BonXeon TP
+
+From: James Hilliard <james.hilliard1@gmail.com>
+
+[ Upstream commit e3b4f94ef52ae1592cbe199bd38dbdc0d58b2217 ]
+
+Based on available information this uses the singletouch irtouch
+protocol. This is tested and confirmed to be fully functional on
+the BonXeon TP hardware I have.
+
+Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
+Link: https://lore.kernel.org/r/20200413184217.55700-1-james.hilliard1@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/usbtouchscreen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index 16d70201de4a..397cb1d3f481 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -182,6 +182,7 @@ static const struct usb_device_id usbtouch_devices[] = {
+ #endif
+
+ #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH
++ {USB_DEVICE(0x255e, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES},
+--
+2.25.1
+
--- /dev/null
+From 325e68786fcf3a9128ebbd3508c1664db2beea9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 14:13:09 -0700
+Subject: Input: xpad - add custom init packet for Xbox One S controllers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Łukasz Patron <priv.luk@gmail.com>
+
+[ Upstream commit 764f7f911bf72450c51eb74cbb262ad9933741d8 ]
+
+Sending [ 0x05, 0x20, 0x00, 0x0f, 0x06 ] packet for Xbox One S controllers
+fixes an issue where controller is stuck in Bluetooth mode and not sending
+any inputs.
+
+Signed-off-by: Łukasz Patron <priv.luk@gmail.com>
+Reviewed-by: Cameron Gutman <aicommander@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200422075206.18229-1-priv.luk@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/joystick/xpad.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 6b40a1c68f9f..c77cdb3b62b5 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -458,6 +458,16 @@ static const u8 xboxone_fw2015_init[] = {
+ 0x05, 0x20, 0x00, 0x01, 0x00
+ };
+
++/*
++ * This packet is required for Xbox One S (0x045e:0x02ea)
++ * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to
++ * initialize the controller that was previously used in
++ * Bluetooth mode.
++ */
++static const u8 xboxone_s_init[] = {
++ 0x05, 0x20, 0x00, 0x0f, 0x06
++};
++
+ /*
+ * This packet is required for the Titanfall 2 Xbox One pads
+ * (0x0e6f:0x0165) to finish initialization and for Hori pads
+@@ -516,6 +526,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
+ XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
++ XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init),
++ XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+--
+2.25.1
+
--- /dev/null
+From da81bbad6ca7931963fafde81f63ee81792131ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:00:19 -0500
+Subject: iommu: Fix reference count leak in iommu_group_alloc.
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit 7cc31613734c4870ae32f5265d576ef296621343 ]
+
+kobject_init_and_add() takes reference even when it fails.
+Thus, when kobject_init_and_add() returns an error,
+kobject_put() must be called to properly clean up the kobject.
+
+Fixes: d72e31c93746 ("iommu: IOMMU Groups")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Link: https://lore.kernel.org/r/20200527210020.6522-1-wu000273@umn.edu
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index cd3c0ea56657..9d7232e26ecf 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -492,7 +492,7 @@ struct iommu_group *iommu_group_alloc(void)
+ NULL, "%d", group->id);
+ if (ret) {
+ ida_simple_remove(&iommu_group_ida, group->id);
+- kfree(group);
++ kobject_put(&group->kobj);
+ return ERR_PTR(ret);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From ee1bfdb10d50ba88d51e618da865ea91a2e2925e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 May 2020 16:03:09 +0800
+Subject: libceph: ignore pool overlay and cache logic on redirects
+
+From: Jerry Lee <leisurelysw24@gmail.com>
+
+[ Upstream commit 890bd0f8997ae6ac0a367dd5146154a3963306dd ]
+
+OSD client should ignore cache/overlay flag if got redirect reply.
+Otherwise, the client hangs when the cache tier is in forward mode.
+
+[ idryomov: Redirects are effectively deprecated and no longer
+ used or tested. The original tiering modes based on redirects
+ are inherently flawed because redirects can race and reorder,
+ potentially resulting in data corruption. The new proxy and
+ readproxy tiering modes should be used instead of forward and
+ readforward. Still marking for stable as obviously correct,
+ though. ]
+
+Cc: stable@vger.kernel.org
+URL: https://tracker.ceph.com/issues/23296
+URL: https://tracker.ceph.com/issues/36406
+Signed-off-by: Jerry Lee <leisurelysw24@gmail.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/osd_client.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 2352afa62d1f..e513b8876d13 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -3652,7 +3652,9 @@ static void handle_reply(struct ceph_osd *osd, struct ceph_msg *msg)
+ * supported.
+ */
+ req->r_t.target_oloc.pool = m.redirect.oloc.pool;
+- req->r_flags |= CEPH_OSD_FLAG_REDIRECTED;
++ req->r_flags |= CEPH_OSD_FLAG_REDIRECTED |
++ CEPH_OSD_FLAG_IGNORE_OVERLAY |
++ CEPH_OSD_FLAG_IGNORE_CACHE;
+ req->r_tid = 0;
+ __submit_request(req, false);
+ goto out_unlock_osdc;
+--
+2.25.1
+
--- /dev/null
+From c7541f902c669515cbdfe682defa81368e1aa152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:47 -0700
+Subject: mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 6988f31d558aa8c744464a7f6d91d34ada48ad12 ]
+
+Replace superfluous VM_BUG_ON() with comment about correct usage.
+
+Technically reverts commit 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to
+page_mapcount()"), but context lines have changed.
+
+Function isolate_migratepages_block() runs some checks out of lru_lock
+when choose pages for migration. After checking PageLRU() it checks
+extra page references by comparing page_count() and page_mapcount().
+Between these two checks page could be removed from lru, freed and taken
+by slab.
+
+As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount().
+Race window is tiny. For certain workload this happens around once a
+year.
+
+ page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0
+ flags: 0x500000000008100(slab|head)
+ raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180
+ raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
+ page dumped because: VM_BUG_ON_PAGE(PageSlab(page))
+ ------------[ cut here ]------------
+ kernel BUG at ./include/linux/mm.h:628!
+ invalid opcode: 0000 [#1] SMP NOPTI
+ CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G W 4.19.109-27 #1
+ Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019
+ RIP: 0010:isolate_migratepages_block+0x986/0x9b0
+
+The code in isolate_migratepages_block() was added in commit
+119d6d59dcc0 ("mm, compaction: avoid isolating pinned pages") before
+adding VM_BUG_ON into page_mapcount().
+
+This race has been predicted in 2015 by Vlastimil Babka (see link
+below).
+
+[akpm@linux-foundation.org: comment tweaks, per Hugh]
+Fixes: 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to page_mapcount()")
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Hugh Dickins <hughd@google.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: David Rientjes <rientjes@google.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/159032779896.957378.7852761411265662220.stgit@buzz
+Link: https://lore.kernel.org/lkml/557710E1.6060103@suse.cz/
+Link: https://lore.kernel.org/linux-mm/158937872515.474360.5066096871639561424.stgit@buzz/T/ (v1)
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mm.h | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index afa77b683a04..53bad834adf5 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -695,6 +695,11 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags)
+
+ extern void kvfree(const void *addr);
+
++/*
++ * Mapcount of compound page as a whole, does not include mapped sub-pages.
++ *
++ * Must be called only for compound pages or any their tail sub-pages.
++ */
+ static inline int compound_mapcount(struct page *page)
+ {
+ VM_BUG_ON_PAGE(!PageCompound(page), page);
+@@ -714,10 +719,16 @@ static inline void page_mapcount_reset(struct page *page)
+
+ int __page_mapcount(struct page *page);
+
++/*
++ * Mapcount of 0-order page; when compound sub-page, includes
++ * compound_mapcount().
++ *
++ * Result is undefined for pages which cannot be mapped into userspace.
++ * For example SLAB or special types of pages. See function page_has_type().
++ * They use this place in struct page differently.
++ */
+ static inline int page_mapcount(struct page *page)
+ {
+- VM_BUG_ON_PAGE(PageSlab(page), page);
+-
+ if (unlikely(PageCompound(page)))
+ return __page_mapcount(page);
+ return atomic_read(&page->_mapcount) + 1;
+--
+2.25.1
+
--- /dev/null
+From f7b494ee5e1427d4469963d35909fa8942fa35d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:43 -0700
+Subject: mm,thp: stop leaking unreleased file pages
+
+From: Hugh Dickins <hughd@google.com>
+
+[ Upstream commit 2f33a706027c94cd4f70fcd3e3f4a17c1ce4ea4b ]
+
+When collapse_file() calls try_to_release_page(), it has already isolated
+the page: so if releasing buffers happens to fail (as it sometimes does),
+remember to putback_lru_page(): otherwise that page is left unreclaimable
+and unfreeable, and the file extent uncollapsible.
+
+Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS")
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Song Liu <songliubraving@fb.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: <stable@vger.kernel.org> [5.4+]
+Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2005231837500.1766@eggly.anvils
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/khugepaged.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index a8a57bebb5fa..f765475be359 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -1655,6 +1655,7 @@ static void collapse_file(struct mm_struct *mm,
+ if (page_has_private(page) &&
+ !try_to_release_page(page, GFP_KERNEL)) {
+ result = SCAN_PAGE_HAS_PRIVATE;
++ putback_lru_page(page);
+ goto out_unlock;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From db1fb7af485234e7af4028e8b4231464f8bdad40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 09:29:25 +0000
+Subject: mmc: block: Fix use-after-free issue for rpmb
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peng Hao <richard.peng@oppo.com>
+
+[ Upstream commit 202500d21654874aa03243e91f96de153ec61860 ]
+
+The data structure member “rpmb->md” was passed to a call of the function
+“mmc_blk_put” after a call of the function “put_device”. Reorder these
+function calls to keep the data accesses consistent.
+
+Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ")
+Signed-off-by: Peng Hao <richard.peng@oppo.com>
+Cc: stable@vger.kernel.org
+[Uffe: Fixed up mangled patch and updated commit message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 9d01b5dca519..7f480c6b1981 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2475,8 +2475,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
+ struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
+ struct mmc_rpmb_data, chrdev);
+
+- put_device(&rpmb->dev);
+ mmc_blk_put(rpmb->md);
++ put_device(&rpmb->dev);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From c15842b8d25ea4a866b164f2ab25b6ccc030b618 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 22:29:25 +0200
+Subject: parisc: Fix kernel panic in mem_init()
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit bf71bc16e02162388808949b179d59d0b571b965 ]
+
+The Debian kernel v5.6 triggers this kernel panic:
+
+ Kernel panic - not syncing: Bad Address (null pointer deref?)
+ Bad Address (null pointer deref?): Code=26 (Data memory access rights trap) at addr 0000000000000000
+ CPU: 0 PID: 0 Comm: swapper Not tainted 5.6.0-2-parisc64 #1 Debian 5.6.14-1
+ IAOQ[0]: mem_init+0xb0/0x150
+ IAOQ[1]: mem_init+0xb4/0x150
+ RP(r2): start_kernel+0x6c8/0x1190
+ Backtrace:
+ [<0000000040101ab4>] start_kernel+0x6c8/0x1190
+ [<0000000040108574>] start_parisc+0x158/0x1b8
+
+on a HP-PARISC rp3440 machine with this memory layout:
+ Memory Ranges:
+ 0) Start 0x0000000000000000 End 0x000000003fffffff Size 1024 MB
+ 1) Start 0x0000004040000000 End 0x00000040ffdfffff Size 3070 MB
+
+Fix the crash by avoiding virt_to_page() and similar functions in
+mem_init() until the memory zones have been fully set up.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: stable@vger.kernel.org # v5.0+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/mm/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index ddca8287d43b..3e54484797f6 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -588,7 +588,7 @@ void __init mem_init(void)
+ > BITS_PER_LONG);
+
+ high_memory = __va((max_pfn << PAGE_SHIFT));
+- set_max_mapnr(page_to_pfn(virt_to_page(high_memory - 1)) + 1);
++ set_max_mapnr(max_low_pfn);
+ memblock_free_all();
+
+ #ifdef CONFIG_PA11
+--
+2.25.1
+
--- /dev/null
+From b7a4df9d4d95df941f910c8da9e4c572ab50f061 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:55:34 +0300
+Subject: RDMA/core: Fix double destruction of uobject
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+[ Upstream commit c85f4abe66bea0b5db8d28d55da760c4fe0a0301 ]
+
+Fix use after free when user user space request uobject concurrently for
+the same object, within the RCU grace period.
+
+In that case, remove_handle_idr_uobject() is called twice and we will have
+an extra put on the uobject which cause use after free. Fix it by leaving
+the uobject write locked after it was removed from the idr.
+
+Call to rdma_lookup_put_uobject with UVERBS_LOOKUP_DESTROY instead of
+UVERBS_LOOKUP_WRITE will do the work.
+
+ refcount_t: underflow; use-after-free.
+ WARNING: CPU: 0 PID: 1381 at lib/refcount.c:28 refcount_warn_saturate+0xfe/0x1a0
+ Kernel panic - not syncing: panic_on_warn set ...
+ CPU: 0 PID: 1381 Comm: syz-executor.0 Not tainted 5.5.0-rc3 #8
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+ Call Trace:
+ dump_stack+0x94/0xce
+ panic+0x234/0x56f
+ __warn+0x1cc/0x1e1
+ report_bug+0x200/0x310
+ fixup_bug.part.11+0x32/0x80
+ do_error_trap+0xd3/0x100
+ do_invalid_op+0x31/0x40
+ invalid_op+0x1e/0x30
+ RIP: 0010:refcount_warn_saturate+0xfe/0x1a0
+ Code: 0f 0b eb 9b e8 23 f6 6d ff 80 3d 6c d4 19 03 00 75 8d e8 15 f6 6d ff 48 c7 c7 c0 02 55 bd c6 05 57 d4 19 03 01 e8 a2 58 49 ff <0f> 0b e9 6e ff ff ff e8 f6 f5 6d ff 80 3d 42 d4 19 03 00 0f 85 5c
+ RSP: 0018:ffffc90002df7b98 EFLAGS: 00010282
+ RAX: 0000000000000000 RBX: ffff88810f6a193c RCX: ffffffffba649009
+ RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88811b0283cc
+ RBP: 0000000000000003 R08: ffffed10236060e3 R09: ffffed10236060e3
+ R10: 0000000000000001 R11: ffffed10236060e2 R12: ffff88810f6a193c
+ R13: ffffc90002df7d60 R14: 0000000000000000 R15: ffff888116ae6a08
+ uverbs_uobject_put+0xfd/0x140
+ __uobj_perform_destroy+0x3d/0x60
+ ib_uverbs_close_xrcd+0x148/0x170
+ ib_uverbs_write+0xaa5/0xdf0
+ __vfs_write+0x7c/0x100
+ vfs_write+0x168/0x4a0
+ ksys_write+0xc8/0x200
+ do_syscall_64+0x9c/0x390
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x465b49
+ Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+ RSP: 002b:00007f759d122c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+ RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 0000000000465b49
+ RDX: 000000000000000c RSI: 0000000020000080 RDI: 0000000000000003
+ RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
+ R10: 0000000000000000 R11: 0000000000000246 R12: 00007f759d1236bc
+ R13: 00000000004ca27c R14: 000000000070de40 R15: 00000000ffffffff
+ Dumping ftrace buffer:
+ (ftrace buffer empty)
+ Kernel Offset: 0x39400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+
+Fixes: 7452a3c745a2 ("IB/uverbs: Allow RDMA_REMOVE_DESTROY to work concurrently with disassociate")
+Link: https://lore.kernel.org/r/20200527135534.482279-1-leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/rdma_core.c | 20 +++++++++++++-------
+ include/rdma/uverbs_std_types.h | 2 +-
+ 2 files changed, 14 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index 1c95fefa1f06..d0580eed3bcb 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -160,9 +160,9 @@ static int uverbs_destroy_uobject(struct ib_uobject *uobj,
+ uobj->context = NULL;
+
+ /*
+- * For DESTROY the usecnt is held write locked, the caller is expected
+- * to put it unlock and put the object when done with it. Only DESTROY
+- * can remove the IDR handle.
++ * For DESTROY the usecnt is not changed, the caller is expected to
++ * manage it via uobj_put_destroy(). Only DESTROY can remove the IDR
++ * handle.
+ */
+ if (reason != RDMA_REMOVE_DESTROY)
+ atomic_set(&uobj->usecnt, 0);
+@@ -194,7 +194,7 @@ static int uverbs_destroy_uobject(struct ib_uobject *uobj,
+ /*
+ * This calls uverbs_destroy_uobject() using the RDMA_REMOVE_DESTROY
+ * sequence. It should only be used from command callbacks. On success the
+- * caller must pair this with rdma_lookup_put_uobject(LOOKUP_WRITE). This
++ * caller must pair this with uobj_put_destroy(). This
+ * version requires the caller to have already obtained an
+ * LOOKUP_DESTROY uobject kref.
+ */
+@@ -205,6 +205,13 @@ int uobj_destroy(struct ib_uobject *uobj, struct uverbs_attr_bundle *attrs)
+
+ down_read(&ufile->hw_destroy_rwsem);
+
++ /*
++ * Once the uobject is destroyed by RDMA_REMOVE_DESTROY then it is left
++ * write locked as the callers put it back with UVERBS_LOOKUP_DESTROY.
++ * This is because any other concurrent thread can still see the object
++ * in the xarray due to RCU. Leaving it locked ensures nothing else will
++ * touch it.
++ */
+ ret = uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE);
+ if (ret)
+ goto out_unlock;
+@@ -223,7 +230,7 @@ out_unlock:
+ /*
+ * uobj_get_destroy destroys the HW object and returns a handle to the uobj
+ * with a NULL object pointer. The caller must pair this with
+- * uverbs_put_destroy.
++ * uobj_put_destroy().
+ */
+ struct ib_uobject *__uobj_get_destroy(const struct uverbs_api_object *obj,
+ u32 id, struct uverbs_attr_bundle *attrs)
+@@ -257,8 +264,7 @@ int __uobj_perform_destroy(const struct uverbs_api_object *obj, u32 id,
+ uobj = __uobj_get_destroy(obj, id, attrs);
+ if (IS_ERR(uobj))
+ return PTR_ERR(uobj);
+-
+- rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_WRITE);
++ uobj_put_destroy(uobj);
+ return 0;
+ }
+
+diff --git a/include/rdma/uverbs_std_types.h b/include/rdma/uverbs_std_types.h
+index 05eabfd5d0d3..9f382e7d4579 100644
+--- a/include/rdma/uverbs_std_types.h
++++ b/include/rdma/uverbs_std_types.h
+@@ -88,7 +88,7 @@ struct ib_uobject *__uobj_get_destroy(const struct uverbs_api_object *obj,
+
+ static inline void uobj_put_destroy(struct ib_uobject *uobj)
+ {
+- rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_WRITE);
++ rdma_lookup_put_uobject(uobj, UVERBS_LOOKUP_DESTROY);
+ }
+
+ static inline void uobj_put_read(struct ib_uobject *uobj)
+--
+2.25.1
+
--- /dev/null
+From 87345a435cbe782756ab740013fe0842995ca0d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 22:04:57 -0500
+Subject: RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit db857e6ae548f0f4f4a0f63fffeeedf3cca21f9d ]
+
+In function pvrdma_pci_probe(), pdev was not disabled in one error
+path. Thus replace the jump target “err_free_device” by
+"err_disable_pdev".
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Link: https://lore.kernel.org/r/20200523030457.16160-1-wu000273@umn.edu
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index e580ae9cc55a..780fd2dfc07e 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -829,7 +829,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
+ !(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "PCI BAR region not MMIO\n");
+ ret = -ENOMEM;
+- goto err_free_device;
++ goto err_disable_pdev;
+ }
+
+ ret = pci_request_regions(pdev, DRV_NAME);
+--
+2.25.1
+
--- /dev/null
+From 0af58e1f17f180e248bc1f6e5e78f97d59fd9cc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 May 2020 13:19:29 -0600
+Subject: Revert "block: end bio with BLK_STS_AGAIN in case of non-mq devs and
+ REQ_NOWAIT"
+
+From: Jens Axboe <axboe@kernel.dk>
+
+[ Upstream commit b0beb28097fa04177b3769f4bb7a0d0d9c4ae76e ]
+
+This reverts commit c58c1f83436b501d45d4050fd1296d71a9760bcb.
+
+io_uring does do the right thing for this case, and we're still returning
+-EAGAIN to userspace for the cases we don't support. Revert this change
+to avoid doing endless spins of resubmits.
+
+Cc: stable@vger.kernel.org # v5.6
+Reported-by: Bijan Mottahedeh <bijan.mottahedeh@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-core.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index 1075aaff606d..d5e668ec751b 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -886,14 +886,11 @@ generic_make_request_checks(struct bio *bio)
+ }
+
+ /*
+- * Non-mq queues do not honor REQ_NOWAIT, so complete a bio
+- * with BLK_STS_AGAIN status in order to catch -EAGAIN and
+- * to give a chance to the caller to repeat request gracefully.
++ * For a REQ_NOWAIT based request, return -EOPNOTSUPP
++ * if queue is not a request based queue.
+ */
+- if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q)) {
+- status = BLK_STS_AGAIN;
+- goto end_io;
+- }
++ if ((bio->bi_opf & REQ_NOWAIT) && !queue_is_mq(q))
++ goto not_supported;
+
+ if (should_fail_bio(bio))
+ goto end_io;
+--
+2.25.1
+
csky-fixup-raw_copy_from_user.patch
samples-bpf-fix-build-error.patch
drivers-net-hamradio-fix-suspicious-rcu-usage-warnin.patch
+input-usbtouchscreen-add-support-for-bonxeon-tp.patch
+input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch
+input-evdev-call-input_flush_device-on-release-not-f.patch
+input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch
+input-dlink-dir685-touchkeys-fix-a-typo-in-driver-na.patch
+input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch
+input-synaptics-rmi4-really-fix-attn_data-use-after-.patch
+input-synaptics-rmi4-fix-error-return-code-in-rmi_dr.patch
+arm-8970-1-decompressor-increase-tag-size.patch
+arm-uaccess-consolidate-uaccess-asm-to-asm-uaccess-a.patch
+arm-uaccess-integrate-uaccess_save-and-uaccess_resto.patch
+arm-uaccess-fix-dacr-mismatch-with-nested-exceptions.patch
+gpio-exar-fix-bad-handling-for-ida_simple_get-error-.patch
+arm64-dts-mt8173-fix-vcodec-enc-clock.patch
+soc-mediatek-cmdq-return-send-msg-error-code.patch
+gpu-drm-ingenic-fix-opaque-pointer-casted-to-wrong-t.patch
+ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch
+arm-dts-imx6q-bx50v3-set-display-interface-clock-par.patch
+arm-dts-bcm2835-rpi-zero-w-fix-led-polarity.patch
+arm-dts-bcm-hr2-fix-ppi-interrupt-types.patch
+mmc-block-fix-use-after-free-issue-for-rpmb.patch
+gpio-pxa-fix-return-value-of-pxa_gpio_probe.patch
+gpio-bcm-kona-fix-return-value-of-bcm_kona_gpio_prob.patch
+rdma-pvrdma-fix-missing-pci-disable-in-pvrdma_pci_pr.patch
+alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch
+alsa-hda-realtek-add-a-model-for-thinkpad-t570-witho.patch
+alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch
+exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch
+clk-qcom-gcc-fix-parent-for-gpll0_out_even.patch
+alsa-usb-audio-quirks-for-gigabyte-trx40-aorus-maste.patch
+alsa-hda-realtek-add-new-codec-supported-for-alc287.patch
+libceph-ignore-pool-overlay-and-cache-logic-on-redir.patch
+ceph-flush-release-queue-when-handling-caps-for-unkn.patch
+rdma-core-fix-double-destruction-of-uobject.patch
+drm-amd-display-drop-cursor-position-check-in-atomic.patch
+ib-ipoib-fix-double-free-of-skb-in-case-of-multicast.patch
+mm-thp-stop-leaking-unreleased-file-pages.patch
+mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch
+fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch
+include-asm-generic-topology.h-guard-cpumask_of_node.patch
+revert-block-end-bio-with-blk_sts_again-in-case-of-n.patch
+gpio-fix-locking-open-drain-irq-lines.patch
+iommu-fix-reference-count-leak-in-iommu_group_alloc.patch
+parisc-fix-kernel-panic-in-mem_init.patch
--- /dev/null
+From bcd5181f75f8b36b62c8aa8cd31609fc5975d31b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Mar 2020 18:52:47 +0800
+Subject: soc: mediatek: cmdq: return send msg error code
+
+From: Dennis YC Hsieh <dennis-yc.hsieh@mediatek.com>
+
+[ Upstream commit 34c4e4072603ff5c174df73b973896abb76cbb51 ]
+
+Return error code to client if send message fail,
+so that client has chance to error handling.
+
+Fixes: 576f1b4bc802 ("soc: mediatek: Add Mediatek CMDQ helper")
+Signed-off-by: Dennis YC Hsieh <dennis-yc.hsieh@mediatek.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Link: https://lore.kernel.org/r/1583664775-19382-6-git-send-email-dennis-yc.hsieh@mediatek.com
+Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/mediatek/mtk-cmdq-helper.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/mediatek/mtk-cmdq-helper.c b/drivers/soc/mediatek/mtk-cmdq-helper.c
+index 73a852b2f417..34eec26b0c1f 100644
+--- a/drivers/soc/mediatek/mtk-cmdq-helper.c
++++ b/drivers/soc/mediatek/mtk-cmdq-helper.c
+@@ -258,7 +258,9 @@ int cmdq_pkt_flush_async(struct cmdq_pkt *pkt, cmdq_async_flush_cb cb,
+ spin_unlock_irqrestore(&client->lock, flags);
+ }
+
+- mbox_send_message(client->chan, pkt);
++ err = mbox_send_message(client->chan, pkt);
++ if (err < 0)
++ return err;
+ /* We can send next packet immediately, so just call txdone. */
+ mbox_client_txdone(client->chan, 0);
+
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
