--- /dev/null
+From 504bb2fe456a53bf2c03af14947c8104a4507960 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 14:26:15 +0530
+Subject: drm/msm/dsi: save pll state before dsi host is powered off
+
+From: Harigovindan P <harigovi@codeaurora.org>
+
+[ Upstream commit a1028dcfd0dd97884072288d0c8ed7f30399b528 ]
+
+Save pll state before dsi host is powered off. Without this change
+some register values gets resetted.
+
+Signed-off-by: Harigovindan P <harigovi@codeaurora.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_manager.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+index 10d49d43c17eb..d46b9e75a8473 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_manager.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+@@ -438,6 +438,7 @@ static void dsi_mgr_bridge_post_disable(struct drm_bridge *bridge)
+ struct msm_dsi *msm_dsi1 = dsi_mgr_get_dsi(DSI_1);
+ struct mipi_dsi_host *host = msm_dsi->host;
+ struct drm_panel *panel = msm_dsi->panel;
++ struct msm_dsi_pll *src_pll;
+ bool is_dual_dsi = IS_DUAL_DSI();
+ int ret;
+
+@@ -471,6 +472,10 @@ static void dsi_mgr_bridge_post_disable(struct drm_bridge *bridge)
+ id, ret);
+ }
+
++ /* Save PLL status if it is a clock source */
++ src_pll = msm_dsi_phy_get_pll(msm_dsi->phy);
++ msm_dsi_pll_save_state(src_pll);
++
+ ret = msm_dsi_host_power_off(host);
+ if (ret)
+ pr_err("%s: host %d power off failed,%d\n", __func__, id, ret);
+--
+2.20.1
+
--- /dev/null
+From 3578678fd1aa8c04ca27a825d544a49fa3530a20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 20:12:44 +0000
+Subject: drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
+
+From: John Stultz <john.stultz@linaro.org>
+
+[ Upstream commit 7fd2dfc3694922eb7ace4801b7208cf9f62ebc7d ]
+
+I was hitting kCFI crashes when building with clang, and after
+some digging finally narrowed it down to the
+dsi_mgr_connector_mode_valid() function being implemented as
+returning an int, instead of an enum drm_mode_status.
+
+This patch fixes it, and appeases the opaque word of the kCFI
+gods (seriously, clang inlining everything makes the kCFI
+backtraces only really rough estimates of where things went
+wrong).
+
+Thanks as always to Sami for his help narrowing this down.
+
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: Sean Paul <sean@poorly.run>
+Cc: Sami Tolvanen <samitolvanen@google.com>
+Cc: Todd Kjos <tkjos@google.com>
+Cc: Alistair Delva <adelva@google.com>
+Cc: Amit Pundir <amit.pundir@linaro.org>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Cc: freedreno@lists.freedesktop.org
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: John Stultz <john.stultz@linaro.org>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Tested-by: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+index c8d1f19c9a6d9..10d49d43c17eb 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_manager.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c
+@@ -306,7 +306,7 @@ static int dsi_mgr_connector_get_modes(struct drm_connector *connector)
+ return num;
+ }
+
+-static int dsi_mgr_connector_mode_valid(struct drm_connector *connector,
++static enum drm_mode_status dsi_mgr_connector_mode_valid(struct drm_connector *connector,
+ struct drm_display_mode *mode)
+ {
+ int id = dsi_mgr_connector_get_id(connector);
+--
+2.20.1
+
--- /dev/null
+From bae912011a25e0e6556eb97e77f3974bbcfb2501 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Feb 2020 17:54:18 +0100
+Subject: net: ks8851-ml: Fix 16-bit data access
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit edacb098ea9c31589276152f09b4439052c0f2b1 ]
+
+The packet data written to and read from Micrel KSZ8851-16MLLI must be
+byte-swapped in 16-bit mode, add this byte-swapping.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Lukas Wunner <lukas@wunner.de>
+Cc: Petr Stetiar <ynezz@true.cz>
+Cc: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 721f851674531..20356976b9772 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -515,7 +515,7 @@ static inline void ks_inblk(struct ks_net *ks, u16 *wptr, u32 len)
+ {
+ len >>= 1;
+ while (len--)
+- *wptr++ = (u16)ioread16(ks->hw_addr);
++ *wptr++ = be16_to_cpu(ioread16(ks->hw_addr));
+ }
+
+ /**
+@@ -529,7 +529,7 @@ static inline void ks_outblk(struct ks_net *ks, u16 *wptr, u32 len)
+ {
+ len >>= 1;
+ while (len--)
+- iowrite16(*wptr++, ks->hw_addr);
++ iowrite16(cpu_to_be16(*wptr++), ks->hw_addr);
+ }
+
+ static void ks_disable_int(struct ks_net *ks)
+--
+2.20.1
+
--- /dev/null
+From e01786339baf25b5af14d7957162235df20e79f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Feb 2020 17:54:19 +0100
+Subject: net: ks8851-ml: Fix 16-bit IO operation
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 58292104832fef6cb4a89f736012c0e0724c3442 ]
+
+The Micrel KSZ8851-16MLLI datasheet DS00002357B page 12 states that
+BE[3:0] signals are active high. This contradicts the measurements
+of the behavior of the actual chip, where these signals behave as
+active low. For example, to read the CIDER register, the bus must
+expose 0xc0c0 during the address phase, which means BE[3:0]=4'b1100.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Lukas Wunner <lukas@wunner.de>
+Cc: Petr Stetiar <ynezz@true.cz>
+Cc: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 20356976b9772..d94e151cff12b 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -484,7 +484,7 @@ static int msg_enable;
+
+ static u16 ks_rdreg16(struct ks_net *ks, int offset)
+ {
+- ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02));
++ ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02));
+ iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+ return ioread16(ks->hw_addr);
+ }
+@@ -499,7 +499,7 @@ static u16 ks_rdreg16(struct ks_net *ks, int offset)
+
+ static void ks_wrreg16(struct ks_net *ks, int offset, u16 value)
+ {
+- ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02));
++ ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02));
+ iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+ iowrite16(value, ks->hw_addr);
+ }
+--
+2.20.1
+
--- /dev/null
+From e26d6bf172053317f9d9d5e63b63de8aaf8994c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 15 Feb 2020 17:54:17 +0100
+Subject: net: ks8851-ml: Remove 8-bit bus accessors
+
+From: Marek Vasut <marex@denx.de>
+
+[ Upstream commit 69233bba6543a37755158ca3382765387b8078df ]
+
+This driver is mixing 8-bit and 16-bit bus accessors for reasons unknown,
+however the speculation is that this was some sort of attempt to support
+the 8-bit bus mode.
+
+As per the KS8851-16MLL documentation, all two registers accessed via the
+8-bit accessors are internally 16-bit registers, so reading them using
+16-bit accessors is fine. The KS_CCR read can be converted to 16-bit read
+outright, as it is already a concatenation of two 8-bit reads of that
+register. The KS_RXQCR accesses are 8-bit only, however writing the top
+8 bits of the register is OK as well, since the driver caches the entire
+16-bit register value anyway.
+
+Finally, the driver is not used by any hardware in the kernel right now.
+The only hardware available to me is one with 16-bit bus, so I have no
+way to test the 8-bit bus mode, however it is unlikely this ever really
+worked anyway. If the 8-bit bus mode is ever required, it can be easily
+added by adjusting the 16-bit accessors to do 2 consecutive accesses,
+which is how this should have been done from the beginning.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Lukas Wunner <lukas@wunner.de>
+Cc: Petr Stetiar <ynezz@true.cz>
+Cc: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/micrel/ks8851_mll.c | 45 +++---------------------
+ 1 file changed, 5 insertions(+), 40 deletions(-)
+
+diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
+index 8dc1f0277117d..721f851674531 100644
+--- a/drivers/net/ethernet/micrel/ks8851_mll.c
++++ b/drivers/net/ethernet/micrel/ks8851_mll.c
+@@ -474,24 +474,6 @@ static int msg_enable;
+ * chip is busy transferring packet data (RX/TX FIFO accesses).
+ */
+
+-/**
+- * ks_rdreg8 - read 8 bit register from device
+- * @ks : The chip information
+- * @offset: The register address
+- *
+- * Read a 8bit register from the chip, returning the result
+- */
+-static u8 ks_rdreg8(struct ks_net *ks, int offset)
+-{
+- u16 data;
+- u8 shift_bit = offset & 0x03;
+- u8 shift_data = (offset & 1) << 3;
+- ks->cmd_reg_cache = (u16) offset | (u16)(BE0 << shift_bit);
+- iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+- data = ioread16(ks->hw_addr);
+- return (u8)(data >> shift_data);
+-}
+-
+ /**
+ * ks_rdreg16 - read 16 bit register from device
+ * @ks : The chip information
+@@ -507,22 +489,6 @@ static u16 ks_rdreg16(struct ks_net *ks, int offset)
+ return ioread16(ks->hw_addr);
+ }
+
+-/**
+- * ks_wrreg8 - write 8bit register value to chip
+- * @ks: The chip information
+- * @offset: The register address
+- * @value: The value to write
+- *
+- */
+-static void ks_wrreg8(struct ks_net *ks, int offset, u8 value)
+-{
+- u8 shift_bit = (offset & 0x03);
+- u16 value_write = (u16)(value << ((offset & 1) << 3));
+- ks->cmd_reg_cache = (u16)offset | (BE0 << shift_bit);
+- iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd);
+- iowrite16(value_write, ks->hw_addr);
+-}
+-
+ /**
+ * ks_wrreg16 - write 16bit register value to chip
+ * @ks: The chip information
+@@ -642,8 +608,7 @@ static void ks_read_config(struct ks_net *ks)
+ u16 reg_data = 0;
+
+ /* Regardless of bus width, 8 bit read should always work.*/
+- reg_data = ks_rdreg8(ks, KS_CCR) & 0x00FF;
+- reg_data |= ks_rdreg8(ks, KS_CCR+1) << 8;
++ reg_data = ks_rdreg16(ks, KS_CCR);
+
+ /* addr/data bus are multiplexed */
+ ks->sharedbus = (reg_data & CCR_SHARED) == CCR_SHARED;
+@@ -747,7 +712,7 @@ static inline void ks_read_qmu(struct ks_net *ks, u16 *buf, u32 len)
+
+ /* 1. set sudo DMA mode */
+ ks_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI);
+- ks_wrreg8(ks, KS_RXQCR, (ks->rc_rxqcr | RXQCR_SDA) & 0xff);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+
+ /* 2. read prepend data */
+ /**
+@@ -764,7 +729,7 @@ static inline void ks_read_qmu(struct ks_net *ks, u16 *buf, u32 len)
+ ks_inblk(ks, buf, ALIGN(len, 4));
+
+ /* 4. reset sudo DMA Mode */
+- ks_wrreg8(ks, KS_RXQCR, ks->rc_rxqcr);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+ }
+
+ /**
+@@ -997,13 +962,13 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len)
+ ks->txh.txw[1] = cpu_to_le16(len);
+
+ /* 1. set sudo-DMA mode */
+- ks_wrreg8(ks, KS_RXQCR, (ks->rc_rxqcr | RXQCR_SDA) & 0xff);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+ /* 2. write status/lenth info */
+ ks_outblk(ks, ks->txh.txw, 4);
+ /* 3. write pkt data */
+ ks_outblk(ks, (u16 *)pdata, ALIGN(len, 4));
+ /* 4. reset sudo-DMA mode */
+- ks_wrreg8(ks, KS_RXQCR, ks->rc_rxqcr);
++ ks_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+ /* 5. Enqueue Tx(move the pkt from TX buffer into TXQ) */
+ ks_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+ /* 6. wait until TXQCR_METFE is auto-cleared */
+--
+2.20.1
+
--- /dev/null
+From 24683ceef3e764115c36c8928ff05e5d567a7599 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 08:48:55 +0300
+Subject: s390/cio: cio_ignore_proc_seq_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 8b101a5e14f2161869636ff9cb4907b7749dc0c2 ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Link: https://lore.kernel.org/r/d44c53a7-9bc1-15c7-6d4a-0c10cb9dffce@virtuozzo.com
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/cio/blacklist.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
+index 9082476b51db9..4e9f794176d35 100644
+--- a/drivers/s390/cio/blacklist.c
++++ b/drivers/s390/cio/blacklist.c
+@@ -302,8 +302,10 @@ static void *
+ cio_ignore_proc_seq_next(struct seq_file *s, void *it, loff_t *offset)
+ {
+ struct ccwdev_iter *iter;
++ loff_t p = *offset;
+
+- if (*offset >= (__MAX_SUBCHANNEL + 1) * (__MAX_SSID + 1))
++ (*offset)++;
++ if (p >= (__MAX_SUBCHANNEL + 1) * (__MAX_SSID + 1))
+ return NULL;
+ iter = it;
+ if (iter->devno == __MAX_SUBCHANNEL) {
+@@ -313,7 +315,6 @@ cio_ignore_proc_seq_next(struct seq_file *s, void *it, loff_t *offset)
+ return NULL;
+ } else
+ iter->devno++;
+- (*offset)++;
+ return iter;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 91b37189252c5a02f285195fa37e3ba34010d90e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 11:53:35 +0200
+Subject: serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit 87c5cbf71ecbb9e289d60a2df22eb686c70bf196 ]
+
+On AR934x this UART is usually not initialized by the bootloader
+as it is only used as a secondary serial port while the primary
+UART is a newly introduced NS16550-compatible.
+In order to make use of the ar933x-uart on AR934x without RTS/CTS
+hardware flow control, one needs to set the
+UART_CS_{RX,TX}_READY_ORIDE bits as other than on AR933x where this
+UART is used as primary/console, the bootloader on AR934x typically
+doesn't set those bits.
+Setting them explicitely on AR933x should not do any harm, so just
+set them unconditionally.
+
+Tested-by: Chuanhong Guo <gch981213@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://lore.kernel.org/r/20200207095335.GA179836@makrotopia.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/ar933x_uart.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/tty/serial/ar933x_uart.c b/drivers/tty/serial/ar933x_uart.c
+index d4462512605b5..246f4aab74075 100644
+--- a/drivers/tty/serial/ar933x_uart.c
++++ b/drivers/tty/serial/ar933x_uart.c
+@@ -289,6 +289,10 @@ static void ar933x_uart_set_termios(struct uart_port *port,
+ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
+ AR933X_UART_CS_HOST_INT_EN);
+
++ /* enable RX and TX ready overide */
++ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
++ AR933X_UART_CS_TX_READY_ORIDE | AR933X_UART_CS_RX_READY_ORIDE);
++
+ /* reenable the UART */
+ ar933x_uart_rmw(up, AR933X_UART_CS_REG,
+ AR933X_UART_CS_IF_MODE_M << AR933X_UART_CS_IF_MODE_S,
+@@ -421,6 +425,10 @@ static int ar933x_uart_startup(struct uart_port *port)
+ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
+ AR933X_UART_CS_HOST_INT_EN);
+
++ /* enable RX and TX ready overide */
++ ar933x_uart_rmw_set(up, AR933X_UART_CS_REG,
++ AR933X_UART_CS_TX_READY_ORIDE | AR933X_UART_CS_RX_READY_ORIDE);
++
+ /* Enable RX interrupts */
+ up->ier = AR933X_UART_INT_RX_VALID;
+ ar933x_uart_write(up, AR933X_UART_INT_EN_REG, up->ier);
+--
+2.20.1
+
mm-huge_memory.c-use-head-to-check-huge-zero-page.patch
audit-always-check-the-netlink-payload-length-in-aud.patch
vhost-check-docket-sk_family-instead-of-call-getname.patch
+serial-ar933x_uart-set-uart_cs_-rx-tx-_ready_oride.patch
+usb-gadget-composite-support-more-than-500ma-maxpowe.patch
+usb-gadget-ffs-ffs_aio_cancel-save-restore-irq-flags.patch
+usb-gadget-serial-fix-tx-stall-after-buffer-overflow.patch
+drm-msm-fix-return-type-of-dsi_mgr_connector_mode_va.patch
+drm-msm-dsi-save-pll-state-before-dsi-host-is-powere.patch
+net-ks8851-ml-remove-8-bit-bus-accessors.patch
+net-ks8851-ml-fix-16-bit-data-access.patch
+net-ks8851-ml-fix-16-bit-io-operation.patch
+watchdog-da9062-do-not-ping-the-hw-during-stop.patch
+s390-cio-cio_ignore_proc_seq_next-should-increase-po.patch
+x86-boot-compressed-don-t-declare-__force_order-in-k.patch
--- /dev/null
+From 35af34004b74f8a6e6e99e2de897dda3e78e1210 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 19:10:36 -0800
+Subject: usb: gadget: composite: Support more than 500mA MaxPower
+
+From: Jack Pham <jackp@codeaurora.org>
+
+[ Upstream commit a2035411fa1d1206cea7d5dfe833e78481844a76 ]
+
+USB 3.x SuperSpeed peripherals can draw up to 900mA of VBUS power
+when in configured state. However, if a configuration wanting to
+take advantage of this is added with MaxPower greater than 500
+(currently possible if using a ConfigFS gadget) the composite
+driver fails to accommodate this for a couple reasons:
+
+ - usb_gadget_vbus_draw() when called from set_config() and
+ composite_resume() will be passed the MaxPower value without
+ regard for the current connection speed, resulting in a
+ violation for USB 2.0 since the max is 500mA.
+
+ - the bMaxPower of the configuration descriptor would be
+ incorrectly encoded, again if the connection speed is only
+ at USB 2.0 or below, likely wrapping around U8_MAX since
+ the 2mA multiplier corresponds to a maximum of 510mA.
+
+Fix these by adding checks against the current gadget->speed
+when the c->MaxPower value is used (set_config() and
+composite_resume()) and appropriately limit based on whether
+it is currently at a low-/full-/high- or super-speed connection.
+
+Because 900 is not divisible by 8, with the round-up division
+currently used in encode_bMaxPower() a MaxPower of 900mA will
+result in an encoded value of 0x71. When a host stack (including
+Linux and Windows) enumerates this on a single port root hub, it
+reads this value back and decodes (multiplies by 8) to get 904mA
+which is strictly greater than 900mA that is typically budgeted
+for that port, causing it to reject the configuration. Instead,
+we should be using the round-down behavior of normal integral
+division so that 900 / 8 -> 0x70 or 896mA to stay within range.
+And we might as well change it for the high/full/low case as well
+for consistency.
+
+N.B. USB 3.2 Gen N x 2 allows for up to 1500mA but there doesn't
+seem to be any any peripheral controller supported by Linux that
+does two lane operation, so for now keeping the clamp at 900
+should be fine.
+
+Signed-off-by: Jack Pham <jackp@codeaurora.org>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/composite.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index 4d7df2f6caf5b..3a0452ff1a565 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -438,9 +438,13 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,
+ if (!val)
+ return 0;
+ if (speed < USB_SPEED_SUPER)
+- return DIV_ROUND_UP(val, 2);
++ return min(val, 500U) / 2;
+ else
+- return DIV_ROUND_UP(val, 8);
++ /*
++ * USB 3.x supports up to 900mA, but since 900 isn't divisible
++ * by 8 the integral division will effectively cap to 896mA.
++ */
++ return min(val, 900U) / 8;
+ }
+
+ static int config_buf(struct usb_configuration *config,
+@@ -833,6 +837,10 @@ static int set_config(struct usb_composite_dev *cdev,
+
+ /* when we return, be sure our power usage is valid */
+ power = c->MaxPower ? c->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
++ if (gadget->speed < USB_SPEED_SUPER)
++ power = min(power, 500U);
++ else
++ power = min(power, 900U);
+ done:
+ usb_gadget_vbus_draw(gadget, power);
+ if (result >= 0 && cdev->delayed_status)
+@@ -2272,7 +2280,7 @@ void composite_resume(struct usb_gadget *gadget)
+ {
+ struct usb_composite_dev *cdev = get_gadget_data(gadget);
+ struct usb_function *f;
+- u16 maxpower;
++ unsigned maxpower;
+
+ /* REVISIT: should we have config level
+ * suspend/resume callbacks?
+@@ -2286,10 +2294,14 @@ void composite_resume(struct usb_gadget *gadget)
+ f->resume(f);
+ }
+
+- maxpower = cdev->config->MaxPower;
++ maxpower = cdev->config->MaxPower ?
++ cdev->config->MaxPower : CONFIG_USB_GADGET_VBUS_DRAW;
++ if (gadget->speed < USB_SPEED_SUPER)
++ maxpower = min(maxpower, 500U);
++ else
++ maxpower = min(maxpower, 900U);
+
+- usb_gadget_vbus_draw(gadget, maxpower ?
+- maxpower : CONFIG_USB_GADGET_VBUS_DRAW);
++ usb_gadget_vbus_draw(gadget, maxpower);
+ }
+
+ cdev->suspended = 0;
+--
+2.20.1
+
--- /dev/null
+From faeb02990af8066f112d42bf0b8a383c8c50d85f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 15:29:01 +0200
+Subject: usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
+
+From: Lars-Peter Clausen <lars@metafoo.de>
+
+[ Upstream commit 43d565727a3a6fd24e37c7c2116475106af71806 ]
+
+ffs_aio_cancel() can be called from both interrupt and thread context. Make
+sure that the current IRQ state is saved and restored by using
+spin_{un,}lock_irq{save,restore}().
+
+Otherwise undefined behavior might occur.
+
+Acked-by: Michal Nazarewicz <mina86@mina86.com>
+Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_fs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index d1278d2d544b4..b5747f1270a6d 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1077,18 +1077,19 @@ static int ffs_aio_cancel(struct kiocb *kiocb)
+ {
+ struct ffs_io_data *io_data = kiocb->private;
+ struct ffs_epfile *epfile = kiocb->ki_filp->private_data;
++ unsigned long flags;
+ int value;
+
+ ENTER();
+
+- spin_lock_irq(&epfile->ffs->eps_lock);
++ spin_lock_irqsave(&epfile->ffs->eps_lock, flags);
+
+ if (likely(io_data && io_data->ep && io_data->req))
+ value = usb_ep_dequeue(io_data->ep, io_data->req);
+ else
+ value = -EINVAL;
+
+- spin_unlock_irq(&epfile->ffs->eps_lock);
++ spin_unlock_irqrestore(&epfile->ffs->eps_lock, flags);
+
+ return value;
+ }
+--
+2.20.1
+
--- /dev/null
+From 323ab4b0b573aca0627d6da9c90817469326bc7e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 14:21:46 +0300
+Subject: usb: gadget: serial: fix Tx stall after buffer overflow
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sergey Organov <sorganov@gmail.com>
+
+[ Upstream commit e4bfded56cf39b8d02733c1e6ef546b97961e18a ]
+
+Symptom: application opens /dev/ttyGS0 and starts sending (writing) to
+it while either USB cable is not connected, or nobody listens on the
+other side of the cable. If driver circular buffer overflows before
+connection is established, no data will be written to the USB layer
+until/unless /dev/ttyGS0 is closed and re-opened again by the
+application (the latter besides having no means of being notified about
+the event of establishing of the connection.)
+
+Fix: on open and/or connect, kick Tx to flush circular buffer data to
+USB layer.
+
+Signed-off-by: Sergey Organov <sorganov@gmail.com>
+Reviewed-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/u_serial.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
+index 510a54f889635..5d7d0f2e80a5e 100644
+--- a/drivers/usb/gadget/function/u_serial.c
++++ b/drivers/usb/gadget/function/u_serial.c
+@@ -715,8 +715,10 @@ static int gs_start_io(struct gs_port *port)
+ port->n_read = 0;
+ started = gs_start_rx(port);
+
+- /* unblock any pending writes into our circular buffer */
+ if (started) {
++ gs_start_tx(port);
++ /* Unblock any pending writes into our circular buffer, in case
++ * we didn't in gs_start_tx() */
+ tty_wakeup(port->port.tty);
+ } else {
+ gs_free_requests(ep, head, &port->read_allocated);
+--
+2.20.1
+
--- /dev/null
+From 94d48713f3358052f6daff29416849ff395a6d72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 10:17:29 +0100
+Subject: watchdog: da9062: do not ping the hw during stop()
+
+From: Marco Felsch <m.felsch@pengutronix.de>
+
+[ Upstream commit e9a0e65eda3f78d0b04ec6136c591c000cbc3b76 ]
+
+The da9062 hw has a minimum ping cool down phase of at least 200ms. The
+driver takes that into account by setting the min_hw_heartbeat_ms to
+300ms and the core guarantees that the hw limit is observed for the
+ping() calls. But the core can't guarantee the required minimum ping
+cool down phase if a stop() command is send immediately after the ping()
+command. So it is not allowed to ping the watchdog within the stop()
+command as the driver does. Remove the ping can be done without doubts
+because the watchdog gets disabled anyway and a (re)start resets the
+watchdog counter too.
+
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20200120091729.16256-1-m.felsch@pengutronix.de
+[groeck: Updated description]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/da9062_wdt.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/watchdog/da9062_wdt.c b/drivers/watchdog/da9062_wdt.c
+index 7386111220d58..daeb645fcea8a 100644
+--- a/drivers/watchdog/da9062_wdt.c
++++ b/drivers/watchdog/da9062_wdt.c
+@@ -126,13 +126,6 @@ static int da9062_wdt_stop(struct watchdog_device *wdd)
+ struct da9062_watchdog *wdt = watchdog_get_drvdata(wdd);
+ int ret;
+
+- ret = da9062_reset_watchdog_timer(wdt);
+- if (ret) {
+- dev_err(wdt->hw->dev, "Failed to ping the watchdog (err = %d)\n",
+- ret);
+- return ret;
+- }
+-
+ ret = regmap_update_bits(wdt->hw->regmap,
+ DA9062AA_CONTROL_D,
+ DA9062AA_TWDSCALE_MASK,
+--
+2.20.1
+
--- /dev/null
+From 7774f0458a4cc6c4600655aadf7b1d6a579a97b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 12:46:51 -0800
+Subject: x86/boot/compressed: Don't declare __force_order in kaslr_64.c
+
+From: H.J. Lu <hjl.tools@gmail.com>
+
+[ Upstream commit df6d4f9db79c1a5d6f48b59db35ccd1e9ff9adfc ]
+
+GCC 10 changed the default to -fno-common, which leads to
+
+ LD arch/x86/boot/compressed/vmlinux
+ ld: arch/x86/boot/compressed/pgtable_64.o:(.bss+0x0): multiple definition of `__force_order'; \
+ arch/x86/boot/compressed/kaslr_64.o:(.bss+0x0): first defined here
+ make[2]: *** [arch/x86/boot/compressed/Makefile:119: arch/x86/boot/compressed/vmlinux] Error 1
+
+Since __force_order is already provided in pgtable_64.c, there is no
+need to declare __force_order in kaslr_64.c.
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://lkml.kernel.org/r/20200124181811.4780-1-hjl.tools@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/boot/compressed/pagetable.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/x86/boot/compressed/pagetable.c b/arch/x86/boot/compressed/pagetable.c
+index 56589d0a804b1..2591f8f6d45f2 100644
+--- a/arch/x86/boot/compressed/pagetable.c
++++ b/arch/x86/boot/compressed/pagetable.c
+@@ -25,9 +25,6 @@
+ #define __PAGE_OFFSET __PAGE_OFFSET_BASE
+ #include "../../mm/ident_map.c"
+
+-/* Used by pgtable.h asm code to force instruction serialization. */
+-unsigned long __force_order;
+-
+ /* Used to track our page table allocation area. */
+ struct alloc_pgt_data {
+ unsigned char *pgt_buf;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
