--- /dev/null
+From 2e2b928a04bd74ea410da72bd60e1c5b06398276 Mon Sep 17 00:00:00 2001
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Fri, 11 Oct 2019 17:09:00 +0800
+Subject: clk: imx7ulp: Correct DDR clock mux options
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+commit 2e2b928a04bd74ea410da72bd60e1c5b06398276 upstream.
+
+In the latest reference manual Rev.0,06/2019, the DDR clock mux
+is extended to 2 bits, and the clock options are also changed,
+correct them accordingly.
+
+Fixes: b1260067ac3d ("clk: imx: add imx7ulp clk driver")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/imx/clk-imx7ulp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/imx/clk-imx7ulp.c
++++ b/drivers/clk/imx/clk-imx7ulp.c
+@@ -25,7 +25,7 @@ static const char * const spll_sels[] =
+ static const char * const apll_pfd_sels[] = { "apll_pfd0", "apll_pfd1", "apll_pfd2", "apll_pfd3", };
+ static const char * const apll_sels[] = { "apll", "apll_pfd_sel", };
+ static const char * const scs_sels[] = { "dummy", "sosc", "sirc", "firc", "dummy", "apll_sel", "spll_sel", "dummy", };
+-static const char * const ddr_sels[] = { "apll_pfd_sel", "upll", };
++static const char * const ddr_sels[] = { "apll_pfd_sel", "dummy", "dummy", "dummy", };
+ static const char * const nic_sels[] = { "firc", "ddr_clk", };
+ static const char * const periph_plat_sels[] = { "dummy", "nic1_bus_clk", "nic1_clk", "ddr_clk", "apll_pfd2", "apll_pfd1", "apll_pfd0", "upll", };
+ static const char * const periph_bus_sels[] = { "dummy", "sosc_bus_clk", "mpll", "firc_bus_clk", "rosc", "nic1_bus_clk", "nic1_clk", "spll_bus_clk", };
+@@ -119,7 +119,7 @@ static void __init imx7ulp_clk_scg1_init
+ clks[IMX7ULP_CLK_SYS_SEL] = imx_clk_hw_mux2("scs_sel", base + 0x14, 24, 4, scs_sels, ARRAY_SIZE(scs_sels));
+ clks[IMX7ULP_CLK_HSRUN_SYS_SEL] = imx_clk_hw_mux2("hsrun_scs_sel", base + 0x1c, 24, 4, scs_sels, ARRAY_SIZE(scs_sels));
+ clks[IMX7ULP_CLK_NIC_SEL] = imx_clk_hw_mux2("nic_sel", base + 0x40, 28, 1, nic_sels, ARRAY_SIZE(nic_sels));
+- clks[IMX7ULP_CLK_DDR_SEL] = imx_clk_hw_mux_flags("ddr_sel", base + 0x30, 24, 1, ddr_sels, ARRAY_SIZE(ddr_sels), CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE);
++ clks[IMX7ULP_CLK_DDR_SEL] = imx_clk_hw_mux_flags("ddr_sel", base + 0x30, 24, 2, ddr_sels, ARRAY_SIZE(ddr_sels), CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE);
+
+ clks[IMX7ULP_CLK_CORE_DIV] = imx_clk_hw_divider_flags("divcore", "scs_sel", base + 0x14, 16, 4, CLK_SET_RATE_PARENT);
+ clks[IMX7ULP_CLK_HSRUN_CORE_DIV] = imx_clk_hw_divider_flags("hsrun_divcore", "hsrun_scs_sel", base + 0x1c, 16, 4, CLK_SET_RATE_PARENT);
--- /dev/null
+From 96ac93a7c4bea4eb4186425795c00937d2dd6085 Mon Sep 17 00:00:00 2001
+From: Anson Huang <Anson.Huang@nxp.com>
+Date: Mon, 14 Oct 2019 08:56:05 +0800
+Subject: clk: imx7ulp: Correct system clock source option #7
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+commit 96ac93a7c4bea4eb4186425795c00937d2dd6085 upstream.
+
+In the latest reference manual Rev.0,06/2019, the SCS's option #7
+is no longer from upll, it is reserved, update clock driver accordingly.
+
+Fixes: b1260067ac3d ("clk: imx: add imx7ulp clk driver")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/imx/clk-imx7ulp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/imx/clk-imx7ulp.c
++++ b/drivers/clk/imx/clk-imx7ulp.c
+@@ -24,7 +24,7 @@ static const char * const spll_pfd_sels[
+ static const char * const spll_sels[] = { "spll", "spll_pfd_sel", };
+ static const char * const apll_pfd_sels[] = { "apll_pfd0", "apll_pfd1", "apll_pfd2", "apll_pfd3", };
+ static const char * const apll_sels[] = { "apll", "apll_pfd_sel", };
+-static const char * const scs_sels[] = { "dummy", "sosc", "sirc", "firc", "dummy", "apll_sel", "spll_sel", "upll", };
++static const char * const scs_sels[] = { "dummy", "sosc", "sirc", "firc", "dummy", "apll_sel", "spll_sel", "dummy", };
+ static const char * const ddr_sels[] = { "apll_pfd_sel", "upll", };
+ static const char * const nic_sels[] = { "firc", "ddr_clk", };
+ static const char * const periph_plat_sels[] = { "dummy", "nic1_bus_clk", "nic1_clk", "ddr_clk", "apll_pfd2", "apll_pfd1", "apll_pfd0", "upll", };
--- /dev/null
+From 9629dbdabd1983ef53f125336e1d62d77b1620f9 Mon Sep 17 00:00:00 2001
+From: Baolin Wang <baolin.wang@linaro.org>
+Date: Tue, 8 Oct 2019 15:41:38 +0800
+Subject: clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle()
+
+From: Baolin Wang <baolin.wang@linaro.org>
+
+commit 9629dbdabd1983ef53f125336e1d62d77b1620f9 upstream.
+
+The syscon_regmap_lookup_by_phandle() will never return NULL, thus use
+IS_ERR() to validate the return value instead of IS_ERR_OR_NULL().
+
+Fixes: d41f59fd92f2 ("clk: sprd: Add common infrastructure")
+Signed-off-by: Baolin Wang <baolin.wang@linaro.org>
+Link: https://lkml.kernel.org/r/1995139bee5248ff3e9d46dc715968f212cfc4cc.1570520268.git.baolin.wang@linaro.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/sprd/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/sprd/common.c
++++ b/drivers/clk/sprd/common.c
+@@ -46,7 +46,7 @@ int sprd_clk_regmap_init(struct platform
+
+ if (of_find_property(node, "sprd,syscon", NULL)) {
+ regmap = syscon_regmap_lookup_by_phandle(node, "sprd,syscon");
+- if (IS_ERR_OR_NULL(regmap)) {
++ if (IS_ERR(regmap)) {
+ pr_err("%s: failed to get syscon regmap\n", __func__);
+ return PTR_ERR(regmap);
+ }
--- /dev/null
+From 92b39ad440968bab38eb6577d63c12994601ed94 Mon Sep 17 00:00:00 2001
+From: Eddie James <eajames@linux.ibm.com>
+Date: Wed, 6 Nov 2019 14:01:06 -0600
+Subject: hwmon: (pmbus/ibm-cffps) Fix LED blink behavior
+
+From: Eddie James <eajames@linux.ibm.com>
+
+commit 92b39ad440968bab38eb6577d63c12994601ed94 upstream.
+
+The LED blink_set function incorrectly did not tell the PSU LED to blink
+if brightness was LED_OFF. Fix this, and also correct the LED_OFF
+command data, which should give control of the LED back to the PSU
+firmware. Also prevent I2C failures from getting the driver LED state
+out of sync and add some dev_dbg statements.
+
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/20191106200106.29519-3-eajames@linux.ibm.com
+Fixes: ef9e1cdf419a3 ("hwmon: (pmbus/cffps) Add led class device for power supply fault led")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/pmbus/ibm-cffps.c | 27 +++++++++++++++++++--------
+ 1 file changed, 19 insertions(+), 8 deletions(-)
+
+--- a/drivers/hwmon/pmbus/ibm-cffps.c
++++ b/drivers/hwmon/pmbus/ibm-cffps.c
+@@ -39,9 +39,13 @@
+ #define CFFPS_MFR_VAUX_FAULT BIT(6)
+ #define CFFPS_MFR_CURRENT_SHARE_WARNING BIT(7)
+
++/*
++ * LED off state actually relinquishes LED control to PSU firmware, so it can
++ * turn on the LED for faults.
++ */
++#define CFFPS_LED_OFF 0
+ #define CFFPS_LED_BLINK BIT(0)
+ #define CFFPS_LED_ON BIT(1)
+-#define CFFPS_LED_OFF BIT(2)
+ #define CFFPS_BLINK_RATE_MS 250
+
+ enum {
+@@ -296,23 +300,31 @@ static int ibm_cffps_led_brightness_set(
+ enum led_brightness brightness)
+ {
+ int rc;
++ u8 next_led_state;
+ struct ibm_cffps *psu = container_of(led_cdev, struct ibm_cffps, led);
+
+ if (brightness == LED_OFF) {
+- psu->led_state = CFFPS_LED_OFF;
++ next_led_state = CFFPS_LED_OFF;
+ } else {
+ brightness = LED_FULL;
++
+ if (psu->led_state != CFFPS_LED_BLINK)
+- psu->led_state = CFFPS_LED_ON;
++ next_led_state = CFFPS_LED_ON;
++ else
++ next_led_state = CFFPS_LED_BLINK;
+ }
+
++ dev_dbg(&psu->client->dev, "LED brightness set: %d. Command: %d.\n",
++ brightness, next_led_state);
++
+ pmbus_set_page(psu->client, 0);
+
+ rc = i2c_smbus_write_byte_data(psu->client, CFFPS_SYS_CONFIG_CMD,
+- psu->led_state);
++ next_led_state);
+ if (rc < 0)
+ return rc;
+
++ psu->led_state = next_led_state;
+ led_cdev->brightness = brightness;
+
+ return 0;
+@@ -325,10 +337,7 @@ static int ibm_cffps_led_blink_set(struc
+ int rc;
+ struct ibm_cffps *psu = container_of(led_cdev, struct ibm_cffps, led);
+
+- psu->led_state = CFFPS_LED_BLINK;
+-
+- if (led_cdev->brightness == LED_OFF)
+- return 0;
++ dev_dbg(&psu->client->dev, "LED blink set.\n");
+
+ pmbus_set_page(psu->client, 0);
+
+@@ -337,6 +346,8 @@ static int ibm_cffps_led_blink_set(struc
+ if (rc < 0)
+ return rc;
+
++ psu->led_state = CFFPS_LED_BLINK;
++ led_cdev->brightness = LED_FULL;
+ *delay_on = CFFPS_BLINK_RATE_MS;
+ *delay_off = CFFPS_BLINK_RATE_MS;
+
--- /dev/null
+From 9861ff954c7e83e2f738ce16fbe15f8a1e121771 Mon Sep 17 00:00:00 2001
+From: Eddie James <eajames@linux.ibm.com>
+Date: Wed, 6 Nov 2019 14:01:05 -0600
+Subject: hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call
+
+From: Eddie James <eajames@linux.ibm.com>
+
+commit 9861ff954c7e83e2f738ce16fbe15f8a1e121771 upstream.
+
+Since i2c_smbus functions can sleep, the brightness setting function
+for this driver must be the blocking version to avoid scheduling while
+atomic.
+
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/20191106200106.29519-2-eajames@linux.ibm.com
+Fixes: ef9e1cdf419a3 ("hwmon: (pmbus/cffps) Add led class device for power supply fault led")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/pmbus/ibm-cffps.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/hwmon/pmbus/ibm-cffps.c
++++ b/drivers/hwmon/pmbus/ibm-cffps.c
+@@ -292,8 +292,8 @@ static int ibm_cffps_read_word_data(stru
+ return rc;
+ }
+
+-static void ibm_cffps_led_brightness_set(struct led_classdev *led_cdev,
+- enum led_brightness brightness)
++static int ibm_cffps_led_brightness_set(struct led_classdev *led_cdev,
++ enum led_brightness brightness)
+ {
+ int rc;
+ struct ibm_cffps *psu = container_of(led_cdev, struct ibm_cffps, led);
+@@ -311,9 +311,11 @@ static void ibm_cffps_led_brightness_set
+ rc = i2c_smbus_write_byte_data(psu->client, CFFPS_SYS_CONFIG_CMD,
+ psu->led_state);
+ if (rc < 0)
+- return;
++ return rc;
+
+ led_cdev->brightness = brightness;
++
++ return 0;
+ }
+
+ static int ibm_cffps_led_blink_set(struct led_classdev *led_cdev,
+@@ -351,7 +353,7 @@ static void ibm_cffps_create_led_class(s
+ client->addr);
+ psu->led.name = psu->led_name;
+ psu->led.max_brightness = LED_FULL;
+- psu->led.brightness_set = ibm_cffps_led_brightness_set;
++ psu->led.brightness_set_blocking = ibm_cffps_led_brightness_set;
+ psu->led.blink_set = ibm_cffps_led_blink_set;
+
+ rc = devm_led_classdev_register(dev, &psu->led);
--- /dev/null
+From 07d369857808b7e8e471bbbbb0074a6718f89b31 Mon Sep 17 00:00:00 2001
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Fri, 25 Oct 2019 17:46:25 +0900
+Subject: perf probe: Fix wrong address verification
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+commit 07d369857808b7e8e471bbbbb0074a6718f89b31 upstream.
+
+Since there are some DIE which has only ranges instead of the
+combination of entrypc/highpc, address verification must use
+dwarf_haspc() instead of dwarf_entrypc/dwarf_highpc.
+
+Also, the ranges only DIE will have a partial code in different section
+(e.g. unlikely code will be in text.unlikely as "FUNC.cold" symbol). In
+that case, we can not use dwarf_entrypc() or die_entrypc(), because the
+offset from original DIE can be a minus value.
+
+Instead, this simply gets the symbol and offset from symtab.
+
+Without this patch;
+
+ # perf probe -D clear_tasks_mm_cpumask:1
+ Failed to get entry address of clear_tasks_mm_cpumask
+ Error: Failed to add events.
+
+And with this patch:
+
+ # perf probe -D clear_tasks_mm_cpumask:1
+ p:probe/clear_tasks_mm_cpumask clear_tasks_mm_cpumask+0
+ p:probe/clear_tasks_mm_cpumask_1 clear_tasks_mm_cpumask+5
+ p:probe/clear_tasks_mm_cpumask_2 clear_tasks_mm_cpumask+8
+ p:probe/clear_tasks_mm_cpumask_3 clear_tasks_mm_cpumask+16
+ p:probe/clear_tasks_mm_cpumask_4 clear_tasks_mm_cpumask+82
+
+Committer testing:
+
+I managed to reproduce the above:
+
+ [root@quaco ~]# perf probe -D clear_tasks_mm_cpumask:1
+ p:probe/clear_tasks_mm_cpumask _text+919968
+ p:probe/clear_tasks_mm_cpumask_1 _text+919973
+ p:probe/clear_tasks_mm_cpumask_2 _text+919976
+ [root@quaco ~]#
+
+But then when trying to actually put the probe in place, it fails if I
+use :0 as the offset:
+
+ [root@quaco ~]# perf probe -L clear_tasks_mm_cpumask | head -5
+ <clear_tasks_mm_cpumask@/usr/src/debug/kernel-5.2.fc30/linux-5.2.18-200.fc30.x86_64/kernel/cpu.c:0>
+ 0 void clear_tasks_mm_cpumask(int cpu)
+ 1 {
+ 2 struct task_struct *p;
+
+ [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0
+ Probe point 'clear_tasks_mm_cpumask' not found.
+ Error: Failed to add events.
+ [root@quaco
+
+The next patch is needed to fix this case.
+
+Fixes: 576b523721b7 ("perf probe: Fix probing symbols with optimization suffix")
+Reported-by: Arnaldo Carvalho de Melo <acme@kernel.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Link: http://lore.kernel.org/lkml/157199318513.8075.10463906803299647907.stgit@devnote2
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/probe-finder.c | 32 ++++++++++----------------------
+ 1 file changed, 10 insertions(+), 22 deletions(-)
+
+--- a/tools/perf/util/probe-finder.c
++++ b/tools/perf/util/probe-finder.c
+@@ -604,38 +604,26 @@ static int convert_to_trace_point(Dwarf_
+ const char *function,
+ struct probe_trace_point *tp)
+ {
+- Dwarf_Addr eaddr, highaddr;
++ Dwarf_Addr eaddr;
+ GElf_Sym sym;
+ const char *symbol;
+
+ /* Verify the address is correct */
+- if (dwarf_entrypc(sp_die, &eaddr) != 0) {
+- pr_warning("Failed to get entry address of %s\n",
+- dwarf_diename(sp_die));
+- return -ENOENT;
+- }
+- if (dwarf_highpc(sp_die, &highaddr) != 0) {
+- pr_warning("Failed to get end address of %s\n",
+- dwarf_diename(sp_die));
+- return -ENOENT;
+- }
+- if (paddr > highaddr) {
+- pr_warning("Offset specified is greater than size of %s\n",
++ if (!dwarf_haspc(sp_die, paddr)) {
++ pr_warning("Specified offset is out of %s\n",
+ dwarf_diename(sp_die));
+ return -EINVAL;
+ }
+
+- symbol = dwarf_diename(sp_die);
++ /* Try to get actual symbol name from symtab */
++ symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
+ if (!symbol) {
+- /* Try to get the symbol name from symtab */
+- symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL);
+- if (!symbol) {
+- pr_warning("Failed to find symbol at 0x%lx\n",
+- (unsigned long)paddr);
+- return -ENOENT;
+- }
+- eaddr = sym.st_value;
++ pr_warning("Failed to find symbol at 0x%lx\n",
++ (unsigned long)paddr);
++ return -ENOENT;
+ }
++ eaddr = sym.st_value;
++
+ tp->offset = (unsigned long)(paddr - eaddr);
+ tp->address = (unsigned long)paddr;
+ tp->symbol = strdup(symbol);
--- /dev/null
+From 3714437d3fcc7956cabcb0077f2a506b61160a56 Mon Sep 17 00:00:00 2001
+From: Andi Kleen <ak@linux.intel.com>
+Date: Wed, 2 Oct 2019 09:46:42 -0700
+Subject: perf script: Allow --time with --reltime
+
+From: Andi Kleen <ak@linux.intel.com>
+
+commit 3714437d3fcc7956cabcb0077f2a506b61160a56 upstream.
+
+The original --reltime patch forbid --time with --reltime.
+
+But it turns out --time doesn't really care about --reltime, because the
+relative time is only used at final output, while the time filtering
+always works earlier on absolute time.
+
+So just remove the check and allow combining the two options.
+
+Fixes: 90b10f47c0ee ("perf script: Support relative time")
+Signed-off-by: Andi Kleen <ak@linux.intel.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Link: http://lore.kernel.org/lkml/20191002164642.1719-1-andi@firstfloor.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/builtin-script.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/tools/perf/builtin-script.c
++++ b/tools/perf/builtin-script.c
+@@ -3605,11 +3605,6 @@ int cmd_script(int argc, const char **ar
+ }
+ }
+
+- if (script.time_str && reltime) {
+- fprintf(stderr, "Don't combine --reltime with --time\n");
+- return -1;
+- }
+-
+ if (itrace_synth_opts.callchain &&
+ itrace_synth_opts.callchain_sz > scripting_max_stack)
+ scripting_max_stack = itrace_synth_opts.callchain_sz;
--- /dev/null
+From 458ea3ad033fc86e291712ce50cbe60c3428cf30 Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan@gerhold.net>
+Date: Wed, 6 Nov 2019 18:31:25 +0100
+Subject: regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+commit 458ea3ad033fc86e291712ce50cbe60c3428cf30 upstream.
+
+Those regulators are not actually supported by the AB8500 regulator
+driver. There is no ab8500_regulator_info for them and no entry in
+ab8505_regulator_match.
+
+As such, they cannot be registered successfully, and looking them
+up in ab8505_regulator_match causes an out-of-bounds array read.
+
+Fixes: 547f384f33db ("regulator: ab8500: add support for ab8505")
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20191106173125.14496-2-stephan@gerhold.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/regulator/ab8500.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/include/linux/regulator/ab8500.h
++++ b/include/linux/regulator/ab8500.h
+@@ -42,8 +42,6 @@ enum ab8505_regulator_id {
+ AB8505_LDO_ANAMIC2,
+ AB8505_LDO_AUX8,
+ AB8505_LDO_ANA,
+- AB8505_SYSCLKREQ_2,
+- AB8505_SYSCLKREQ_4,
+ AB8505_NUM_REGULATORS,
+ };
+
--- /dev/null
+From 394440d469413fa9b74f88a11f144d76017221f2 Mon Sep 17 00:00:00 2001
+From: Jeff Mahoney <jeffm@suse.com>
+Date: Wed, 15 Jan 2020 13:00:59 -0500
+Subject: reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
+
+From: Jeff Mahoney <jeffm@suse.com>
+
+commit 394440d469413fa9b74f88a11f144d76017221f2 upstream.
+
+Commit 60e4cf67a58 (reiserfs: fix extended attributes on the root
+directory) introduced a regression open_xa_root started returning
+-EOPNOTSUPP but it was not handled properly in reiserfs_for_each_xattr.
+
+When the reiserfs module is built without CONFIG_REISERFS_FS_XATTR,
+deleting an inode would result in a warning and chowning an inode
+would also result in a warning and then fail to complete.
+
+With CONFIG_REISERFS_FS_XATTR enabled, the xattr root would always be
+present for read-write operations.
+
+This commit handles -EOPNOSUPP in the same way -ENODATA is handled.
+
+Fixes: 60e4cf67a582 ("reiserfs: fix extended attributes on the root directory")
+CC: stable@vger.kernel.org # Commit 60e4cf67a58 was picked up by stable
+Link: https://lore.kernel.org/r/20200115180059.6935-1-jeffm@suse.com
+Reported-by: Michael Brunnbauer <brunni@netestate.de>
+Signed-off-by: Jeff Mahoney <jeffm@suse.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/reiserfs/xattr.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -319,8 +319,12 @@ static int reiserfs_for_each_xattr(struc
+ out_dir:
+ dput(dir);
+ out:
+- /* -ENODATA isn't an error */
+- if (err == -ENODATA)
++ /*
++ * -ENODATA: this object doesn't have any xattrs
++ * -EOPNOTSUPP: this file system doesn't have xattrs enabled on disk.
++ * Neither are errors
++ */
++ if (err == -ENODATA || err == -EOPNOTSUPP)
+ err = 0;
+ return err;
+ }
--- /dev/null
+From 18a0696e85fde169e0109aa61d0505b2b935b59d Mon Sep 17 00:00:00 2001
+From: Tzu-En Huang <tehuang@realtek.com>
+Date: Fri, 25 Oct 2019 17:33:44 +0800
+Subject: rtw88: fix potential read outside array boundary
+
+From: Tzu-En Huang <tehuang@realtek.com>
+
+commit 18a0696e85fde169e0109aa61d0505b2b935b59d upstream.
+
+The level of cckpd is from 0 to 4, and it is the index of
+array pd_lvl[] and cs_lvl[]. However, the length of both arrays
+are 4, which is smaller than the possible maximum input index.
+Enumerate cck level to make sure the max level will not be wrong
+if new level is added in future.
+
+Fixes: 479c4ee931a6 ("rtw88: add dynamic cck pd mechanism")
+Signed-off-by: Tzu-En Huang <tehuang@realtek.com>
+Signed-off-by: Yan-Hsuan Chuang <yhchuang@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/realtek/rtw88/phy.c | 17 ++++++++---------
+ drivers/net/wireless/realtek/rtw88/phy.h | 9 +++++++++
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 4 ++--
+ 3 files changed, 19 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -118,7 +118,7 @@ static void rtw_phy_cck_pd_init(struct r
+
+ for (i = 0; i <= RTW_CHANNEL_WIDTH_40; i++) {
+ for (j = 0; j < RTW_RF_PATH_MAX; j++)
+- dm_info->cck_pd_lv[i][j] = 0;
++ dm_info->cck_pd_lv[i][j] = CCK_PD_LV0;
+ }
+
+ dm_info->cck_fa_avg = CCK_FA_AVG_RESET;
+@@ -461,7 +461,6 @@ static void rtw_phy_dpk_track(struct rtw
+ chip->ops->dpk_track(rtwdev);
+ }
+
+-#define CCK_PD_LV_MAX 5
+ #define CCK_PD_FA_LV1_MIN 1000
+ #define CCK_PD_FA_LV0_MAX 500
+
+@@ -471,10 +470,10 @@ static u8 rtw_phy_cck_pd_lv_unlink(struc
+ u32 cck_fa_avg = dm_info->cck_fa_avg;
+
+ if (cck_fa_avg > CCK_PD_FA_LV1_MIN)
+- return 1;
++ return CCK_PD_LV1;
+
+ if (cck_fa_avg < CCK_PD_FA_LV0_MAX)
+- return 0;
++ return CCK_PD_LV0;
+
+ return CCK_PD_LV_MAX;
+ }
+@@ -494,15 +493,15 @@ static u8 rtw_phy_cck_pd_lv_link(struct
+ u32 cck_fa_avg = dm_info->cck_fa_avg;
+
+ if (igi > CCK_PD_IGI_LV4_VAL && rssi > CCK_PD_RSSI_LV4_VAL)
+- return 4;
++ return CCK_PD_LV4;
+ if (igi > CCK_PD_IGI_LV3_VAL && rssi > CCK_PD_RSSI_LV3_VAL)
+- return 3;
++ return CCK_PD_LV3;
+ if (igi > CCK_PD_IGI_LV2_VAL || rssi > CCK_PD_RSSI_LV2_VAL)
+- return 2;
++ return CCK_PD_LV2;
+ if (cck_fa_avg > CCK_PD_FA_LV1_MIN)
+- return 1;
++ return CCK_PD_LV1;
+ if (cck_fa_avg < CCK_PD_FA_LV0_MAX)
+- return 0;
++ return CCK_PD_LV0;
+
+ return CCK_PD_LV_MAX;
+ }
+--- a/drivers/net/wireless/realtek/rtw88/phy.h
++++ b/drivers/net/wireless/realtek/rtw88/phy.h
+@@ -125,6 +125,15 @@ rtw_get_tx_power_params(struct rtw_dev *
+ u8 rate, u8 bw, u8 ch, u8 regd,
+ struct rtw_power_params *pwr_param);
+
++enum rtw_phy_cck_pd_lv {
++ CCK_PD_LV0,
++ CCK_PD_LV1,
++ CCK_PD_LV2,
++ CCK_PD_LV3,
++ CCK_PD_LV4,
++ CCK_PD_LV_MAX,
++};
++
+ #define MASKBYTE0 0xff
+ #define MASKBYTE1 0xff00
+ #define MASKBYTE2 0xff0000
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -3168,8 +3168,8 @@ rtw8822c_phy_cck_pd_set_reg(struct rtw_d
+ static void rtw8822c_phy_cck_pd_set(struct rtw_dev *rtwdev, u8 new_lvl)
+ {
+ struct rtw_dm_info *dm_info = &rtwdev->dm_info;
+- s8 pd_lvl[4] = {2, 4, 6, 8};
+- s8 cs_lvl[4] = {2, 2, 2, 4};
++ s8 pd_lvl[CCK_PD_LV_MAX] = {0, 2, 4, 6, 8};
++ s8 cs_lvl[CCK_PD_LV_MAX] = {0, 2, 2, 2, 4};
+ u8 cur_lvl;
+ u8 nrx, bw;
+
--- /dev/null
+From 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Wed, 6 Nov 2019 20:32:21 +0800
+Subject: scsi: bnx2i: fix potential use after free
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 upstream.
+
+The member hba->pcidev may be used after its reference is dropped. Move the
+put function to where it is never used to avoid potential use after free
+issues.
+
+Fixes: a77171806515 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr")
+Link: https://lore.kernel.org/r/1573043541-19126-1-git-send-email-bianpan2016@163.com
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
+@@ -915,12 +915,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hb
+ INIT_LIST_HEAD(&hba->ep_ofld_list);
+ INIT_LIST_HEAD(&hba->ep_active_list);
+ INIT_LIST_HEAD(&hba->ep_destroy_list);
+- pci_dev_put(hba->pcidev);
+
+ if (hba->regview) {
+ pci_iounmap(hba->pcidev, hba->regview);
+ hba->regview = NULL;
+ }
++ pci_dev_put(hba->pcidev);
+ bnx2i_free_mp_bdt(hba);
+ bnx2i_release_free_cid_que(hba);
+ iscsi_host_free(shost);
--- /dev/null
+From b1335f5b0486f61fb66b123b40f8e7a98e49605d Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Fri, 1 Nov 2019 14:14:47 -0700
+Subject: scsi: core: scsi_trace: Use get_unaligned_be*()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit b1335f5b0486f61fb66b123b40f8e7a98e49605d upstream.
+
+This patch fixes an unintended sign extension on left shifts. From Colin
+King: "Shifting a u8 left will cause the value to be promoted to an
+integer. If the top bit of the u8 is set then the following conversion to
+an u64 will sign extend the value causing the upper 32 bits to be set in
+the result."
+
+Fix this by using get_unaligned_be*() instead.
+
+Fixes: bf8162354233 ("[SCSI] add scsi trace core functions and put trace points")
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Douglas Gilbert <dgilbert@interlog.com>
+Link: https://lore.kernel.org/r/20191101211447.187151-1-bvanassche@acm.org
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_trace.c | 103 ++++++++++++----------------------------------
+ 1 file changed, 28 insertions(+), 75 deletions(-)
+
+--- a/drivers/scsi/scsi_trace.c
++++ b/drivers/scsi/scsi_trace.c
+@@ -9,7 +9,7 @@
+ #include <trace/events/scsi.h>
+
+ #define SERVICE_ACTION16(cdb) (cdb[1] & 0x1f)
+-#define SERVICE_ACTION32(cdb) ((cdb[8] << 8) | cdb[9])
++#define SERVICE_ACTION32(cdb) (get_unaligned_be16(&cdb[8]))
+
+ static const char *
+ scsi_trace_misc(struct trace_seq *, unsigned char *, int);
+@@ -39,17 +39,12 @@ static const char *
+ scsi_trace_rw10(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- sector_t lba = 0, txlen = 0;
++ u32 lba, txlen;
+
+- lba |= (cdb[2] << 24);
+- lba |= (cdb[3] << 16);
+- lba |= (cdb[4] << 8);
+- lba |= cdb[5];
+- txlen |= (cdb[7] << 8);
+- txlen |= cdb[8];
++ lba = get_unaligned_be32(&cdb[2]);
++ txlen = get_unaligned_be16(&cdb[7]);
+
+- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+- (unsigned long long)lba, (unsigned long long)txlen,
++ trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen,
+ cdb[1] >> 5);
+
+ if (cdb[0] == WRITE_SAME)
+@@ -64,19 +59,12 @@ static const char *
+ scsi_trace_rw12(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- sector_t lba = 0, txlen = 0;
++ u32 lba, txlen;
+
+- lba |= (cdb[2] << 24);
+- lba |= (cdb[3] << 16);
+- lba |= (cdb[4] << 8);
+- lba |= cdb[5];
+- txlen |= (cdb[6] << 24);
+- txlen |= (cdb[7] << 16);
+- txlen |= (cdb[8] << 8);
+- txlen |= cdb[9];
++ lba = get_unaligned_be32(&cdb[2]);
++ txlen = get_unaligned_be32(&cdb[6]);
+
+- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+- (unsigned long long)lba, (unsigned long long)txlen,
++ trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen,
+ cdb[1] >> 5);
+ trace_seq_putc(p, 0);
+
+@@ -87,23 +75,13 @@ static const char *
+ scsi_trace_rw16(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- sector_t lba = 0, txlen = 0;
++ u64 lba;
++ u32 txlen;
+
+- lba |= ((u64)cdb[2] << 56);
+- lba |= ((u64)cdb[3] << 48);
+- lba |= ((u64)cdb[4] << 40);
+- lba |= ((u64)cdb[5] << 32);
+- lba |= (cdb[6] << 24);
+- lba |= (cdb[7] << 16);
+- lba |= (cdb[8] << 8);
+- lba |= cdb[9];
+- txlen |= (cdb[10] << 24);
+- txlen |= (cdb[11] << 16);
+- txlen |= (cdb[12] << 8);
+- txlen |= cdb[13];
++ lba = get_unaligned_be64(&cdb[2]);
++ txlen = get_unaligned_be32(&cdb[10]);
+
+- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+- (unsigned long long)lba, (unsigned long long)txlen,
++ trace_seq_printf(p, "lba=%llu txlen=%u protect=%u", lba, txlen,
+ cdb[1] >> 5);
+
+ if (cdb[0] == WRITE_SAME_16)
+@@ -118,8 +96,8 @@ static const char *
+ scsi_trace_rw32(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p), *cmd;
+- sector_t lba = 0, txlen = 0;
+- u32 ei_lbrt = 0;
++ u64 lba;
++ u32 ei_lbrt, txlen;
+
+ switch (SERVICE_ACTION32(cdb)) {
+ case READ_32:
+@@ -139,26 +117,12 @@ scsi_trace_rw32(struct trace_seq *p, uns
+ goto out;
+ }
+
+- lba |= ((u64)cdb[12] << 56);
+- lba |= ((u64)cdb[13] << 48);
+- lba |= ((u64)cdb[14] << 40);
+- lba |= ((u64)cdb[15] << 32);
+- lba |= (cdb[16] << 24);
+- lba |= (cdb[17] << 16);
+- lba |= (cdb[18] << 8);
+- lba |= cdb[19];
+- ei_lbrt |= (cdb[20] << 24);
+- ei_lbrt |= (cdb[21] << 16);
+- ei_lbrt |= (cdb[22] << 8);
+- ei_lbrt |= cdb[23];
+- txlen |= (cdb[28] << 24);
+- txlen |= (cdb[29] << 16);
+- txlen |= (cdb[30] << 8);
+- txlen |= cdb[31];
+-
+- trace_seq_printf(p, "%s_32 lba=%llu txlen=%llu protect=%u ei_lbrt=%u",
+- cmd, (unsigned long long)lba,
+- (unsigned long long)txlen, cdb[10] >> 5, ei_lbrt);
++ lba = get_unaligned_be64(&cdb[12]);
++ ei_lbrt = get_unaligned_be32(&cdb[20]);
++ txlen = get_unaligned_be32(&cdb[28]);
++
++ trace_seq_printf(p, "%s_32 lba=%llu txlen=%u protect=%u ei_lbrt=%u",
++ cmd, lba, txlen, cdb[10] >> 5, ei_lbrt);
+
+ if (SERVICE_ACTION32(cdb) == WRITE_SAME_32)
+ trace_seq_printf(p, " unmap=%u", cdb[10] >> 3 & 1);
+@@ -173,7 +137,7 @@ static const char *
+ scsi_trace_unmap(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p);
+- unsigned int regions = cdb[7] << 8 | cdb[8];
++ unsigned int regions = get_unaligned_be16(&cdb[7]);
+
+ trace_seq_printf(p, "regions=%u", (regions - 8) / 16);
+ trace_seq_putc(p, 0);
+@@ -185,8 +149,8 @@ static const char *
+ scsi_trace_service_action_in(struct trace_seq *p, unsigned char *cdb, int len)
+ {
+ const char *ret = trace_seq_buffer_ptr(p), *cmd;
+- sector_t lba = 0;
+- u32 alloc_len = 0;
++ u64 lba;
++ u32 alloc_len;
+
+ switch (SERVICE_ACTION16(cdb)) {
+ case SAI_READ_CAPACITY_16:
+@@ -200,21 +164,10 @@ scsi_trace_service_action_in(struct trac
+ goto out;
+ }
+
+- lba |= ((u64)cdb[2] << 56);
+- lba |= ((u64)cdb[3] << 48);
+- lba |= ((u64)cdb[4] << 40);
+- lba |= ((u64)cdb[5] << 32);
+- lba |= (cdb[6] << 24);
+- lba |= (cdb[7] << 16);
+- lba |= (cdb[8] << 8);
+- lba |= cdb[9];
+- alloc_len |= (cdb[10] << 24);
+- alloc_len |= (cdb[11] << 16);
+- alloc_len |= (cdb[12] << 8);
+- alloc_len |= cdb[13];
++ lba = get_unaligned_be64(&cdb[2]);
++ alloc_len = get_unaligned_be32(&cdb[10]);
+
+- trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd,
+- (unsigned long long)lba, alloc_len);
++ trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd, lba, alloc_len);
+
+ out:
+ trace_seq_putc(p, 0);
--- /dev/null
+From 906ca6353ac09696c1bf0892513c8edffff5e0a6 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 22 Oct 2019 13:23:24 +0300
+Subject: scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 906ca6353ac09696c1bf0892513c8edffff5e0a6 upstream.
+
+This error path is missing an unlock.
+
+Fixes: 26780d9e12ed ("[SCSI] esas2r: ATTO Technology ExpressSAS 6G SAS/SATA RAID Adapter Driver")
+Link: https://lore.kernel.org/r/20191022102324.GA27540@mwanda
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/esas2r/esas2r_flash.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/esas2r/esas2r_flash.c
++++ b/drivers/scsi/esas2r/esas2r_flash.c
+@@ -1197,6 +1197,7 @@ bool esas2r_nvram_read_direct(struct esa
+ if (!esas2r_read_flash_block(a, a->nvram, FLS_OFFSET_NVR,
+ sizeof(struct esas2r_sas_nvram))) {
+ esas2r_hdebug("NVRAM read failed, using defaults");
++ up(&a->nvram_semaphore);
+ return false;
+ }
+
--- /dev/null
+From 35160421b63d4753a72e9f72ebcdd9d6f88f84b9 Mon Sep 17 00:00:00 2001
+From: Xiang Chen <chenxiang66@hisilicon.com>
+Date: Thu, 24 Oct 2019 22:08:08 +0800
+Subject: scsi: hisi_sas: Don't create debugfs dump folder twice
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+commit 35160421b63d4753a72e9f72ebcdd9d6f88f84b9 upstream.
+
+Due to a merge error, we attempt to create 2x debugfs dump folders, which
+fails:
+[ 861.101914] debugfs: Directory 'dump' with parent '0000:74:02.0'
+already present!
+
+This breaks the dump function.
+
+To fix, remove the superfluous attempt to create the folder.
+
+Fixes: 7ec7082c57ec ("scsi: hisi_sas: Add hisi_sas_debugfs_alloc() to centralise allocation")
+Link: https://lore.kernel.org/r/1571926105-74636-2-git-send-email-john.garry@huawei.com
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/hisi_sas/hisi_sas_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
+@@ -3719,9 +3719,6 @@ static int hisi_sas_debugfs_alloc(struct
+ int p, c, d;
+ size_t sz;
+
+- hisi_hba->debugfs_dump_dentry =
+- debugfs_create_dir("dump", hisi_hba->debugfs_dir);
+-
+ sz = hw->debugfs_reg_array[DEBUGFS_GLOBAL]->count * 4;
+ hisi_hba->debugfs_regs[DEBUGFS_GLOBAL] =
+ devm_kmalloc(dev, sz, GFP_KERNEL);
--- /dev/null
+From 547fde8b5a1923050f388caae4f76613b5a620e0 Mon Sep 17 00:00:00 2001
+From: Xiang Chen <chenxiang66@hisilicon.com>
+Date: Tue, 12 Nov 2019 17:30:57 +0800
+Subject: scsi: hisi_sas: Return directly if init hardware failed
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+commit 547fde8b5a1923050f388caae4f76613b5a620e0 upstream.
+
+Need to return directly if init hardware failed.
+
+Fixes: 73a4925d154c ("scsi: hisi_sas: Update all the registers after suspend and resume")
+Link: https://lore.kernel.org/r/1573551059-107873-3-git-send-email-john.garry@huawei.com
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -3423,6 +3423,7 @@ static int hisi_sas_v3_resume(struct pci
+ if (rc) {
+ scsi_remove_host(shost);
+ pci_disable_device(pdev);
++ return rc;
+ }
+ hisi_hba->hw->phys_init(hisi_hba);
+ sas_resume_ha(sha);
--- /dev/null
+From 65a3b8bd56942dc988b8c05615bd3f510a10012b Mon Sep 17 00:00:00 2001
+From: Xiang Chen <chenxiang66@hisilicon.com>
+Date: Thu, 24 Oct 2019 22:08:09 +0800
+Subject: scsi: hisi_sas: Set the BIST init value before enabling BIST
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+commit 65a3b8bd56942dc988b8c05615bd3f510a10012b upstream.
+
+If set the BIST init value after enabling BIST, there may be still some few
+error bits. According to the process, need to set the BIST init value
+before enabling BIST.
+
+Fixes: 97b151e75861 ("scsi: hisi_sas: Add BIST support for phy loopback")
+Link: https://lore.kernel.org/r/1571926105-74636-3-git-send-email-john.garry@huawei.com
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+@@ -3022,11 +3022,6 @@ static int debugfs_set_bist_v3_hw(struct
+ hisi_sas_phy_write32(hisi_hba, phy_id,
+ SAS_PHY_BIST_CTRL, reg_val);
+
+- mdelay(100);
+- reg_val |= (CFG_RX_BIST_EN_MSK | CFG_TX_BIST_EN_MSK);
+- hisi_sas_phy_write32(hisi_hba, phy_id,
+- SAS_PHY_BIST_CTRL, reg_val);
+-
+ /* set the bist init value */
+ hisi_sas_phy_write32(hisi_hba, phy_id,
+ SAS_PHY_BIST_CODE,
+@@ -3035,6 +3030,11 @@ static int debugfs_set_bist_v3_hw(struct
+ SAS_PHY_BIST_CODE1,
+ SAS_PHY_BIST_CODE1_INIT);
+
++ mdelay(100);
++ reg_val |= (CFG_RX_BIST_EN_MSK | CFG_TX_BIST_EN_MSK);
++ hisi_sas_phy_write32(hisi_hba, phy_id,
++ SAS_PHY_BIST_CTRL, reg_val);
++
+ /* clear error bit */
+ mdelay(100);
+ hisi_sas_phy_read32(hisi_hba, phy_id, SAS_BIST_ERR_CNT);
--- /dev/null
+From 765ab6cdac3b681952da0e22184bf6cf1ae41cf8 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 6 Nov 2019 21:21:54 -0800
+Subject: scsi: lpfc: Fix a kernel warning triggered by lpfc_get_sgl_per_hdwq()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit 765ab6cdac3b681952da0e22184bf6cf1ae41cf8 upstream.
+
+Fix the following kernel bug report:
+
+BUG: using smp_processor_id() in preemptible [00000000] code: systemd-udevd/954
+
+Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.")
+Link: https://lore.kernel.org/r/20191107052158.25788-2-bvanassche@acm.org
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -20430,7 +20430,7 @@ lpfc_get_sgl_per_hdwq(struct lpfc_hba *p
+ /* allocate more */
+ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ tmp = kmalloc_node(sizeof(*tmp), GFP_ATOMIC,
+- cpu_to_node(smp_processor_id()));
++ cpu_to_node(raw_smp_processor_id()));
+ if (!tmp) {
+ lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+ "8353 error kmalloc memory for HDWQ "
+@@ -20573,7 +20573,7 @@ lpfc_get_cmd_rsp_buf_per_hdwq(struct lpf
+ /* allocate more */
+ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ tmp = kmalloc_node(sizeof(*tmp), GFP_ATOMIC,
+- cpu_to_node(smp_processor_id()));
++ cpu_to_node(raw_smp_processor_id()));
+ if (!tmp) {
+ lpfc_printf_log(phba, KERN_INFO, LOG_SLI,
+ "8355 error kmalloc memory for HDWQ "
--- /dev/null
+From 6f23f8c5c9f1be4eb17c035129c80e49000c18a7 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Mon, 11 Nov 2019 15:03:56 -0800
+Subject: scsi: lpfc: fix: Coverity: lpfc_get_scsi_buf_s3(): Null pointer dereferences
+
+From: James Smart <jsmart2021@gmail.com>
+
+commit 6f23f8c5c9f1be4eb17c035129c80e49000c18a7 upstream.
+
+Coverity reported the following:
+
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -719,7 +719,7 @@ lpfc_get_scsi_buf_s4(struct lpfc_hba *ph
+ iocb->ulpLe = 1;
+ iocb->ulpClass = CLASS3;
+
+- if (lpfc_ndlp_check_qdepth(phba, ndlp)) {
++ if (lpfc_ndlp_check_qdepth(phba, ndlp) && lpfc_cmd) {
+ atomic_inc(&ndlp->cmd_pending);
+ lpfc_cmd->flags |= LPFC_SBUF_BUMP_QDEPTH;
+ }
--- /dev/null
+From a4c21acca2be6729ecbe72eda9b08092725b0a77 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Sat, 21 Sep 2019 20:59:01 -0700
+Subject: scsi: lpfc: Fix hdwq sgl locks and irq handling
+
+From: James Smart <jsmart2021@gmail.com>
+
+commit a4c21acca2be6729ecbe72eda9b08092725b0a77 upstream.
+
+Many of the sgl-per-hdwq paths are locking with spin_lock_irq() and
+spin_unlock_irq() and may unwittingly raising irq when it shouldn't. Hard
+deadlocks were seen around lpfc_scsi_prep_cmnd().
+
+Fix by converting the locks to irqsave/irqrestore.
+
+Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.")
+Link: https://lore.kernel.org/r/20190922035906.10977-16-jsmart2021@gmail.com
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 38 ++++++++++++++++++++++----------------
+ 1 file changed, 22 insertions(+), 16 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -20414,8 +20414,9 @@ lpfc_get_sgl_per_hdwq(struct lpfc_hba *p
+ struct sli4_hybrid_sgl *allocated_sgl = NULL;
+ struct lpfc_sli4_hdw_queue *hdwq = lpfc_buf->hdwq;
+ struct list_head *buf_list = &hdwq->sgl_list;
++ unsigned long iflags;
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+
+ if (likely(!list_empty(buf_list))) {
+ /* break off 1 chunk from the sgl_list */
+@@ -20427,7 +20428,7 @@ lpfc_get_sgl_per_hdwq(struct lpfc_hba *p
+ }
+ } else {
+ /* allocate more */
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ tmp = kmalloc_node(sizeof(*tmp), GFP_ATOMIC,
+ cpu_to_node(smp_processor_id()));
+ if (!tmp) {
+@@ -20449,7 +20450,7 @@ lpfc_get_sgl_per_hdwq(struct lpfc_hba *p
+ return NULL;
+ }
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+ list_add_tail(&tmp->list_node, &lpfc_buf->dma_sgl_xtra_list);
+ }
+
+@@ -20457,7 +20458,7 @@ lpfc_get_sgl_per_hdwq(struct lpfc_hba *p
+ struct sli4_hybrid_sgl,
+ list_node);
+
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+
+ return allocated_sgl;
+ }
+@@ -20481,8 +20482,9 @@ lpfc_put_sgl_per_hdwq(struct lpfc_hba *p
+ struct sli4_hybrid_sgl *tmp = NULL;
+ struct lpfc_sli4_hdw_queue *hdwq = lpfc_buf->hdwq;
+ struct list_head *buf_list = &hdwq->sgl_list;
++ unsigned long iflags;
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+
+ if (likely(!list_empty(&lpfc_buf->dma_sgl_xtra_list))) {
+ list_for_each_entry_safe(list_entry, tmp,
+@@ -20495,7 +20497,7 @@ lpfc_put_sgl_per_hdwq(struct lpfc_hba *p
+ rc = -EINVAL;
+ }
+
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ return rc;
+ }
+
+@@ -20516,8 +20518,9 @@ lpfc_free_sgl_per_hdwq(struct lpfc_hba *
+ struct list_head *buf_list = &hdwq->sgl_list;
+ struct sli4_hybrid_sgl *list_entry = NULL;
+ struct sli4_hybrid_sgl *tmp = NULL;
++ unsigned long iflags;
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+
+ /* Free sgl pool */
+ list_for_each_entry_safe(list_entry, tmp,
+@@ -20529,7 +20532,7 @@ lpfc_free_sgl_per_hdwq(struct lpfc_hba *
+ kfree(list_entry);
+ }
+
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ }
+
+ /**
+@@ -20553,8 +20556,9 @@ lpfc_get_cmd_rsp_buf_per_hdwq(struct lpf
+ struct fcp_cmd_rsp_buf *allocated_buf = NULL;
+ struct lpfc_sli4_hdw_queue *hdwq = lpfc_buf->hdwq;
+ struct list_head *buf_list = &hdwq->cmd_rsp_buf_list;
++ unsigned long iflags;
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+
+ if (likely(!list_empty(buf_list))) {
+ /* break off 1 chunk from the list */
+@@ -20567,7 +20571,7 @@ lpfc_get_cmd_rsp_buf_per_hdwq(struct lpf
+ }
+ } else {
+ /* allocate more */
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ tmp = kmalloc_node(sizeof(*tmp), GFP_ATOMIC,
+ cpu_to_node(smp_processor_id()));
+ if (!tmp) {
+@@ -20594,7 +20598,7 @@ lpfc_get_cmd_rsp_buf_per_hdwq(struct lpf
+ tmp->fcp_rsp = (struct fcp_rsp *)((uint8_t *)tmp->fcp_cmnd +
+ sizeof(struct fcp_cmnd));
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+ list_add_tail(&tmp->list_node, &lpfc_buf->dma_cmd_rsp_list);
+ }
+
+@@ -20602,7 +20606,7 @@ lpfc_get_cmd_rsp_buf_per_hdwq(struct lpf
+ struct fcp_cmd_rsp_buf,
+ list_node);
+
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+
+ return allocated_buf;
+ }
+@@ -20627,8 +20631,9 @@ lpfc_put_cmd_rsp_buf_per_hdwq(struct lpf
+ struct fcp_cmd_rsp_buf *tmp = NULL;
+ struct lpfc_sli4_hdw_queue *hdwq = lpfc_buf->hdwq;
+ struct list_head *buf_list = &hdwq->cmd_rsp_buf_list;
++ unsigned long iflags;
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+
+ if (likely(!list_empty(&lpfc_buf->dma_cmd_rsp_list))) {
+ list_for_each_entry_safe(list_entry, tmp,
+@@ -20641,7 +20646,7 @@ lpfc_put_cmd_rsp_buf_per_hdwq(struct lpf
+ rc = -EINVAL;
+ }
+
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ return rc;
+ }
+
+@@ -20662,8 +20667,9 @@ lpfc_free_cmd_rsp_buf_per_hdwq(struct lp
+ struct list_head *buf_list = &hdwq->cmd_rsp_buf_list;
+ struct fcp_cmd_rsp_buf *list_entry = NULL;
+ struct fcp_cmd_rsp_buf *tmp = NULL;
++ unsigned long iflags;
+
+- spin_lock_irq(&hdwq->hdwq_lock);
++ spin_lock_irqsave(&hdwq->hdwq_lock, iflags);
+
+ /* Free cmd_rsp buf pool */
+ list_for_each_entry_safe(list_entry, tmp,
+@@ -20676,5 +20682,5 @@ lpfc_free_cmd_rsp_buf_per_hdwq(struct lp
+ kfree(list_entry);
+ }
+
+- spin_unlock_irq(&hdwq->hdwq_lock);
++ spin_unlock_irqrestore(&hdwq->hdwq_lock, iflags);
+ }
--- /dev/null
+From 35a635af54ce79881eb35ba20b64dcb1e81b0389 Mon Sep 17 00:00:00 2001
+From: James Smart <jsmart2021@gmail.com>
+Date: Sat, 21 Sep 2019 20:59:02 -0700
+Subject: scsi: lpfc: Fix list corruption detected in lpfc_put_sgl_per_hdwq
+
+From: James Smart <jsmart2021@gmail.com>
+
+commit 35a635af54ce79881eb35ba20b64dcb1e81b0389 upstream.
+
+In lpfc_release_io_buf, an lpfc_io_buf is returned to the 'available' pool
+before any associated sgl or cmd and rsp buffers are returned via their
+respective 'put' routines. If xri rebalancing occurs and an lpfc_io_buf
+structure is reused quickly, there may be a race condition between release
+of old and association of new resources.
+
+Re-ordered lpfc_release_io_buf to release sgl and cmd/rsp
+buffer lists before releasing the lpfc_io_buf structure for re-use.
+
+Fixes: d79c9e9d4b3d ("scsi: lpfc: Support dynamic unbounded SGL lists on G7 hardware.")
+Link: https://lore.kernel.org/r/20190922035906.10977-17-jsmart2021@gmail.com
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -20108,6 +20108,13 @@ void lpfc_release_io_buf(struct lpfc_hba
+ lpfc_ncmd->cur_iocbq.wqe_cmpl = NULL;
+ lpfc_ncmd->cur_iocbq.iocb_cmpl = NULL;
+
++ if (phba->cfg_xpsgl && !phba->nvmet_support &&
++ !list_empty(&lpfc_ncmd->dma_sgl_xtra_list))
++ lpfc_put_sgl_per_hdwq(phba, lpfc_ncmd);
++
++ if (!list_empty(&lpfc_ncmd->dma_cmd_rsp_list))
++ lpfc_put_cmd_rsp_buf_per_hdwq(phba, lpfc_ncmd);
++
+ if (phba->cfg_xri_rebalancing) {
+ if (lpfc_ncmd->expedite) {
+ /* Return to expedite pool */
+@@ -20172,13 +20179,6 @@ void lpfc_release_io_buf(struct lpfc_hba
+ spin_unlock_irqrestore(&qp->io_buf_list_put_lock,
+ iflag);
+ }
+-
+- if (phba->cfg_xpsgl && !phba->nvmet_support &&
+- !list_empty(&lpfc_ncmd->dma_sgl_xtra_list))
+- lpfc_put_sgl_per_hdwq(phba, lpfc_ncmd);
+-
+- if (!list_empty(&lpfc_ncmd->dma_cmd_rsp_list))
+- lpfc_put_cmd_rsp_buf_per_hdwq(phba, lpfc_ncmd);
+ }
+
+ /**
--- /dev/null
+From 45dc8f2d9c94ed74a5e31e63e9136a19a7e16081 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Thu, 21 Nov 2019 13:40:47 +0800
+Subject: scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
+
+From: Huacai Chen <chenhc@lemote.com>
+
+commit 45dc8f2d9c94ed74a5e31e63e9136a19a7e16081 upstream.
+
+Commit 4fa183455988 ("scsi: qla2xxx: Utilize pci_alloc_irq_vectors/
+pci_free_irq_vectors calls.") use pci_alloc_irq_vectors() to replace
+pci_enable_msi() but it didn't handle the return value correctly. This bug
+make qla2x00 always fail to setup MSI if MSI-X fail, so fix it.
+
+BTW, improve the log message of return value in qla2x00_request_irqs() to
+avoid confusion.
+
+Fixes: 4fa183455988 ("scsi: qla2xxx: Utilize pci_alloc_irq_vectors/pci_free_irq_vectors calls.")
+Cc: Michael Hernandez <michael.hernandez@cavium.com>
+Link: https://lore.kernel.org/r/1574314847-14280-1-git-send-email-chenhc@lemote.com
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3625,7 +3625,7 @@ qla2x00_request_irqs(struct qla_hw_data
+ skip_msix:
+
+ ql_log(ql_log_info, vha, 0x0037,
+- "Falling back-to MSI mode -%d.\n", ret);
++ "Falling back-to MSI mode -- ret=%d.\n", ret);
+
+ if (!IS_QLA24XX(ha) && !IS_QLA2532(ha) && !IS_QLA8432(ha) &&
+ !IS_QLA8001(ha) && !IS_P3P_TYPE(ha) && !IS_QLAFX00(ha) &&
+@@ -3633,13 +3633,13 @@ skip_msix:
+ goto skip_msi;
+
+ ret = pci_alloc_irq_vectors(ha->pdev, 1, 1, PCI_IRQ_MSI);
+- if (!ret) {
++ if (ret > 0) {
+ ql_dbg(ql_dbg_init, vha, 0x0038,
+ "MSI: Enabled.\n");
+ ha->flags.msi_enabled = 1;
+ } else
+ ql_log(ql_log_warn, vha, 0x0039,
+- "Falling back-to INTa mode -- %d.\n", ret);
++ "Falling back-to INTa mode -- ret=%d.\n", ret);
+ skip_msi:
+
+ /* Skip INTx on ISP82xx. */
--- /dev/null
+From d341e9a8f2cffe4000c610225c629f62c7489c74 Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Fri, 22 Nov 2019 22:19:22 +0000
+Subject: scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
+
+From: Martin Wilck <mwilck@suse.com>
+
+commit d341e9a8f2cffe4000c610225c629f62c7489c74 upstream.
+
+In qla2x00_find_all_fabric_devs(), fcport->flags & FCF_LOGIN_NEEDED is a
+necessary condition for logging into new rports, but not for dropping lost
+ones.
+
+Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery")
+Link: https://lore.kernel.org/r/20191122221912.20100-2-martin.wilck@suse.com
+Tested-by: David Bond <dbond@suse.com>
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla2xxx/qla_init.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -5891,8 +5891,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_ho
+ if (test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
+ break;
+
+- if ((fcport->flags & FCF_FABRIC_DEVICE) == 0 ||
+- (fcport->flags & FCF_LOGIN_NEEDED) == 0)
++ if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
+ continue;
+
+ if (fcport->scan_state == QLA_FCPORT_SCAN) {
+@@ -5915,7 +5914,8 @@ qla2x00_find_all_fabric_devs(scsi_qla_ho
+ }
+ }
+
+- if (fcport->scan_state == QLA_FCPORT_FOUND)
++ if (fcport->scan_state == QLA_FCPORT_FOUND &&
++ (fcport->flags & FCF_LOGIN_NEEDED) != 0)
+ qla24xx_fcport_handle_login(vha, fcport);
+ }
+ return (rval);
--- /dev/null
+From 3fe3d2428b62822b7b030577cd612790bdd8c941 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Tue, 5 Nov 2019 17:25:27 +0800
+Subject: scsi: qla4xxx: fix double free bug
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 3fe3d2428b62822b7b030577cd612790bdd8c941 upstream.
+
+The variable init_fw_cb is released twice, resulting in a double free
+bug. The call to the function dma_free_coherent() before goto is removed to
+get rid of potential double free.
+
+Fixes: 2a49a78ed3c8 ("[SCSI] qla4xxx: added IPv6 support.")
+Link: https://lore.kernel.org/r/1572945927-27796-1-git-send-email-bianpan2016@163.com
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Acked-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/qla4xxx/ql4_mbx.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/scsi/qla4xxx/ql4_mbx.c
++++ b/drivers/scsi/qla4xxx/ql4_mbx.c
+@@ -640,9 +640,6 @@ int qla4xxx_initialize_fw_cb(struct scsi
+
+ if (qla4xxx_get_ifcb(ha, &mbox_cmd[0], &mbox_sts[0], init_fw_cb_dma) !=
+ QLA_SUCCESS) {
+- dma_free_coherent(&ha->pdev->dev,
+- sizeof(struct addr_ctrl_blk),
+- init_fw_cb, init_fw_cb_dma);
+ goto exit_init_fw_cb;
+ }
+
--- /dev/null
+From 82ea3e0e129e2ab913dd6684bab7a6e5e9896dee Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Wed, 20 Nov 2019 17:39:15 +0800
+Subject: scsi: scsi_transport_sas: Fix memory leak when removing devices
+
+From: John Garry <john.garry@huawei.com>
+
+commit 82ea3e0e129e2ab913dd6684bab7a6e5e9896dee upstream.
+
+Removing a non-host rphy causes a memory leak:
+
+root@(none)$ echo 0 > /sys/devices/platform/HISI0162:01/host0/port-0:0/expander-0:0/port-0:0:10/phy-0:0:10/sas_phy/phy-0:0:10/enable
+[ 79.857888] hisi_sas_v2_hw HISI0162:01: dev[7:1] is gone
+root@(none)$ echo scan > /sys/kernel/debug/kmemleak
+[ 131.656603] kmemleak: 3 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
+root@(none)$ more /sys/kernel/debug/kmemleak
+unreferenced object 0xffff041da5c66000 (size 256):
+ comm "kworker/u128:1", pid 549, jiffies 4294898543 (age 113.728s)
+ hex dump (first 32 bytes):
+ 00 5e c6 a5 1d 04 ff ff 01 00 00 00 00 00 00 00 .^..............
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<(____ptrval____)>] kmem_cache_alloc+0x188/0x260
+ [<(____ptrval____)>] bsg_setup_queue+0x48/0x1a8
+ [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0
+ [<(____ptrval____)>] sas_probe_devices+0x168/0x208
+ [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8
+ [<(____ptrval____)>] process_one_work+0x3f8/0x690
+ [<(____ptrval____)>] worker_thread+0x70/0x6a0
+ [<(____ptrval____)>] kthread+0x1b8/0x1c0
+ [<(____ptrval____)>] ret_from_fork+0x10/0x18
+unreferenced object 0xffff041d8c075400 (size 128):
+ comm "kworker/u128:1", pid 549, jiffies 4294898543 (age 113.728s)
+ hex dump (first 32 bytes):
+ 00 40 25 97 1d 00 ff ff 00 00 00 00 00 00 00 00 .@%.............
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<(____ptrval____)>] __kmalloc_node+0x1a8/0x2c8
+ [<(____ptrval____)>] blk_mq_realloc_tag_set_tags.part.70+0x48/0xd8
+ [<(____ptrval____)>] blk_mq_alloc_tag_set+0x1dc/0x530
+ [<(____ptrval____)>] bsg_setup_queue+0xe8/0x1a8
+ [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0
+ [<(____ptrval____)>] sas_probe_devices+0x168/0x208
+ [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8
+ [<(____ptrval____)>] process_one_work+0x3f8/0x690
+ [<(____ptrval____)>] worker_thread+0x70/0x6a0
+ [<(____ptrval____)>] kthread+0x1b8/0x1c0
+ [<(____ptrval____)>] ret_from_fork+0x10/0x18
+unreferenced object 0xffff041da5c65e00 (size 256):
+ comm "kworker/u128:1", pid 549, jiffies 4294898543 (age 113.728s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<(____ptrval____)>] __kmalloc_node+0x1a8/0x2c8
+ [<(____ptrval____)>] blk_mq_alloc_tag_set+0x254/0x530
+ [<(____ptrval____)>] bsg_setup_queue+0xe8/0x1a8
+ [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0
+ [<(____ptrval____)>] sas_probe_devices+0x168/0x208
+ [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8
+ [<(____ptrval____)>] process_one_work+0x3f8/0x690
+ [<(____ptrval____)>] worker_thread+0x70/0x6a0
+ [<(____ptrval____)>] kthread+0x1b8/0x1c0
+ [<(____ptrval____)>] ret_from_fork+0x10/0x18
+root@(none)$
+
+It turns out that we don't clean up the request queue fully for bsg
+devices, as the blk mq tags for the request queue are not freed.
+
+Fix by doing the queue removal in one place - in sas_rphy_remove() -
+instead of unregistering the queue in sas_rphy_remove() and finally
+cleaning up the queue in calling blk_cleanup_queue() from
+sas_end_device_release() or sas_expander_release().
+
+Function bsg_remove_queue() can handle a NULL pointer q, so remove the
+precheck in sas_rphy_remove().
+
+Fixes: 651a013649943 ("scsi: scsi_transport_sas: switch to bsg-lib for SMP passthrough")
+Link: https://lore.kernel.org/r/1574242755-94156-1-git-send-email-john.garry@huawei.com
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_transport_sas.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/drivers/scsi/scsi_transport_sas.c
++++ b/drivers/scsi/scsi_transport_sas.c
+@@ -1391,9 +1391,6 @@ static void sas_expander_release(struct
+ struct sas_rphy *rphy = dev_to_rphy(dev);
+ struct sas_expander_device *edev = rphy_to_expander_device(rphy);
+
+- if (rphy->q)
+- blk_cleanup_queue(rphy->q);
+-
+ put_device(dev->parent);
+ kfree(edev);
+ }
+@@ -1403,9 +1400,6 @@ static void sas_end_device_release(struc
+ struct sas_rphy *rphy = dev_to_rphy(dev);
+ struct sas_end_device *edev = rphy_to_end_device(rphy);
+
+- if (rphy->q)
+- blk_cleanup_queue(rphy->q);
+-
+ put_device(dev->parent);
+ kfree(edev);
+ }
+@@ -1634,8 +1628,7 @@ sas_rphy_remove(struct sas_rphy *rphy)
+ }
+
+ sas_rphy_unlink(rphy);
+- if (rphy->q)
+- bsg_unregister_queue(rphy->q);
++ bsg_remove_queue(rphy->q);
+ transport_remove_device(dev);
+ device_del(dev);
+ }
--- /dev/null
+From c941e0d172605731de9b4628bd4146d35cf2e7d6 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Thu, 7 Nov 2019 13:55:25 -0800
+Subject: scsi: target: core: Fix a pr_debug() argument
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit c941e0d172605731de9b4628bd4146d35cf2e7d6 upstream.
+
+Print the string for which conversion failed instead of printing the
+function name twice.
+
+Fixes: 2650d71e244f ("target: move transport ID handling to the core")
+Cc: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20191107215525.64415-1-bvanassche@acm.org
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/target/target_core_fabric_lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/target/target_core_fabric_lib.c
++++ b/drivers/target/target_core_fabric_lib.c
+@@ -118,7 +118,7 @@ static int srp_get_pr_transport_id(
+ memset(buf + 8, 0, leading_zero_bytes);
+ rc = hex2bin(buf + 8 + leading_zero_bytes, p, count);
+ if (rc < 0) {
+- pr_debug("hex2bin failed for %s: %d\n", __func__, rc);
++ pr_debug("hex2bin failed for %s: %d\n", p, rc);
+ return rc;
+ }
+
mtd-cfi_cmdset_0002-fix-delayed-error-detection-on-hyperflash.patch
um-don-t-trace-irqflags-during-shutdown.patch
um-virtio_uml-disallow-modular-build.patch
+reiserfs-fix-handling-of-eopnotsupp-in-reiserfs_for_each_xattr.patch
+scsi-esas2r-unlock-on-error-in-esas2r_nvram_read_direct.patch
+scsi-hisi_sas-don-t-create-debugfs-dump-folder-twice.patch
+scsi-hisi_sas-set-the-bist-init-value-before-enabling-bist.patch
+scsi-qla4xxx-fix-double-free-bug.patch
+scsi-bnx2i-fix-potential-use-after-free.patch
+scsi-target-core-fix-a-pr_debug-argument.patch
+scsi-lpfc-fix-coverity-lpfc_get_scsi_buf_s3-null-pointer-dereferences.patch
+scsi-hisi_sas-return-directly-if-init-hardware-failed.patch
+scsi-scsi_transport_sas-fix-memory-leak-when-removing-devices.patch
+scsi-qla2xxx-fix-qla2x00_request_irqs-for-msi.patch
+scsi-qla2xxx-fix-rports-not-being-mark-as-lost-in-sync-fabric-scan.patch
+scsi-core-scsi_trace-use-get_unaligned_be.patch
+scsi-lpfc-fix-list-corruption-detected-in-lpfc_put_sgl_per_hdwq.patch
+scsi-lpfc-fix-hdwq-sgl-locks-and-irq-handling.patch
+scsi-lpfc-fix-a-kernel-warning-triggered-by-lpfc_get_sgl_per_hdwq.patch
+rtw88-fix-potential-read-outside-array-boundary.patch
+perf-probe-fix-wrong-address-verification.patch
+perf-script-allow-time-with-reltime.patch
+clk-sprd-use-is_err-to-validate-the-return-value-of-syscon_regmap_lookup_by_phandle.patch
+clk-imx7ulp-correct-system-clock-source-option-7.patch
+clk-imx7ulp-correct-ddr-clock-mux-options.patch
+regulator-ab8500-remove-sysclkreq-from-enum-ab8505_regulator_id.patch
+hwmon-pmbus-ibm-cffps-switch-leds-to-blocking-brightness-call.patch
+hwmon-pmbus-ibm-cffps-fix-led-blink-behavior.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
