--- /dev/null
+From 7e5894f0664fa07154cf90810dbc272bb1e212d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 14:27:54 -0600
+Subject: ACPI: button: Add DMI quirk for Razer Blade Stealth 13 late 2019 lid
+ switch
+
+From: Jason Ekstrand <jason@jlekstrand.net>
+
+[ Upstream commit 0528904926aab19bffb2068879aa44db166c6d5f ]
+
+Running evemu-record on the lid switch event shows that the lid reports
+the first "close" but then never reports an "open". This causes systemd
+to continuously re-suspend the laptop every 30s. Resetting the _LID to
+"open" fixes the issue.
+
+Signed-off-by: Jason Ekstrand <jason@jlekstrand.net>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/button.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
+index a25d77b3a16ad..d5c19e25ddf59 100644
+--- a/drivers/acpi/button.c
++++ b/drivers/acpi/button.c
+@@ -102,6 +102,17 @@ static const struct dmi_system_id lid_blacklst[] = {
+ },
+ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+ },
++ {
++ /*
++ * Razer Blade Stealth 13 late 2019, notification of the LID device
++ * only happens on close, not on open and _LID always returns closed.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Razer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Razer Blade Stealth 13 Late 2019"),
++ },
++ .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
++ },
+ {}
+ };
+
+--
+2.20.1
+
--- /dev/null
+From defd3244646d37e55c0d670bb9ee0ba953ba33fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jan 2020 20:14:11 +0800
+Subject: ACPI/IORT: Fix 'Number of IDs' handling in iort_id_map()
+
+From: Hanjun Guo <guohanjun@huawei.com>
+
+[ Upstream commit 3c23b83a88d00383e1d498cfa515249aa2fe0238 ]
+
+The IORT specification [0] (Section 3, table 4, page 9) defines the
+'Number of IDs' as 'The number of IDs in the range minus one'.
+
+However, the IORT ID mapping function iort_id_map() treats the 'Number
+of IDs' field as if it were the full IDs mapping count, with the
+following check in place to detect out of boundary input IDs:
+
+InputID >= Input base + Number of IDs
+
+This check is flawed in that it considers the 'Number of IDs' field as
+the full number of IDs mapping and disregards the 'minus one' from
+the IDs count.
+
+The correct check in iort_id_map() should be implemented as:
+
+InputID > Input base + Number of IDs
+
+this implements the specification correctly but unfortunately it breaks
+existing firmwares that erroneously set the 'Number of IDs' as the full
+IDs mapping count rather than IDs mapping count minus one.
+
+e.g.
+
+PCI hostbridge mapping entry 1:
+Input base: 0x1000
+ID Count: 0x100
+Output base: 0x1000
+Output reference: 0xC4 //ITS reference
+
+PCI hostbridge mapping entry 2:
+Input base: 0x1100
+ID Count: 0x100
+Output base: 0x2000
+Output reference: 0xD4 //ITS reference
+
+Two mapping entries which the second entry's Input base = the first
+entry's Input base + ID count, so for InputID 0x1100 and with the
+correct InputID check in place in iort_id_map() the kernel would map
+the InputID to ITS 0xC4 not 0xD4 as it would be expected.
+
+Therefore, to keep supporting existing flawed firmwares, introduce a
+workaround that instructs the kernel to use the old InputID range check
+logic in iort_id_map(), so that we can support both firmwares written
+with the flawed 'Number of IDs' logic and the correct one as defined in
+the specifications.
+
+[0]: http://infocenter.arm.com/help/topic/com.arm.doc.den0049d/DEN0049D_IO_Remapping_Table.pdf
+
+Reported-by: Pankaj Bansal <pankaj.bansal@nxp.com>
+Link: https://lore.kernel.org/linux-acpi/20191215203303.29811-1-pankaj.bansal@nxp.com/
+Signed-off-by: Hanjun Guo <guohanjun@huawei.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Pankaj Bansal <pankaj.bansal@nxp.com>
+Cc: Will Deacon <will@kernel.org>
+Cc: Sudeep Holla <sudeep.holla@arm.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/arm64/iort.c | 57 +++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 55 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c
+index e11b5da6f828f..7d86468300b78 100644
+--- a/drivers/acpi/arm64/iort.c
++++ b/drivers/acpi/arm64/iort.c
+@@ -306,6 +306,59 @@ out:
+ return status;
+ }
+
++struct iort_workaround_oem_info {
++ char oem_id[ACPI_OEM_ID_SIZE + 1];
++ char oem_table_id[ACPI_OEM_TABLE_ID_SIZE + 1];
++ u32 oem_revision;
++};
++
++static bool apply_id_count_workaround;
++
++static struct iort_workaround_oem_info wa_info[] __initdata = {
++ {
++ .oem_id = "HISI ",
++ .oem_table_id = "HIP07 ",
++ .oem_revision = 0,
++ }, {
++ .oem_id = "HISI ",
++ .oem_table_id = "HIP08 ",
++ .oem_revision = 0,
++ }
++};
++
++static void __init
++iort_check_id_count_workaround(struct acpi_table_header *tbl)
++{
++ int i;
++
++ for (i = 0; i < ARRAY_SIZE(wa_info); i++) {
++ if (!memcmp(wa_info[i].oem_id, tbl->oem_id, ACPI_OEM_ID_SIZE) &&
++ !memcmp(wa_info[i].oem_table_id, tbl->oem_table_id, ACPI_OEM_TABLE_ID_SIZE) &&
++ wa_info[i].oem_revision == tbl->oem_revision) {
++ apply_id_count_workaround = true;
++ pr_warn(FW_BUG "ID count for ID mapping entry is wrong, applying workaround\n");
++ break;
++ }
++ }
++}
++
++static inline u32 iort_get_map_max(struct acpi_iort_id_mapping *map)
++{
++ u32 map_max = map->input_base + map->id_count;
++
++ /*
++ * The IORT specification revision D (Section 3, table 4, page 9) says
++ * Number of IDs = The number of IDs in the range minus one, but the
++ * IORT code ignored the "minus one", and some firmware did that too,
++ * so apply a workaround here to keep compatible with both the spec
++ * compliant and non-spec compliant firmwares.
++ */
++ if (apply_id_count_workaround)
++ map_max--;
++
++ return map_max;
++}
++
+ static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
+ u32 *rid_out)
+ {
+@@ -322,8 +375,7 @@ static int iort_id_map(struct acpi_iort_id_mapping *map, u8 type, u32 rid_in,
+ return -ENXIO;
+ }
+
+- if (rid_in < map->input_base ||
+- (rid_in >= map->input_base + map->id_count))
++ if (rid_in < map->input_base || rid_in > iort_get_map_max(map))
+ return -ENXIO;
+
+ *rid_out = map->output_base + (rid_in - map->input_base);
+@@ -1542,5 +1594,6 @@ void __init acpi_iort_init(void)
+ return;
+ }
+
++ iort_check_id_count_workaround(iort_table);
+ iort_init_platform_devices();
+ }
+--
+2.20.1
+
--- /dev/null
+From b8176770140aa3f66a8c675f8f9c3277d55f4039 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 11:35:20 -0800
+Subject: ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1
+
+From: Erik Kaneda <erik.kaneda@intel.com>
+
+[ Upstream commit 5ddbd77181dfca61b16d2e2222382ea65637f1b9 ]
+
+ACPICA commit 29cc8dbc5463a93625bed87d7550a8bed8913bf4
+
+create_buffer_field is a deferred op that is typically processed in
+load pass 2. However, disassembly of control method contents walk the
+parse tree with ACPI_PARSE_LOAD_PASS1 and AML_CREATE operators are
+processed in a later walk. This is a problem when there is a control
+method that has the same name as the AML_CREATE object. In this case,
+any use of the name segment will be detected as a method call rather
+than a reference to a buffer field. If this is detected as a method
+call, it can result in a mal-formed parse tree if the control methods
+have parameters.
+
+This change in processing AML_CREATE ops earlier solves this issue by
+inserting the named object in the ACPI namespace so that references
+to this name would be detected as a name string rather than a method
+call.
+
+Link: https://github.com/acpica/acpica/commit/29cc8dbc
+Reported-by: Elia Geretto <elia.f.geretto@gmail.com>
+Tested-by: Elia Geretto <elia.f.geretto@gmail.com>
+Signed-off-by: Bob Moore <robert.moore@intel.com>
+Signed-off-by: Erik Kaneda <erik.kaneda@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpica/dsfield.c | 2 +-
+ drivers/acpi/acpica/dswload.c | 21 +++++++++++++++++++++
+ 2 files changed, 22 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/acpi/acpica/dsfield.c b/drivers/acpi/acpica/dsfield.c
+index 30fe89545d6ab..bcc6a7acc5762 100644
+--- a/drivers/acpi/acpica/dsfield.c
++++ b/drivers/acpi/acpica/dsfield.c
+@@ -244,7 +244,7 @@ cleanup:
+ * FUNCTION: acpi_ds_get_field_names
+ *
+ * PARAMETERS: info - create_field info structure
+- * ` walk_state - Current method state
++ * walk_state - Current method state
+ * arg - First parser arg for the field name list
+ *
+ * RETURN: Status
+diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c
+index d06c414462822..ba53662f12179 100644
+--- a/drivers/acpi/acpica/dswload.c
++++ b/drivers/acpi/acpica/dswload.c
+@@ -412,6 +412,27 @@ acpi_status acpi_ds_load1_end_op(struct acpi_walk_state *walk_state)
+ ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH, "Op=%p State=%p\n", op,
+ walk_state));
+
++ /*
++ * Disassembler: handle create field operators here.
++ *
++ * create_buffer_field is a deferred op that is typically processed in load
++ * pass 2. However, disassembly of control method contents walk the parse
++ * tree with ACPI_PARSE_LOAD_PASS1 and AML_CREATE operators are processed
++ * in a later walk. This is a problem when there is a control method that
++ * has the same name as the AML_CREATE object. In this case, any use of the
++ * name segment will be detected as a method call rather than a reference
++ * to a buffer field.
++ *
++ * This earlier creation during disassembly solves this issue by inserting
++ * the named object in the ACPI namespace so that references to this name
++ * would be a name string rather than a method call.
++ */
++ if ((walk_state->parse_flags & ACPI_PARSE_DISASSEMBLE) &&
++ (walk_state->op_info->flags & AML_CREATE)) {
++ status = acpi_ds_create_buffer_field(op, walk_state);
++ return_ACPI_STATUS(status);
++ }
++
+ /* We are only interested in opcodes that have an associated name */
+
+ if (!(walk_state->op_info->flags & (AML_NAMED | AML_FIELD))) {
+--
+2.20.1
+
--- /dev/null
+From 9e84082db9cc8cd9b3b5cdfa545c82d9ff5aa4f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 18:33:47 +0900
+Subject: ALSA: ctl: allow TLV read operation for callback type of element in
+ locked case
+
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+
+[ Upstream commit d61fe22c2ae42d9fd76c34ef4224064cca4b04b0 ]
+
+A design of ALSA control core allows applications to execute three
+operations for TLV feature; read, write and command. Furthermore, it
+allows driver developers to process the operations by two ways; allocated
+array or callback function. In the former, read operation is just allowed,
+thus developers uses the latter when device driver supports variety of
+models or the target model is expected to dynamically change information
+stored in TLV container.
+
+The core also allows applications to lock any element so that the other
+applications can't perform write operation to the element for element
+value and TLV information. When the element is locked, write and command
+operation for TLV information are prohibited as well as element value.
+Any read operation should be allowed in the case.
+
+At present, when an element has callback function for TLV information,
+TLV read operation returns EPERM if the element is locked. On the
+other hand, the read operation is success when an element has allocated
+array for TLV information. In both cases, read operation is success for
+element value expectedly.
+
+This commit fixes the bug. This change can be backported to v4.14
+kernel or later.
+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Link: https://lore.kernel.org/r/20191223093347.15279-1-o-takashi@sakamocchi.jp
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/control.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/control.c b/sound/core/control.c
+index 649d3217590ed..d1312f14d78fb 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1468,8 +1468,9 @@ static int call_tlv_handler(struct snd_ctl_file *file, int op_flag,
+ if (kctl->tlv.c == NULL)
+ return -ENXIO;
+
+- /* When locked, this is unavailable. */
+- if (vd->owner != NULL && vd->owner != file)
++ /* Write and command operations are not allowed for locked element. */
++ if (op_flag != SNDRV_CTL_TLV_OP_READ &&
++ vd->owner != NULL && vd->owner != file)
+ return -EPERM;
+
+ return kctl->tlv.c(kctl, op_flag, size, buf);
+--
+2.20.1
+
--- /dev/null
+From 1a4e81f48240361b73b91dafc6aa4b8c8f9f1351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 19:01:06 +0100
+Subject: ALSA: hda - Add docking station support for Lenovo Thinkpad T420s
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peter Große <pegro@friiks.de>
+
+[ Upstream commit ef7d84caa5928b40b1c93a26dbe5a3f12737c6ab ]
+
+Lenovo Thinkpad T420s uses the same codec as T420, so apply the
+same quirk to enable audio output on a docking station.
+
+Signed-off-by: Peter Große <pegro@friiks.de>
+Link: https://lore.kernel.org/r/20200122180106.9351-1-pegro@friiks.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 5500dd437b44d..78bb96263bc27 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -935,6 +935,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
++ SND_PCI_QUIRK(0x17aa, 0x21d2, "Lenovo T420s", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
+ SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
+--
+2.20.1
+
--- /dev/null
+From 59ddf6db33b6561412d9c8dbf09eab6f9741fe16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 18:01:17 +0200
+Subject: ALSA: hda/hdmi - add retry logic to parse_intel_hdmi()
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 2928fa0a97ebb9549cb877fdc99aed9b95438c3a ]
+
+The initial snd_hda_get_sub_node() can fail on certain
+devices (e.g. some Chromebook models using Intel GLK).
+The failure rate is very low, but as this is is part of
+the probe process, end-user impact is high.
+
+In observed cases, related hardware status registers have
+expected values, but the node query still fails. Retrying
+the node query does seem to help, so fix the problem by
+adding retry logic to the query. This does not impact
+non-Intel platforms.
+
+BugLink: https://github.com/thesofproject/linux/issues/1642
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Link: https://lore.kernel.org/r/20200120160117.29130-4-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index c827a2a89cc3d..c67fadd5aae53 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2604,9 +2604,12 @@ static int alloc_intel_hdmi(struct hda_codec *codec)
+ /* parse and post-process for Intel codecs */
+ static int parse_intel_hdmi(struct hda_codec *codec)
+ {
+- int err;
++ int err, retries = 3;
++
++ do {
++ err = hdmi_parse_codec(codec);
++ } while (err < 0 && retries--);
+
+- err = hdmi_parse_codec(codec);
+ if (err < 0) {
+ generic_spec_free(codec);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From db8195c8467adf10bf0c8ac3eec516a8c99a5604 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 Jan 2020 15:48:23 +0100
+Subject: ALSA: sh: Fix compile warning wrt const
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit f1dd4795b1523fbca7ab4344dd5a8bb439cc770d ]
+
+A long-standing compile warning was seen during build test:
+ sound/sh/aica.c: In function 'load_aica_firmware':
+ sound/sh/aica.c:521:25: warning: passing argument 2 of 'spu_memload' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
+
+Fixes: 198de43d758c ("[ALSA] Add ALSA support for the SEGA Dreamcast PCM device")
+Link: https://lore.kernel.org/r/20200105144823.29547-69-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/aica.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/sh/aica.c b/sound/sh/aica.c
+index ad3f71358486a..69ac44b335602 100644
+--- a/sound/sh/aica.c
++++ b/sound/sh/aica.c
+@@ -117,10 +117,10 @@ static void spu_memset(u32 toi, u32 what, int length)
+ }
+
+ /* spu_memload - write to SPU address space */
+-static void spu_memload(u32 toi, void *from, int length)
++static void spu_memload(u32 toi, const void *from, int length)
+ {
+ unsigned long flags;
+- u32 *froml = from;
++ const u32 *froml = from;
+ u32 __iomem *to = (u32 __iomem *) (SPU_MEMORY_BASE + toi);
+ int i;
+ u32 val;
+--
+2.20.1
+
--- /dev/null
+From f993997ca352ba4f3499750ba056f16c1e649078 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 12:00:57 +0100
+Subject: ALSA: sh: Fix unused variable warnings
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 5da116f164ce265e397b8f59af5c39e4a61d61a5 ]
+
+Remove unused variables that are left over after the conversion of new
+PCM ops:
+ sound/sh/sh_dac_audio.c:166:26: warning: unused variable 'runtime'
+ sound/sh/sh_dac_audio.c:186:26: warning: unused variable 'runtime'
+ sound/sh/sh_dac_audio.c:205:26: warning: unused variable 'runtime'
+
+Fixes: 1cc2f8ba0b3e ("ALSA: sh: Convert to the new PCM ops")
+Link: https://lore.kernel.org/r/20200104110057.13875-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/sh/sh_dac_audio.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/sound/sh/sh_dac_audio.c b/sound/sh/sh_dac_audio.c
+index 834b2574786f5..6251b5e1b64a2 100644
+--- a/sound/sh/sh_dac_audio.c
++++ b/sound/sh/sh_dac_audio.c
+@@ -190,7 +190,6 @@ static int snd_sh_dac_pcm_copy(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ if (copy_from_user_toio(chip->data_buffer + pos, src, count))
+ return -EFAULT;
+@@ -210,7 +209,6 @@ static int snd_sh_dac_pcm_copy_kernel(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ memcpy_toio(chip->data_buffer + pos, src, count);
+ chip->buffer_end = chip->data_buffer + pos + count;
+@@ -229,7 +227,6 @@ static int snd_sh_dac_pcm_silence(struct snd_pcm_substream *substream,
+ {
+ /* channel is not used (interleaved data) */
+ struct snd_sh_dac *chip = snd_pcm_substream_chip(substream);
+- struct snd_pcm_runtime *runtime = substream->runtime;
+
+ memset_io(chip->data_buffer + pos, 0, count);
+ chip->buffer_end = chip->data_buffer + pos + count;
+--
+2.20.1
+
--- /dev/null
+From 76905a4844a8ea8e599c219e53e140ff711196cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 20:42:57 -0700
+Subject: ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit df4654bd6e42125d9b85ce3a26eaca2935290b98 ]
+
+Clang warns:
+
+../sound/usb/usx2y/usX2Yhwdep.c:122:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ info->version = USX2Y_DRIVER_VERSION;
+ ^
+../sound/usb/usx2y/usX2Yhwdep.c:120:2: note: previous statement is here
+ if (us428->chip_status & USX2Y_STAT_CHIP_INIT)
+ ^
+1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+This was introduced before the beginning of git history so no fixes tag.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/831
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218034257.54535-1-natechancellor@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/usx2y/usX2Yhwdep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
+index c1dd9a7b48df6..36b3459703640 100644
+--- a/sound/usb/usx2y/usX2Yhwdep.c
++++ b/sound/usb/usx2y/usX2Yhwdep.c
+@@ -131,7 +131,7 @@ static int snd_usX2Y_hwdep_dsp_status(struct snd_hwdep *hw,
+ info->num_dsps = 2; // 0: Prepad Data, 1: FPGA Code
+ if (us428->chip_status & USX2Y_STAT_CHIP_INIT)
+ info->chip_ready = 1;
+- info->version = USX2Y_DRIVER_VERSION;
++ info->version = USX2Y_DRIVER_VERSION;
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c41d38294670511937af3de27b9d41ec6c69905e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 13:37:59 +0100
+Subject: ARM: 8951/1: Fix Kexec compilation issue.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit 76950f7162cad51d2200ebd22c620c14af38f718 ]
+
+To perform the reserve_crashkernel() operation kexec uses SECTION_SIZE to
+find a memblock in a range.
+SECTION_SIZE is not defined for nommu systems. Trying to compile kexec in
+these conditions results in a build error:
+
+ linux/arch/arm/kernel/setup.c: In function ‘reserve_crashkernel’:
+ linux/arch/arm/kernel/setup.c:1016:25: error: ‘SECTION_SIZE’ undeclared
+ (first use in this function); did you mean ‘SECTIONS_WIDTH’?
+ crash_size, SECTION_SIZE);
+ ^~~~~~~~~~~~
+ SECTIONS_WIDTH
+ linux/arch/arm/kernel/setup.c:1016:25: note: each undeclared identifier
+ is reported only once for each function it appears in
+ linux/scripts/Makefile.build:265: recipe for target 'arch/arm/kernel/setup.o'
+ failed
+
+Make KEXEC depend on MMU to fix the compilation issue.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 9f03befdfbf06..e2f7c50dbace5 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -2008,7 +2008,7 @@ config XIP_DEFLATED_DATA
+ config KEXEC
+ bool "Kexec system call (EXPERIMENTAL)"
+ depends on (!SMP || PM_SLEEP_SMP)
+- depends on !CPU_V7M
++ depends on MMU
+ select KEXEC_CORE
+ help
+ kexec is a system call that implements the ability to shutdown your
+--
+2.20.1
+
--- /dev/null
+From 472f841ed79aff063182178554ae4eb16f57e85c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 13:39:26 +0100
+Subject: ARM: 8952/1: Disable kmemleak on XIP kernels
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit bc420c6ceefbb86cbbc8c00061bd779c17fa6997 ]
+
+Kmemleak relies on specific symbols to register the read only data
+during init (e.g. __start_ro_after_init).
+Trying to build an XIP kernel on arm results in the linking error
+reported below because when this option is selected read only data
+after init are not allowed since .data is read only (.rodata).
+
+ arm-linux-gnueabihf-ld: mm/kmemleak.o: in function `kmemleak_init':
+ kmemleak.c:(.init.text+0x148): undefined reference to `__end_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x14c):
+ undefined reference to `__end_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x150):
+ undefined reference to `__start_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x156):
+ undefined reference to `__start_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x162):
+ undefined reference to `__start_ro_after_init'
+ arm-linux-gnueabihf-ld: kmemleak.c:(.init.text+0x16a):
+ undefined reference to `__start_ro_after_init'
+ linux/Makefile:1078: recipe for target 'vmlinux' failed
+
+Fix the issue enabling kmemleak only on non XIP kernels.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 185e552f14610..9f03befdfbf06 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -61,7 +61,7 @@ config ARM
+ select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32
+ select HAVE_CONTEXT_TRACKING
+ select HAVE_C_RECORDMCOUNT
+- select HAVE_DEBUG_KMEMLEAK
++ select HAVE_DEBUG_KMEMLEAK if !XIP_KERNEL
+ select HAVE_DMA_CONTIGUOUS if MMU
+ select HAVE_DYNAMIC_FTRACE if (!XIP_KERNEL) && !CPU_ENDIAN_BE32 && MMU
+ select HAVE_DYNAMIC_FTRACE_WITH_REGS if HAVE_DYNAMIC_FTRACE
+--
+2.20.1
+
--- /dev/null
+From 70da18e89361cabbaa88790ac37b1daa532bfcfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:35 +0000
+Subject: arm: dts: allwinner: H3: Add PMU node
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 0388a110747bec0c9d9de995842bb2a03a26aae1 ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H3
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core. The numbers come from the manual and have
+been checked in U-Boot and with perf in Linux.
+
+Tested with perf record and taskset on an OrangePi Zero.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3.dtsi | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
+index 9233ba30a857c..11172fbdc03aa 100644
+--- a/arch/arm/boot/dts/sun8i-h3.dtsi
++++ b/arch/arm/boot/dts/sun8i-h3.dtsi
+@@ -80,7 +80,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@1 {
++ cpu1: cpu@1 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <1>;
+@@ -90,7 +90,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@2 {
++ cpu2: cpu@2 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <2>;
+@@ -100,7 +100,7 @@
+ #cooling-cells = <2>;
+ };
+
+- cpu@3 {
++ cpu3: cpu@3 {
+ compatible = "arm,cortex-a7";
+ device_type = "cpu";
+ reg = <3>;
+@@ -111,6 +111,15 @@
+ };
+ };
+
++ pmu {
++ compatible = "arm,cortex-a7-pmu";
++ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++ };
++
+ timer {
+ compatible = "arm,armv7-timer";
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>,
+--
+2.20.1
+
--- /dev/null
+From 196f1381fda99978f0ff204155ac56c1b4441967 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 08:50:17 -0800
+Subject: ARM: dts: imx6: rdu2: Disable WP for USDHC2 and USDHC3
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit cd58a174e58649426fb43d7456e5f7d7eab58af1 ]
+
+RDU2 production units come with resistor connecting WP pin to
+correpsonding GPIO DNPed for both SD card slots. Drop any WP related
+configuration and mark both slots with "disable-wp".
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 315d0e7615f33..56d6e82b75337 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -657,7 +657,7 @@
+ pinctrl-0 = <&pinctrl_usdhc2>;
+ bus-width = <4>;
+ cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
+- wp-gpios = <&gpio2 3 GPIO_ACTIVE_HIGH>;
++ disable-wp;
+ vmmc-supply = <®_3p3v_sd>;
+ vqmmc-supply = <®_3p3v>;
+ no-1-8-v;
+@@ -670,7 +670,7 @@
+ pinctrl-0 = <&pinctrl_usdhc3>;
+ bus-width = <4>;
+ cd-gpios = <&gpio2 0 GPIO_ACTIVE_LOW>;
+- wp-gpios = <&gpio2 1 GPIO_ACTIVE_HIGH>;
++ disable-wp;
+ vmmc-supply = <®_3p3v_sd>;
+ vqmmc-supply = <®_3p3v>;
+ no-1-8-v;
+@@ -1081,7 +1081,6 @@
+ MX6QDL_PAD_SD2_DAT1__SD2_DATA1 0x17059
+ MX6QDL_PAD_SD2_DAT2__SD2_DATA2 0x17059
+ MX6QDL_PAD_SD2_DAT3__SD2_DATA3 0x17059
+- MX6QDL_PAD_NANDF_D3__GPIO2_IO03 0x40010040
+ MX6QDL_PAD_NANDF_D2__GPIO2_IO02 0x40010040
+ >;
+ };
+@@ -1094,7 +1093,6 @@
+ MX6QDL_PAD_SD3_DAT1__SD3_DATA1 0x17059
+ MX6QDL_PAD_SD3_DAT2__SD3_DATA2 0x17059
+ MX6QDL_PAD_SD3_DAT3__SD3_DATA3 0x17059
+- MX6QDL_PAD_NANDF_D1__GPIO2_IO01 0x40010040
+ MX6QDL_PAD_NANDF_D0__GPIO2_IO00 0x40010040
+
+ >;
+--
+2.20.1
+
--- /dev/null
+From fe252fdc328f6af03986be9ad4a6016b76d869b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 08:50:18 -0800
+Subject: ARM: dts: imx6: rdu2: Limit USBH1 to Full Speed
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit 6bb1e09c4c375db29770444f689f35f5cbe696bc ]
+
+Cabling used to connect devices to USBH1 on RDU2 does not meet USB
+spec cable quality and cable length requirements to operate at High
+Speed, so limit the port to Full Speed only.
+
+Reported-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Chris Healy <cphealy@gmail.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Cc: Fabio Estevam <festevam@gmail.com>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 56d6e82b75337..bc5f2de02d433 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -804,6 +804,7 @@
+ &usbh1 {
+ vbus-supply = <®_5p0v_main>;
+ disable-over-current;
++ maximum-speed = "full-speed";
+ status = "okay";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 82529dd01b079d4050e4d9870e90fca8ae445d5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 14:52:21 +0100
+Subject: ARM: dts: r8a7779: Add device node for ARM global timer
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 8443ffd1bbd5be74e9b12db234746d12e8ea93e2 ]
+
+Add a device node for the global timer, which is part of the Cortex-A9
+MPCore.
+
+The global timer can serve as an accurate (4 ns) clock source for
+scheduling and delay loops.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191211135222.26770-4-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7779.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi
+index 03919714645ae..f1c9b2bc542c5 100644
+--- a/arch/arm/boot/dts/r8a7779.dtsi
++++ b/arch/arm/boot/dts/r8a7779.dtsi
+@@ -68,6 +68,14 @@
+ <0xf0000100 0x100>;
+ };
+
++ timer@f0000200 {
++ compatible = "arm,cortex-a9-global-timer";
++ reg = <0xf0000200 0x100>;
++ interrupts = <GIC_PPI 11
++ (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
++ clocks = <&cpg_clocks R8A7779_CLK_ZS>;
++ };
++
+ timer@f0000600 {
+ compatible = "arm,cortex-a9-twd-timer";
+ reg = <0xf0000600 0x20>;
+--
+2.20.1
+
--- /dev/null
+From b556863cbea17940be85165d14f63283f4cceb84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 14:26:47 +0100
+Subject: ARM: dts: stm32: Add power-supply for DSI panel on stm32f469-disco
+
+From: Benjamin Gaignard <benjamin.gaignard@st.com>
+
+[ Upstream commit 0ff15a86d0c5a3f004fee2e92d65b88e56a3bc58 ]
+
+Add a fixed regulator and use it as power supply for DSI panel.
+
+Fixes: 18c8866266 ("ARM: dts: stm32: Add display support on stm32f469-disco")
+
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32f469-disco.dts | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/stm32f469-disco.dts b/arch/arm/boot/dts/stm32f469-disco.dts
+index 3ee768cb86fc9..eea979ef5512f 100644
+--- a/arch/arm/boot/dts/stm32f469-disco.dts
++++ b/arch/arm/boot/dts/stm32f469-disco.dts
+@@ -75,6 +75,13 @@
+ regulator-max-microvolt = <3300000>;
+ };
+
++ vdd_dsi: vdd-dsi {
++ compatible = "regulator-fixed";
++ regulator-name = "vdd_dsi";
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
++ };
++
+ soc {
+ dma-ranges = <0xc0000000 0x0 0x10000000>;
+ };
+@@ -154,6 +161,7 @@
+ compatible = "orisetech,otm8009a";
+ reg = <0>; /* dsi virtual channel (0..3) */
+ reset-gpios = <&gpioh 7 GPIO_ACTIVE_LOW>;
++ power-supply = <&vdd_dsi>;
+ status = "okay";
+
+ port {
+--
+2.20.1
+
--- /dev/null
+From 46d4e9efee7196cfa6e580b7b4528e8a35857cfd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 01:18:33 +0000
+Subject: arm64: dts: allwinner: H6: Add PMU mode
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 7aa9b9eb7d6a8fde7acbe0446444f7e3fae1fe3b ]
+
+Add the Performance Monitoring Unit (PMU) device tree node to the H6
+.dtsi, which tells DT users which interrupts are triggered by PMU
+overflow events on each core. The numbers come from the manual and have
+been checked in U-Boot and with perf in Linux.
+
+Tested with perf record and taskset on a Pine H64.
+
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+index 72813e7aefb8a..bd43912696111 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-h6.dtsi
+@@ -69,6 +69,16 @@
+ clock-output-names = "osc32k";
+ };
+
++ pmu {
++ compatible = "arm,cortex-a53-pmu",
++ "arm,armv8-pmuv3";
++ interrupts = <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-affinity = <&cpu0>, <&cpu1>, <&cpu2>, <&cpu3>;
++ };
++
+ psci {
+ compatible = "arm,psci-0.2";
+ method = "smc";
+--
+2.20.1
+
--- /dev/null
+From 8f22812342d5e0d4a1e0b7aae89f20c94155574b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 16:15:01 +0100
+Subject: arm64: dts: qcom: msm8996: Disable USB2 PHY suspend by core
+
+From: Manu Gautam <mgautam@codeaurora.org>
+
+[ Upstream commit d026c96b25b7ce5df89526aad2df988d553edb4d ]
+
+QUSB2 PHY on msm8996 doesn't work well when autosuspend by
+dwc3 core using USB2PHYCFG register is enabled. One of the
+issue seen is that PHY driver reports PLL lock failure and
+fails phy_init() if dwc3 core has USB2 PHY suspend enabled.
+Fix this by using quirks to disable USB2 PHY LPM/suspend and
+dwc3 core already takes care of explicitly suspending PHY
+during suspend if quirks are specified.
+
+Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
+Signed-off-by: Paolo Pisati <p.pisati@gmail.com>
+Link: https://lore.kernel.org/r/20191209151501.26993-1-p.pisati@gmail.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/msm8996.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+index 8c86c41a0d25f..3e7baabf64507 100644
+--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
+@@ -918,6 +918,8 @@
+ interrupts = <0 138 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&hsusb_phy2>;
+ phy-names = "usb2-phy";
++ snps,dis_u2_susphy_quirk;
++ snps,dis_enblslpm_quirk;
+ };
+ };
+
+@@ -947,6 +949,8 @@
+ interrupts = <0 131 IRQ_TYPE_LEVEL_HIGH>;
+ phys = <&hsusb_phy1>, <&ssusb_phy_0>;
+ phy-names = "usb2-phy", "usb3-phy";
++ snps,dis_u2_susphy_quirk;
++ snps,dis_enblslpm_quirk;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From c0b9451d1a92427271f4f40f8619ff2ebe4c6281 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 12:46:52 -0700
+Subject: arm64: fix alternatives with LLVM's integrated assembler
+
+From: Sami Tolvanen <samitolvanen@google.com>
+
+[ Upstream commit c54f90c2627cc316d365e3073614731e17dbc631 ]
+
+LLVM's integrated assembler fails with the following error when
+building KVM:
+
+ <inline asm>:12:6: error: expected absolute expression
+ .if kvm_update_va_mask == 0
+ ^
+ <inline asm>:21:6: error: expected absolute expression
+ .if kvm_update_va_mask == 0
+ ^
+ <inline asm>:24:2: error: unrecognized instruction mnemonic
+ NOT_AN_INSTRUCTION
+ ^
+ LLVM ERROR: Error parsing inline asm
+
+These errors come from ALTERNATIVE_CB and __ALTERNATIVE_CFG,
+which test for the existence of the callback parameter in inline
+assembly using the following expression:
+
+ " .if " __stringify(cb) " == 0\n"
+
+This works with GNU as, but isn't supported by LLVM. This change
+splits __ALTERNATIVE_CFG and ALTINSTR_ENTRY into separate macros
+to fix the LLVM build.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/472
+Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
+Tested-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/include/asm/alternative.h | 32 ++++++++++++++++++----------
+ 1 file changed, 21 insertions(+), 11 deletions(-)
+
+diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h
+index 4b650ec1d7dd1..887a8512bf10b 100644
+--- a/arch/arm64/include/asm/alternative.h
++++ b/arch/arm64/include/asm/alternative.h
+@@ -35,13 +35,16 @@ void apply_alternatives_module(void *start, size_t length);
+ static inline void apply_alternatives_module(void *start, size_t length) { }
+ #endif
+
+-#define ALTINSTR_ENTRY(feature,cb) \
++#define ALTINSTR_ENTRY(feature) \
+ " .word 661b - .\n" /* label */ \
+- " .if " __stringify(cb) " == 0\n" \
+ " .word 663f - .\n" /* new instruction */ \
+- " .else\n" \
++ " .hword " __stringify(feature) "\n" /* feature bit */ \
++ " .byte 662b-661b\n" /* source len */ \
++ " .byte 664f-663f\n" /* replacement len */
++
++#define ALTINSTR_ENTRY_CB(feature, cb) \
++ " .word 661b - .\n" /* label */ \
+ " .word " __stringify(cb) "- .\n" /* callback */ \
+- " .endif\n" \
+ " .hword " __stringify(feature) "\n" /* feature bit */ \
+ " .byte 662b-661b\n" /* source len */ \
+ " .byte 664f-663f\n" /* replacement len */
+@@ -62,15 +65,14 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ *
+ * Alternatives with callbacks do not generate replacement instructions.
+ */
+-#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled, cb) \
++#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled) \
+ ".if "__stringify(cfg_enabled)" == 1\n" \
+ "661:\n\t" \
+ oldinstr "\n" \
+ "662:\n" \
+ ".pushsection .altinstructions,\"a\"\n" \
+- ALTINSTR_ENTRY(feature,cb) \
++ ALTINSTR_ENTRY(feature) \
+ ".popsection\n" \
+- " .if " __stringify(cb) " == 0\n" \
+ ".pushsection .altinstr_replacement, \"a\"\n" \
+ "663:\n\t" \
+ newinstr "\n" \
+@@ -78,17 +80,25 @@ static inline void apply_alternatives_module(void *start, size_t length) { }
+ ".popsection\n\t" \
+ ".org . - (664b-663b) + (662b-661b)\n\t" \
+ ".org . - (662b-661b) + (664b-663b)\n" \
+- ".else\n\t" \
++ ".endif\n"
++
++#define __ALTERNATIVE_CFG_CB(oldinstr, feature, cfg_enabled, cb) \
++ ".if "__stringify(cfg_enabled)" == 1\n" \
++ "661:\n\t" \
++ oldinstr "\n" \
++ "662:\n" \
++ ".pushsection .altinstructions,\"a\"\n" \
++ ALTINSTR_ENTRY_CB(feature, cb) \
++ ".popsection\n" \
+ "663:\n\t" \
+ "664:\n\t" \
+- ".endif\n" \
+ ".endif\n"
+
+ #define _ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg, ...) \
+- __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg), 0)
++ __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg))
+
+ #define ALTERNATIVE_CB(oldinstr, cb) \
+- __ALTERNATIVE_CFG(oldinstr, "NOT_AN_INSTRUCTION", ARM64_CB_PATCH, 1, cb)
++ __ALTERNATIVE_CFG_CB(oldinstr, ARM64_CB_PATCH, 1, cb)
+ #else
+
+ #include <asm/assembler.h>
+--
+2.20.1
+
--- /dev/null
+From 6c8ad5dc6120257d88c8f35fa8b93eb4a134d71c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 21:32:42 +0800
+Subject: ASoC: atmel: fix build error with CONFIG_SND_ATMEL_SOC_DMA=m
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+[ Upstream commit 8fea78029f5e6ed734ae1957bef23cfda1af4354 ]
+
+If CONFIG_SND_ATMEL_SOC_DMA=m, build error:
+
+sound/soc/atmel/atmel_ssc_dai.o: In function `atmel_ssc_set_audio':
+(.text+0x7cd): undefined reference to `atmel_pcm_dma_platform_register'
+
+Function atmel_pcm_dma_platform_register is defined under
+CONFIG SND_ATMEL_SOC_DMA, so select SND_ATMEL_SOC_DMA in
+CONFIG SND_ATMEL_SOC_SSC, same to CONFIG_SND_ATMEL_SOC_PDC.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Link: https://lore.kernel.org/r/20200113133242.144550-1-chenzhou10@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/atmel/Kconfig | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/atmel/Kconfig b/sound/soc/atmel/Kconfig
+index 64b784e96f844..dad778e5884bd 100644
+--- a/sound/soc/atmel/Kconfig
++++ b/sound/soc/atmel/Kconfig
+@@ -25,6 +25,8 @@ config SND_ATMEL_SOC_DMA
+
+ config SND_ATMEL_SOC_SSC_DMA
+ tristate
++ select SND_ATMEL_SOC_DMA
++ select SND_ATMEL_SOC_PDC
+
+ config SND_ATMEL_SOC_SSC
+ tristate
+--
+2.20.1
+
--- /dev/null
+From 1781e087456d964da662ea073e571ceac9db3ff9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 12:42:28 +0530
+Subject: ath10k: Correct the DMA direction for management tx buffers
+
+From: Rakesh Pillai <pillair@codeaurora.org>
+
+[ Upstream commit 6ba8b3b6bd772f575f7736c8fd893c6981fcce16 ]
+
+The management packets, send to firmware via WMI, are
+mapped using the direction DMA_TO_DEVICE. Currently in
+case of wmi cleanup, these buffers are being unmapped
+using an incorrect DMA direction. This can cause unwanted
+behavior when the host driver is handling a restart
+of the wlan firmware.
+
+We might see a trace like below
+
+[<ffffff8008098b18>] __dma_inv_area+0x28/0x58
+[<ffffff8001176734>] ath10k_wmi_mgmt_tx_clean_up_pending+0x60/0xb0 [ath10k_core]
+[<ffffff80088c7c50>] idr_for_each+0x78/0xe4
+[<ffffff80011766a4>] ath10k_wmi_detach+0x4c/0x7c [ath10k_core]
+[<ffffff8001163d7c>] ath10k_core_stop+0x58/0x68 [ath10k_core]
+[<ffffff800114fb74>] ath10k_halt+0xec/0x13c [ath10k_core]
+[<ffffff8001165110>] ath10k_core_restart+0x11c/0x1a8 [ath10k_core]
+[<ffffff80080c36bc>] process_one_work+0x16c/0x31c
+
+Fix the incorrect DMA direction during the wmi
+management tx buffer cleanup.
+
+Tested HW: WCN3990
+Tested FW: WLAN.HL.3.1-00784-QCAHLSWMTPLZ-1
+
+Fixes: dc405152bb6 ("ath10k: handle mgmt tx completion event")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
+index 0f6ff7a78e49d..3372dfa0deccf 100644
+--- a/drivers/net/wireless/ath/ath10k/wmi.c
++++ b/drivers/net/wireless/ath/ath10k/wmi.c
+@@ -9193,7 +9193,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr,
+
+ msdu = pkt_addr->vaddr;
+ dma_unmap_single(ar->dev, pkt_addr->paddr,
+- msdu->len, DMA_FROM_DEVICE);
++ msdu->len, DMA_TO_DEVICE);
+ ieee80211_free_txskb(ar->hw, msdu);
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 3b0b8cc95aa2ae63f5069d49e3f9c2e3631db177 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:26 +0700
+Subject: b43legacy: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit 475eec112e4267232d10f4afe2f939a241692b6c ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/b43legacy/main.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43legacy/main.c b/drivers/net/wireless/broadcom/b43legacy/main.c
+index 55f411925960e..770cc218ca4bd 100644
+--- a/drivers/net/wireless/broadcom/b43legacy/main.c
++++ b/drivers/net/wireless/broadcom/b43legacy/main.c
+@@ -1304,8 +1304,9 @@ static void handle_irq_ucode_debug(struct b43legacy_wldev *dev)
+ }
+
+ /* Interrupt handler bottom-half */
+-static void b43legacy_interrupt_tasklet(struct b43legacy_wldev *dev)
++static void b43legacy_interrupt_tasklet(unsigned long data)
+ {
++ struct b43legacy_wldev *dev = (struct b43legacy_wldev *)data;
+ u32 reason;
+ u32 dma_reason[ARRAY_SIZE(dev->dma_reason)];
+ u32 merged_dma_reason = 0;
+@@ -3775,7 +3776,7 @@ static int b43legacy_one_core_attach(struct ssb_device *dev,
+ b43legacy_set_status(wldev, B43legacy_STAT_UNINIT);
+ wldev->bad_frames_preempt = modparam_bad_frames_preempt;
+ tasklet_init(&wldev->isr_tasklet,
+- (void (*)(unsigned long))b43legacy_interrupt_tasklet,
++ b43legacy_interrupt_tasklet,
+ (unsigned long)wldev);
+ if (modparam_pio)
+ wldev->__using_pio = true;
+--
+2.20.1
+
--- /dev/null
+From 4da671464b44495acd304552e9e2208c391e6508 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 01:01:26 +0800
+Subject: bcache: cached_dev_free needs to put the sb page
+
+From: Liang Chen <liangchen.linux@gmail.com>
+
+[ Upstream commit e8547d42095e58bee658f00fef8e33d2a185c927 ]
+
+Same as cache device, the buffer page needs to be put while
+freeing cached_dev. Otherwise a page would be leaked every
+time a cached_dev is stopped.
+
+Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/super.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index c45d9ad010770..5b5cbfadd003d 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1226,6 +1226,9 @@ static void cached_dev_free(struct closure *cl)
+
+ mutex_unlock(&bch_register_lock);
+
++ if (dc->sb_bio.bi_inline_vecs[0].bv_page)
++ put_page(bio_first_page_all(&dc->sb_bio));
++
+ if (!IS_ERR_OR_NULL(dc->bdev))
+ blkdev_put(dc->bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+
+--
+2.20.1
+
--- /dev/null
+From b57c523107c55ab2a7731644dfdbdbaa646cf8a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 22:42:32 +0800
+Subject: bcache: explicity type cast in bset_bkey_last()
+
+From: Coly Li <colyli@suse.de>
+
+[ Upstream commit 7c02b0055f774ed9afb6e1c7724f33bf148ffdc0 ]
+
+In bset.h, macro bset_bkey_last() is defined as,
+ bkey_idx((struct bkey *) (i)->d, (i)->keys)
+
+Parameter i can be variable type of data structure, the macro always
+works once the type of struct i has member 'd' and 'keys'.
+
+bset_bkey_last() is also used in macro csum_set() to calculate the
+checksum of a on-disk data structure. When csum_set() is used to
+calculate checksum of on-disk bcache super block, the parameter 'i'
+data type is struct cache_sb_disk. Inside struct cache_sb_disk (also in
+struct cache_sb) the member keys is __u16 type. But bkey_idx() expects
+unsigned int (a 32bit width), so there is problem when sending
+parameters via stack to call bkey_idx().
+
+Sparse tool from Intel 0day kbuild system reports this incompatible
+problem. bkey_idx() is part of user space API, so the simplest fix is
+to cast the (i)->keys to unsigned int type in macro bset_bkey_last().
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/bcache/bset.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h
+index c71365e7c1fac..a50dcfda656f5 100644
+--- a/drivers/md/bcache/bset.h
++++ b/drivers/md/bcache/bset.h
+@@ -397,7 +397,8 @@ void bch_btree_keys_stats(struct btree_keys *b, struct bset_stats *state);
+
+ /* Bkey utility code */
+
+-#define bset_bkey_last(i) bkey_idx((struct bkey *) (i)->d, (i)->keys)
++#define bset_bkey_last(i) bkey_idx((struct bkey *) (i)->d, \
++ (unsigned int)(i)->keys)
+
+ static inline struct bkey *bset_bkey_idx(struct bset *i, unsigned int idx)
+ {
+--
+2.20.1
+
--- /dev/null
+From 08e9198a76a5d25d2eedcbc090b0dadcf7da6439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 25 Jan 2020 12:10:02 +0300
+Subject: bpf: map_seq_next should always increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 90435a7891a2259b0f74c5a1bc5600d0d64cba8f ]
+
+If seq_file .next fuction does not change position index,
+read after some lseek can generate an unexpected output.
+
+See also: https://bugzilla.kernel.org/show_bug.cgi?id=206283
+
+v1 -> v2: removed missed increment in end of function
+
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/eca84fdd-c374-a154-d874-6c7b55fc3bc4@virtuozzo.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/inode.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index dc9d7ac8228db..c04815bb15cc1 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -198,6 +198,7 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ void *key = map_iter(m)->key;
+ void *prev_key;
+
++ (*pos)++;
+ if (map_iter(m)->done)
+ return NULL;
+
+@@ -210,8 +211,6 @@ static void *map_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ map_iter(m)->done = true;
+ return NULL;
+ }
+-
+- ++(*pos);
+ return key;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 998c2bc7f499fee150c681e411717a8df2896fae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 09:04:37 +0800
+Subject: bpf: Return -EBADRQC for invalid map type in __bpf_tx_xdp_map
+
+From: Li RongQing <lirongqing@baidu.com>
+
+[ Upstream commit 0a29275b6300f39f78a87f2038bbfe5bdbaeca47 ]
+
+A negative value should be returned if map->map_type is invalid
+although that is impossible now, but if we run into such situation
+in future, then xdpbuff could be leaked.
+
+Daniel Borkmann suggested:
+
+-EBADRQC should be returned to stay consistent with generic XDP
+for the tracepoint output and not to be confused with -EOPNOTSUPP
+from other locations like dev_map_enqueue() when ndo_xdp_xmit is
+missing and such.
+
+Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Li RongQing <lirongqing@baidu.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: https://lore.kernel.org/bpf/1578618277-18085-1-git-send-email-lirongqing@baidu.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/filter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 9daf1a4118b51..40b3af05c883c 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3207,7 +3207,7 @@ static int __bpf_tx_xdp_map(struct net_device *dev_rx, void *fwd,
+ return err;
+ }
+ default:
+- break;
++ return -EBADRQC;
+ }
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 5abe82fd5b7964c23f7084d42f64e2fa7c66dbc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 12:58:55 +0300
+Subject: brcmfmac: Fix use after free in brcmf_sdio_readframes()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]
+
+The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
+static checker warning:
+
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
+ error: dereferencing freed memory 'pkt'
+
+It looks like there was supposed to be a continue after we free "pkt".
+
+Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index 5c3b62e619807..e0211321fe9e8 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1934,6 +1934,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
+ BRCMF_SDIO_FT_NORMAL)) {
+ rd->len = 0;
+ brcmu_pkt_buf_free_skb(pkt);
++ continue;
+ }
+ bus->sdcnt.rx_readahead_cnt++;
+ if (rd->len != roundup(rd_new.len, 16)) {
+--
+2.20.1
+
--- /dev/null
+From 849ec06761cc3efcce75e720b6f21453b386cb2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Feb 2020 19:30:20 +0800
+Subject: brd: check and limit max_part par
+
+From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+
+[ Upstream commit c8ab422553c81a0eb070329c63725df1cd1425bc ]
+
+In brd_init func, rd_nr num of brd_device are firstly allocated
+and add in brd_devices, then brd_devices are traversed to add each
+brd_device by calling add_disk func. When allocating brd_device,
+the disk->first_minor is set to i * max_part, if rd_nr * max_part
+is larger than MINORMASK, two different brd_device may have the same
+devt, then only one of them can be successfully added.
+when rmmod brd.ko, it will cause oops when calling brd_exit.
+
+Follow those steps:
+ # modprobe brd rd_nr=3 rd_size=102400 max_part=1048576
+ # rmmod brd
+then, the oops will appear.
+
+Oops log:
+[ 726.613722] Call trace:
+[ 726.614175] kernfs_find_ns+0x24/0x130
+[ 726.614852] kernfs_find_and_get_ns+0x44/0x68
+[ 726.615749] sysfs_remove_group+0x38/0xb0
+[ 726.616520] blk_trace_remove_sysfs+0x1c/0x28
+[ 726.617320] blk_unregister_queue+0x98/0x100
+[ 726.618105] del_gendisk+0x144/0x2b8
+[ 726.618759] brd_exit+0x68/0x560 [brd]
+[ 726.619501] __arm64_sys_delete_module+0x19c/0x2a0
+[ 726.620384] el0_svc_common+0x78/0x130
+[ 726.621057] el0_svc_handler+0x38/0x78
+[ 726.621738] el0_svc+0x8/0xc
+[ 726.622259] Code: aa0203f6 aa0103f7 aa1e03e0 d503201f (7940e260)
+
+Here, we add brd_check_and_reset_par func to check and limit max_part par.
+
+--
+V5->V6:
+ - remove useless code
+
+V4->V5:(suggested by Ming Lei)
+ - make sure max_part is not larger than DISK_MAX_PARTS
+
+V3->V4:(suggested by Ming Lei)
+ - remove useless change
+ - add one limit of max_part
+
+V2->V3: (suggested by Ming Lei)
+ - clear .minors when running out of consecutive minor space in brd_alloc
+ - remove limit of rd_nr
+
+V1->V2:
+ - add more checks in brd_check_par_valid as suggested by Ming Lei.
+
+Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reviewed-by: Bob Liu <bob.liu@oracle.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/brd.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index 17defbf4f332c..02e8fff3f8283 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -463,6 +463,25 @@ static struct kobject *brd_probe(dev_t dev, int *part, void *data)
+ return kobj;
+ }
+
++static inline void brd_check_and_reset_par(void)
++{
++ if (unlikely(!max_part))
++ max_part = 1;
++
++ /*
++ * make sure 'max_part' can be divided exactly by (1U << MINORBITS),
++ * otherwise, it is possiable to get same dev_t when adding partitions.
++ */
++ if ((1U << MINORBITS) % max_part != 0)
++ max_part = 1UL << fls(max_part);
++
++ if (max_part > DISK_MAX_PARTS) {
++ pr_info("brd: max_part can't be larger than %d, reset max_part = %d.\n",
++ DISK_MAX_PARTS, DISK_MAX_PARTS);
++ max_part = DISK_MAX_PARTS;
++ }
++}
++
+ static int __init brd_init(void)
+ {
+ struct brd_device *brd, *next;
+@@ -486,8 +505,7 @@ static int __init brd_init(void)
+ if (register_blkdev(RAMDISK_MAJOR, "ramdisk"))
+ return -EIO;
+
+- if (unlikely(!max_part))
+- max_part = 1;
++ brd_check_and_reset_par();
+
+ for (i = 0; i < rd_nr; i++) {
+ brd = brd_alloc(i);
+--
+2.20.1
+
--- /dev/null
+From 4413bb962020a523c08d819f3048b57888c347fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 12:26:34 +0800
+Subject: btrfs: device stats, log when stats are zeroed
+
+From: Anand Jain <anand.jain@oracle.com>
+
+[ Upstream commit a69976bc69308aa475d0ba3b8b3efd1d013c0460 ]
+
+We had a report indicating that some read errors aren't reported by the
+device stats in the userland. It is important to have the errors
+reported in the device stat as user land scripts might depend on it to
+take the reasonable corrective actions. But to debug these issue we need
+to be really sure that request to reset the device stat did not come
+from the userland itself. So log an info message when device error reset
+happens.
+
+For example:
+ BTRFS info (device sdc): device stats zeroed by btrfs(9223)
+
+Reported-by: philip@philip-seeger.de
+Link: https://www.spinics.net/lists/linux-btrfs/msg96528.html
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Anand Jain <anand.jain@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/volumes.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 5bbcdcff68a9e..9c3b394b99fa2 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -7260,6 +7260,8 @@ int btrfs_get_dev_stats(struct btrfs_fs_info *fs_info,
+ else
+ btrfs_dev_stat_reset(dev, i);
+ }
++ btrfs_info(fs_info, "device stats zeroed by %s (%d)",
++ current->comm, task_pid_nr(current));
+ } else {
+ for (i = 0; i < BTRFS_DEV_STAT_VALUES_MAX; i++)
+ if (stats->nr_items > i)
+--
+2.20.1
+
--- /dev/null
+From 432f85b999b29cb2069d9414c2f654312a450ab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 14:19:57 +0100
+Subject: btrfs: fix possible NULL-pointer dereference in integrity checks
+
+From: Johannes Thumshirn <jth@kernel.org>
+
+[ Upstream commit 3dbd351df42109902fbcebf27104149226a4fcd9 ]
+
+A user reports a possible NULL-pointer dereference in
+btrfsic_process_superblock(). We are assigning state->fs_info to a local
+fs_info variable and afterwards checking for the presence of state.
+
+While we would BUG_ON() a NULL state anyways, we can also just remove
+the local fs_info copy, as fs_info is only used once as the first
+argument for btrfs_num_copies(). There we can just pass in
+state->fs_info as well.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205003
+Signed-off-by: Johannes Thumshirn <jth@kernel.org>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/check-integrity.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
+index 833cf3c35b4df..3b77c8ab5357e 100644
+--- a/fs/btrfs/check-integrity.c
++++ b/fs/btrfs/check-integrity.c
+@@ -629,7 +629,6 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(dev_t dev,
+ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ struct btrfs_fs_devices *fs_devices)
+ {
+- struct btrfs_fs_info *fs_info = state->fs_info;
+ struct btrfs_super_block *selected_super;
+ struct list_head *dev_head = &fs_devices->devices;
+ struct btrfs_device *device;
+@@ -700,7 +699,7 @@ static int btrfsic_process_superblock(struct btrfsic_state *state,
+ break;
+ }
+
+- num_copies = btrfs_num_copies(fs_info, next_bytenr,
++ num_copies = btrfs_num_copies(state->fs_info, next_bytenr,
+ state->metablock_size);
+ if (state->print_mask & BTRFSIC_PRINT_MASK_NUM_COPIES)
+ pr_info("num_copies(log_bytenr=%llu) = %d\n",
+--
+2.20.1
+
--- /dev/null
+From 8b0d047e6f0798391460353d734cff69d82b2082 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 15:29:53 +0100
+Subject: btrfs: safely advance counter when looking up bio csums
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 4babad10198fa73fe73239d02c2e99e3333f5f5c ]
+
+Dan's smatch tool reports
+
+ fs/btrfs/file-item.c:295 btrfs_lookup_bio_sums()
+ warn: should this be 'count == -1'
+
+which points to the while (count--) loop. With count == 0 the check
+itself could decrement it to -1. There's a WARN_ON a few lines below
+that has never been seen in practice though.
+
+It turns out that the value of page_bytes_left matches the count (by
+sectorsize multiples). The loop never reaches the state where count
+would go to -1, because page_bytes_left == 0 is found first and this
+breaks out.
+
+For clarity, use only plain check on count (and only for positive
+value), decrement safely inside the loop. Any other discrepancy after
+the whole bio list processing should be reported by the exising
+WARN_ON_ONCE as well.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file-item.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index 4cf2817ab1202..f9e280d0b44f3 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -275,7 +275,8 @@ found:
+ csum += count * csum_size;
+ nblocks -= count;
+ next:
+- while (count--) {
++ while (count > 0) {
++ count--;
+ disk_bytenr += fs_info->sectorsize;
+ offset += fs_info->sectorsize;
+ page_bytes_left -= fs_info->sectorsize;
+--
+2.20.1
+
--- /dev/null
+From 864e35f97e34ea11ae6fafe35c0d8e3491bd653e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 20:29:40 -0500
+Subject: ceph: check availability of mds cluster on mount after wait timeout
+
+From: Xiubo Li <xiubli@redhat.com>
+
+[ Upstream commit 97820058fb2831a4b203981fa2566ceaaa396103 ]
+
+If all the MDS daemons are down for some reason, then the first mount
+attempt will fail with EIO after the mount request times out. A mount
+attempt will also fail with EIO if all of the MDS's are laggy.
+
+This patch changes the code to return -EHOSTUNREACH in these situations
+and adds a pr_info error message to help the admin determine the cause.
+
+URL: https://tracker.ceph.com/issues/4386
+Signed-off-by: Xiubo Li <xiubli@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/mds_client.c | 3 +--
+ fs/ceph/super.c | 5 +++++
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 09db6d08614d2..a2e903203bf9f 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -2343,8 +2343,7 @@ static void __do_request(struct ceph_mds_client *mdsc,
+ if (!(mdsc->fsc->mount_options->flags &
+ CEPH_MOUNT_OPT_MOUNTWAIT) &&
+ !ceph_mdsmap_is_cluster_available(mdsc->mdsmap)) {
+- err = -ENOENT;
+- pr_info("probably no mds server is up\n");
++ err = -EHOSTUNREACH;
+ goto finish;
+ }
+ }
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index 2bd0b1ed9708e..c4314f4492401 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -1106,6 +1106,11 @@ static struct dentry *ceph_mount(struct file_system_type *fs_type,
+ return res;
+
+ out_splat:
++ if (!ceph_mdsmap_is_cluster_available(fsc->mdsc->mdsmap)) {
++ pr_info("No mds server is up or the cluster is laggy\n");
++ err = -EHOSTUNREACH;
++ }
++
+ ceph_mdsc_close_sessions(fsc->mdsc);
+ deactivate_locked_super(sb);
+ goto out_final;
+--
+2.20.1
+
--- /dev/null
+From 342c7374eb884f25a04045c15b75dda46847570c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 16:16:25 -0500
+Subject: char/random: silence a lockdep splat with printk()
+
+From: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+
+[ Upstream commit 1b710b1b10eff9d46666064ea25f079f70bc67a8 ]
+
+Sergey didn't like the locking order,
+
+uart_port->lock -> tty_port->lock
+
+uart_write (uart_port->lock)
+ __uart_start
+ pl011_start_tx
+ pl011_tx_chars
+ uart_write_wakeup
+ tty_port_tty_wakeup
+ tty_port_default
+ tty_port_tty_get (tty_port->lock)
+
+but those code is so old, and I have no clue how to de-couple it after
+checking other locks in the splat. There is an onging effort to make all
+printk() as deferred, so until that happens, workaround it for now as a
+short-term fix.
+
+LTP: starting iogen01 (export LTPROOT; rwtest -N iogen01 -i 120s -s
+read,write -Da -Dv -n 2 500b:$TMPDIR/doio.f1.$$
+1000b:$TMPDIR/doio.f2.$$)
+WARNING: possible circular locking dependency detected
+------------------------------------------------------
+doio/49441 is trying to acquire lock:
+ffff008b7cff7290 (&(&zone->lock)->rlock){..-.}, at: rmqueue+0x138/0x2050
+
+but task is already holding lock:
+60ff000822352818 (&pool->lock/1){-.-.}, at: start_flush_work+0xd8/0x3f0
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #4 (&pool->lock/1){-.-.}:
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ __queue_work+0x4b4/0xa10
+ queue_work_on+0xac/0x11c
+ tty_schedule_flip+0x84/0xbc
+ tty_flip_buffer_push+0x1c/0x28
+ pty_write+0x98/0xd0
+ n_tty_write+0x450/0x60c
+ tty_write+0x338/0x474
+ __vfs_write+0x88/0x214
+ vfs_write+0x12c/0x1a4
+ redirected_tty_write+0x90/0xdc
+ do_loop_readv_writev+0x140/0x180
+ do_iter_write+0xe0/0x10c
+ vfs_writev+0x134/0x1cc
+ do_writev+0xbc/0x130
+ __arm64_sys_writev+0x58/0x8c
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+ -> #3 (&(&port->lock)->rlock){-.-.}:
+ lock_acquire+0x320/0x360
+ _raw_spin_lock_irqsave+0x7c/0x9c
+ tty_port_tty_get+0x24/0x60
+ tty_port_default_wakeup+0x1c/0x3c
+ tty_port_tty_wakeup+0x34/0x40
+ uart_write_wakeup+0x28/0x44
+ pl011_tx_chars+0x1b8/0x270
+ pl011_start_tx+0x24/0x70
+ __uart_start+0x5c/0x68
+ uart_write+0x164/0x1c8
+ do_output_char+0x33c/0x348
+ n_tty_write+0x4bc/0x60c
+ tty_write+0x338/0x474
+ redirected_tty_write+0xc0/0xdc
+ do_loop_readv_writev+0x140/0x180
+ do_iter_write+0xe0/0x10c
+ vfs_writev+0x134/0x1cc
+ do_writev+0xbc/0x130
+ __arm64_sys_writev+0x58/0x8c
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+ -> #2 (&port_lock_key){-.-.}:
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ pl011_console_write+0xec/0x2cc
+ console_unlock+0x794/0x96c
+ vprintk_emit+0x260/0x31c
+ vprintk_default+0x54/0x7c
+ vprintk_func+0x218/0x254
+ printk+0x7c/0xa4
+ register_console+0x734/0x7b0
+ uart_add_one_port+0x734/0x834
+ pl011_register_port+0x6c/0xac
+ sbsa_uart_probe+0x234/0x2ec
+ platform_drv_probe+0xd4/0x124
+ really_probe+0x250/0x71c
+ driver_probe_device+0xb4/0x200
+ __device_attach_driver+0xd8/0x188
+ bus_for_each_drv+0xbc/0x110
+ __device_attach+0x120/0x220
+ device_initial_probe+0x20/0x2c
+ bus_probe_device+0x54/0x100
+ device_add+0xae8/0xc2c
+ platform_device_add+0x278/0x3b8
+ platform_device_register_full+0x238/0x2ac
+ acpi_create_platform_device+0x2dc/0x3a8
+ acpi_bus_attach+0x390/0x3cc
+ acpi_bus_attach+0x108/0x3cc
+ acpi_bus_attach+0x108/0x3cc
+ acpi_bus_attach+0x108/0x3cc
+ acpi_bus_scan+0x7c/0xb0
+ acpi_scan_init+0xe4/0x304
+ acpi_init+0x100/0x114
+ do_one_initcall+0x348/0x6a0
+ do_initcall_level+0x190/0x1fc
+ do_basic_setup+0x34/0x4c
+ kernel_init_freeable+0x19c/0x260
+ kernel_init+0x18/0x338
+ ret_from_fork+0x10/0x18
+
+ -> #1 (console_owner){-...}:
+ lock_acquire+0x320/0x360
+ console_lock_spinning_enable+0x6c/0x7c
+ console_unlock+0x4f8/0x96c
+ vprintk_emit+0x260/0x31c
+ vprintk_default+0x54/0x7c
+ vprintk_func+0x218/0x254
+ printk+0x7c/0xa4
+ get_random_u64+0x1c4/0x1dc
+ shuffle_pick_tail+0x40/0xac
+ __free_one_page+0x424/0x710
+ free_one_page+0x70/0x120
+ __free_pages_ok+0x61c/0xa94
+ __free_pages_core+0x1bc/0x294
+ memblock_free_pages+0x38/0x48
+ __free_pages_memory+0xcc/0xfc
+ __free_memory_core+0x70/0x78
+ free_low_memory_core_early+0x148/0x18c
+ memblock_free_all+0x18/0x54
+ mem_init+0xb4/0x17c
+ mm_init+0x14/0x38
+ start_kernel+0x19c/0x530
+
+ -> #0 (&(&zone->lock)->rlock){..-.}:
+ validate_chain+0xf6c/0x2e2c
+ __lock_acquire+0x868/0xc2c
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ rmqueue+0x138/0x2050
+ get_page_from_freelist+0x474/0x688
+ __alloc_pages_nodemask+0x3b4/0x18dc
+ alloc_pages_current+0xd0/0xe0
+ alloc_slab_page+0x2b4/0x5e0
+ new_slab+0xc8/0x6bc
+ ___slab_alloc+0x3b8/0x640
+ kmem_cache_alloc+0x4b4/0x588
+ __debug_object_init+0x778/0x8b4
+ debug_object_init_on_stack+0x40/0x50
+ start_flush_work+0x16c/0x3f0
+ __flush_work+0xb8/0x124
+ flush_work+0x20/0x30
+ xlog_cil_force_lsn+0x88/0x204 [xfs]
+ xfs_log_force_lsn+0x128/0x1b8 [xfs]
+ xfs_file_fsync+0x3c4/0x488 [xfs]
+ vfs_fsync_range+0xb0/0xd0
+ generic_write_sync+0x80/0xa0 [xfs]
+ xfs_file_buffered_aio_write+0x66c/0x6e4 [xfs]
+ xfs_file_write_iter+0x1a0/0x218 [xfs]
+ __vfs_write+0x1cc/0x214
+ vfs_write+0x12c/0x1a4
+ ksys_write+0xb0/0x120
+ __arm64_sys_write+0x54/0x88
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ &(&zone->lock)->rlock --> &(&port->lock)->rlock --> &pool->lock/1
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&pool->lock/1);
+ lock(&(&port->lock)->rlock);
+ lock(&pool->lock/1);
+ lock(&(&zone->lock)->rlock);
+
+ *** DEADLOCK ***
+
+4 locks held by doio/49441:
+ #0: a0ff00886fc27408 (sb_writers#8){.+.+}, at: vfs_write+0x118/0x1a4
+ #1: 8fff00080810dfe0 (&xfs_nondir_ilock_class){++++}, at:
+xfs_ilock+0x2a8/0x300 [xfs]
+ #2: ffff9000129f2390 (rcu_read_lock){....}, at:
+rcu_lock_acquire+0x8/0x38
+ #3: 60ff000822352818 (&pool->lock/1){-.-.}, at:
+start_flush_work+0xd8/0x3f0
+
+ stack backtrace:
+CPU: 48 PID: 49441 Comm: doio Tainted: G W
+Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS
+L50_5.13_1.11 06/18/2019
+Call trace:
+ dump_backtrace+0x0/0x248
+ show_stack+0x20/0x2c
+ dump_stack+0xe8/0x150
+ print_circular_bug+0x368/0x380
+ check_noncircular+0x28c/0x294
+ validate_chain+0xf6c/0x2e2c
+ __lock_acquire+0x868/0xc2c
+ lock_acquire+0x320/0x360
+ _raw_spin_lock+0x64/0x80
+ rmqueue+0x138/0x2050
+ get_page_from_freelist+0x474/0x688
+ __alloc_pages_nodemask+0x3b4/0x18dc
+ alloc_pages_current+0xd0/0xe0
+ alloc_slab_page+0x2b4/0x5e0
+ new_slab+0xc8/0x6bc
+ ___slab_alloc+0x3b8/0x640
+ kmem_cache_alloc+0x4b4/0x588
+ __debug_object_init+0x778/0x8b4
+ debug_object_init_on_stack+0x40/0x50
+ start_flush_work+0x16c/0x3f0
+ __flush_work+0xb8/0x124
+ flush_work+0x20/0x30
+ xlog_cil_force_lsn+0x88/0x204 [xfs]
+ xfs_log_force_lsn+0x128/0x1b8 [xfs]
+ xfs_file_fsync+0x3c4/0x488 [xfs]
+ vfs_fsync_range+0xb0/0xd0
+ generic_write_sync+0x80/0xa0 [xfs]
+ xfs_file_buffered_aio_write+0x66c/0x6e4 [xfs]
+ xfs_file_write_iter+0x1a0/0x218 [xfs]
+ __vfs_write+0x1cc/0x214
+ vfs_write+0x12c/0x1a4
+ ksys_write+0xb0/0x120
+ __arm64_sys_write+0x54/0x88
+ el0_svc_handler+0x170/0x240
+ el0_sync_handler+0x150/0x250
+ el0_sync+0x164/0x180
+
+Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Signed-off-by: Qian Cai <cai@lca.pw>
+Link: https://lore.kernel.org/r/1573679785-21068-1-git-send-email-cai@lca.pw
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/char/random.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 53e822793d463..28b110cd39775 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -1609,8 +1609,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller,
+ print_once = true;
+ #endif
+ if (__ratelimit(&unseeded_warning))
+- pr_notice("random: %s called from %pS with crng_init=%d\n",
+- func_name, caller, crng_init);
++ printk_deferred(KERN_NOTICE "random: %s called from %pS "
++ "with crng_init=%d\n", func_name, caller,
++ crng_init);
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 5a35f941c3129a4eb06964c3e2fc9c760e75a69c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 11:07:56 +1000
+Subject: cifs: fix NULL dereference in match_prepath
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+[ Upstream commit fe1292686333d1dadaf84091f585ee903b9ddb84 ]
+
+RHBZ: 1760879
+
+Fix an oops in match_prepath() by making sure that the prepath string is not
+NULL before we pass it into strcmp().
+
+This is similar to other checks we make for example in cifs_root_iget()
+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 576cf71576da1..6c62ce40608a1 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -3342,8 +3342,10 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
+ {
+ struct cifs_sb_info *old = CIFS_SB(sb);
+ struct cifs_sb_info *new = mnt_data->cifs_sb;
+- bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
+- bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
++ bool old_set = (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++ old->prepath;
++ bool new_set = (new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) &&
++ new->prepath;
+
+ if (old_set && new_set && !strcmp(new->prepath, old->prepath))
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From 64cd9081d534b3594508758ca9072997cfa5eaf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Feb 2020 16:52:11 -0600
+Subject: cifs: log warning message (once) if out of disk space
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit d6fd41905ec577851734623fb905b1763801f5ef ]
+
+We ran into a confusing problem where an application wasn't checking
+return code on close and so user didn't realize that the application
+ran out of disk space. log a warning message (once) in these
+cases. For example:
+
+ [ 8407.391909] Out of space writing to \\oleg-server\small-share
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reported-by: Oleg Kravtsov <oleg@tuxera.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2pdu.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 0d4e4d97e6cf5..e2d2b749c8f38 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -3425,6 +3425,9 @@ smb2_writev_callback(struct mid_q_entry *mid)
+ wdata->cfile->fid.persistent_fid,
+ tcon->tid, tcon->ses->Suid, wdata->offset,
+ wdata->bytes, wdata->result);
++ if (wdata->result == -ENOSPC)
++ printk_once(KERN_WARNING "Out of space writing to %s\n",
++ tcon->treeName);
+ } else
+ trace_smb3_write_done(0 /* no xid */,
+ wdata->cfile->fid.persistent_fid,
+--
+2.20.1
+
--- /dev/null
+From e8d63e4a2fbf583d16ef0d235a1b95ea40685053 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 10:31:34 -0800
+Subject: clk: qcom: rcg2: Don't crash if our parent can't be found; return an
+ error
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 908b050114d8fefdddc57ec9fbc213c3690e7f5f ]
+
+When I got my clock parenting slightly wrong I ended up with a crash
+that looked like this:
+
+ Unable to handle kernel NULL pointer dereference at virtual
+ address 0000000000000000
+ ...
+ pc : clk_hw_get_rate+0x14/0x44
+ ...
+ Call trace:
+ clk_hw_get_rate+0x14/0x44
+ _freq_tbl_determine_rate+0x94/0xfc
+ clk_rcg2_determine_rate+0x2c/0x38
+ clk_core_determine_round_nolock+0x4c/0x88
+ clk_core_round_rate_nolock+0x6c/0xa8
+ clk_core_round_rate_nolock+0x9c/0xa8
+ clk_core_set_rate_nolock+0x70/0x180
+ clk_set_rate+0x3c/0x6c
+ of_clk_set_defaults+0x254/0x360
+ platform_drv_probe+0x28/0xb0
+ really_probe+0x120/0x2dc
+ driver_probe_device+0x64/0xfc
+ device_driver_attach+0x4c/0x6c
+ __driver_attach+0xac/0xc0
+ bus_for_each_dev+0x84/0xcc
+ driver_attach+0x2c/0x38
+ bus_add_driver+0xfc/0x1d0
+ driver_register+0x64/0xf8
+ __platform_driver_register+0x4c/0x58
+ msm_drm_register+0x5c/0x60
+ ...
+
+It turned out that clk_hw_get_parent_by_index() was returning NULL and
+we weren't checking. Let's check it so that we don't crash.
+
+Fixes: ac269395cdd8 ("clk: qcom: Convert to clk_hw based provider APIs")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Matthias Kaehlcke <mka@chromium.org>
+Link: https://lkml.kernel.org/r/20200203103049.v4.1.I7487325fe8e701a68a07d3be8a6a4b571eca9cfa@changeid
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/clk-rcg2.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
+index 51b2388d80ac9..ee693e15d9ebc 100644
+--- a/drivers/clk/qcom/clk-rcg2.c
++++ b/drivers/clk/qcom/clk-rcg2.c
+@@ -203,6 +203,9 @@ static int _freq_tbl_determine_rate(struct clk_hw *hw, const struct freq_tbl *f,
+
+ clk_flags = clk_hw_get_flags(hw);
+ p = clk_hw_get_parent_by_index(hw, index);
++ if (!p)
++ return -EINVAL;
++
+ if (clk_flags & CLK_SET_RATE_PARENT) {
+ rate = f->freq;
+ if (f->pre_div) {
+--
+2.20.1
+
--- /dev/null
+From 7e48215d7446dd5302c39569cf421e6c2ae5b9b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 22:35:03 -0800
+Subject: clk: sunxi-ng: add mux and pll notifiers for A64 CPU clock
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit ec97faff743b398e21f74a54c81333f3390093aa ]
+
+The A64 PLL_CPU clock has the same instability if some factor changed
+without the PLL gated like other SoCs with sun6i-style CCU, e.g. A33,
+H3.
+
+Add the mux and pll notifiers for A64 CPU clock to workaround the
+problem.
+
+Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 28 ++++++++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index dec4a130390a3..9ac6c299e0744 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -901,11 +901,26 @@ static const struct sunxi_ccu_desc sun50i_a64_ccu_desc = {
+ .num_resets = ARRAY_SIZE(sun50i_a64_ccu_resets),
+ };
+
++static struct ccu_pll_nb sun50i_a64_pll_cpu_nb = {
++ .common = &pll_cpux_clk.common,
++ /* copy from pll_cpux_clk */
++ .enable = BIT(31),
++ .lock = BIT(28),
++};
++
++static struct ccu_mux_nb sun50i_a64_cpu_nb = {
++ .common = &cpux_clk.common,
++ .cm = &cpux_clk.mux,
++ .delay_us = 1, /* > 8 clock cycles at 24 MHz */
++ .bypass_index = 1, /* index of 24 MHz oscillator */
++};
++
+ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+ {
+ struct resource *res;
+ void __iomem *reg;
+ u32 val;
++ int ret;
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ reg = devm_ioremap_resource(&pdev->dev, res);
+@@ -919,7 +934,18 @@ static int sun50i_a64_ccu_probe(struct platform_device *pdev)
+
+ writel(0x515, reg + SUN50I_A64_PLL_MIPI_REG);
+
+- return sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++ ret = sunxi_ccu_probe(pdev->dev.of_node, reg, &sun50i_a64_ccu_desc);
++ if (ret)
++ return ret;
++
++ /* Gate then ungate PLL CPU after any rate changes */
++ ccu_pll_notifier_register(&sun50i_a64_pll_cpu_nb);
++
++ /* Reparent CPU during PLL CPU rate changes */
++ ccu_mux_notifier_register(pll_cpux_clk.common.hw.clk,
++ &sun50i_a64_cpu_nb);
++
++ return 0;
+ }
+
+ static const struct of_device_id sun50i_a64_ccu_ids[] = {
+--
+2.20.1
+
--- /dev/null
+From a35302f39b97f9e4746aab8ba8576a50437dfd31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2019 10:42:05 +0900
+Subject: clk: uniphier: Add SCSSI clock gate for each channel
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 1ec09a2ec67a0baa46a3ccac041dbcdbc6db2cb9 ]
+
+SCSSI has clock gates for each channel in the SoCs newer than Pro4,
+so this adds missing clock gates for channel 1, 2 and 3. And more, this
+moves MCSSI clock ID after SCSSI.
+
+Fixes: ff388ee36516 ("clk: uniphier: add clock frequency support for SPI")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Link: https://lkml.kernel.org/r/1577410925-22021-1-git-send-email-hayashi.kunihiko@socionext.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/uniphier/clk-uniphier-peri.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/uniphier/clk-uniphier-peri.c b/drivers/clk/uniphier/clk-uniphier-peri.c
+index 89b3ac378b3f9..8b75dc116a98c 100644
+--- a/drivers/clk/uniphier/clk-uniphier-peri.c
++++ b/drivers/clk/uniphier/clk-uniphier-peri.c
+@@ -27,8 +27,8 @@
+ #define UNIPHIER_PERI_CLK_FI2C(idx, ch) \
+ UNIPHIER_CLK_GATE("i2c" #ch, (idx), "i2c", 0x24, 24 + (ch))
+
+-#define UNIPHIER_PERI_CLK_SCSSI(idx) \
+- UNIPHIER_CLK_GATE("scssi", (idx), "spi", 0x20, 17)
++#define UNIPHIER_PERI_CLK_SCSSI(idx, ch) \
++ UNIPHIER_CLK_GATE("scssi" #ch, (idx), "spi", 0x20, 17 + (ch))
+
+ #define UNIPHIER_PERI_CLK_MCSSI(idx) \
+ UNIPHIER_CLK_GATE("mcssi", (idx), "spi", 0x24, 14)
+@@ -44,7 +44,7 @@ const struct uniphier_clk_data uniphier_ld4_peri_clk_data[] = {
+ UNIPHIER_PERI_CLK_I2C(6, 2),
+ UNIPHIER_PERI_CLK_I2C(7, 3),
+ UNIPHIER_PERI_CLK_I2C(8, 4),
+- UNIPHIER_PERI_CLK_SCSSI(11),
++ UNIPHIER_PERI_CLK_SCSSI(11, 0),
+ { /* sentinel */ }
+ };
+
+@@ -60,7 +60,10 @@ const struct uniphier_clk_data uniphier_pro4_peri_clk_data[] = {
+ UNIPHIER_PERI_CLK_FI2C(8, 4),
+ UNIPHIER_PERI_CLK_FI2C(9, 5),
+ UNIPHIER_PERI_CLK_FI2C(10, 6),
+- UNIPHIER_PERI_CLK_SCSSI(11),
+- UNIPHIER_PERI_CLK_MCSSI(12),
++ UNIPHIER_PERI_CLK_SCSSI(11, 0),
++ UNIPHIER_PERI_CLK_SCSSI(12, 1),
++ UNIPHIER_PERI_CLK_SCSSI(13, 2),
++ UNIPHIER_PERI_CLK_SCSSI(14, 3),
++ UNIPHIER_PERI_CLK_MCSSI(15),
+ { /* sentinel */ }
+ };
+--
+2.20.1
+
--- /dev/null
+From 2fe5c7d29be57de25593d7dc689634b102cabcac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 21:32:46 +0000
+Subject: clocksource/drivers/bcm2835_timer: Fix memory leak of timer
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 2052d032c06761330bca4944bb7858b00960e868 ]
+
+Currently when setup_irq fails the error exit path will leak the
+recently allocated timer structure. Originally the code would
+throw a panic but a later commit changed the behaviour to return
+via the err_iounmap path and hence we now have a memory leak. Fix
+this by adding a err_timer_free error path that kfree's timer.
+
+Addresses-Coverity: ("Resource Leak")
+Fixes: 524a7f08983d ("clocksource/drivers/bcm2835_timer: Convert init function to return error")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/r/20191219213246.34437-1-colin.king@canonical.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/bcm2835_timer.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/bcm2835_timer.c b/drivers/clocksource/bcm2835_timer.c
+index 60da2537bef93..1082dcef17d17 100644
+--- a/drivers/clocksource/bcm2835_timer.c
++++ b/drivers/clocksource/bcm2835_timer.c
+@@ -134,7 +134,7 @@ static int __init bcm2835_timer_init(struct device_node *node)
+ ret = setup_irq(irq, &timer->act);
+ if (ret) {
+ pr_err("Can't set up timer IRQ\n");
+- goto err_iounmap;
++ goto err_timer_free;
+ }
+
+ clockevents_config_and_register(&timer->evt, freq, 0xf, 0xffffffff);
+@@ -143,6 +143,9 @@ static int __init bcm2835_timer_init(struct device_node *node)
+
+ return 0;
+
++err_timer_free:
++ kfree(timer);
++
+ err_iounmap:
+ iounmap(base);
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From ffde5674a745e3d45e90237a2e508263a61fe755 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:04:41 +0300
+Subject: cmd64x: potential buffer overflow in cmd64x_program_timings()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 117fcc3053606d8db5cef8821dca15022ae578bb ]
+
+The "drive->dn" value is a u8 and it is controlled by root only, but
+it could be out of bounds here so let's check.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/cmd64x.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/ide/cmd64x.c b/drivers/ide/cmd64x.c
+index b127ed60c7336..9dde8390da09b 100644
+--- a/drivers/ide/cmd64x.c
++++ b/drivers/ide/cmd64x.c
+@@ -65,6 +65,9 @@ static void cmd64x_program_timings(ide_drive_t *drive, u8 mode)
+ struct ide_timing t;
+ u8 arttim = 0;
+
++ if (drive->dn >= ARRAY_SIZE(drwtim_regs))
++ return;
++
+ ide_timing_compute(drive, mode, &t, T, 0);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From ea43e1549949fca622a66aa84465dc3324745cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 09:34:54 +0100
+Subject: cpu/hotplug, stop_machine: Fix stop_machine vs hotplug order
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit 45178ac0cea853fe0e405bf11e101bdebea57b15 ]
+
+Paul reported a very sporadic, rcutorture induced, workqueue failure.
+When the planets align, the workqueue rescuer's self-migrate fails and
+then triggers a WARN for running a work on the wrong CPU.
+
+Tejun then figured that set_cpus_allowed_ptr()'s stop_one_cpu() call
+could be ignored! When stopper->enabled is false, stop_machine will
+insta complete the work, without actually doing the work. Worse, it
+will not WARN about this (we really should fix this).
+
+It turns out there is a small window where a freshly online'ed CPU is
+marked 'online' but doesn't yet have the stopper task running:
+
+ BP AP
+
+ bringup_cpu()
+ __cpu_up(cpu, idle) --> start_secondary()
+ ...
+ cpu_startup_entry()
+ bringup_wait_for_ap()
+ wait_for_ap_thread() <-- cpuhp_online_idle()
+ while (1)
+ do_idle()
+
+ ... available to run kthreads ...
+
+ stop_machine_unpark()
+ stopper->enable = true;
+
+Close this by moving the stop_machine_unpark() into
+cpuhp_online_idle(), such that the stopper thread is ready before we
+start the idle loop and schedule.
+
+Reported-by: "Paul E. McKenney" <paulmck@kernel.org>
+Debugged-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Tested-by: "Paul E. McKenney" <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/cpu.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 8d6b8b5493f9f..2d850eaaf82e3 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -493,8 +493,7 @@ static int bringup_wait_for_ap(unsigned int cpu)
+ if (WARN_ON_ONCE((!cpu_online(cpu))))
+ return -ECANCELED;
+
+- /* Unpark the stopper thread and the hotplug thread of the target cpu */
+- stop_machine_unpark(cpu);
++ /* Unpark the hotplug thread of the target cpu */
+ kthread_unpark(st->thread);
+
+ /*
+@@ -1048,8 +1047,8 @@ void notify_cpu_starting(unsigned int cpu)
+
+ /*
+ * Called from the idle task. Wake up the controlling task which brings the
+- * stopper and the hotplug thread of the upcoming CPU up and then delegates
+- * the rest of the online bringup to the hotplug thread.
++ * hotplug thread of the upcoming CPU up and then delegates the rest of the
++ * online bringup to the hotplug thread.
+ */
+ void cpuhp_online_idle(enum cpuhp_state state)
+ {
+@@ -1059,6 +1058,12 @@ void cpuhp_online_idle(enum cpuhp_state state)
+ if (state != CPUHP_AP_ONLINE_IDLE)
+ return;
+
++ /*
++ * Unpart the stopper thread before we start the idle loop (and start
++ * scheduling); this ensures the stopper task is always available.
++ */
++ stop_machine_unpark(smp_processor_id());
++
+ st->state = CPUHP_AP_ONLINE_IDLE;
+ complete_ap_thread(st, true);
+ }
+--
+2.20.1
+
--- /dev/null
+From 246405459dcf391a8b9362a0f28e31d8bcc41b18 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 16:21:48 +0530
+Subject: crypto: chtls - Fixed memory leak
+
+From: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+
+[ Upstream commit 93e23eb2ed6c11b4f483c8111ac155ec2b1f3042 ]
+
+Freed work request skbs when connection terminates.
+enqueue_wr()/ dequeue_wr() is shared between softirq
+and application contexts, should be protected by socket
+lock. Moved dequeue_wr() to appropriate file.
+
+Signed-off-by: Vinay Kumar Yadav <vinay.yadav@chelsio.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/chelsio/chtls/chtls_cm.c | 27 +++++++++++++------------
+ drivers/crypto/chelsio/chtls/chtls_cm.h | 21 +++++++++++++++++++
+ drivers/crypto/chelsio/chtls/chtls_hw.c | 3 +++
+ 3 files changed, 38 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index 8b749c721c871..28d24118c6450 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -731,6 +731,14 @@ static int chtls_close_listsrv_rpl(struct chtls_dev *cdev, struct sk_buff *skb)
+ return 0;
+ }
+
++static void chtls_purge_wr_queue(struct sock *sk)
++{
++ struct sk_buff *skb;
++
++ while ((skb = dequeue_wr(sk)) != NULL)
++ kfree_skb(skb);
++}
++
+ static void chtls_release_resources(struct sock *sk)
+ {
+ struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+@@ -745,6 +753,11 @@ static void chtls_release_resources(struct sock *sk)
+ kfree_skb(csk->txdata_skb_cache);
+ csk->txdata_skb_cache = NULL;
+
++ if (csk->wr_credits != csk->wr_max_credits) {
++ chtls_purge_wr_queue(sk);
++ chtls_reset_wr_list(csk);
++ }
++
+ if (csk->l2t_entry) {
+ cxgb4_l2t_release(csk->l2t_entry);
+ csk->l2t_entry = NULL;
+@@ -1714,6 +1727,7 @@ static void chtls_peer_close(struct sock *sk, struct sk_buff *skb)
+ else
+ sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+ }
++ kfree_skb(skb);
+ }
+
+ static void chtls_close_con_rpl(struct sock *sk, struct sk_buff *skb)
+@@ -2041,19 +2055,6 @@ rel_skb:
+ return 0;
+ }
+
+-static struct sk_buff *dequeue_wr(struct sock *sk)
+-{
+- struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
+- struct sk_buff *skb = csk->wr_skb_head;
+-
+- if (likely(skb)) {
+- /* Don't bother clearing the tail */
+- csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
+- WR_SKB_CB(skb)->next_wr = NULL;
+- }
+- return skb;
+-}
+-
+ static void chtls_rx_ack(struct sock *sk, struct sk_buff *skb)
+ {
+ struct cpl_fw4_ack *hdr = cplhdr(skb) + RSS_HDR;
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.h b/drivers/crypto/chelsio/chtls/chtls_cm.h
+index 78eb3afa3a80d..4282d8a4eae48 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.h
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.h
+@@ -188,6 +188,12 @@ static inline void chtls_kfree_skb(struct sock *sk, struct sk_buff *skb)
+ kfree_skb(skb);
+ }
+
++static inline void chtls_reset_wr_list(struct chtls_sock *csk)
++{
++ csk->wr_skb_head = NULL;
++ csk->wr_skb_tail = NULL;
++}
++
+ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ {
+ WR_SKB_CB(skb)->next_wr = NULL;
+@@ -200,4 +206,19 @@ static inline void enqueue_wr(struct chtls_sock *csk, struct sk_buff *skb)
+ WR_SKB_CB(csk->wr_skb_tail)->next_wr = skb;
+ csk->wr_skb_tail = skb;
+ }
++
++static inline struct sk_buff *dequeue_wr(struct sock *sk)
++{
++ struct chtls_sock *csk = rcu_dereference_sk_user_data(sk);
++ struct sk_buff *skb = NULL;
++
++ skb = csk->wr_skb_head;
++
++ if (likely(skb)) {
++ /* Don't bother clearing the tail */
++ csk->wr_skb_head = WR_SKB_CB(skb)->next_wr;
++ WR_SKB_CB(skb)->next_wr = NULL;
++ }
++ return skb;
++}
+ #endif
+diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c
+index 4909607558644..64d24823c65aa 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_hw.c
++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c
+@@ -361,6 +361,7 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ kwr->sc_imm.cmd_more = cpu_to_be32(ULPTX_CMD_V(ULP_TX_SC_IMM));
+ kwr->sc_imm.len = cpu_to_be32(klen);
+
++ lock_sock(sk);
+ /* key info */
+ kctx = (struct _key_ctx *)(kwr + 1);
+ ret = chtls_key_info(csk, kctx, keylen, optname);
+@@ -399,8 +400,10 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ csk->tlshws.txkey = keyid;
+ }
+
++ release_sock(sk);
+ return ret;
+ out_notcb:
++ release_sock(sk);
+ free_tls_keyid(sk);
+ out_nokey:
+ kfree_skb(skb);
+--
+2.20.1
+
--- /dev/null
+From a3f1e1202b5245b4853075266e7d028640bbb4b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:53:28 +0100
+Subject: dmaengine: imx-sdma: Fix memory leak
+
+From: Sascha Hauer <s.hauer@pengutronix.de>
+
+[ Upstream commit 02939cd167095f16328a1bd5cab5a90b550606df ]
+
+The current descriptor is not on any list of the virtual DMA channel.
+Once sdma_terminate_all() is called when a descriptor is currently
+in flight then this one is forgotten to be freed. We have to call
+vchan_terminate_vdesc() on this descriptor to re-add it to the lists.
+Now that we also free the currently running descriptor we can (and
+actually have to) remove the current descriptor from its list also
+for the cyclic case.
+
+Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
+Reviewed-by: Robin Gong <yibin.gong@nxp.com>
+Tested-by: Robin Gong <yibin.gong@nxp.com>
+Link: https://lore.kernel.org/r/20191216105328.15198-10-s.hauer@pengutronix.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-sdma.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index ceb82e74f5b4e..d66a7fdff898e 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -738,12 +738,8 @@ static void sdma_start_desc(struct sdma_channel *sdmac)
+ return;
+ }
+ sdmac->desc = desc = to_sdma_desc(&vd->tx);
+- /*
+- * Do not delete the node in desc_issued list in cyclic mode, otherwise
+- * the desc allocated will never be freed in vchan_dma_desc_free_list
+- */
+- if (!(sdmac->flags & IMX_DMA_SG_LOOP))
+- list_del(&vd->node);
++
++ list_del(&vd->node);
+
+ sdma->channel_control[channel].base_bd_ptr = desc->bd_phys;
+ sdma->channel_control[channel].current_bd_ptr = desc->bd_phys;
+@@ -1044,7 +1040,6 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+
+ spin_lock_irqsave(&sdmac->vc.lock, flags);
+ vchan_get_all_descriptors(&sdmac->vc, &head);
+- sdmac->desc = NULL;
+ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+ vchan_dma_desc_free_list(&sdmac->vc, &head);
+ }
+@@ -1052,11 +1047,19 @@ static void sdma_channel_terminate_work(struct work_struct *work)
+ static int sdma_disable_channel_async(struct dma_chan *chan)
+ {
+ struct sdma_channel *sdmac = to_sdma_chan(chan);
++ unsigned long flags;
++
++ spin_lock_irqsave(&sdmac->vc.lock, flags);
+
+ sdma_disable_channel(chan);
+
+- if (sdmac->desc)
++ if (sdmac->desc) {
++ vchan_terminate_vdesc(&sdmac->desc->vd);
++ sdmac->desc = NULL;
+ schedule_work(&sdmac->terminate_worker);
++ }
++
++ spin_unlock_irqrestore(&sdmac->vc.lock, flags);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 30d58638b1fdfacbc35a7728a2efef0c025a22ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 12:01:16 -0700
+Subject: dmaengine: Store module owner in dma_device struct
+
+From: Logan Gunthorpe <logang@deltatee.com>
+
+[ Upstream commit dae7a589c18a4d979d5f14b09374e871b995ceb1 ]
+
+dma_chan_to_owner() dereferences the driver from the struct device to
+obtain the owner and call module_[get|put](). However, if the backing
+device is unbound before the dma_device is unregistered, the driver
+will be cleared and this will cause a NULL pointer dereference.
+
+Instead, store a pointer to the owner module in the dma_device struct
+so the module reference can be properly put when the channel is put, even
+if the backing device was destroyed first.
+
+This change helps to support a safer unbind of DMA engines.
+If the dma_device is unregistered in the driver's remove function,
+there's no guarantee that there are no existing clients and a users
+action may trigger the WARN_ONCE in dma_async_device_unregister()
+which is unlikely to leave the system in a consistent state.
+Instead, a better approach is to allow the backing driver to go away
+and fail any subsequent requests to it.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Link: https://lore.kernel.org/r/20191216190120.21374-2-logang@deltatee.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dmaengine.c | 4 +++-
+ include/linux/dmaengine.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
+index f1a441ab395d7..8a52a5efee4f5 100644
+--- a/drivers/dma/dmaengine.c
++++ b/drivers/dma/dmaengine.c
+@@ -190,7 +190,7 @@ __dma_device_satisfies_mask(struct dma_device *device,
+
+ static struct module *dma_chan_to_owner(struct dma_chan *chan)
+ {
+- return chan->device->dev->driver->owner;
++ return chan->device->owner;
+ }
+
+ /**
+@@ -923,6 +923,8 @@ int dma_async_device_register(struct dma_device *device)
+ return -EIO;
+ }
+
++ device->owner = device->dev->driver->owner;
++
+ if (dma_has_cap(DMA_MEMCPY, device->cap_mask) && !device->device_prep_dma_memcpy) {
+ dev_err(device->dev,
+ "Device claims capability %s, but op is not defined\n",
+diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
+index 0647f436f88c2..50128c36f0b48 100644
+--- a/include/linux/dmaengine.h
++++ b/include/linux/dmaengine.h
+@@ -686,6 +686,7 @@ struct dma_filter {
+ * @fill_align: alignment shift for memset operations
+ * @dev_id: unique device ID
+ * @dev: struct device reference for dma mapping api
++ * @owner: owner module (automatically set based on the provided dev)
+ * @src_addr_widths: bit mask of src addr widths the device supports
+ * Width is specified in bytes, e.g. for a device supporting
+ * a width of 4 the mask should have BIT(4) set.
+@@ -749,6 +750,7 @@ struct dma_device {
+
+ int dev_id;
+ struct device *dev;
++ struct module *owner;
+
+ u32 src_addr_widths;
+ u32 dst_addr_widths;
+--
+2.20.1
+
--- /dev/null
+From f57c9294636904c8605c1eefb8ca7a8470000fae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 17:57:58 +0000
+Subject: driver core: platform: fix u32 greater or equal to zero comparison
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 0707cfa5c3ef58effb143db9db6d6e20503f9dec ]
+
+Currently the check that a u32 variable i is >= 0 is always true because
+the unsigned variable will never be negative, causing the loop to run
+forever. Fix this by changing the pre-decrement check to a zero check on
+i followed by a decrement of i.
+
+Addresses-Coverity: ("Unsigned compared against 0")
+Fixes: 39cc539f90d0 ("driver core: platform: Prevent resouce overflow from causing infinite loops")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Link: https://lore.kernel.org/r/20200116175758.88396-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index 1d3a50ac21664..d1f901b58f755 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -427,7 +427,7 @@ int platform_device_add(struct platform_device *pdev)
+ pdev->id = PLATFORM_DEVID_AUTO;
+ }
+
+- while (--i >= 0) {
++ while (i--) {
+ struct resource *r = &pdev->resource[i];
+ if (r->parent)
+ release_resource(r);
+--
+2.20.1
+
--- /dev/null
+From 2b6e659cfac2359eb34ea61b1092e2476a740974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 17:41:37 -0500
+Subject: driver core: platform: Prevent resouce overflow from causing infinite
+ loops
+
+From: Simon Schwartz <kern.simon@theschwartz.xyz>
+
+[ Upstream commit 39cc539f90d035a293240c9443af50be55ee81b8 ]
+
+num_resources in the platform_device struct is declared as a u32. The
+for loops that iterate over num_resources use an int as the counter,
+which can cause infinite loops on architectures with smaller ints.
+Change the loop counters to u32.
+
+Signed-off-by: Simon Schwartz <kern.simon@theschwartz.xyz>
+Link: https://lore.kernel.org/r/2201ce63a2a171ffd2ed14e867875316efcf71db.camel@theschwartz.xyz
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/platform.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index e9be1f56929af..1d3a50ac21664 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -27,6 +27,7 @@
+ #include <linux/limits.h>
+ #include <linux/property.h>
+ #include <linux/kmemleak.h>
++#include <linux/types.h>
+
+ #include "base.h"
+ #include "power/power.h"
+@@ -67,7 +68,7 @@ void __weak arch_setup_pdev_archdata(struct platform_device *pdev)
+ struct resource *platform_get_resource(struct platform_device *dev,
+ unsigned int type, unsigned int num)
+ {
+- int i;
++ u32 i;
+
+ for (i = 0; i < dev->num_resources; i++) {
+ struct resource *r = &dev->resource[i];
+@@ -162,7 +163,7 @@ struct resource *platform_get_resource_byname(struct platform_device *dev,
+ unsigned int type,
+ const char *name)
+ {
+- int i;
++ u32 i;
+
+ for (i = 0; i < dev->num_resources; i++) {
+ struct resource *r = &dev->resource[i];
+@@ -359,7 +360,8 @@ EXPORT_SYMBOL_GPL(platform_device_add_properties);
+ */
+ int platform_device_add(struct platform_device *pdev)
+ {
+- int i, ret;
++ u32 i;
++ int ret;
+
+ if (!pdev)
+ return -EINVAL;
+@@ -446,7 +448,7 @@ EXPORT_SYMBOL_GPL(platform_device_add);
+ */
+ void platform_device_del(struct platform_device *pdev)
+ {
+- int i;
++ u32 i;
+
+ if (pdev) {
+ device_remove_properties(&pdev->dev);
+--
+2.20.1
+
--- /dev/null
+From 645240830f897d5b2e39bfaa0d7995e18dac23d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 14:22:19 +0100
+Subject: driver core: Print device when resources present in really_probe()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 7c35e699c88bd60734277b26962783c60e04b494 ]
+
+If a device already has devres items attached before probing, a warning
+backtrace is printed. However, this backtrace does not reveal the
+offending device, leaving the user uninformed. Furthermore, using
+WARN_ON() causes systems with panic-on-warn to reboot.
+
+Fix this by replacing the WARN_ON() by a dev_crit() message.
+Abort probing the device, to prevent doing more damage to the device's
+resources.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191206132219.28908-1-geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/dd.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 11d24a552ee49..5f6416e6ba96b 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -470,7 +470,10 @@ static int really_probe(struct device *dev, struct device_driver *drv)
+ atomic_inc(&probe_count);
+ pr_debug("bus: '%s': %s: probing driver %s with device %s\n",
+ drv->bus->name, __func__, drv->name, dev_name(dev));
+- WARN_ON(!list_empty(&dev->devres_head));
++ if (!list_empty(&dev->devres_head)) {
++ dev_crit(dev, "Resources present before probing\n");
++ return -EBUSY;
++ }
+
+ re_probe:
+ dev->driver = drv;
+--
+2.20.1
+
--- /dev/null
+From 8b72d0287c782a39ea08a7e788b96746a102ae7f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 14:40:56 -0500
+Subject: drm/amd/display: fixup DML dependencies
+
+From: Jun Lei <Jun.Lei@amd.com>
+
+[ Upstream commit 34ad0230062c39cdcba564d16d122c0fb467a7d6 ]
+
+[why]
+Need to fix DML portability issues to enable SW unit testing around DML
+
+[how]
+Move calcs into dc include folder since multiple components reference it
+Remove relative paths to external dependencies
+
+Signed-off-by: Jun Lei <Jun.Lei@amd.com>
+Reviewed-by: Anthony Koo <Anthony.Koo@amd.com>
+Acked-by: Harry Wentland <harry.wentland@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c | 2 +-
+ drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h | 2 +-
+ drivers/gpu/drm/amd/display/dc/{calcs => inc}/dcn_calc_math.h | 0
+ 3 files changed, 2 insertions(+), 2 deletions(-)
+ rename drivers/gpu/drm/amd/display/dc/{calcs => inc}/dcn_calc_math.h (100%)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+index b953b02a15121..723af0b2dda04 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_common_defs.c
+@@ -24,7 +24,7 @@
+ */
+
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+
+ #include "dml_inline_defs.h"
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+index e8ce08567cd8e..e4f595a3038c4 100644
+--- a/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
++++ b/drivers/gpu/drm/amd/display/dc/dml/dml_inline_defs.h
+@@ -27,7 +27,7 @@
+ #define __DML_INLINE_DEFS_H__
+
+ #include "dml_common_defs.h"
+-#include "../calcs/dcn_calc_math.h"
++#include "dcn_calc_math.h"
+ #include "dml_logger.h"
+
+ static inline double dml_min(double a, double b)
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h b/drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+similarity index 100%
+rename from drivers/gpu/drm/amd/display/dc/calcs/dcn_calc_math.h
+rename to drivers/gpu/drm/amd/display/dc/inc/dcn_calc_math.h
+--
+2.20.1
+
--- /dev/null
+From 8a350f70d16f530239a265c965c5d82e6ab7d59a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jan 2020 16:12:45 -0500
+Subject: drm/amd/display: Retrain dongles when SINK_COUNT becomes non-zero
+
+From: Harry Wentland <harry.wentland@amd.com>
+
+[ Upstream commit 3eb6d7aca53d81ce888624f09cd44dc0302161e8 ]
+
+[WHY]
+Two years ago the patch referenced by the Fixes tag stopped running
+dp_verify_link_cap_with_retries during DP detection when the reason
+for the detection was a short-pulse interrupt. This effectively meant
+that we were no longer doing the verify_link_cap training on active
+dongles when their SINK_COUNT changed from 0 to 1.
+
+A year ago this was partly remedied with:
+commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle")
+
+This made sure that we trained the dongle on initial hotplug (without
+connected downstream devices).
+
+This is all fine and dandy if it weren't for the fact that there are
+some dongles on the market that don't like link training when SINK_COUNT
+is 0 These dongles will in fact indicate a SINK_COUNT of 0 immediately
+after hotplug, even when a downstream device is connected, and then
+trigger a shortpulse interrupt indicating a SINK_COUNT change to 1.
+
+In order to play nicely we will need our policy to not link train an
+active DP dongle when SINK_COUNT is 0 but ensure we train it when the
+SINK_COUNT changes to 1.
+
+[HOW]
+Call dp_verify_link_cap_with_retries on detection even when the detection
+is triggered from a short pulse interrupt.
+
+With this change we can also revert this commit which we'll do in a separate
+follow-up change:
+commit 80adaebd2d41 ("drm/amd/display: Don't skip link training for empty dongle")
+
+Fixes: 0301ccbaf67d ("drm/amd/display: DP Compliance 400.1.1 failure")
+Suggested-by: Louis Li <Ching-shih.Li@amd.com>
+Tested-by: Louis Li <Ching-shih.Li@amd.com>
+Cc: Wenjing Liu <Wenjing.Liu@amd.com>
+Cc: Hersen Wu <hersenxs.wu@amd.com>
+Cc: Eric Yang <Eric.Yang2@amd.com>
+Reviewed-by: Wenjing Liu <Wenjing.Liu@amd.com>
+Signed-off-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_link.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index 2f42964fb9f45..3abc0294c05f5 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -780,8 +780,7 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason)
+ same_edid = is_same_edid(&prev_sink->dc_edid, &sink->dc_edid);
+
+ if (link->connector_signal == SIGNAL_TYPE_DISPLAY_PORT &&
+- sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX &&
+- reason != DETECT_REASON_HPDRX) {
++ sink_caps.transaction_type == DDC_TRANSACTION_TYPE_I2C_OVER_AUX) {
+ /*
+ * TODO debug why Dell 2413 doesn't like
+ * two link trainings
+--
+2.20.1
+
--- /dev/null
+From fbc77a5e3aa6a1fead3f0f410d21d407b9748f12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 14:39:45 -0500
+Subject: drm/amdgpu/display: handle multiple numbers of fclks in dcn_calcs.c
+ (v2)
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit c37243579d6c881c575dcfb54cf31c9ded88f946 ]
+
+We might get different numbers of clocks from powerplay depending
+on what the OEM has populated.
+
+v2: add assert for at least one level
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/amd/display/dc/calcs/dcn_calcs.c | 34 +++++++++++++------
+ 1 file changed, 23 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+index 6342f64993512..b0956c360393e 100644
+--- a/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
++++ b/drivers/gpu/drm/amd/display/dc/calcs/dcn_calcs.c
+@@ -1346,6 +1346,7 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ struct dc_context *ctx = dc->ctx;
+ struct dm_pp_clock_levels_with_voltage fclks = {0}, dcfclks = {0};
+ bool res;
++ unsigned vmin0p65_idx, vmid0p72_idx, vnom0p8_idx, vmax0p9_idx;
+
+ /* TODO: This is not the proper way to obtain fabric_and_dram_bandwidth, should be min(fclk, memclk) */
+ res = dm_pp_get_clock_levels_by_type_with_voltage(
+@@ -1357,17 +1358,28 @@ void dcn_bw_update_from_pplib(struct dc *dc)
+ res = verify_clock_values(&fclks);
+
+ if (res) {
+- ASSERT(fclks.num_levels >= 3);
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 = 32 * (fclks.data[0].clocks_in_khz / 1000.0) / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - (fclks.num_levels > 2 ? 3 : 2)].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - 2].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
+- dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 = dc->dcn_soc->number_of_channels *
+- (fclks.data[fclks.num_levels - 1].clocks_in_khz / 1000.0)
+- * ddr4_dram_factor_single_Channel / 1000.0;
++ ASSERT(fclks.num_levels);
++
++ vmin0p65_idx = 0;
++ vmid0p72_idx = fclks.num_levels -
++ (fclks.num_levels > 2 ? 3 : (fclks.num_levels > 1 ? 2 : 1));
++ vnom0p8_idx = fclks.num_levels - (fclks.num_levels > 1 ? 2 : 1);
++ vmax0p9_idx = fclks.num_levels - 1;
++
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmin0p65 =
++ 32 * (fclks.data[vmin0p65_idx].clocks_in_khz / 1000.0) / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmid0p72 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vmid0p72_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vnom0p8 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vnom0p8_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
++ dc->dcn_soc->fabric_and_dram_bandwidth_vmax0p9 =
++ dc->dcn_soc->number_of_channels *
++ (fclks.data[vmax0p9_idx].clocks_in_khz / 1000.0)
++ * ddr4_dram_factor_single_Channel / 1000.0;
+ } else
+ BREAK_TO_DEBUGGER();
+
+--
+2.20.1
+
--- /dev/null
+From f36b3c285be343ffa7f61d8e4d0676e78e8dd43f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 23 Nov 2019 12:23:36 -0700
+Subject: drm/amdgpu: Ensure ret is always initialized when using
+ SOC15_WAIT_ON_RREG
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit a63141e31764f8daf3f29e8e2d450dcf9199d1c8 ]
+
+Commit b0f3cd3191cd ("drm/amdgpu: remove unnecessary JPEG2.0 code from
+VCN2.0") introduced a new clang warning in the vcn_v2_0_stop function:
+
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1082:2: warning: variable 'r'
+is used uninitialized whenever 'while' loop exits because its condition
+is false [-Wsometimes-uninitialized]
+ SOC15_WAIT_ON_RREG(VCN, 0, mmUVD_STATUS, UVD_STATUS__IDLE, 0x7, r);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+../drivers/gpu/drm/amd/amdgpu/../amdgpu/soc15_common.h:55:10: note:
+expanded from macro 'SOC15_WAIT_ON_RREG'
+ while ((tmp_ & (mask)) != (expected_value)) { \
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1083:6: note: uninitialized use
+occurs here
+ if (r)
+ ^
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1082:2: note: remove the
+condition if it is always true
+ SOC15_WAIT_ON_RREG(VCN, 0, mmUVD_STATUS, UVD_STATUS__IDLE, 0x7, r);
+ ^
+../drivers/gpu/drm/amd/amdgpu/../amdgpu/soc15_common.h:55:10: note:
+expanded from macro 'SOC15_WAIT_ON_RREG'
+ while ((tmp_ & (mask)) != (expected_value)) { \
+ ^
+../drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c:1072:7: note: initialize the
+variable 'r' to silence this warning
+ int r;
+ ^
+ = 0
+1 warning generated.
+
+To prevent warnings like this from happening in the future, make the
+SOC15_WAIT_ON_RREG macro initialize its ret variable before the while
+loop that can time out. This macro's return value is always checked so
+it should set ret in both the success and fail path.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/776
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/soc15_common.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/soc15_common.h b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+index 0942f492d2e19..9d444f7fdfcdd 100644
+--- a/drivers/gpu/drm/amd/amdgpu/soc15_common.h
++++ b/drivers/gpu/drm/amd/amdgpu/soc15_common.h
+@@ -51,6 +51,7 @@
+ do { \
+ uint32_t tmp_ = RREG32(adev->reg_offset[ip##_HWIP][inst][reg##_BASE_IDX] + reg); \
+ uint32_t loop = adev->usec_timeout; \
++ ret = 0; \
+ while ((tmp_ & (mask)) != (expected_value)) { \
+ udelay(2); \
+ tmp_ = RREG32(adev->reg_offset[ip##_HWIP][inst][reg##_BASE_IDX] + reg); \
+--
+2.20.1
+
--- /dev/null
+From e1a2d9f02d38eb5783d4dcaca8e927d8f810bf56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:27:20 +0800
+Subject: drm/amdgpu: remove 4 set but not used variable in
+ amdgpu_atombios_get_connector_info_from_object_table
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit bae028e3e521e8cb8caf2cc16a455ce4c55f2332 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c: In function
+'amdgpu_atombios_get_connector_info_from_object_table':
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:376:26: warning: variable
+'grph_obj_num' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:376:13: warning: variable
+'grph_obj_id' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:341:37: warning: variable
+'con_obj_type' set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c:341:24: warning: variable
+'con_obj_num' set but not used [-Wunused-but-set-variable]
+
+They are never used, so can be removed.
+
+Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+index bf872f694f509..d1fbaea91f580 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c
+@@ -337,17 +337,9 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ path_size += le16_to_cpu(path->usSize);
+
+ if (device_support & le16_to_cpu(path->usDeviceTag)) {
+- uint8_t con_obj_id, con_obj_num, con_obj_type;
+-
+- con_obj_id =
++ uint8_t con_obj_id =
+ (le16_to_cpu(path->usConnObjectId) & OBJECT_ID_MASK)
+ >> OBJECT_ID_SHIFT;
+- con_obj_num =
+- (le16_to_cpu(path->usConnObjectId) & ENUM_ID_MASK)
+- >> ENUM_ID_SHIFT;
+- con_obj_type =
+- (le16_to_cpu(path->usConnObjectId) &
+- OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+
+ /* Skip TV/CV support */
+ if ((le16_to_cpu(path->usDeviceTag) ==
+@@ -372,14 +364,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device *
+ router.ddc_valid = false;
+ router.cd_valid = false;
+ for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) {
+- uint8_t grph_obj_id, grph_obj_num, grph_obj_type;
+-
+- grph_obj_id =
+- (le16_to_cpu(path->usGraphicObjIds[j]) &
+- OBJECT_ID_MASK) >> OBJECT_ID_SHIFT;
+- grph_obj_num =
+- (le16_to_cpu(path->usGraphicObjIds[j]) &
+- ENUM_ID_MASK) >> ENUM_ID_SHIFT;
++ uint8_t grph_obj_type=
+ grph_obj_type =
+ (le16_to_cpu(path->usGraphicObjIds[j]) &
+ OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT;
+--
+2.20.1
+
--- /dev/null
+From 7b01e3c04b7f9bdd6be7109b38c36741a80d8d57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 13:19:51 -0500
+Subject: drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_latency
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 4d0a72b66065dd7e274bad6aa450196d42fd8f84 ]
+
+Only send non-0 clocks to DC for validation. This mirrors
+what the windows driver does.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index 1546bc49004f8..3fa6e8123b8eb 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -994,12 +994,15 @@ static int smu10_get_clock_by_type_with_latency(struct pp_hwmgr *hwmgr,
+
+ clocks->num_levels = 0;
+ for (i = 0; i < pclk_vol_table->count; i++) {
+- clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
+- clocks->data[i].latency_in_us = latency_required ?
+- smu10_get_mem_latency(hwmgr,
+- pclk_vol_table->entries[i].clk) :
+- 0;
+- clocks->num_levels++;
++ if (pclk_vol_table->entries[i].clk) {
++ clocks->data[clocks->num_levels].clocks_in_khz =
++ pclk_vol_table->entries[i].clk * 10;
++ clocks->data[clocks->num_levels].latency_in_us = latency_required ?
++ smu10_get_mem_latency(hwmgr,
++ pclk_vol_table->entries[i].clk) :
++ 0;
++ clocks->num_levels++;
++ }
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 910d15ad3b2b20e2eaf66a6d87d4fe6412c36d07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Jan 2020 12:42:57 -0500
+Subject: drm/amdgpu/smu10: fix smu10_get_clock_by_type_with_voltage
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+[ Upstream commit 1064ad4aeef94f51ca230ac639a9e996fb7867a0 ]
+
+Cull out 0 clocks to avoid a warning in DC.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/issues/963
+Reviewed-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+index 3fa6e8123b8eb..48e31711bc68f 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu10_hwmgr.c
+@@ -1048,9 +1048,11 @@ static int smu10_get_clock_by_type_with_voltage(struct pp_hwmgr *hwmgr,
+
+ clocks->num_levels = 0;
+ for (i = 0; i < pclk_vol_table->count; i++) {
+- clocks->data[i].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
+- clocks->data[i].voltage_in_mv = pclk_vol_table->entries[i].vol;
+- clocks->num_levels++;
++ if (pclk_vol_table->entries[i].clk) {
++ clocks->data[clocks->num_levels].clocks_in_khz = pclk_vol_table->entries[i].clk * 10;
++ clocks->data[clocks->num_levels].voltage_in_mv = pclk_vol_table->entries[i].vol;
++ clocks->num_levels++;
++ }
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 6cbbdfe6dfdb32bc09643d3fdebb329d112b31a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 16:30:48 +0100
+Subject: drm/gma500: Fixup fbdev stolen size usage evaluation
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit fd1a5e521c3c083bb43ea731aae0f8b95f12b9bd ]
+
+psbfb_probe performs an evaluation of the required size from the stolen
+GTT memory, but gets it wrong in two distinct ways:
+- The resulting size must be page-size-aligned;
+- The size to allocate is derived from the surface dimensions, not the fb
+ dimensions.
+
+When two connectors are connected with different modes, the smallest will
+be stored in the fb dimensions, but the size that needs to be allocated must
+match the largest (surface) dimensions. This is what is used in the actual
+allocation code.
+
+Fix this by correcting the evaluation to conform to the two points above.
+It allows correctly switching to 16bpp when one connector is e.g. 1920x1080
+and the other is 1024x768.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191107153048.843881-1-paul.kocialkowski@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/gma500/framebuffer.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
+index adefae58b5fcd..b4035ef72af8a 100644
+--- a/drivers/gpu/drm/gma500/framebuffer.c
++++ b/drivers/gpu/drm/gma500/framebuffer.c
+@@ -480,6 +480,7 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ container_of(helper, struct psb_fbdev, psb_fb_helper);
+ struct drm_device *dev = psb_fbdev->psb_fb_helper.dev;
+ struct drm_psb_private *dev_priv = dev->dev_private;
++ unsigned int fb_size;
+ int bytespp;
+
+ bytespp = sizes->surface_bpp / 8;
+@@ -489,8 +490,11 @@ static int psbfb_probe(struct drm_fb_helper *helper,
+ /* If the mode will not fit in 32bit then switch to 16bit to get
+ a console on full resolution. The X mode setting server will
+ allocate its own 32bit GEM framebuffer */
+- if (ALIGN(sizes->fb_width * bytespp, 64) * sizes->fb_height >
+- dev_priv->vram_stolen_size) {
++ fb_size = ALIGN(sizes->surface_width * bytespp, 64) *
++ sizes->surface_height;
++ fb_size = ALIGN(fb_size, PAGE_SIZE);
++
++ if (fb_size > dev_priv->vram_stolen_size) {
+ sizes->surface_bpp = 16;
+ sizes->surface_depth = 16;
+ }
+--
+2.20.1
+
--- /dev/null
+From fdc250fa63edc8bfa516c47dd0f2066b1c2a0589 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 13:05:21 +0800
+Subject: drm/mediatek: handle events when enabling/disabling crtc
+
+From: Bibby Hsieh <bibby.hsieh@mediatek.com>
+
+[ Upstream commit 411f5c1eacfebb1f6e40b653d29447cdfe7282aa ]
+
+The driver currently handles vblank events only when updating planes on
+an already enabled CRTC. The atomic update API however allows requesting
+an event when enabling or disabling a CRTC. This currently leads to
+event objects being leaked in the kernel and to events not being sent
+out. Fix it.
+
+Signed-off-by: Bibby Hsieh <bibby.hsieh@mediatek.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index 92ecb9bf982cf..b86ee7d25af36 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -308,6 +308,7 @@ err_pm_runtime_put:
+ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ {
+ struct drm_device *drm = mtk_crtc->base.dev;
++ struct drm_crtc *crtc = &mtk_crtc->base;
+ int i;
+
+ DRM_DEBUG_DRIVER("%s\n", __func__);
+@@ -329,6 +330,13 @@ static void mtk_crtc_ddp_hw_fini(struct mtk_drm_crtc *mtk_crtc)
+ mtk_disp_mutex_unprepare(mtk_crtc->mutex);
+
+ pm_runtime_put(drm->dev);
++
++ if (crtc->state->event && !crtc->state->active) {
++ spin_lock_irq(&crtc->dev->event_lock);
++ drm_crtc_send_vblank_event(crtc, crtc->state->event);
++ crtc->state->event = NULL;
++ spin_unlock_irq(&crtc->dev->event_lock);
++ }
+ }
+
+ static void mtk_crtc_ddp_config(struct drm_crtc *crtc)
+--
+2.20.1
+
--- /dev/null
+From 47792cfd6c0ea6ddad48622dc373b25e10bfbbc2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 14:39:26 +1000
+Subject: drm/nouveau/disp/nv50-: prevent oops when no channel method map
+ provided
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 0e6176c6d286316e9431b4f695940cfac4ffe6c2 ]
+
+The implementations for most channel types contains a map of methods to
+priv registers in order to provide debugging info when a disp exception
+has been raised.
+
+This info is missing from the implementation of PIO channels as they're
+rather simplistic already, however, if an exception is raised by one of
+them, we'd end up triggering a NULL-pointer deref. Not ideal...
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=206299
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+index bcf32d92ee5a9..50e3539f33d22 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/channv50.c
+@@ -74,6 +74,8 @@ nv50_disp_chan_mthd(struct nv50_disp_chan *chan, int debug)
+
+ if (debug > subdev->debug)
+ return;
++ if (!mthd)
++ return;
+
+ for (i = 0; (list = mthd->data[i].mthd) != NULL; i++) {
+ u32 base = chan->head * mthd->addr;
+--
+2.20.1
+
--- /dev/null
+From 4ce5cacfc34f5d8ac11b02958f70c5c087a5ee31 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 15:28:37 +0800
+Subject: drm/nouveau/drm/ttm: Remove set but not used variable 'mem'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2e4534a22794746b11a794b2229b8d58797eccce ]
+
+drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_vram_manager_new:
+drivers/gpu/drm/nouveau/nouveau_ttm.c:66:22: warning: variable mem set but not used [-Wunused-but-set-variable]
+drivers/gpu/drm/nouveau/nouveau_ttm.c: In function nouveau_gart_manager_new:
+drivers/gpu/drm/nouveau/nouveau_ttm.c:106:22: warning: variable mem set but not used [-Wunused-but-set-variable]
+
+They are not used any more, so remove it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_ttm.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_ttm.c b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+index e4b977cc84528..37715a2a2f3f9 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_ttm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_ttm.c
+@@ -63,14 +63,12 @@ nouveau_vram_manager_new(struct ttm_mem_type_manager *man,
+ {
+ struct nouveau_bo *nvbo = nouveau_bo(bo);
+ struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+- struct nouveau_mem *mem;
+ int ret;
+
+ if (drm->client.device.info.ram_size == 0)
+ return -ENOMEM;
+
+ ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+- mem = nouveau_mem(reg);
+ if (ret)
+ return ret;
+
+@@ -103,11 +101,9 @@ nouveau_gart_manager_new(struct ttm_mem_type_manager *man,
+ {
+ struct nouveau_bo *nvbo = nouveau_bo(bo);
+ struct nouveau_drm *drm = nouveau_bdev(bo->bdev);
+- struct nouveau_mem *mem;
+ int ret;
+
+ ret = nouveau_mem_new(&drm->master, nvbo->kind, nvbo->comp, reg);
+- mem = nouveau_mem(reg);
+ if (ret)
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From 071070b565154cf7a6c5d43eebbf398f781e0a09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 06:34:21 +1000
+Subject: drm/nouveau/fault/gv100-: fix memory leak on module unload
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 633cc9beeb6f9b5fa2f17a2a9d0e2790cb6c3de7 ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+index 16ad91c91a7be..f18ce6ff5b7ed 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fault/base.c
+@@ -150,6 +150,7 @@ nvkm_fault_dtor(struct nvkm_subdev *subdev)
+ struct nvkm_fault *fault = nvkm_fault(subdev);
+ int i;
+
++ nvkm_notify_fini(&fault->nrpfb);
+ nvkm_event_fini(&fault->event);
+
+ for (i = 0; i < fault->buffer_nr; i++) {
+--
+2.20.1
+
--- /dev/null
+From 77cbc3e35f7c6e061eb1f3b427682ea58725783e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 14:32:01 +0800
+Subject: drm/nouveau: Fix copy-paste error in
+ nouveau_fence_wait_uevent_handler
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 1eb013473bff5f95b6fe1ca4dd7deda47257b9c2 ]
+
+Like other cases, it should use rcu protected 'chan' rather
+than 'fence->channel' in nouveau_fence_wait_uevent_handler.
+
+Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
+index 412d49bc6e560..ba3883aed4567 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
+@@ -157,7 +157,7 @@ nouveau_fence_wait_uevent_handler(struct nvif_notify *notify)
+
+ fence = list_entry(fctx->pending.next, typeof(*fence), head);
+ chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+- if (nouveau_fence_update(fence->channel, fctx))
++ if (nouveau_fence_update(chan, fctx))
+ ret = NVIF_NOTIFY_DROP;
+ }
+ spin_unlock_irqrestore(&fctx->lock, flags);
+--
+2.20.1
+
--- /dev/null
+From 209874c9a5aa9e4574b470d2efa3dad6767f20de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 11:46:15 +1000
+Subject: drm/nouveau/gr/gk20a,gm200-: add terminators to method lists read
+ from fw
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 7adc77aa0e11f25b0e762859219c70852cd8d56f ]
+
+Method init is typically ordered by class in the FW image as ThreeD,
+TwoD, Compute.
+
+Due to a bug in parsing the FW into our internal format, we've been
+accidentally sending Twod + Compute methods to the ThreeD class, as
+well as Compute methods to the TwoD class - oops.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../gpu/drm/nouveau/nvkm/engine/gr/gk20a.c | 21 ++++++++++---------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+index 500cb08dd6080..b57ab5cea9a10 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gk20a.c
+@@ -143,23 +143,24 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+
+ nent = (fuc.size / sizeof(struct gk20a_fw_av));
+
+- pack = vzalloc((sizeof(*pack) * max_classes) +
+- (sizeof(*init) * (nent + 1)));
++ pack = vzalloc((sizeof(*pack) * (max_classes + 1)) +
++ (sizeof(*init) * (nent + max_classes + 1)));
+ if (!pack) {
+ ret = -ENOMEM;
+ goto end;
+ }
+
+- init = (void *)(pack + max_classes);
++ init = (void *)(pack + max_classes + 1);
+
+- for (i = 0; i < nent; i++) {
+- struct gf100_gr_init *ent = &init[i];
++ for (i = 0; i < nent; i++, init++) {
+ struct gk20a_fw_av *av = &((struct gk20a_fw_av *)fuc.data)[i];
+ u32 class = av->addr & 0xffff;
+ u32 addr = (av->addr & 0xffff0000) >> 14;
+
+ if (prevclass != class) {
+- pack[classidx].init = ent;
++ if (prevclass) /* Add terminator to the method list. */
++ init++;
++ pack[classidx].init = init;
+ pack[classidx].type = class;
+ prevclass = class;
+ if (++classidx >= max_classes) {
+@@ -169,10 +170,10 @@ gk20a_gr_av_to_method(struct gf100_gr *gr, const char *fw_name,
+ }
+ }
+
+- ent->addr = addr;
+- ent->data = av->data;
+- ent->count = 1;
+- ent->pitch = 1;
++ init->addr = addr;
++ init->data = av->data;
++ init->count = 1;
++ init->pitch = 1;
+ }
+
+ *ppack = pack;
+--
+2.20.1
+
--- /dev/null
+From 1448e5e81cad18d71c2effb030c80ea8a7ff0b6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 08:23:06 +1000
+Subject: drm/nouveau/mmu: fix comptag memory leak
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+[ Upstream commit 35e4909b6a2b4005ced3c4238da60d926b78fdea ]
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/core/memory.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/core/memory.c b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+index e85a08ecd9da5..4cc186262d344 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/core/memory.c
++++ b/drivers/gpu/drm/nouveau/nvkm/core/memory.c
+@@ -91,8 +91,8 @@ nvkm_memory_tags_get(struct nvkm_memory *memory, struct nvkm_device *device,
+ }
+
+ refcount_set(&tags->refcount, 1);
++ *ptags = memory->tags = tags;
+ mutex_unlock(&fb->subdev.mutex);
+- *ptags = tags;
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 70913bb1c649209b46143e0a11ddca2644a39da5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 08:46:01 +0300
+Subject: drm/nouveau/secboot/gm20b: initialize pointer in gm20b_secboot_new()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 3613a9bea95a1470dd42e4ed1cc7d86ebe0a2dc0 ]
+
+We accidentally set "psb" which is a no-op instead of "*psb" so it
+generates a static checker warning. We should probably set it before
+the first error return so that it's always initialized.
+
+Fixes: 923f1bd27bf1 ("drm/nouveau/secboot/gm20b: add secure boot support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+index df8b919dcf09b..ace6fefba4280 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/secboot/gm20b.c
+@@ -108,6 +108,7 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ struct gm200_secboot *gsb;
+ struct nvkm_acr *acr;
+
++ *psb = NULL;
+ acr = acr_r352_new(BIT(NVKM_SECBOOT_FALCON_FECS) |
+ BIT(NVKM_SECBOOT_FALCON_PMU));
+ if (IS_ERR(acr))
+@@ -116,10 +117,8 @@ gm20b_secboot_new(struct nvkm_device *device, int index,
+ acr->optional_falcons = BIT(NVKM_SECBOOT_FALCON_PMU);
+
+ gsb = kzalloc(sizeof(*gsb), GFP_KERNEL);
+- if (!gsb) {
+- psb = NULL;
++ if (!gsb)
+ return -ENOMEM;
+- }
+ *psb = &gsb->base;
+
+ ret = nvkm_secboot_ctor(&gm20b_secboot, acr, device, index, &gsb->base);
+--
+2.20.1
+
--- /dev/null
+From 795ef66991842d2c61ae416dffbb596bee4ddfc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Jun 2019 09:47:51 -0400
+Subject: drm: remove the newline for CRC source name.
+
+From: Dingchen Zhang <dingchen.zhang@amd.com>
+
+[ Upstream commit 72a848f5c46bab4c921edc9cbffd1ab273b2be17 ]
+
+userspace may transfer a newline, and this terminating newline
+is replaced by a '\0' to avoid followup issues.
+
+'len-1' is the index to replace the newline of CRC source name.
+
+v3: typo fix (Sam)
+
+v2: update patch subject, body and format. (Sam)
+
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Dingchen Zhang <dingchen.zhang@amd.com>
+Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190610134751.14356-1-dingchen.zhang@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_debugfs_crc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c
+index c88e5ff41add6..a3c756710845e 100644
+--- a/drivers/gpu/drm/drm_debugfs_crc.c
++++ b/drivers/gpu/drm/drm_debugfs_crc.c
+@@ -101,8 +101,8 @@ static ssize_t crc_control_write(struct file *file, const char __user *ubuf,
+ if (IS_ERR(source))
+ return PTR_ERR(source);
+
+- if (source[len] == '\n')
+- source[len] = '\0';
++ if (source[len - 1] == '\n')
++ source[len - 1] = '\0';
+
+ spin_lock_irq(&crc->lock);
+
+--
+2.20.1
+
--- /dev/null
+From fe071ce197aa1483de47a6286f1eed5291128dcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 23:37:58 -0500
+Subject: drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 40efb09a7f53125719e49864da008495e39aaa1e ]
+
+In vmw_cmdbuf_res_add if drm_ht_insert_item fails the allocated memory
+for cres should be released.
+
+Fixes: 18e4a4669c50 ("drm/vmwgfx: Fix compat shader namespace")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+index 3b75af9bf85f3..f27bd7cff579d 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+@@ -210,8 +210,10 @@ int vmw_cmdbuf_res_add(struct vmw_cmdbuf_res_manager *man,
+
+ cres->hash.key = user_key | (res_type << 24);
+ ret = drm_ht_insert_item(&man->resources, &cres->hash);
+- if (unlikely(ret != 0))
++ if (unlikely(ret != 0)) {
++ kfree(cres);
+ goto out_invalid_key;
++ }
+
+ cres->state = VMW_CMDBUF_RES_ADD;
+ cres->res = vmw_resource_reference(res);
+--
+2.20.1
+
--- /dev/null
+From 3372fdd1e034197a2d20c8ce7d497f18f723d4c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:39:46 +0100
+Subject: efi/x86: Don't panic or BUG() on non-critical error conditions
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit e2d68a955e49d61fd0384f23e92058dc9b79be5e ]
+
+The logic in __efi_enter_virtual_mode() does a number of steps in
+sequence, all of which may fail in one way or the other. In most
+cases, we simply print an error and disable EFI runtime services
+support, but in some cases, we BUG() or panic() and bring down the
+system when encountering conditions that we could easily handle in
+the same way.
+
+While at it, replace a pointless page-to-virt-phys conversion with
+one that goes straight from struct page to physical.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: Matthew Garrett <mjg59@google.com>
+Cc: linux-efi@vger.kernel.org
+Link: https://lkml.kernel.org/r/20200103113953.9571-14-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi.c | 28 ++++++++++++++--------------
+ arch/x86/platform/efi/efi_64.c | 9 +++++----
+ 2 files changed, 19 insertions(+), 18 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 5b0275310070e..e7f19dec16b97 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -930,16 +930,14 @@ static void __init __efi_enter_virtual_mode(void)
+
+ if (efi_alloc_page_tables()) {
+ pr_err("Failed to allocate EFI page tables\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ efi_merge_regions();
+ new_memmap = efi_map_regions(&count, &pg_shift);
+ if (!new_memmap) {
+ pr_err("Error reallocating memory, EFI runtime non-functional!\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ pa = __pa(new_memmap);
+@@ -953,8 +951,7 @@ static void __init __efi_enter_virtual_mode(void)
+
+ if (efi_memmap_init_late(pa, efi.memmap.desc_size * count)) {
+ pr_err("Failed to remap late EFI memory map\n");
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
++ goto err;
+ }
+
+ if (efi_enabled(EFI_DBG)) {
+@@ -962,12 +959,11 @@ static void __init __efi_enter_virtual_mode(void)
+ efi_print_memmap();
+ }
+
+- BUG_ON(!efi.systab);
++ if (WARN_ON(!efi.systab))
++ goto err;
+
+- if (efi_setup_page_tables(pa, 1 << pg_shift)) {
+- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+- return;
+- }
++ if (efi_setup_page_tables(pa, 1 << pg_shift))
++ goto err;
+
+ efi_sync_low_kernel_mappings();
+
+@@ -987,9 +983,9 @@ static void __init __efi_enter_virtual_mode(void)
+ }
+
+ if (status != EFI_SUCCESS) {
+- pr_alert("Unable to switch EFI into virtual mode (status=%lx)!\n",
+- status);
+- panic("EFI call to SetVirtualAddressMap() failed!");
++ pr_err("Unable to switch EFI into virtual mode (status=%lx)!\n",
++ status);
++ goto err;
+ }
+
+ /*
+@@ -1016,6 +1012,10 @@ static void __init __efi_enter_virtual_mode(void)
+
+ /* clean DUMMY object */
+ efi_delete_dummy_variable();
++ return;
++
++err:
++ clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
+ }
+
+ void __init efi_enter_virtual_mode(void)
+diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
+index ee5d08f25ce45..6db8f3598c800 100644
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -389,11 +389,12 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
+ return 0;
+
+ page = alloc_page(GFP_KERNEL|__GFP_DMA32);
+- if (!page)
+- panic("Unable to allocate EFI runtime stack < 4GB\n");
++ if (!page) {
++ pr_err("Unable to allocate EFI runtime stack < 4GB\n");
++ return 1;
++ }
+
+- efi_scratch.phys_stack = virt_to_phys(page_address(page));
+- efi_scratch.phys_stack += PAGE_SIZE; /* stack grows down */
++ efi_scratch.phys_stack = page_to_phys(page + 1); /* stack grows down */
+
+ npages = (_etext - _text) >> PAGE_SHIFT;
+ text = __pa(_text);
+--
+2.20.1
+
--- /dev/null
+From d8eae1b8e55de5cdde07fa829eb418934b9ad5cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 12:39:37 +0100
+Subject: efi/x86: Map the entire EFI vendor string before copying it
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit ffc2760bcf2dba0dbef74013ed73eea8310cc52c ]
+
+Fix a couple of issues with the way we map and copy the vendor string:
+- we map only 2 bytes, which usually works since you get at least a
+ page, but if the vendor string happens to cross a page boundary,
+ a crash will result
+- only call early_memunmap() if early_memremap() succeeded, or we will
+ call it with a NULL address which it doesn't like,
+- while at it, switch to early_memremap_ro(), and array indexing rather
+ than pointer dereferencing to read the CHAR16 characters.
+
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Arvind Sankar <nivedita@alum.mit.edu>
+Cc: Matthew Garrett <mjg59@google.com>
+Cc: linux-efi@vger.kernel.org
+Fixes: 5b83683f32b1 ("x86: EFI runtime service support")
+Link: https://lkml.kernel.org/r/20200103113953.9571-5-ardb@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/platform/efi/efi.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 335a62e74a2e9..5b0275310070e 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -480,7 +480,6 @@ void __init efi_init(void)
+ efi_char16_t *c16;
+ char vendor[100] = "unknown";
+ int i = 0;
+- void *tmp;
+
+ #ifdef CONFIG_X86_32
+ if (boot_params.efi_info.efi_systab_hi ||
+@@ -505,14 +504,16 @@ void __init efi_init(void)
+ /*
+ * Show what we know for posterity
+ */
+- c16 = tmp = early_memremap(efi.systab->fw_vendor, 2);
++ c16 = early_memremap_ro(efi.systab->fw_vendor,
++ sizeof(vendor) * sizeof(efi_char16_t));
+ if (c16) {
+- for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i)
+- vendor[i] = *c16++;
++ for (i = 0; i < sizeof(vendor) - 1 && c16[i]; ++i)
++ vendor[i] = c16[i];
+ vendor[i] = '\0';
+- } else
++ early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
++ } else {
+ pr_err("Could not map the firmware vendor!\n");
+- early_memunmap(tmp, 2);
++ }
+
+ pr_info("EFI v%u.%.02u by %s\n",
+ efi.systab->hdr.revision >> 16,
+--
+2.20.1
+
--- /dev/null
+From f30c21afd431f0d192240b80a57e497ac06817f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:25:55 +0530
+Subject: ext4: fix ext4_dax_read/write inode locking sequence for IOCB_NOWAIT
+
+From: Ritesh Harjani <riteshh@linux.ibm.com>
+
+[ Upstream commit f629afe3369e9885fd6e9cc7a4f514b6a65cf9e9 ]
+
+Apparently our current rwsem code doesn't like doing the trylock, then
+lock for real scheme. So change our dax read/write methods to just do the
+trylock for the RWF_NOWAIT case.
+This seems to fix AIM7 regression in some scalable filesystems upto ~25%
+in some cases. Claimed in commit 942491c9e6d6 ("xfs: fix AIM7 regression")
+
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Matthew Bobrowski <mbobrowski@mbobrowski.org>
+Tested-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
+Link: https://lore.kernel.org/r/20191212055557.11151-2-riteshh@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/file.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index f4a24a46245ea..52d155b4e7334 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -40,9 +40,10 @@ static ssize_t ext4_dax_read_iter(struct kiocb *iocb, struct iov_iter *to)
+ struct inode *inode = file_inode(iocb->ki_filp);
+ ssize_t ret;
+
+- if (!inode_trylock_shared(inode)) {
+- if (iocb->ki_flags & IOCB_NOWAIT)
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock_shared(inode))
+ return -EAGAIN;
++ } else {
+ inode_lock_shared(inode);
+ }
+ /*
+@@ -190,9 +191,10 @@ ext4_dax_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ struct inode *inode = file_inode(iocb->ki_filp);
+ ssize_t ret;
+
+- if (!inode_trylock(inode)) {
+- if (iocb->ki_flags & IOCB_NOWAIT)
++ if (iocb->ki_flags & IOCB_NOWAIT) {
++ if (!inode_trylock(inode))
+ return -EAGAIN;
++ } else {
+ inode_lock(inode);
+ }
+ ret = ext4_write_checks(iocb, from);
+--
+2.20.1
+
--- /dev/null
+From 90c6f19e5c60100dc8e491369eb84c019196a918 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:12 +0800
+Subject: ext4, jbd2: ensure panic when aborting with zero errno
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit 51f57b01e4a3c7d7bdceffd84de35144e8c538e7 ]
+
+JBD2_REC_ERR flag used to indicate the errno has been updated when jbd2
+aborted, and then __ext4_abort() and ext4_handle_error() can invoke
+panic if ERRORS_PANIC is specified. But if the journal has been aborted
+with zero errno, jbd2_journal_abort() didn't set this flag so we can
+no longer panic. Fix this by always record the proper errno in the
+journal superblock.
+
+Fixes: 4327ba52afd03 ("ext4, jbd2: ensure entering into panic after recording an error in superblock")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-3-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/checkpoint.c | 2 +-
+ fs/jbd2/journal.c | 15 ++++-----------
+ 2 files changed, 5 insertions(+), 12 deletions(-)
+
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index 26f8d7e46462e..66409cbd3ed54 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -165,7 +165,7 @@ void __jbd2_log_wait_for_space(journal_t *journal)
+ "journal space in %s\n", __func__,
+ journal->j_devname);
+ WARN_ON(1);
+- jbd2_journal_abort(journal, 0);
++ jbd2_journal_abort(journal, -EIO);
+ }
+ write_lock(&journal->j_state_lock);
+ } else {
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 568ca0ca0127c..1a96287f92647 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2142,12 +2142,10 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ __jbd2_journal_abort_hard(journal);
+
+- if (errno) {
+- jbd2_journal_update_sb_errno(journal);
+- write_lock(&journal->j_state_lock);
+- journal->j_flags |= JBD2_REC_ERR;
+- write_unlock(&journal->j_state_lock);
+- }
++ jbd2_journal_update_sb_errno(journal);
++ write_lock(&journal->j_state_lock);
++ journal->j_flags |= JBD2_REC_ERR;
++ write_unlock(&journal->j_state_lock);
+ }
+
+ /**
+@@ -2189,11 +2187,6 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+ * failure to disk. ext3_error, for example, now uses this
+ * functionality.
+ *
+- * Errors which originate from within the journaling layer will NOT
+- * supply an errno; a null errno implies that absolutely no further
+- * writes are done to the journal (unless there are any already in
+- * progress).
+- *
+ */
+
+ void jbd2_journal_abort(journal_t *journal, int errno)
+--
+2.20.1
+
--- /dev/null
+From d7d4062350bf2ab278b8760d4dc9774d03ce65e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 17:41:41 +0800
+Subject: f2fs: fix memleak of kobject
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit fe396ad8e7526f059f7b8c7290d33a1b84adacab ]
+
+If kobject_init_and_add() failed, caller needs to invoke kobject_put()
+to release kobject explicitly.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index b405548202d3b..9a59f49ba4050 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -658,10 +658,12 @@ int __init f2fs_init_sysfs(void)
+
+ ret = kobject_init_and_add(&f2fs_feat, &f2fs_feat_ktype,
+ NULL, "features");
+- if (ret)
++ if (ret) {
++ kobject_put(&f2fs_feat);
+ kset_unregister(&f2fs_kset);
+- else
++ } else {
+ f2fs_proc_root = proc_mkdir("fs/f2fs", NULL);
++ }
+ return ret;
+ }
+
+@@ -682,8 +684,11 @@ int f2fs_register_sysfs(struct f2fs_sb_info *sbi)
+ init_completion(&sbi->s_kobj_unregister);
+ err = kobject_init_and_add(&sbi->s_kobj, &f2fs_sb_ktype, NULL,
+ "%s", sb->s_id);
+- if (err)
++ if (err) {
++ kobject_put(&sbi->s_kobj);
++ wait_for_completion(&sbi->s_kobj_unregister);
+ return err;
++ }
+
+ if (f2fs_proc_root)
+ sbi->s_proc = proc_mkdir(sb->s_id, f2fs_proc_root);
+--
+2.20.1
+
--- /dev/null
+From a472706483980bc713ca724886b732b4dd8f224a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 18:32:16 -0800
+Subject: f2fs: free sysfs kobject
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 820d366736c949ffe698d3b3fe1266a91da1766d ]
+
+Detected kmemleak.
+
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/sysfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
+index 98887187af4cd..b405548202d3b 100644
+--- a/fs/f2fs/sysfs.c
++++ b/fs/f2fs/sysfs.c
+@@ -711,4 +711,5 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi)
+ remove_proc_entry(sbi->sb->s_id, f2fs_proc_root);
+ }
+ kobject_del(&sbi->s_kobj);
++ kobject_put(&sbi->s_kobj);
+ }
+--
+2.20.1
+
--- /dev/null
+From e7512dc810c4a7fa3b9ae1430c56b79864c17501 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:59:58 -0800
+Subject: f2fs: set I_LINKABLE early to avoid wrong access by vfs
+
+From: Jaegeuk Kim <jaegeuk@kernel.org>
+
+[ Upstream commit 5b1dbb082f196278f82b6a15a13848efacb9ff11 ]
+
+This patch moves setting I_LINKABLE early in rename2(whiteout) to avoid the
+below warning.
+
+[ 3189.163385] WARNING: CPU: 3 PID: 59523 at fs/inode.c:358 inc_nlink+0x32/0x40
+[ 3189.246979] Call Trace:
+[ 3189.248707] f2fs_init_inode_metadata+0x2d6/0x440 [f2fs]
+[ 3189.251399] f2fs_add_inline_entry+0x162/0x8c0 [f2fs]
+[ 3189.254010] f2fs_add_dentry+0x69/0xe0 [f2fs]
+[ 3189.256353] f2fs_do_add_link+0xc5/0x100 [f2fs]
+[ 3189.258774] f2fs_rename2+0xabf/0x1010 [f2fs]
+[ 3189.261079] vfs_rename+0x3f8/0xaa0
+[ 3189.263056] ? tomoyo_path_rename+0x44/0x60
+[ 3189.265283] ? do_renameat2+0x49b/0x550
+[ 3189.267324] do_renameat2+0x49b/0x550
+[ 3189.269316] __x64_sys_renameat2+0x20/0x30
+[ 3189.271441] do_syscall_64+0x5a/0x230
+[ 3189.273410] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 3189.275848] RIP: 0033:0x7f270b4d9a49
+
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/namei.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 0ace2c2e3de93..4f0cc0c79d1ee 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -769,6 +769,7 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry,
+
+ if (whiteout) {
+ f2fs_i_links_write(inode, false);
++ inode->i_state |= I_LINKABLE;
+ *whiteout = inode;
+ } else {
+ d_tmpfile(dentry, inode);
+@@ -835,6 +836,12 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ F2FS_I(old_dentry->d_inode)->i_projid)))
+ return -EXDEV;
+
++ if (flags & RENAME_WHITEOUT) {
++ err = f2fs_create_whiteout(old_dir, &whiteout);
++ if (err)
++ return err;
++ }
++
+ err = dquot_initialize(old_dir);
+ if (err)
+ goto out;
+@@ -865,17 +872,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ }
+ }
+
+- if (flags & RENAME_WHITEOUT) {
+- err = f2fs_create_whiteout(old_dir, &whiteout);
+- if (err)
+- goto out_dir;
+- }
+-
+ if (new_inode) {
+
+ err = -ENOTEMPTY;
+ if (old_dir_entry && !f2fs_empty_dir(new_inode))
+- goto out_whiteout;
++ goto out_dir;
+
+ err = -ENOENT;
+ new_entry = f2fs_find_entry(new_dir, &new_dentry->d_name,
+@@ -883,7 +884,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (!new_entry) {
+ if (IS_ERR(new_page))
+ err = PTR_ERR(new_page);
+- goto out_whiteout;
++ goto out_dir;
+ }
+
+ f2fs_balance_fs(sbi, true);
+@@ -915,7 +916,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ err = f2fs_add_link(new_dentry, old_inode);
+ if (err) {
+ f2fs_unlock_op(sbi);
+- goto out_whiteout;
++ goto out_dir;
+ }
+
+ if (old_dir_entry)
+@@ -939,7 +940,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ if (IS_ERR(old_page))
+ err = PTR_ERR(old_page);
+ f2fs_unlock_op(sbi);
+- goto out_whiteout;
++ goto out_dir;
+ }
+ }
+ }
+@@ -958,7 +959,6 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ f2fs_delete_entry(old_entry, old_page, old_dir, NULL);
+
+ if (whiteout) {
+- whiteout->i_state |= I_LINKABLE;
+ set_inode_flag(whiteout, FI_INC_LINK);
+ err = f2fs_add_link(old_dentry, whiteout);
+ if (err)
+@@ -992,15 +992,14 @@ put_out_dir:
+ f2fs_unlock_op(sbi);
+ if (new_page)
+ f2fs_put_page(new_page, 0);
+-out_whiteout:
+- if (whiteout)
+- iput(whiteout);
+ out_dir:
+ if (old_dir_entry)
+ f2fs_put_page(old_dir_page, 0);
+ out_old:
+ f2fs_put_page(old_page, 0);
+ out:
++ if (whiteout)
++ iput(whiteout);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f2e69adc5d5594d3f25e506d794b174b9624237e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 10:14:51 -0600
+Subject: fore200e: Fix incorrect checks of NULL pointer dereference
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit bbd20c939c8aa3f27fa30e86691af250bf92973a ]
+
+In fore200e_send and fore200e_close, the pointers from the arguments
+are dereferenced in the variable declaration block and then checked
+for NULL. The patch fixes these issues by avoiding NULL pointer
+dereferences.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/atm/fore200e.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
+index 99a38115b0a8f..86aab14872fd0 100644
+--- a/drivers/atm/fore200e.c
++++ b/drivers/atm/fore200e.c
+@@ -1504,12 +1504,14 @@ fore200e_open(struct atm_vcc *vcc)
+ static void
+ fore200e_close(struct atm_vcc* vcc)
+ {
+- struct fore200e* fore200e = FORE200E_DEV(vcc->dev);
+ struct fore200e_vcc* fore200e_vcc;
++ struct fore200e* fore200e;
+ struct fore200e_vc_map* vc_map;
+ unsigned long flags;
+
+ ASSERT(vcc);
++ fore200e = FORE200E_DEV(vcc->dev);
++
+ ASSERT((vcc->vpi >= 0) && (vcc->vpi < 1<<FORE200E_VPI_BITS));
+ ASSERT((vcc->vci >= 0) && (vcc->vci < 1<<FORE200E_VCI_BITS));
+
+@@ -1554,10 +1556,10 @@ fore200e_close(struct atm_vcc* vcc)
+ static int
+ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ {
+- struct fore200e* fore200e = FORE200E_DEV(vcc->dev);
+- struct fore200e_vcc* fore200e_vcc = FORE200E_VCC(vcc);
++ struct fore200e* fore200e;
++ struct fore200e_vcc* fore200e_vcc;
+ struct fore200e_vc_map* vc_map;
+- struct host_txq* txq = &fore200e->host_txq;
++ struct host_txq* txq;
+ struct host_txq_entry* entry;
+ struct tpd* tpd;
+ struct tpd_haddr tpd_haddr;
+@@ -1570,9 +1572,18 @@ fore200e_send(struct atm_vcc *vcc, struct sk_buff *skb)
+ unsigned char* data;
+ unsigned long flags;
+
+- ASSERT(vcc);
+- ASSERT(fore200e);
+- ASSERT(fore200e_vcc);
++ if (!vcc)
++ return -EINVAL;
++
++ fore200e = FORE200E_DEV(vcc->dev);
++ fore200e_vcc = FORE200E_VCC(vcc);
++
++ if (!fore200e)
++ return -EINVAL;
++
++ txq = &fore200e->host_txq;
++ if (!fore200e_vcc)
++ return -EINVAL;
+
+ if (!test_bit(ATM_VF_READY, &vcc->flags)) {
+ DPRINTK(1, "VC %d.%d.%d not ready for tx\n", vcc->itf, vcc->vpi, vcc->vpi);
+--
+2.20.1
+
--- /dev/null
+From b841953afb7a0017c96f437027a0770a6c9012f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 10:02:56 +0300
+Subject: ftrace: fpid_next() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit e4075e8bdffd93a9b6d6e1d52fabedceeca5a91b ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+Without patch:
+ # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid
+ dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset
+ id
+ no pid
+ 2+1 records in
+ 2+1 records out
+ 10 bytes copied, 0.000213285 s, 46.9 kB/s
+
+Notice the "id" followed by "no pid".
+
+With the patch:
+ # dd bs=4 skip=1 if=/sys/kernel/tracing/set_ftrace_pid
+ dd: /sys/kernel/tracing/set_ftrace_pid: cannot skip to specified offset
+ id
+ 0+1 records in
+ 0+1 records out
+ 3 bytes copied, 0.000202112 s, 14.8 kB/s
+
+Notice that it only prints "id" and not the "no pid" afterward.
+
+Link: http://lkml.kernel.org/r/4f87c6ad-f114-30bb-8506-c32274ce2992@virtuozzo.com
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/ftrace.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 53795237e9751..0c379cd40bea3 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -6525,9 +6525,10 @@ static void *fpid_next(struct seq_file *m, void *v, loff_t *pos)
+ struct trace_array *tr = m->private;
+ struct trace_pid_list *pid_list = rcu_dereference_sched(tr->function_pids);
+
+- if (v == FTRACE_NO_PIDS)
++ if (v == FTRACE_NO_PIDS) {
++ (*pos)++;
+ return NULL;
+-
++ }
+ return trace_pid_next(pid_list, v, pos);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9e0e406d8a8b22bd19f082eb5621c4cbee576783 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 15:30:45 +0200
+Subject: gianfar: Fix TX timestamping with a stacked DSA driver
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit c26a2c2ddc0115eb088873f5c309cf46b982f522 ]
+
+The driver wrongly assumes that it is the only entity that can set the
+SKBTX_IN_PROGRESS bit of the current skb. Therefore, in the
+gfar_clean_tx_ring function, where the TX timestamp is collected if
+necessary, the aforementioned bit is used to discriminate whether or not
+the TX timestamp should be delivered to the socket's error queue.
+
+But a stacked driver such as a DSA switch can also set the
+SKBTX_IN_PROGRESS bit, which is actually exactly what it should do in
+order to denote that the hardware timestamping process is undergoing.
+
+Therefore, gianfar would misinterpret the "in progress" bit as being its
+own, and deliver a second skb clone in the socket's error queue,
+completely throwing off a PTP process which is not expecting to receive
+it, _even though_ TX timestamping is not enabled for gianfar.
+
+There have been discussions [0] as to whether non-MAC drivers need or
+not to set SKBTX_IN_PROGRESS at all (whose purpose is to avoid sending 2
+timestamps, a sw and a hw one, to applications which only expect one).
+But as of this patch, there are at least 2 PTP drivers that would break
+in conjunction with gianfar: the sja1105 DSA switch and the felix
+switch, by way of its ocelot core driver.
+
+So regardless of that conclusion, fix the gianfar driver to not do stuff
+based on flags set by others and not intended for it.
+
+[0]: https://www.spinics.net/lists/netdev/msg619699.html
+
+Fixes: f0ee7acfcdd4 ("gianfar: Add hardware TX timestamping support")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index c97c4edfa31bc..cf2d1e846a692 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -2685,13 +2685,17 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ skb_dirtytx = tx_queue->skb_dirtytx;
+
+ while ((skb = tx_queue->tx_skbuff[skb_dirtytx])) {
++ bool do_tstamp;
++
++ do_tstamp = (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) &&
++ priv->hwts_tx_en;
+
+ frags = skb_shinfo(skb)->nr_frags;
+
+ /* When time stamping, one additional TxBD must be freed.
+ * Also, we need to dma_unmap_single() the TxPAL.
+ */
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS))
++ if (unlikely(do_tstamp))
+ nr_txbds = frags + 2;
+ else
+ nr_txbds = frags + 1;
+@@ -2705,7 +2709,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ (lstatus & BD_LENGTH_MASK))
+ break;
+
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++ if (unlikely(do_tstamp)) {
+ next = next_txbd(bdp, base, tx_ring_size);
+ buflen = be16_to_cpu(next->length) +
+ GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+@@ -2715,7 +2719,7 @@ static void gfar_clean_tx_ring(struct gfar_priv_tx_q *tx_queue)
+ dma_unmap_single(priv->dev, be32_to_cpu(bdp->bufPtr),
+ buflen, DMA_TO_DEVICE);
+
+- if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_IN_PROGRESS)) {
++ if (unlikely(do_tstamp)) {
+ struct skb_shared_hwtstamps shhwtstamps;
+ u64 *ns = (u64 *)(((uintptr_t)skb->data + 0x10) &
+ ~0x7UL);
+--
+2.20.1
+
--- /dev/null
+From a34e39d1e215b39bb137d9b7b581359adc194b62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 21:26:05 +0800
+Subject: gpio: gpio-grgpio: fix possible sleep-in-atomic-context bugs in
+ grgpio_irq_map/unmap()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit e36eaf94be8f7bc4e686246eed3cf92d845e2ef8 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/gpio/gpio-grgpio.c, 261:
+ request_irq in grgpio_irq_map
+drivers/gpio/gpio-grgpio.c, 255:
+ _raw_spin_lock_irqsave in grgpio_irq_map
+
+drivers/gpio/gpio-grgpio.c, 318:
+ free_irq in grgpio_irq_unmap
+drivers/gpio/gpio-grgpio.c, 299:
+ _raw_spin_lock_irqsave in grgpio_irq_unmap
+
+request_irq() and free_irq() can sleep at runtime.
+
+To fix these bugs, request_irq() and free_irq() are called without
+holding the spinlock.
+
+These bugs are found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20191218132605.10594-1-baijiaju1990@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-grgpio.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpio/gpio-grgpio.c b/drivers/gpio/gpio-grgpio.c
+index 60a1556c570a4..c1be299e5567b 100644
+--- a/drivers/gpio/gpio-grgpio.c
++++ b/drivers/gpio/gpio-grgpio.c
+@@ -258,17 +258,16 @@ static int grgpio_irq_map(struct irq_domain *d, unsigned int irq,
+ lirq->irq = irq;
+ uirq = &priv->uirqs[lirq->index];
+ if (uirq->refcnt == 0) {
++ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ ret = request_irq(uirq->uirq, grgpio_irq_handler, 0,
+ dev_name(priv->dev), priv);
+ if (ret) {
+ dev_err(priv->dev,
+ "Could not request underlying irq %d\n",
+ uirq->uirq);
+-
+- spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+-
+ return ret;
+ }
++ spin_lock_irqsave(&priv->gc.bgpio_lock, flags);
+ }
+ uirq->refcnt++;
+
+@@ -314,8 +313,11 @@ static void grgpio_irq_unmap(struct irq_domain *d, unsigned int irq)
+ if (index >= 0) {
+ uirq = &priv->uirqs[lirq->index];
+ uirq->refcnt--;
+- if (uirq->refcnt == 0)
++ if (uirq->refcnt == 0) {
++ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+ free_irq(uirq->uirq, priv);
++ return;
++ }
+ }
+
+ spin_unlock_irqrestore(&priv->gc.bgpio_lock, flags);
+--
+2.20.1
+
--- /dev/null
+From b3384aaf0b72cd93e71f914e52710e29568efa78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 09:10:47 +0300
+Subject: help_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 9f198a2ac543eaaf47be275531ad5cbd50db3edf ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Mike Marshall <hubcap@omnibond.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/orangefs/orangefs-debugfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
+index 0732cb08173e9..e24738c691f66 100644
+--- a/fs/orangefs/orangefs-debugfs.c
++++ b/fs/orangefs/orangefs-debugfs.c
+@@ -305,6 +305,7 @@ static void *help_start(struct seq_file *m, loff_t *pos)
+
+ static void *help_next(struct seq_file *m, void *v, loff_t *pos)
+ {
++ (*pos)++;
+ gossip_debug(GOSSIP_DEBUGFS_DEBUG, "help_next: start\n");
+
+ return NULL;
+--
+2.20.1
+
--- /dev/null
+From 24d1cf44666e0db30d6ce921ffceaab4438cea4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:15:46 -0700
+Subject: hostap: Adjust indentation in prism2_hostapd_add_sta
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b61156fba74f659d0bc2de8f2dbf5bad9f4b8faf ]
+
+Clang warns:
+
+../drivers/net/wireless/intersil/hostap/hostap_ap.c:2511:3: warning:
+misleading indentation; statement is not part of the previous 'if'
+[-Wmisleading-indentation]
+ if (sta->tx_supp_rates & WLAN_RATE_5M5)
+ ^
+../drivers/net/wireless/intersil/hostap/hostap_ap.c:2509:2: note:
+previous statement is here
+ if (sta->tx_supp_rates & WLAN_RATE_2M)
+ ^
+1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+Fixes: ff1d2767d5a4 ("Add HostAP wireless driver.")
+Link: https://github.com/ClangBuiltLinux/linux/issues/813
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/hostap/hostap_ap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intersil/hostap/hostap_ap.c b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+index 0094b1d2b5770..3ec46f48cfde1 100644
+--- a/drivers/net/wireless/intersil/hostap/hostap_ap.c
++++ b/drivers/net/wireless/intersil/hostap/hostap_ap.c
+@@ -2508,7 +2508,7 @@ static int prism2_hostapd_add_sta(struct ap_data *ap,
+ sta->supported_rates[0] = 2;
+ if (sta->tx_supp_rates & WLAN_RATE_2M)
+ sta->supported_rates[1] = 4;
+- if (sta->tx_supp_rates & WLAN_RATE_5M5)
++ if (sta->tx_supp_rates & WLAN_RATE_5M5)
+ sta->supported_rates[2] = 11;
+ if (sta->tx_supp_rates & WLAN_RATE_11M)
+ sta->supported_rates[3] = 22;
+--
+2.20.1
+
--- /dev/null
+From c31c21154acd4a2ff7f2d705263f20072649f446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 08:42:28 -0500
+Subject: IB/hfi1: Add software counter for ctxt0 seq drop
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 5ffd048698ea5139743acd45e8ab388a683642b8 ]
+
+All other code paths increment some form of drop counter.
+
+This was missed in the original implementation.
+
+Fixes: 82c2611daaf0 ("staging/rdma/hfi1: Handle packets with invalid RHF on context 0")
+Link: https://lore.kernel.org/r/20200106134228.119356.96828.stgit@awfm-01.aw.intel.com
+Reviewed-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 10 ++++++++++
+ drivers/infiniband/hw/hfi1/chip.h | 1 +
+ drivers/infiniband/hw/hfi1/driver.c | 1 +
+ drivers/infiniband/hw/hfi1/hfi.h | 2 ++
+ 4 files changed, 14 insertions(+)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index b09a4b1cf397b..1221faea75a68 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -1687,6 +1687,14 @@ static u64 access_sw_pio_drain(const struct cntr_entry *entry,
+ return dd->verbs_dev.n_piodrain;
+ }
+
++static u64 access_sw_ctx0_seq_drop(const struct cntr_entry *entry,
++ void *context, int vl, int mode, u64 data)
++{
++ struct hfi1_devdata *dd = context;
++
++ return dd->ctx0_seq_drop;
++}
++
+ static u64 access_sw_vtx_wait(const struct cntr_entry *entry,
+ void *context, int vl, int mode, u64 data)
+ {
+@@ -4247,6 +4255,8 @@ static struct cntr_entry dev_cntrs[DEV_CNTR_LAST] = {
+ access_sw_cpu_intr),
+ [C_SW_CPU_RCV_LIM] = CNTR_ELEM("RcvLimit", 0, 0, CNTR_NORMAL,
+ access_sw_cpu_rcv_limit),
++[C_SW_CTX0_SEQ_DROP] = CNTR_ELEM("SeqDrop0", 0, 0, CNTR_NORMAL,
++ access_sw_ctx0_seq_drop),
+ [C_SW_VTX_WAIT] = CNTR_ELEM("vTxWait", 0, 0, CNTR_NORMAL,
+ access_sw_vtx_wait),
+ [C_SW_PIO_WAIT] = CNTR_ELEM("PioWait", 0, 0, CNTR_NORMAL,
+diff --git a/drivers/infiniband/hw/hfi1/chip.h b/drivers/infiniband/hw/hfi1/chip.h
+index 36b04d6300e54..c9a352d8a7e13 100644
+--- a/drivers/infiniband/hw/hfi1/chip.h
++++ b/drivers/infiniband/hw/hfi1/chip.h
+@@ -909,6 +909,7 @@ enum {
+ C_DC_PG_STS_TX_MBE_CNT,
+ C_SW_CPU_INTR,
+ C_SW_CPU_RCV_LIM,
++ C_SW_CTX0_SEQ_DROP,
+ C_SW_VTX_WAIT,
+ C_SW_PIO_WAIT,
+ C_SW_PIO_DRAIN,
+diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c
+index d5277c23cba60..769e114567a03 100644
+--- a/drivers/infiniband/hw/hfi1/driver.c
++++ b/drivers/infiniband/hw/hfi1/driver.c
+@@ -734,6 +734,7 @@ static noinline int skip_rcv_packet(struct hfi1_packet *packet, int thread)
+ {
+ int ret;
+
++ packet->rcd->dd->ctx0_seq_drop++;
+ /* Set up for the next packet */
+ packet->rhqoff += packet->rsize;
+ if (packet->rhqoff >= packet->maxcnt)
+diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h
+index ab981874c71cc..e38de547785d0 100644
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1093,6 +1093,8 @@ struct hfi1_devdata {
+
+ char *boardname; /* human readable board info */
+
++ u64 ctx0_seq_drop;
++
+ /* reset value */
+ u64 z_int_counter;
+ u64 z_rcv_limit;
+--
+2.20.1
+
--- /dev/null
+From 9440888807d0cfe8d008d3b84e05e74d9f8f5ca2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:06:07 +0300
+Subject: ide: serverworks: potential overflow in svwks_set_pio_mode()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ce1f31b4c0b9551dd51874dd5364654ed4ca13ae ]
+
+The "drive->dn" variable is a u8 controlled by root.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ide/serverworks.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ide/serverworks.c b/drivers/ide/serverworks.c
+index a97affca18abe..0f57d45484d1d 100644
+--- a/drivers/ide/serverworks.c
++++ b/drivers/ide/serverworks.c
+@@ -114,6 +114,9 @@ static void svwks_set_pio_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+ struct pci_dev *dev = to_pci_dev(hwif->dev);
+ const u8 pio = drive->pio_mode - XFER_PIO_0;
+
++ if (drive->dn >= ARRAY_SIZE(drive_pci))
++ return;
++
+ pci_write_config_byte(dev, drive_pci[drive->dn], pio_modes[pio]);
+
+ if (svwks_csb_check(dev)) {
+@@ -140,6 +143,9 @@ static void svwks_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
+
+ u8 ultra_enable = 0, ultra_timing = 0, dma_timing = 0;
+
++ if (drive->dn >= ARRAY_SIZE(drive_pci2))
++ return;
++
+ pci_read_config_byte(dev, (0x56|hwif->channel), &ultra_timing);
+ pci_read_config_byte(dev, 0x54, &ultra_enable);
+
+--
+2.20.1
+
--- /dev/null
+From 3c5c214f121e3e05c72dcb5f0b0f1ffa01e5ccf2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jan 2020 17:03:21 -0800
+Subject: Input: edt-ft5x06 - work around first register access error
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit e112324cc0422c046f1cf54c56f333d34fa20885 ]
+
+The EP0700MLP1 returns bogus data on the first register read access
+(reading the threshold parameter from register 0x00):
+
+ edt_ft5x06 2-0038: crc error: 0xfc expected, got 0x40
+
+It ignores writes until then. This patch adds a dummy read after which
+the number of sensors and parameter read/writes work correctly.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Tested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/edt-ft5x06.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
+index 1e18ca0d1b4e1..3fdaa644a82c1 100644
+--- a/drivers/input/touchscreen/edt-ft5x06.c
++++ b/drivers/input/touchscreen/edt-ft5x06.c
+@@ -968,6 +968,7 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ {
+ const struct edt_i2c_chip_data *chip_data;
+ struct edt_ft5x06_ts_data *tsdata;
++ u8 buf[2] = { 0xfc, 0x00 };
+ struct input_dev *input;
+ unsigned long irq_flags;
+ int error;
+@@ -1037,6 +1038,12 @@ static int edt_ft5x06_ts_probe(struct i2c_client *client,
+ return error;
+ }
+
++ /*
++ * Dummy read access. EP0700MLP1 returns bogus data on the first
++ * register read access and ignores writes.
++ */
++ edt_ft5x06_ts_readwrite(tsdata->client, 2, buf, 2, buf);
++
+ edt_ft5x06_ts_set_regs(tsdata);
+ edt_ft5x06_ts_get_defaults(&client->dev, tsdata);
+ edt_ft5x06_ts_get_parameters(tsdata);
+--
+2.20.1
+
--- /dev/null
+From 1be5003814767b849cb0723d4f8de1d07ffdec68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 15:21:47 +0000
+Subject: iommu/arm-smmu-v3: Use WRITE_ONCE() when changing validity of an STE
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit d71e01716b3606a6648df7e5646ae12c75babde4 ]
+
+If, for some bizarre reason, the compiler decided to split up the write
+of STE DWORD 0, we could end up making a partial structure valid.
+
+Although this probably won't happen, follow the example of the
+context-descriptor code and use WRITE_ONCE() to ensure atomicity of the
+write.
+
+Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/arm-smmu-v3.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c
+index eff1f3aa5ef43..6b7664052b5be 100644
+--- a/drivers/iommu/arm-smmu-v3.c
++++ b/drivers/iommu/arm-smmu-v3.c
+@@ -1185,7 +1185,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid,
+ }
+
+ arm_smmu_sync_ste_for_sid(smmu, sid);
+- dst[0] = cpu_to_le64(val);
++ /* See comment in arm_smmu_write_ctx_desc() */
++ WRITE_ONCE(dst[0], cpu_to_le64(val));
+ arm_smmu_sync_ste_for_sid(smmu, sid);
+
+ /* It's likely that we'll want to use the new STE soon */
+--
+2.20.1
+
--- /dev/null
+From cf30e0062947c86afc84b03e409c402a4e465fe5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jan 2020 08:18:07 +0800
+Subject: iommu/vt-d: Fix off-by-one in PASID allocation
+
+From: Jacob Pan <jacob.jun.pan@linux.intel.com>
+
+[ Upstream commit 39d630e332144028f56abba83d94291978e72df1 ]
+
+PASID allocator uses IDR which is exclusive for the end of the
+allocation range. There is no need to decrement pasid_max.
+
+Fixes: af39507305fb ("iommu/vt-d: Apply global PASID in SVA")
+Reported-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-svm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
+index fd8730b2cd46e..5944d3b4dca37 100644
+--- a/drivers/iommu/intel-svm.c
++++ b/drivers/iommu/intel-svm.c
+@@ -377,7 +377,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_
+ /* Do not use PASID 0 in caching mode (virtualised IOMMU) */
+ ret = intel_pasid_alloc_id(svm,
+ !!cap_caching_mode(iommu->cap),
+- pasid_max - 1, GFP_KERNEL);
++ pasid_max, GFP_KERNEL);
+ if (ret < 0) {
+ kfree(svm);
+ kfree(sdev);
+--
+2.20.1
+
--- /dev/null
+From 617d12ffe86fb0c91a7931a8ca6973eca4a565b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 09:52:36 +0800
+Subject: iommu/vt-d: Remove unnecessary WARN_ON_ONCE()
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 857f081426e5aa38313426c13373730f1345fe95 ]
+
+Address field in device TLB invalidation descriptor is qualified
+by the S field. If S field is zero, a single page at page address
+specified by address [63:12] is requested to be invalidated. If S
+field is set, the least significant bit in the address field with
+value 0b (say bit N) indicates the invalidation address range. The
+spec doesn't require the address [N - 1, 0] to be cleared, hence
+remove the unnecessary WARN_ON_ONCE().
+
+Otherwise, the caller might set "mask = MAX_AGAW_PFN_WIDTH" in order
+to invalidating all the cached mappings on an endpoint, and below
+overflow error will be triggered.
+
+[...]
+UBSAN: Undefined behaviour in drivers/iommu/dmar.c:1354:3
+shift exponent 64 is too large for 64-bit type 'long long unsigned int'
+[...]
+
+Reported-and-tested-by: Frank <fgndev@posteo.de>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/dmar.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 7f9824b0609e7..72994d67bc5b9 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -1345,7 +1345,6 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 pfsid,
+ struct qi_desc desc;
+
+ if (mask) {
+- WARN_ON_ONCE(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1));
+ addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1;
+ desc.high = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE;
+ } else
+--
+2.20.1
+
--- /dev/null
+From ca8456c4e8521679e109a7f60359194a4b526e19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:27 +0700
+Subject: ipw2x00: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit ebd77feb27e91bb5fe35a7818b7c13ea7435fb98 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/ipw2x00/ipw2100.c | 7 ++++---
+ drivers/net/wireless/intel/ipw2x00/ipw2200.c | 5 +++--
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2100.c b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+index 910db46db6a12..a3a470976a5c7 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2100.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2100.c
+@@ -3220,8 +3220,9 @@ static void ipw2100_tx_send_data(struct ipw2100_priv *priv)
+ }
+ }
+
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv)
++static void ipw2100_irq_tasklet(unsigned long data)
+ {
++ struct ipw2100_priv *priv = (struct ipw2100_priv *)data;
+ struct net_device *dev = priv->net_dev;
+ unsigned long flags;
+ u32 inta, tmp;
+@@ -6025,7 +6026,7 @@ static void ipw2100_rf_kill(struct work_struct *work)
+ spin_unlock_irqrestore(&priv->low_lock, flags);
+ }
+
+-static void ipw2100_irq_tasklet(struct ipw2100_priv *priv);
++static void ipw2100_irq_tasklet(unsigned long data);
+
+ static const struct net_device_ops ipw2100_netdev_ops = {
+ .ndo_open = ipw2100_open,
+@@ -6155,7 +6156,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
+ INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
+ INIT_DELAYED_WORK(&priv->scan_event, ipw2100_scan_event);
+
+- tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++ tasklet_init(&priv->irq_tasklet,
+ ipw2100_irq_tasklet, (unsigned long)priv);
+
+ /* NOTE: We do not start the deferred work for status checks yet */
+diff --git a/drivers/net/wireless/intel/ipw2x00/ipw2200.c b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+index 9644e7b93645f..04aee2fdba375 100644
+--- a/drivers/net/wireless/intel/ipw2x00/ipw2200.c
++++ b/drivers/net/wireless/intel/ipw2x00/ipw2200.c
+@@ -1959,8 +1959,9 @@ static void notify_wx_assoc_event(struct ipw_priv *priv)
+ wireless_send_event(priv->net_dev, SIOCGIWAP, &wrqu, NULL);
+ }
+
+-static void ipw_irq_tasklet(struct ipw_priv *priv)
++static void ipw_irq_tasklet(unsigned long data)
+ {
++ struct ipw_priv *priv = (struct ipw_priv *)data;
+ u32 inta, inta_mask, handled = 0;
+ unsigned long flags;
+ int rc = 0;
+@@ -10694,7 +10695,7 @@ static int ipw_setup_deferred_work(struct ipw_priv *priv)
+ INIT_WORK(&priv->qos_activate, ipw_bg_qos_activate);
+ #endif /* CONFIG_IPW2200_QOS */
+
+- tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
++ tasklet_init(&priv->irq_tasklet,
+ ipw_irq_tasklet, (unsigned long)priv);
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From bcdea834c77cfc0e4d996ab185f58eaeb492a218 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Dec 2019 15:10:21 +0800
+Subject: irqchip/gic-v3-its: Reference to its_invall_cmd descriptor when
+ building INVALL
+
+From: Zenghui Yu <yuzenghui@huawei.com>
+
+[ Upstream commit 107945227ac5d4c37911c7841b27c64b489ce9a9 ]
+
+It looks like an obvious mistake to use its_mapc_cmd descriptor when
+building the INVALL command block. It so far worked by luck because
+both its_mapc_cmd.col and its_invall_cmd.col sit at the same offset of
+the ITS command descriptor, but we should not rely on it.
+
+Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue")
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/20191202071021.1251-1-yuzenghui@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 050d6e040128d..bf7b69449b438 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -578,7 +578,7 @@ static struct its_collection *its_build_invall_cmd(struct its_node *its,
+ struct its_cmd_desc *desc)
+ {
+ its_encode_cmd(cmd, GITS_CMD_INVALL);
+- its_encode_collection(cmd, desc->its_mapc_cmd.col->col_id);
++ its_encode_collection(cmd, desc->its_invall_cmd.col->col_id);
+
+ its_fixup_cmd(cmd);
+
+--
+2.20.1
+
--- /dev/null
+From 62bfd6a77dfb144d3127f53121666abb948a2b38 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:24:57 +0000
+Subject: irqchip/gic-v3: Only provision redistributors that are enabled in
+ ACPI
+
+From: Marc Zyngier <maz@kernel.org>
+
+[ Upstream commit 926b5dfa6b8dc666ff398044af6906b156e1d949 ]
+
+We currently allocate redistributor region structures for
+individual redistributors when ACPI doesn't present us with
+compact MMIO regions covering multiple redistributors.
+
+It turns out that we allocate these structures even when
+the redistributor is flagged as disabled by ACPI. It works
+fine until someone actually tries to tarse one of these
+structures, and access the corresponding MMIO region.
+
+Instead, track the number of enabled redistributors, and
+only allocate what is required. This makes sure that there
+is no invalid data to misuse.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reported-by: Heyi Guo <guoheyi@huawei.com>
+Tested-by: Heyi Guo <guoheyi@huawei.com>
+Link: https://lore.kernel.org/r/20191216062745.63397-1-guoheyi@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-gic-v3.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index d5912f1ec8848..ac888d7a0b00a 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1347,6 +1347,7 @@ static struct
+ struct redist_region *redist_regs;
+ u32 nr_redist_regions;
+ bool single_redist;
++ int enabled_rdists;
+ u32 maint_irq;
+ int maint_irq_mode;
+ phys_addr_t vcpu_base;
+@@ -1441,8 +1442,10 @@ static int __init gic_acpi_match_gicc(struct acpi_subtable_header *header,
+ * If GICC is enabled and has valid gicr base address, then it means
+ * GICR base is presented via GICC
+ */
+- if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address)
++ if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address) {
++ acpi_data.enabled_rdists++;
+ return 0;
++ }
+
+ /*
+ * It's perfectly valid firmware can pass disabled GICC entry, driver
+@@ -1472,8 +1475,10 @@ static int __init gic_acpi_count_gicr_regions(void)
+
+ count = acpi_table_parse_madt(ACPI_MADT_TYPE_GENERIC_INTERRUPT,
+ gic_acpi_match_gicc, 0);
+- if (count > 0)
++ if (count > 0) {
+ acpi_data.single_redist = true;
++ count = acpi_data.enabled_rdists;
++ }
+
+ return count;
+ }
+--
+2.20.1
+
--- /dev/null
+From cc36a8d70178dda7741ab1dd6155a315be1e0e57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 01:38:43 +0800
+Subject: irqchip/mbigen: Set driver .suppress_bind_attrs to avoid remove
+ problems
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit d6152e6ec9e2171280436f7b31a571509b9287e1 ]
+
+The following crash can be seen for setting
+CONFIG_DEBUG_TEST_DRIVER_REMOVE=y for DT FW (which some people still use):
+
+Hisilicon MBIGEN-V2 60080000.interrupt-controller: Failed to create mbi-gen irqdomain
+Hisilicon MBIGEN-V2: probe of 60080000.interrupt-controller failed with error -12
+
+[...]
+
+Unable to handle kernel paging request at virtual address 0000000000005008
+ Mem abort info:
+ ESR = 0x96000004
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ Data abort info:
+ ISV = 0, ISS = 0x00000004
+ CM = 0, WnR = 0
+ user pgtable: 4k pages, 48-bit VAs, pgdp=0000041fb9990000
+ [0000000000005008] pgd=0000000000000000
+ Internal error: Oops: 96000004 [#1] PREEMPT SMP
+ Modules linked in:
+ CPU: 7 PID: 1 Comm: swapper/0 Not tainted 5.5.0-rc6-00002-g3fc42638a506-dirty #1622
+ Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
+ pstate: 40000085 (nZcv daIf -PAN -UAO)
+ pc : mbigen_set_type+0x38/0x60
+ lr : __irq_set_trigger+0x6c/0x188
+ sp : ffff800014b4b400
+ x29: ffff800014b4b400 x28: 0000000000000007
+ x27: 0000000000000000 x26: 0000000000000000
+ x25: ffff041fd83bd0d4 x24: ffff041fd83bd188
+ x23: 0000000000000000 x22: ffff80001193ce00
+ x21: 0000000000000004 x20: 0000000000000000
+ x19: ffff041fd83bd000 x18: ffffffffffffffff
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: ffff8000119098c8 x14: ffff041fb94ec91c
+ x13: ffff041fb94ec1a1 x12: 0000000000000030
+ x11: 0101010101010101 x10: 0000000000000040
+ x9 : 0000000000000000 x8 : ffff041fb98c6680
+ x7 : ffff800014b4b380 x6 : ffff041fd81636c8
+ x5 : 0000000000000000 x4 : 000000000000025f
+ x3 : 0000000000005000 x2 : 0000000000005008
+ x1 : 0000000000000004 x0 : 0000000080000000
+ Call trace:
+ mbigen_set_type+0x38/0x60
+ __setup_irq+0x744/0x900
+ request_threaded_irq+0xe0/0x198
+ pcie_pme_probe+0x98/0x118
+ pcie_port_probe_service+0x38/0x78
+ really_probe+0xa0/0x3e0
+ driver_probe_device+0x58/0x100
+ __device_attach_driver+0x90/0xb0
+ bus_for_each_drv+0x64/0xc8
+ __device_attach+0xd8/0x138
+ device_initial_probe+0x10/0x18
+ bus_probe_device+0x90/0x98
+ device_add+0x4c4/0x770
+ device_register+0x1c/0x28
+ pcie_port_device_register+0x1e4/0x4f0
+ pcie_portdrv_probe+0x34/0xd8
+ local_pci_probe+0x3c/0xa0
+ pci_device_probe+0x128/0x1c0
+ really_probe+0xa0/0x3e0
+ driver_probe_device+0x58/0x100
+ __device_attach_driver+0x90/0xb0
+ bus_for_each_drv+0x64/0xc8
+ __device_attach+0xd8/0x138
+ device_attach+0x10/0x18
+ pci_bus_add_device+0x4c/0xb8
+ pci_bus_add_devices+0x38/0x88
+ pci_host_probe+0x3c/0xc0
+ pci_host_common_probe+0xf0/0x208
+ hisi_pcie_almost_ecam_probe+0x24/0x30
+ platform_drv_probe+0x50/0xa0
+ really_probe+0xa0/0x3e0
+ driver_probe_device+0x58/0x100
+ device_driver_attach+0x6c/0x90
+ __driver_attach+0x84/0xc8
+ bus_for_each_dev+0x74/0xc8
+ driver_attach+0x20/0x28
+ bus_add_driver+0x148/0x1f0
+ driver_register+0x60/0x110
+ __platform_driver_register+0x40/0x48
+ hisi_pcie_almost_ecam_driver_init+0x1c/0x24
+
+The specific problem here is that the mbigen driver real probe has failed
+as the mbigen_of_create_domain()->of_platform_device_create() call fails,
+the reason for that being that we never destroyed the platform device
+created during the remove test dry run and there is some conflict.
+
+Since we generally would never want to unbind this driver, and to save
+adding a driver tear down path for that, just set the driver
+.suppress_bind_attrs member to avoid this possibility.
+
+Signed-off-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Reviewed-by: Hanjun Guo <guohanjun@huawei.com>
+Link: https://lore.kernel.org/r/1579196323-180137-1-git-send-email-john.garry@huawei.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/irqchip/irq-mbigen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-mbigen.c b/drivers/irqchip/irq-mbigen.c
+index 98b6e1d4b1a68..f7fdbf5d183b9 100644
+--- a/drivers/irqchip/irq-mbigen.c
++++ b/drivers/irqchip/irq-mbigen.c
+@@ -381,6 +381,7 @@ static struct platform_driver mbigen_platform_driver = {
+ .name = "Hisilicon MBIGEN-V2",
+ .of_match_table = mbigen_of_match,
+ .acpi_match_table = ACPI_PTR(mbigen_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = mbigen_device_probe,
+ };
+--
+2.20.1
+
--- /dev/null
+From 079b1293bd835f559327d281cfb895ebd6c12c10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 20:48:56 +0100
+Subject: isdn: don't mark kcapi_proc_exit as __exit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit b33bdf8020c94438269becc6dace9ed49257c4ba ]
+
+As everybody pointed out by now, my patch to clean up CAPI introduced
+a link time warning, as the two parts of the capi driver are now in
+one module and the exit function may need to be called in the error
+path of the init function:
+
+>> WARNING: drivers/isdn/capi/kernelcapi.o(.text+0xea4): Section mismatch in reference from the function kcapi_exit() to the function .exit.text:kcapi_proc_exit()
+ The function kcapi_exit() references a function in an exit section.
+ Often the function kcapi_proc_exit() has valid usage outside the exit section
+ and the fix is to remove the __exit annotation of kcapi_proc_exit.
+
+Remove the incorrect __exit annotation.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: kernelci.org bot <bot@kernelci.org>
+Reported-by: Olof's autobuilder <build@lixom.net>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20191216194909.1983639-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/capi/kcapi_proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/capi/kcapi_proc.c b/drivers/isdn/capi/kcapi_proc.c
+index c94bd12c0f7c6..28cd051f1dfd9 100644
+--- a/drivers/isdn/capi/kcapi_proc.c
++++ b/drivers/isdn/capi/kcapi_proc.c
+@@ -239,7 +239,7 @@ kcapi_proc_init(void)
+ proc_create_seq("capi/driver", 0, NULL, &seq_capi_driver_ops);
+ }
+
+-void __exit
++void
+ kcapi_proc_exit(void)
+ {
+ remove_proc_entry("capi/driver", NULL);
+--
+2.20.1
+
--- /dev/null
+From 3c282077bd85dd0321391847a0a3fbc40afc2a0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 26 Jan 2020 00:09:54 +0000
+Subject: iwlegacy: ensure loop counter addr does not wrap and cause an
+ infinite loop
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit c2f9a4e4a5abfc84c01b738496b3fd2d471e0b18 ]
+
+The loop counter addr is a u16 where as the upper limit of the loop
+is an int. In the unlikely event that the il->cfg->eeprom_size is
+greater than 64K then we end up with an infinite loop since addr will
+wrap around an never reach upper loop limit. Fix this by making addr
+an int.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: be663ab67077 ("iwlwifi: split the drivers for agn and legacy devices 3945/4965")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
+index 6514baf799fef..e16f2597c2199 100644
+--- a/drivers/net/wireless/intel/iwlegacy/common.c
++++ b/drivers/net/wireless/intel/iwlegacy/common.c
+@@ -717,7 +717,7 @@ il_eeprom_init(struct il_priv *il)
+ u32 gp = _il_rd(il, CSR_EEPROM_GP);
+ int sz;
+ int ret;
+- u16 addr;
++ int addr;
+
+ /* allocate eeprom */
+ sz = il->cfg->eeprom_size;
+--
+2.20.1
+
--- /dev/null
+From b791f05101c891a308f0a9a91c1cda89ab4fb214 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:28 +0700
+Subject: iwlegacy: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit da5e57e8a6a3e69dac2937ba63fa86355628fbb2 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlegacy/3945-mac.c | 5 +++--
+ drivers/net/wireless/intel/iwlegacy/4965-mac.c | 5 +++--
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/3945-mac.c b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+index 57e3b6cca2341..b536ec20eaccb 100644
+--- a/drivers/net/wireless/intel/iwlegacy/3945-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/3945-mac.c
+@@ -1392,8 +1392,9 @@ il3945_dump_nic_error_log(struct il_priv *il)
+ }
+
+ static void
+-il3945_irq_tasklet(struct il_priv *il)
++il3945_irq_tasklet(unsigned long data)
+ {
++ struct il_priv *il = (struct il_priv *)data;
+ u32 inta, handled = 0;
+ u32 inta_fh;
+ unsigned long flags;
+@@ -3419,7 +3420,7 @@ il3945_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_init(&il->irq_tasklet,
+- (void (*)(unsigned long))il3945_irq_tasklet,
++ il3945_irq_tasklet,
+ (unsigned long)il);
+ }
+
+diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+index 280cd8ae1696d..6fc51c74cdb86 100644
+--- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c
++++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c
+@@ -4360,8 +4360,9 @@ il4965_synchronize_irq(struct il_priv *il)
+ }
+
+ static void
+-il4965_irq_tasklet(struct il_priv *il)
++il4965_irq_tasklet(unsigned long data)
+ {
++ struct il_priv *il = (struct il_priv *)data;
+ u32 inta, handled = 0;
+ u32 inta_fh;
+ unsigned long flags;
+@@ -6257,7 +6258,7 @@ il4965_setup_deferred_work(struct il_priv *il)
+ timer_setup(&il->watchdog, il_bg_watchdog, 0);
+
+ tasklet_init(&il->irq_tasklet,
+- (void (*)(unsigned long))il4965_irq_tasklet,
++ il4965_irq_tasklet,
+ (unsigned long)il);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From adcd22512186fe7f59de73cbb8d44d246ab0f446 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 31 Jan 2020 15:45:24 +0200
+Subject: iwlwifi: mvm: Fix thermal zone registration
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit baa6cf8450b72dcab11f37c47efce7c5b9b8ad0f ]
+
+Use a unique name when registering a thermal zone. Otherwise, with
+multiple NICS, we hit the following warning during the unregistration.
+
+WARNING: CPU: 2 PID: 3525 at fs/sysfs/group.c:255
+ RIP: 0010:sysfs_remove_group+0x80/0x90
+ Call Trace:
+ dpm_sysfs_remove+0x57/0x60
+ device_del+0x5a/0x350
+ ? sscanf+0x4e/0x70
+ device_unregister+0x1a/0x60
+ hwmon_device_unregister+0x4a/0xa0
+ thermal_remove_hwmon_sysfs+0x175/0x1d0
+ thermal_zone_device_unregister+0x188/0x1e0
+ iwl_mvm_thermal_exit+0xe7/0x100 [iwlmvm]
+ iwl_op_mode_mvm_stop+0x27/0x180 [iwlmvm]
+ _iwl_op_mode_stop.isra.3+0x2b/0x50 [iwlwifi]
+ iwl_opmode_deregister+0x90/0xa0 [iwlwifi]
+ __exit_compat+0x10/0x2c7 [iwlmvm]
+ __x64_sys_delete_module+0x13f/0x270
+ do_syscall_64+0x5a/0x110
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tt.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+index 1232f63278eb6..319103f4b432e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tt.c
+@@ -739,7 +739,8 @@ static struct thermal_zone_device_ops tzone_ops = {
+ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+ {
+ int i;
+- char name[] = "iwlwifi";
++ char name[16];
++ static atomic_t counter = ATOMIC_INIT(0);
+
+ if (!iwl_mvm_is_tt_in_fw(mvm)) {
+ mvm->tz_device.tzone = NULL;
+@@ -749,6 +750,7 @@ static void iwl_mvm_thermal_zone_register(struct iwl_mvm *mvm)
+
+ BUILD_BUG_ON(ARRAY_SIZE(name) >= THERMAL_NAME_LENGTH);
+
++ sprintf(name, "iwlwifi_%u", atomic_inc_return(&counter) & 0xFF);
+ mvm->tz_device.tzone = thermal_zone_device_register(name,
+ IWL_MAX_DTS_TRIPS,
+ IWL_WRITABLE_TRIPS_MSK,
+--
+2.20.1
+
--- /dev/null
+From 6943ad3d97e8a3cf3d10c2666b257be5122fb223 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 10:25:42 +0800
+Subject: jbd2: clear JBD2_ABORT flag before journal_reset to update log tail
+ info when load journal
+
+From: Kai Li <li.kai4@h3c.com>
+
+[ Upstream commit a09decff5c32060639a685581c380f51b14e1fc2 ]
+
+If the journal is dirty when the filesystem is mounted, jbd2 will replay
+the journal but the journal superblock will not be updated by
+journal_reset() because JBD2_ABORT flag is still set (it was set in
+journal_init_common()). This is problematic because when a new transaction
+is then committed, it will be recorded in block 1 (journal->j_tail was set
+to 1 in journal_reset()). If unclean shutdown happens again before the
+journal superblock is updated, the new recorded transaction will not be
+replayed during the next mount (because of stale sb->s_start and
+sb->s_sequence values) which can lead to filesystem corruption.
+
+Fixes: 85e0c4e89c1b ("jbd2: if the journal is aborted then don't allow update of the log tail")
+Signed-off-by: Kai Li <li.kai4@h3c.com>
+Link: https://lore.kernel.org/r/20200111022542.5008-1-li.kai4@h3c.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/journal.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 1a2339f2cb49b..568ca0ca0127c 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1701,6 +1701,11 @@ int jbd2_journal_load(journal_t *journal)
+ journal->j_devname);
+ return -EFSCORRUPTED;
+ }
++ /*
++ * clear JBD2_ABORT flag initialized in journal_init_common
++ * here to update log tail information with the newest seq.
++ */
++ journal->j_flags &= ~JBD2_ABORT;
+
+ /* OK, we've finished with the dynamic journal bits:
+ * reinitialise the dynamic contents of the superblock in memory
+@@ -1708,7 +1713,6 @@ int jbd2_journal_load(journal_t *journal)
+ if (journal_reset(journal))
+ goto recovery_error;
+
+- journal->j_flags &= ~JBD2_ABORT;
+ journal->j_flags |= JBD2_LOADED;
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From 5b52ef19cded9566db47b228e0667edd6d0180f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:13 +0800
+Subject: jbd2: make sure ESHUTDOWN to be recorded in the journal superblock
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit 0e98c084a21177ef136149c6a293b3d1eb33ff92 ]
+
+Commit fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer") want
+to allow jbd2 layer to distinguish shutdown journal abort from other
+error cases. So the ESHUTDOWN should be taken precedence over any other
+errno which has already been recoded after EXT4_FLAGS_SHUTDOWN is set,
+but it only update errno in the journal suoerblock now if the old errno
+is 0.
+
+Fixes: fb7c02445c49 ("ext4: pass -ESHUTDOWN code to jbd2 layer")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-4-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/journal.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index 1a96287f92647..a15a22d209090 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -2133,8 +2133,7 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ if (journal->j_flags & JBD2_ABORT) {
+ write_unlock(&journal->j_state_lock);
+- if (!old_errno && old_errno != -ESHUTDOWN &&
+- errno == -ESHUTDOWN)
++ if (old_errno != -ESHUTDOWN && errno == -ESHUTDOWN)
+ jbd2_journal_update_sb_errno(journal);
+ return;
+ }
+--
+2.20.1
+
--- /dev/null
+From 580717ae7cf104274291723078f5974a3574ceca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 20:46:11 +0800
+Subject: jbd2: switch to use jbd2_journal_abort() when failed to submit the
+ commit record
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+[ Upstream commit d0a186e0d3e7ac05cc77da7c157dae5aa59f95d9 ]
+
+We invoke jbd2_journal_abort() to abort the journal and record errno
+in the jbd2 superblock when committing journal transaction besides the
+failure on submitting the commit record. But there is no need for the
+case and we can also invoke jbd2_journal_abort() instead of
+__jbd2_journal_abort_hard().
+
+Fixes: 818d276ceb83a ("ext4: Add the journal checksum feature")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20191204124614.45424-2-yi.zhang@huawei.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jbd2/commit.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index c321fa06081ce..4200a6fe9599c 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -781,7 +781,7 @@ start_journal_io:
+ err = journal_submit_commit_record(journal, commit_transaction,
+ &cbh, crc32_sum);
+ if (err)
+- __jbd2_journal_abort_hard(journal);
++ jbd2_journal_abort(journal, err);
+ }
+
+ blk_finish_plug(&plug);
+@@ -874,7 +874,7 @@ start_journal_io:
+ err = journal_submit_commit_record(journal, commit_transaction,
+ &cbh, crc32_sum);
+ if (err)
+- __jbd2_journal_abort_hard(journal);
++ jbd2_journal_abort(journal, err);
+ }
+ if (cbh)
+ err = journal_wait_on_commit_record(journal, cbh);
+--
+2.20.1
+
--- /dev/null
+From 7e89c393432eeefff6fbd8e8150eac44e5244f57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Jan 2020 02:14:35 +0900
+Subject: kbuild: use -S instead of -E for precise cc-option test in Kconfig
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit 3bed1b7b9d79ca40e41e3af130931a3225e951a3 ]
+
+Currently, -E (stop after the preprocessing stage) is used to check
+whether the given compiler flag is supported.
+
+While it is faster than -S (or -c), it can be false-positive. You need
+to run the compilation proper to check the flag more precisely.
+
+For example, -E and -S disagree about the support of
+"--param asan-instrument-allocas=1".
+
+$ gcc -Werror --param asan-instrument-allocas=1 -E -x c /dev/null -o /dev/null
+$ echo $?
+0
+
+$ gcc -Werror --param asan-instrument-allocas=1 -S -x c /dev/null -o /dev/null
+cc1: error: invalid --param name ‘asan-instrument-allocas’; did you mean ‘asan-instrument-writes’?
+$ echo $?
+1
+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Kconfig.include | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/Kconfig.include b/scripts/Kconfig.include
+index 3b2861f47709b..79455ad6b3863 100644
+--- a/scripts/Kconfig.include
++++ b/scripts/Kconfig.include
+@@ -20,7 +20,7 @@ success = $(if-success,$(1),y,n)
+
+ # $(cc-option,<flag>)
+ # Return y if the compiler supports <flag>, n otherwise
+-cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -E -x c /dev/null -o /dev/null)
++cc-option = $(success,$(CC) -Werror $(CLANG_FLAGS) $(1) -S -x c /dev/null -o /dev/null)
+
+ # $(ld-option,<flag>)
+ # Return y if the linker supports <flag>, n otherwise
+--
+2.20.1
+
--- /dev/null
+From 447cbf4f29231ffaab05bcc1a9456546c5577f3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Feb 2020 14:03:11 +0900
+Subject: kconfig: fix broken dependency in randconfig-generated .config
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+[ Upstream commit c8fb7d7e48d11520ad24808cfce7afb7b9c9f798 ]
+
+Running randconfig on arm64 using KCONFIG_SEED=0x40C5E904 (e.g. on v5.5)
+produces the .config with CONFIG_EFI=y and CONFIG_CPU_BIG_ENDIAN=y,
+which does not meet the !CONFIG_CPU_BIG_ENDIAN dependency.
+
+This is because the user choice for CONFIG_CPU_LITTLE_ENDIAN vs
+CONFIG_CPU_BIG_ENDIAN is set by randomize_choice_values() after the
+value of CONFIG_EFI is calculated.
+
+When this happens, the has_changed flag should be set.
+
+Currently, it takes the result from the last iteration. It should
+accumulate all the results of the loop.
+
+Fixes: 3b9a19e08960 ("kconfig: loop as long as we changed some symbols in randconfig")
+Reported-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/confdata.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
+index 0dde19cf74865..2caf5fac102a2 100644
+--- a/scripts/kconfig/confdata.c
++++ b/scripts/kconfig/confdata.c
+@@ -1314,7 +1314,7 @@ bool conf_set_all_new_symbols(enum conf_def_mode mode)
+
+ sym_calc_value(csym);
+ if (mode == def_random)
+- has_changed = randomize_choice_values(csym);
++ has_changed |= randomize_choice_values(csym);
+ else {
+ set_all_choice_values(csym);
+ has_changed = true;
+--
+2.20.1
+
--- /dev/null
+From f5416bacf4fed66ca6d7d13c07909319e446e6f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 22:11:58 +0530
+Subject: kselftest: Minimise dependency of get_size on C library interfaces
+
+From: Siddhesh Poyarekar <siddhesh@gotplt.org>
+
+[ Upstream commit 6b64a650f0b2ae3940698f401732988699eecf7a ]
+
+It was observed[1] on arm64 that __builtin_strlen led to an infinite
+loop in the get_size selftest. This is because __builtin_strlen (and
+other builtins) may sometimes result in a call to the C library
+function. The C library implementation of strlen uses an IFUNC
+resolver to load the most efficient strlen implementation for the
+underlying machine and hence has a PLT indirection even for static
+binaries. Because this binary avoids the C library startup routines,
+the PLT initialization never happens and hence the program gets stuck
+in an infinite loop.
+
+On x86_64 the __builtin_strlen just happens to expand inline and avoid
+the call but that is not always guaranteed.
+
+Further, while testing on x86_64 (Fedora 31), it was observed that the
+test also failed with a segfault inside write() because the generated
+code for the write function in glibc seems to access TLS before the
+syscall (probably due to the cancellation point check) and fails
+because TLS is not initialised.
+
+To mitigate these problems, this patch reduces the interface with the
+C library to just the syscall function. The syscall function still
+sets errno on failure, which is undesirable but for now it only
+affects cases where syscalls fail.
+
+[1] https://bugs.linaro.org/show_bug.cgi?id=5479
+
+Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
+Reported-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
+Tested-by: Masami Hiramatsu <masami.hiramatsu@linaro.org>
+Reviewed-by: Tim Bird <tim.bird@sony.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/size/get_size.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+diff --git a/tools/testing/selftests/size/get_size.c b/tools/testing/selftests/size/get_size.c
+index d4b59ab979a09..f55943b6d1e2a 100644
+--- a/tools/testing/selftests/size/get_size.c
++++ b/tools/testing/selftests/size/get_size.c
+@@ -12,23 +12,35 @@
+ * own execution. It also attempts to have as few dependencies
+ * on kernel features as possible.
+ *
+- * It should be statically linked, with startup libs avoided.
+- * It uses no library calls, and only the following 3 syscalls:
++ * It should be statically linked, with startup libs avoided. It uses
++ * no library calls except the syscall() function for the following 3
++ * syscalls:
+ * sysinfo(), write(), and _exit()
+ *
+ * For output, it avoids printf (which in some C libraries
+ * has large external dependencies) by implementing it's own
+ * number output and print routines, and using __builtin_strlen()
++ *
++ * The test may crash if any of the above syscalls fails because in some
++ * libc implementations (e.g. the GNU C Library) errno is saved in
++ * thread-local storage, which does not get initialized due to avoiding
++ * startup libs.
+ */
+
+ #include <sys/sysinfo.h>
+ #include <unistd.h>
++#include <sys/syscall.h>
+
+ #define STDOUT_FILENO 1
+
+ static int print(const char *s)
+ {
+- return write(STDOUT_FILENO, s, __builtin_strlen(s));
++ size_t len = 0;
++
++ while (s[len] != '\0')
++ len++;
++
++ return syscall(SYS_write, STDOUT_FILENO, s, len);
+ }
+
+ static inline char *num_to_str(unsigned long num, char *buf, int len)
+@@ -80,12 +92,12 @@ void _start(void)
+ print("TAP version 13\n");
+ print("# Testing system size.\n");
+
+- ccode = sysinfo(&info);
++ ccode = syscall(SYS_sysinfo, &info);
+ if (ccode < 0) {
+ print("not ok 1");
+ print(test_name);
+ print(" ---\n reason: \"could not get sysinfo\"\n ...\n");
+- _exit(ccode);
++ syscall(SYS_exit, ccode);
+ }
+ print("ok 1");
+ print(test_name);
+@@ -101,5 +113,5 @@ void _start(void)
+ print(" ...\n");
+ print("1..1\n");
+
+- _exit(0);
++ syscall(SYS_exit, 0);
+ }
+--
+2.20.1
+
--- /dev/null
+From 01a91bca27e0d155259cc9e3a286cd983cbbf642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 07:40:43 -0500
+Subject: KVM: s390: ENOTSUPP -> EOPNOTSUPP fixups
+
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+
+[ Upstream commit c611990844c28c61ca4b35ff69d3a2ae95ccd486 ]
+
+There is no ENOTSUPP for userspace.
+
+Reported-by: Julian Wiedmann <jwi@linux.ibm.com>
+Fixes: 519783935451 ("KVM: s390: introduce ais mode modify function")
+Fixes: 2c1a48f2e5ed ("KVM: S390: add new group for flic")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kvm/interrupt.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 05ea466b9e403..3515f2b55eb9e 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -2109,7 +2109,7 @@ static int flic_ais_mode_get_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ return -EINVAL;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ mutex_lock(&fi->ais_lock);
+ ais.simm = fi->simm;
+@@ -2412,7 +2412,7 @@ static int modify_ais_mode(struct kvm *kvm, struct kvm_device_attr *attr)
+ int ret = 0;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&req, (void __user *)attr->addr, sizeof(req)))
+ return -EFAULT;
+@@ -2492,7 +2492,7 @@ static int flic_ais_mode_set_all(struct kvm *kvm, struct kvm_device_attr *attr)
+ struct kvm_s390_ais_all ais;
+
+ if (!test_kvm_facility(kvm, 72))
+- return -ENOTSUPP;
++ return -EOPNOTSUPP;
+
+ if (copy_from_user(&ais, (void __user *)attr->addr, sizeof(ais)))
+ return -EFAULT;
+--
+2.20.1
+
--- /dev/null
+From 58767b0f0399225ad3f4156b64065bd8a01419d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 23:02:55 +0200
+Subject: leds: pca963x: Fix open-drain initialization
+
+From: Zahari Petkov <zahari@balena.io>
+
+[ Upstream commit 697529091ac7a0a90ca349b914bb30641c13c753 ]
+
+Before commit bb29b9cccd95 ("leds: pca963x: Add bindings to invert
+polarity") Mode register 2 was initialized directly with either 0x01
+or 0x05 for open-drain or totem pole (push-pull) configuration.
+
+Afterwards, MODE2 initialization started using bitwise operations on
+top of the default MODE2 register value (0x05). Using bitwise OR for
+setting OUTDRV with 0x01 and 0x05 does not produce correct results.
+When open-drain is used, instead of setting OUTDRV to 0, the driver
+keeps it as 1:
+
+Open-drain: 0x05 | 0x01 -> 0x05 (0b101 - incorrect)
+Totem pole: 0x05 | 0x05 -> 0x05 (0b101 - correct but still wrong)
+
+Now OUTDRV setting uses correct bitwise operations for initialization:
+
+Open-drain: 0x05 & ~0x04 -> 0x01 (0b001 - correct)
+Totem pole: 0x05 | 0x04 -> 0x05 (0b101 - correct)
+
+Additional MODE2 register definitions are introduced now as well.
+
+Fixes: bb29b9cccd95 ("leds: pca963x: Add bindings to invert polarity")
+Signed-off-by: Zahari Petkov <zahari@balena.io>
+Signed-off-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/leds/leds-pca963x.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/leds/leds-pca963x.c b/drivers/leds/leds-pca963x.c
+index 5c0908113e388..bbcde13b77f16 100644
+--- a/drivers/leds/leds-pca963x.c
++++ b/drivers/leds/leds-pca963x.c
+@@ -43,6 +43,8 @@
+ #define PCA963X_LED_PWM 0x2 /* Controlled through PWM */
+ #define PCA963X_LED_GRP_PWM 0x3 /* Controlled through PWM/GRPPWM */
+
++#define PCA963X_MODE2_OUTDRV 0x04 /* Open-drain or totem pole */
++#define PCA963X_MODE2_INVRT 0x10 /* Normal or inverted direction */
+ #define PCA963X_MODE2_DMBLNK 0x20 /* Enable blinking */
+
+ #define PCA963X_MODE1 0x00
+@@ -462,12 +464,12 @@ static int pca963x_probe(struct i2c_client *client,
+ PCA963X_MODE2);
+ /* Configure output: open-drain or totem pole (push-pull) */
+ if (pdata->outdrv == PCA963X_OPEN_DRAIN)
+- mode2 |= 0x01;
++ mode2 &= ~PCA963X_MODE2_OUTDRV;
+ else
+- mode2 |= 0x05;
++ mode2 |= PCA963X_MODE2_OUTDRV;
+ /* Configure direction: normal or inverted */
+ if (pdata->dir == PCA963X_INVERTED)
+- mode2 |= 0x10;
++ mode2 |= PCA963X_MODE2_INVRT;
+ i2c_smbus_write_byte_data(pca963x->chip->client, PCA963X_MODE2,
+ mode2);
+ }
+--
+2.20.1
+
--- /dev/null
+From 0decc70afd748e4112d3a4ee2b60e7d512c326f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:16:37 -0800
+Subject: lib/scatterlist.c: adjust indentation in __sg_alloc_table
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4e456fee215677584cafa7f67298a76917e89c64 ]
+
+Clang warns:
+
+ ../lib/scatterlist.c:314:5: warning: misleading indentation; statement
+ is not part of the previous 'if' [-Wmisleading-indentation]
+ return -ENOMEM;
+ ^
+ ../lib/scatterlist.c:311:4: note: previous statement is here
+ if (prv)
+ ^
+ 1 warning generated.
+
+This warning occurs because there is a space before the tab on this
+line. Remove it so that the indentation is consistent with the Linux
+kernel coding style and clang no longer warns.
+
+Link: http://lkml.kernel.org/r/20191218033606.11942-1-natechancellor@gmail.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/830
+Fixes: edce6820a9fd ("scatterlist: prevent invalid free when alloc fails")
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/scatterlist.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index 8c3036c37ba0e..60e7eca2f4bed 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -305,7 +305,7 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
+ if (prv)
+ table->nents = ++table->orig_nents;
+
+- return -ENOMEM;
++ return -ENOMEM;
+ }
+
+ sg_init_table(sg, alloc_size);
+--
+2.20.1
+
--- /dev/null
+From 0fd131e863d2260837b7338ccc254245c2a0e67c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 16 Nov 2019 23:38:40 +0100
+Subject: media: cx23885: Add support for AVerMedia CE310B
+
+From: Forest Crossman <cyrozap@gmail.com>
+
+[ Upstream commit dc4cac67e13515835ed8081d510aa507aacb013b ]
+
+The AVerMedia CE310B is a simple composite + S-Video + stereo audio
+capture card, and uses only the CX23888 to perform all of these
+functions.
+
+I've tested both video inputs and the audio interface and confirmed that
+they're all working. However, there are some issues:
+
+* Sometimes when I switch inputs the video signal turns black and can't
+ be recovered until the system is rebooted. I haven't been able to
+ determine the cause of this behavior, nor have I found a solution to
+ fix it or any workarounds other than rebooting.
+* The card sometimes seems to have trouble syncing to the video signal,
+ and some of the VBI data appears as noise at the top of the frame, but
+ I assume that to be a result of my very noisy RF environment and the
+ card's unshielded input traces rather than a configuration issue.
+
+Signed-off-by: Forest Crossman <cyrozap@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx23885/cx23885-cards.c | 24 +++++++++++++++++++++++
+ drivers/media/pci/cx23885/cx23885-video.c | 3 ++-
+ drivers/media/pci/cx23885/cx23885.h | 1 +
+ 3 files changed, 27 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c
+index ed3210dc50bc2..642aefdbb7bb6 100644
+--- a/drivers/media/pci/cx23885/cx23885-cards.c
++++ b/drivers/media/pci/cx23885/cx23885-cards.c
+@@ -811,6 +811,25 @@ struct cx23885_board cx23885_boards[] = {
+ .name = "Hauppauge WinTV-Starburst2",
+ .portb = CX23885_MPEG_DVB,
+ },
++ [CX23885_BOARD_AVERMEDIA_CE310B] = {
++ .name = "AVerMedia CE310B",
++ .porta = CX23885_ANALOG_VIDEO,
++ .force_bff = 1,
++ .input = {{
++ .type = CX23885_VMUX_COMPOSITE1,
++ .vmux = CX25840_VIN1_CH1 |
++ CX25840_NONE_CH2 |
++ CX25840_NONE0_CH3,
++ .amux = CX25840_AUDIO7,
++ }, {
++ .type = CX23885_VMUX_SVIDEO,
++ .vmux = CX25840_VIN8_CH1 |
++ CX25840_NONE_CH2 |
++ CX25840_VIN7_CH3 |
++ CX25840_SVIDEO_ON,
++ .amux = CX25840_AUDIO7,
++ } },
++ },
+ };
+ const unsigned int cx23885_bcount = ARRAY_SIZE(cx23885_boards);
+
+@@ -1134,6 +1153,10 @@ struct cx23885_subid cx23885_subids[] = {
+ .subvendor = 0x0070,
+ .subdevice = 0xf02a,
+ .card = CX23885_BOARD_HAUPPAUGE_STARBURST2,
++ }, {
++ .subvendor = 0x1461,
++ .subdevice = 0x3100,
++ .card = CX23885_BOARD_AVERMEDIA_CE310B,
+ },
+ };
+ const unsigned int cx23885_idcount = ARRAY_SIZE(cx23885_subids);
+@@ -2358,6 +2381,7 @@ void cx23885_card_setup(struct cx23885_dev *dev)
+ case CX23885_BOARD_DVBSKY_T982:
+ case CX23885_BOARD_VIEWCAST_260E:
+ case CX23885_BOARD_VIEWCAST_460E:
++ case CX23885_BOARD_AVERMEDIA_CE310B:
+ dev->sd_cx25840 = v4l2_i2c_new_subdev(&dev->v4l2_dev,
+ &dev->i2c_bus[2].i2c_adap,
+ "cx25840", 0x88 >> 1, NULL);
+diff --git a/drivers/media/pci/cx23885/cx23885-video.c b/drivers/media/pci/cx23885/cx23885-video.c
+index f8a3deadc77a1..2a20c7165e1e8 100644
+--- a/drivers/media/pci/cx23885/cx23885-video.c
++++ b/drivers/media/pci/cx23885/cx23885-video.c
+@@ -268,7 +268,8 @@ static int cx23885_video_mux(struct cx23885_dev *dev, unsigned int input)
+ (dev->board == CX23885_BOARD_MYGICA_X8507) ||
+ (dev->board == CX23885_BOARD_AVERMEDIA_HC81R) ||
+ (dev->board == CX23885_BOARD_VIEWCAST_260E) ||
+- (dev->board == CX23885_BOARD_VIEWCAST_460E)) {
++ (dev->board == CX23885_BOARD_VIEWCAST_460E) ||
++ (dev->board == CX23885_BOARD_AVERMEDIA_CE310B)) {
+ /* Configure audio routing */
+ v4l2_subdev_call(dev->sd_cx25840, audio, s_routing,
+ INPUT(input)->amux, 0, 0);
+diff --git a/drivers/media/pci/cx23885/cx23885.h b/drivers/media/pci/cx23885/cx23885.h
+index cf965efabe666..7bbd62cc993ef 100644
+--- a/drivers/media/pci/cx23885/cx23885.h
++++ b/drivers/media/pci/cx23885/cx23885.h
+@@ -111,6 +111,7 @@
+ #define CX23885_BOARD_HAUPPAUGE_STARBURST2 59
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_DVB_885 60
+ #define CX23885_BOARD_HAUPPAUGE_QUADHD_ATSC_885 61
++#define CX23885_BOARD_AVERMEDIA_CE310B 62
+
+ #define GPIO_0 0x00000001
+ #define GPIO_1 0x00000002
+--
+2.20.1
+
--- /dev/null
+From b48f69e45c2ff05b5464b8288e3770ca20329117 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 08:55:24 +0100
+Subject: media: i2c: mt9v032: fix enum mbus codes and frame sizes
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 1451d5ae351d938a0ab1677498c893f17b9ee21d ]
+
+This driver supports both the mt9v032 (color) and the mt9v022 (mono)
+sensors. Depending on which sensor is used, the format from the sensor is
+different. The format.code inside the dev struct holds this information.
+The enum mbus and enum frame sizes need to take into account both type of
+sensors, not just the color one. To solve this, use the format.code in
+these functions instead of the hardcoded bayer color format (which is only
+used for mt9v032).
+
+[Sakari Ailus: rewrapped commit message]
+
+Suggested-by: Wenyou Yang <wenyou.yang@microchip.com>
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/mt9v032.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/i2c/mt9v032.c b/drivers/media/i2c/mt9v032.c
+index f74730d24d8fe..04788692c9ff4 100644
+--- a/drivers/media/i2c/mt9v032.c
++++ b/drivers/media/i2c/mt9v032.c
+@@ -431,10 +431,12 @@ static int mt9v032_enum_mbus_code(struct v4l2_subdev *subdev,
+ struct v4l2_subdev_pad_config *cfg,
+ struct v4l2_subdev_mbus_code_enum *code)
+ {
++ struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
+ if (code->index > 0)
+ return -EINVAL;
+
+- code->code = MEDIA_BUS_FMT_SGRBG10_1X10;
++ code->code = mt9v032->format.code;
+ return 0;
+ }
+
+@@ -442,7 +444,11 @@ static int mt9v032_enum_frame_size(struct v4l2_subdev *subdev,
+ struct v4l2_subdev_pad_config *cfg,
+ struct v4l2_subdev_frame_size_enum *fse)
+ {
+- if (fse->index >= 3 || fse->code != MEDIA_BUS_FMT_SGRBG10_1X10)
++ struct mt9v032 *mt9v032 = to_mt9v032(subdev);
++
++ if (fse->index >= 3)
++ return -EINVAL;
++ if (mt9v032->format.code != fse->code)
+ return -EINVAL;
+
+ fse->min_width = MT9V032_WINDOW_WIDTH_DEF / (1 << fse->index);
+--
+2.20.1
+
--- /dev/null
+From 804e6c8ddb39903008dbf258caf29d98fd710ca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 11:34:01 +0100
+Subject: media: sti: bdisp: fix a possible sleep-in-atomic-context bug in
+ bdisp_device_run()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit bb6d42061a05d71dd73f620582d9e09c8fbf7f5b ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/media/platform/sti/bdisp/bdisp-hw.c, 385:
+ msleep in bdisp_hw_reset
+drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 341:
+ bdisp_hw_reset in bdisp_device_run
+drivers/media/platform/sti/bdisp/bdisp-v4l2.c, 317:
+ _raw_spin_lock_irqsave in bdisp_device_run
+
+To fix this bug, msleep() is replaced with udelay().
+
+This bug is found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Fabien Dessenne <fabien.dessenne@st.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/sti/bdisp/bdisp-hw.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/sti/bdisp/bdisp-hw.c b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+index 26d9fa7aeb5f2..d57f659d740a1 100644
+--- a/drivers/media/platform/sti/bdisp/bdisp-hw.c
++++ b/drivers/media/platform/sti/bdisp/bdisp-hw.c
+@@ -14,8 +14,8 @@
+ #define MAX_SRC_WIDTH 2048
+
+ /* Reset & boot poll config */
+-#define POLL_RST_MAX 50
+-#define POLL_RST_DELAY_MS 20
++#define POLL_RST_MAX 500
++#define POLL_RST_DELAY_MS 2
+
+ enum bdisp_target_plan {
+ BDISP_RGB,
+@@ -382,7 +382,7 @@ int bdisp_hw_reset(struct bdisp_dev *bdisp)
+ for (i = 0; i < POLL_RST_MAX; i++) {
+ if (readl(bdisp->regs + BLT_STA1) & BLT_STA1_IDLE)
+ break;
+- msleep(POLL_RST_DELAY_MS);
++ udelay(POLL_RST_DELAY_MS * 1000);
+ }
+ if (i == POLL_RST_MAX)
+ dev_err(bdisp->dev, "Reset timeout\n");
+--
+2.20.1
+
--- /dev/null
+From 2f1e94ebe53317737530dc9c64bd4a7fcb7d2022 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Dec 2019 22:11:40 +0100
+Subject: media: v4l2-device.h: Explicitly compare grp{id,mask} to zero in
+ v4l2_device macros
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit afb34781620274236bd9fc9246e22f6963ef5262 ]
+
+When building with Clang + -Wtautological-constant-compare, several of
+the ivtv and cx18 drivers warn along the lines of:
+
+ drivers/media/pci/cx18/cx18-driver.c:1005:21: warning: converting the
+ result of '<<' to a boolean always evaluates to true
+ [-Wtautological-constant-compare]
+ cx18_call_hw(cx, CX18_HW_GPIO_RESET_CTRL,
+ ^
+ drivers/media/pci/cx18/cx18-cards.h:18:37: note: expanded from macro
+ 'CX18_HW_GPIO_RESET_CTRL'
+ #define CX18_HW_GPIO_RESET_CTRL (1 << 6)
+ ^
+ 1 warning generated.
+
+This warning happens because the shift operation is implicitly converted
+to a boolean in v4l2_device_mask_call_all before being negated. This can
+be solved by just comparing the mask result to 0 explicitly so that
+there is no boolean conversion. The ultimate goal is to enable
+-Wtautological-compare globally because there are several subwarnings
+that would be helpful to have.
+
+For visual consistency and avoidance of these warnings in the future,
+all of the implicitly boolean conversions in the v4l2_device macros
+are converted to explicit ones as well.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/752
+
+Reviewed-by: Ezequiel Garcia <ezequiel@collabora.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/media/v4l2-device.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
+index b330e4a08a6b8..40840fec337ca 100644
+--- a/include/media/v4l2-device.h
++++ b/include/media/v4l2-device.h
+@@ -372,7 +372,7 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ struct v4l2_subdev *__sd; \
+ \
+ __v4l2_device_call_subdevs_p(v4l2_dev, __sd, \
+- !(grpid) || __sd->grp_id == (grpid), o, f , \
++ (grpid) == 0 || __sd->grp_id == (grpid), o, f , \
+ ##args); \
+ } while (0)
+
+@@ -404,7 +404,7 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ ({ \
+ struct v4l2_subdev *__sd; \
+ __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, \
+- !(grpid) || __sd->grp_id == (grpid), o, f , \
++ (grpid) == 0 || __sd->grp_id == (grpid), o, f , \
+ ##args); \
+ })
+
+@@ -432,8 +432,8 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ struct v4l2_subdev *__sd; \
+ \
+ __v4l2_device_call_subdevs_p(v4l2_dev, __sd, \
+- !(grpmsk) || (__sd->grp_id & (grpmsk)), o, f , \
+- ##args); \
++ (grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o, \
++ f , ##args); \
+ } while (0)
+
+ /**
+@@ -463,8 +463,8 @@ static inline void v4l2_subdev_notify(struct v4l2_subdev *sd,
+ ({ \
+ struct v4l2_subdev *__sd; \
+ __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, \
+- !(grpmsk) || (__sd->grp_id & (grpmsk)), o, f , \
+- ##args); \
++ (grpmsk) == 0 || (__sd->grp_id & (grpmsk)), o, \
++ f , ##args); \
+ })
+
+
+--
+2.20.1
+
--- /dev/null
+From 4077127e98aeb17c6a6040b83ed14cfc8f901d94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 18:44:34 +0530
+Subject: microblaze: Prevent the overflow of the start
+
+From: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+
+[ Upstream commit 061d2c1d593076424c910cb1b64ecdb5c9a6923f ]
+
+In case the start + cache size is more than the max int the
+start overflows.
+Prevent the same.
+
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/microblaze/kernel/cpu/cache.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/microblaze/kernel/cpu/cache.c b/arch/microblaze/kernel/cpu/cache.c
+index 0bde47e4fa694..dcba53803fa5f 100644
+--- a/arch/microblaze/kernel/cpu/cache.c
++++ b/arch/microblaze/kernel/cpu/cache.c
+@@ -92,7 +92,8 @@ static inline void __disable_dcache_nomsr(void)
+ #define CACHE_LOOP_LIMITS(start, end, cache_line_length, cache_size) \
+ do { \
+ int align = ~(cache_line_length - 1); \
+- end = min(start + cache_size, end); \
++ if (start < UINT_MAX - cache_size) \
++ end = min(start + cache_size, end); \
+ start &= align; \
+ } while (0)
+
+--
+2.20.1
+
--- /dev/null
+From c22b172d636e11a37e4f073cc0a0cdf371c41877 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 09:30:42 +0800
+Subject: MIPS: Loongson: Fix potential NULL dereference in
+ loongson3_platform_init()
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 72d052e28d1d2363f9107be63ef3a3afdea6143c ]
+
+If kzalloc fails, it should return -ENOMEM, otherwise may trigger a NULL
+pointer dereference.
+
+Fixes: 3adeb2566b9b ("MIPS: Loongson: Improve LEFI firmware interface")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/loongson64/loongson-3/platform.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/mips/loongson64/loongson-3/platform.c b/arch/mips/loongson64/loongson-3/platform.c
+index 25a97cc0ee336..0db4cc3196ebd 100644
+--- a/arch/mips/loongson64/loongson-3/platform.c
++++ b/arch/mips/loongson64/loongson-3/platform.c
+@@ -31,6 +31,9 @@ static int __init loongson3_platform_init(void)
+ continue;
+
+ pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL);
++ if (!pdev)
++ return -ENOMEM;
++
+ pdev->name = loongson_sysconf.sensors[i].name;
+ pdev->id = loongson_sysconf.sensors[i].id;
+ pdev->dev.platform_data = &loongson_sysconf.sensors[i];
+--
+2.20.1
+
--- /dev/null
+From 0f4f7907a4cf53a64c4d09e71410c0e881a1f13b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 22:51:44 +0100
+Subject: mlx5: work around high stack usage with gcc
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 42ae1a5c76691928ed217c7e40269db27f5225e9 ]
+
+In some configurations, gcc tries too hard to optimize this code:
+
+drivers/net/ethernet/mellanox/mlx5/core/en_stats.c: In function 'mlx5e_grp_sw_update_stats':
+drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:302:1: error: the frame size of 1336 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+As was stated in the bug report, the reason is that gcc runs into a corner
+case in the register allocator that is rather hard to fix in a good way.
+
+As there is an easy way to work around it, just add a comment and the
+barrier that stops gcc from trying to overoptimize the function.
+
+Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92657
+Cc: Adhemerval Zanella <adhemerval.zanella@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+index 8255d797ea943..9a68dee588c1a 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -211,6 +211,9 @@ void mlx5e_grp_sw_update_stats(struct mlx5e_priv *priv)
+ s->tx_tls_resync_bytes += sq_stats->tls_resync_bytes;
+ #endif
+ s->tx_cqes += sq_stats->cqes;
++
++ /* https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92657 */
++ barrier();
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 66fae347374aa138f242b7a232cb6f9004235045 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 19:26:28 +0200
+Subject: mlxsw: spectrum_dpipe: Add missing error path
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 3a99cbb6fa7bca1995586ec2dc21b0368aad4937 ]
+
+In case devlink_dpipe_entry_ctx_prepare() failed, release RTNL that was
+previously taken and free the memory allocated by
+mlxsw_sp_erif_entry_prepare().
+
+Fixes: 2ba5999f009d ("mlxsw: spectrum: Add Support for erif table entries access")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+index 41e607a14846d..4fe193c4fa55d 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dpipe.c
+@@ -215,7 +215,7 @@ mlxsw_sp_dpipe_table_erif_entries_dump(void *priv, bool counters_enabled,
+ start_again:
+ err = devlink_dpipe_entry_ctx_prepare(dump_ctx);
+ if (err)
+- return err;
++ goto err_ctx_prepare;
+ j = 0;
+ for (; i < rif_count; i++) {
+ struct mlxsw_sp_rif *rif = mlxsw_sp_rif_by_index(mlxsw_sp, i);
+@@ -247,6 +247,7 @@ start_again:
+ return 0;
+ err_entry_append:
+ err_entry_get:
++err_ctx_prepare:
+ rtnl_unlock();
+ devlink_dpipe_entry_clear(&entry);
+ return err;
+--
+2.20.1
+
--- /dev/null
+From 4d9b7ec755f316deb6f4cda53d48921f778b7d0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 13:32:21 +0100
+Subject: module: avoid setting info->name early in case we can fall back to
+ info->mod->name
+
+From: Jessica Yu <jeyu@kernel.org>
+
+[ Upstream commit 708e0ada1916be765b7faa58854062f2bc620bbf ]
+
+In setup_load_info(), info->name (which contains the name of the module,
+mostly used for early logging purposes before the module gets set up)
+gets unconditionally assigned if .modinfo is missing despite the fact
+that there is an if (!info->name) check near the end of the function.
+Avoid assigning a placeholder string to info->name if .modinfo doesn't
+exist, so that we can fall back to info->mod->name later on.
+
+Fixes: 5fdc7db6448a ("module: setup load info before module_sig_check()")
+Reviewed-by: Miroslav Benes <mbenes@suse.cz>
+Signed-off-by: Jessica Yu <jeyu@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/module.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/module.c b/kernel/module.c
+index 70a75a7216abb..20fc0efc679c0 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2980,9 +2980,7 @@ static int setup_load_info(struct load_info *info, int flags)
+
+ /* Try to find a name early so we can log errors with a module name */
+ info->index.info = find_sec(info, ".modinfo");
+- if (!info->index.info)
+- info->name = "(missing .modinfo section)";
+- else
++ if (info->index.info)
+ info->name = get_modinfo(info, "name");
+
+ /* Find internal symbols and strings. */
+@@ -2997,14 +2995,15 @@ static int setup_load_info(struct load_info *info, int flags)
+ }
+
+ if (info->index.sym == 0) {
+- pr_warn("%s: module has no symbols (stripped?)\n", info->name);
++ pr_warn("%s: module has no symbols (stripped?)\n",
++ info->name ?: "(missing .modinfo section or name field)");
+ return -ENOEXEC;
+ }
+
+ info->index.mod = find_sec(info, ".gnu.linkonce.this_module");
+ if (!info->index.mod) {
+ pr_warn("%s: No module found in object\n",
+- info->name ?: "(missing .modinfo name field)");
++ info->name ?: "(missing .modinfo section or name field)");
+ return -ENOEXEC;
+ }
+ /* This is temporary: point mod into copy of data. */
+--
+2.20.1
+
--- /dev/null
+From 2ec1f709f9fbf1bbbd0d695e32bab25882571c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 11:18:57 +0800
+Subject: nbd: add a flush_workqueue in nbd_start_device
+
+From: Sun Ke <sunke32@huawei.com>
+
+[ Upstream commit 5c0dd228b5fc30a3b732c7ae2657e0161ec7ed80 ]
+
+When kzalloc fail, may cause trying to destroy the
+workqueue from inside the workqueue.
+
+If num_connections is m (2 < m), and NO.1 ~ NO.n
+(1 < n < m) kzalloc are successful. The NO.(n + 1)
+failed. Then, nbd_start_device will return ENOMEM
+to nbd_start_device_ioctl, and nbd_start_device_ioctl
+will return immediately without running flush_workqueue.
+However, we still have n recv threads. If nbd_release
+run first, recv threads may have to drop the last
+config_refs and try to destroy the workqueue from
+inside the workqueue.
+
+To fix it, add a flush_workqueue in nbd_start_device.
+
+Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs")
+Signed-off-by: Sun Ke <sunke32@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index b9d321bdaa8a7..226103af30f05 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -1216,6 +1216,16 @@ static int nbd_start_device(struct nbd_device *nbd)
+ args = kzalloc(sizeof(*args), GFP_KERNEL);
+ if (!args) {
+ sock_shutdown(nbd);
++ /*
++ * If num_connections is m (2 < m),
++ * and NO.1 ~ NO.n(1 < n < m) kzallocs are successful.
++ * But NO.(n + 1) failed. We still have n recv threads.
++ * So, add flush_workqueue here to prevent recv threads
++ * dropping the last config_refs and trying to destroy
++ * the workqueue from inside the workqueue.
++ */
++ if (i)
++ flush_workqueue(nbd->recv_workq);
+ return -ENOMEM;
+ }
+ sk_set_memalloc(config->socks[i]->sock->sk);
+--
+2.20.1
+
--- /dev/null
+From 58bfe541dbfd4099e76a2ea2dbbe9c20a9f6ca7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 15:55:51 +0100
+Subject: net/wan/fsl_ucc_hdlc: reject muram offsets above 64K
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 148587a59f6b85831695e0497d9dd1af5f0495af ]
+
+Qiang Zhao points out that these offsets get written to 16-bit
+registers, and there are some QE platforms with more than 64K
+muram. So it is possible that qe_muram_alloc() gives us an allocation
+that can't actually be used by the hardware, so detect and reject
+that.
+
+Reported-by: Qiang Zhao <qiang.zhao@nxp.com>
+Reviewed-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Acked-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/fsl_ucc_hdlc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
+index daeab33f623e7..9ab04ef532f34 100644
+--- a/drivers/net/wan/fsl_ucc_hdlc.c
++++ b/drivers/net/wan/fsl_ucc_hdlc.c
+@@ -242,6 +242,11 @@ static int uhdlc_init(struct ucc_hdlc_private *priv)
+ ret = -ENOMEM;
+ goto free_riptr;
+ }
++ if (riptr != (u16)riptr || tiptr != (u16)tiptr) {
++ dev_err(priv->dev, "MURAM allocation out of addressable range\n");
++ ret = -ENOMEM;
++ goto free_tiptr;
++ }
+
+ /* Set RIPTR, TIPTR */
+ iowrite16be(riptr, &priv->ucc_pram->riptr);
+--
+2.20.1
+
--- /dev/null
+From 044b95bdc9389f4a39cc037379d4975b661bddc6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 16:53:06 +0800
+Subject: netfilter: nft_tunnel: add the missing ERSPAN_VERSION nla_policy
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 0705f95c332081036d85f26691e9d3cd7d901c31 ]
+
+ERSPAN_VERSION is an attribute parsed in kernel side, nla_policy
+type should be added for it, like other attributes.
+
+Fixes: af308b94a2a4 ("netfilter: nf_tables: add tunnel support")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_tunnel.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index e5444f3ff43fc..5e66042ac3466 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -218,8 +218,9 @@ static int nft_tunnel_obj_vxlan_init(const struct nlattr *attr,
+ }
+
+ static const struct nla_policy nft_tunnel_opts_erspan_policy[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1] = {
++ [NFTA_TUNNEL_KEY_ERSPAN_VERSION] = { .type = NLA_U32 },
+ [NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX] = { .type = NLA_U32 },
+- [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 },
++ [NFTA_TUNNEL_KEY_ERSPAN_V2_DIR] = { .type = NLA_U8 },
+ [NFTA_TUNNEL_KEY_ERSPAN_V2_HWID] = { .type = NLA_U8 },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 05794c913589a43e84c25dc1ca35828f974a2af7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 21:08:45 +0800
+Subject: NFC: port100: Convert cpu_to_le16(le16_to_cpu(E1) + E2) to use
+ le16_add_cpu().
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 718eae277e62a26e5862eb72a830b5e0fe37b04a ]
+
+Convert cpu_to_le16(le16_to_cpu(frame->datalen) + len) to
+use le16_add_cpu(), which is more concise and does the same thing.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/port100.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
+index 60ae382f50da9..06bb226c62ef4 100644
+--- a/drivers/nfc/port100.c
++++ b/drivers/nfc/port100.c
+@@ -574,7 +574,7 @@ static void port100_tx_update_payload_len(void *_frame, int len)
+ {
+ struct port100_frame *frame = _frame;
+
+- frame->datalen = cpu_to_le16(le16_to_cpu(frame->datalen) + len);
++ le16_add_cpu(&frame->datalen, len);
+ }
+
+ static bool port100_rx_frame_is_valid(void *_frame)
+--
+2.20.1
+
--- /dev/null
+From 92e371af9879b2ed80cbf351e34e0f846c2dfa53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Feb 2020 03:47:53 +0000
+Subject: NFS: Fix memory leaks
+
+From: Wenwen Wang <wenwen@cs.uga.edu>
+
+[ Upstream commit 123c23c6a7b7ecd2a3d6060bea1d94019f71fd66 ]
+
+In _nfs42_proc_copy(), 'res->commit_res.verf' is allocated through
+kzalloc() if 'args->sync' is true. In the following code, if
+'res->synchronous' is false, handle_async_copy() will be invoked. If an
+error occurs during the invocation, the following code will not be executed
+and the error will be returned . However, the allocated
+'res->commit_res.verf' is not deallocated, leading to a memory leak. This
+is also true if the invocation of process_copy_commit() returns an error.
+
+To fix the above leaks, redirect the execution to the 'out' label if an
+error is encountered.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs42proc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
+index 94f98e190e632..526441de89c1d 100644
+--- a/fs/nfs/nfs42proc.c
++++ b/fs/nfs/nfs42proc.c
+@@ -283,14 +283,14 @@ static ssize_t _nfs42_proc_copy(struct file *src,
+ status = handle_async_copy(res, server, src, dst,
+ &args->src_stateid);
+ if (status)
+- return status;
++ goto out;
+ }
+
+ if ((!res->synchronous || !args->sync) &&
+ res->write_res.verifier.committed != NFS_FILE_SYNC) {
+ status = process_copy_commit(dst, pos_dst, res);
+ if (status)
+- return status;
++ goto out;
+ }
+
+ truncate_pagecache_range(dst_inode, pos_dst,
+--
+2.20.1
+
--- /dev/null
+From 6681e19ad413b85811213e66a1a2e60f231bcda4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Dec 2019 16:07:32 -0500
+Subject: nfsd4: avoid NULL deference on strange COPY compounds
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit d781e3df710745fbbaee4eb07fd5b64331a1b175 ]
+
+With cross-server COPY we've introduced the possibility that the current
+or saved filehandle might not have fh_dentry/fh_export filled in, but we
+missed a place that assumed it was. I think this could be triggered by
+a compound like:
+
+ PUTFH(foreign filehandle)
+ GETATTR
+ SAVEFH
+ COPY
+
+First, check_if_stalefh_allowed sets no_verify on the first (PUTFH) op.
+Then op_func = nfsd4_putfh runs and leaves current_fh->fh_export NULL.
+need_wrongsec_check returns true, since this PUTFH has OP_IS_PUTFH_LIKE
+set and GETATTR does not have OP_HANDLES_WRONGSEC set.
+
+We should probably also consider tightening the checks in
+check_if_stalefh_allowed and double-checking that we don't assume the
+filehandle is verified elsewhere in the compound. But I think this
+fixes the immediate issue.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 4e48f1cccab3 "NFSD: allow inter server COPY to have... "
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index f35aa9f88b5ec..895123518fd42 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1789,7 +1789,8 @@ nfsd4_proc_compound(struct svc_rqst *rqstp)
+ if (op->opdesc->op_flags & OP_CLEAR_STATEID)
+ clear_current_stateid(cstate);
+
+- if (need_wrongsec_check(rqstp))
++ if (current_fh->fh_export &&
++ need_wrongsec_check(rqstp))
+ op->status = check_nfsd_access(current_fh->fh_export, rqstp);
+ }
+ encode_op:
+--
+2.20.1
+
--- /dev/null
+From a8a0dacfa29539cc819907a4fca7912a57056217 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:11:50 -0800
+Subject: ocfs2: fix a NULL pointer dereference when call
+ ocfs2_update_inode_fsync_trans()
+
+From: wangyan <wangyan122@huawei.com>
+
+[ Upstream commit 9f16ca48fc818a17de8be1f75d08e7f4addc4497 ]
+
+I found a NULL pointer dereference in ocfs2_update_inode_fsync_trans(),
+handle->h_transaction may be NULL in this situation:
+
+ocfs2_file_write_iter
+ ->__generic_file_write_iter
+ ->generic_perform_write
+ ->ocfs2_write_begin
+ ->ocfs2_write_begin_nolock
+ ->ocfs2_write_cluster_by_desc
+ ->ocfs2_write_cluster
+ ->ocfs2_mark_extent_written
+ ->ocfs2_change_extent_flag
+ ->ocfs2_split_extent
+ ->ocfs2_try_to_merge_extent
+ ->ocfs2_extend_rotate_transaction
+ ->ocfs2_extend_trans
+ ->jbd2_journal_restart
+ ->jbd2__journal_restart
+ // handle->h_transaction is NULL here
+ ->handle->h_transaction = NULL;
+ ->start_this_handle
+ /* journal aborted due to storage
+ network disconnection, return error */
+ ->return -EROFS;
+ /* line 3806 in ocfs2_try_to_merge_extent (),
+ it will ignore ret error. */
+ ->ret = 0;
+ ->...
+ ->ocfs2_write_end
+ ->ocfs2_write_end_nolock
+ ->ocfs2_update_inode_fsync_trans
+ // NULL pointer dereference
+ ->oi->i_sync_tid = handle->h_transaction->t_tid;
+
+The information of NULL pointer dereference as follows:
+ JBD2: Detected IO errors while flushing file data on dm-11-45
+ Aborting journal on device dm-11-45.
+ JBD2: Error -5 detected when updating journal superblock for dm-11-45.
+ (dd,22081,3):ocfs2_extend_trans:474 ERROR: status = -30
+ (dd,22081,3):ocfs2_try_to_merge_extent:3877 ERROR: status = -30
+ Unable to handle kernel NULL pointer dereference at
+ virtual address 0000000000000008
+ Mem abort info:
+ ESR = 0x96000004
+ Exception class = DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+ Data abort info:
+ ISV = 0, ISS = 0x00000004
+ CM = 0, WnR = 0
+ user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000e74e1338
+ [0000000000000008] pgd=0000000000000000
+ Internal error: Oops: 96000004 [#1] SMP
+ Process dd (pid: 22081, stack limit = 0x00000000584f35a9)
+ CPU: 3 PID: 22081 Comm: dd Kdump: loaded
+ Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 0.98 08/25/2019
+ pstate: 60400009 (nZCv daif +PAN -UAO)
+ pc : ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2]
+ lr : ocfs2_write_end_nolock+0x2a0/0x550 [ocfs2]
+ sp : ffff0000459fba70
+ x29: ffff0000459fba70 x28: 0000000000000000
+ x27: ffff807ccf7f1000 x26: 0000000000000001
+ x25: ffff807bdff57970 x24: ffff807caf1d4000
+ x23: ffff807cc79e9000 x22: 0000000000001000
+ x21: 000000006c6cd000 x20: ffff0000091d9000
+ x19: ffff807ccb239db0 x18: ffffffffffffffff
+ x17: 000000000000000e x16: 0000000000000007
+ x15: ffff807c5e15bd78 x14: 0000000000000000
+ x13: 0000000000000000 x12: 0000000000000000
+ x11: 0000000000000000 x10: 0000000000000001
+ x9 : 0000000000000228 x8 : 000000000000000c
+ x7 : 0000000000000fff x6 : ffff807a308ed6b0
+ x5 : ffff7e01f10967c0 x4 : 0000000000000018
+ x3 : d0bc661572445600 x2 : 0000000000000000
+ x1 : 000000001b2e0200 x0 : 0000000000000000
+ Call trace:
+ ocfs2_write_end_nolock+0x2b8/0x550 [ocfs2]
+ ocfs2_write_end+0x4c/0x80 [ocfs2]
+ generic_perform_write+0x108/0x1a8
+ __generic_file_write_iter+0x158/0x1c8
+ ocfs2_file_write_iter+0x668/0x950 [ocfs2]
+ __vfs_write+0x11c/0x190
+ vfs_write+0xac/0x1c0
+ ksys_write+0x6c/0xd8
+ __arm64_sys_write+0x24/0x30
+ el0_svc_common+0x78/0x130
+ el0_svc_handler+0x38/0x78
+ el0_svc+0x8/0xc
+
+To prevent NULL pointer dereference in this situation, we use
+is_handle_aborted() before using handle->h_transaction->t_tid.
+
+Link: http://lkml.kernel.org/r/03e750ab-9ade-83aa-b000-b9e81e34e539@huawei.com
+Signed-off-by: Yan Wang <wangyan122@huawei.com>
+Reviewed-by: Jun Piao <piaojun@huawei.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Joseph Qi <jiangqi903@gmail.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ocfs2/journal.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/journal.h b/fs/ocfs2/journal.h
+index 497a4171ef61f..bfb50fc51528f 100644
+--- a/fs/ocfs2/journal.h
++++ b/fs/ocfs2/journal.h
+@@ -637,9 +637,11 @@ static inline void ocfs2_update_inode_fsync_trans(handle_t *handle,
+ {
+ struct ocfs2_inode_info *oi = OCFS2_I(inode);
+
+- oi->i_sync_tid = handle->h_transaction->t_tid;
+- if (datasync)
+- oi->i_datasync_tid = handle->h_transaction->t_tid;
++ if (!is_handle_aborted(handle)) {
++ oi->i_sync_tid = handle->h_transaction->t_tid;
++ if (datasync)
++ oi->i_datasync_tid = handle->h_transaction->t_tid;
++ }
+ }
+
+ #endif /* OCFS2_JOURNAL_H */
+--
+2.20.1
+
--- /dev/null
+From 4ad7fab6d27a5f71583230ff006648442a2c44a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 13:58:58 -0600
+Subject: orinoco: avoid assertion in case of NULL pointer
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit c705f9fc6a1736dcf6ec01f8206707c108dca824 ]
+
+In ezusb_init, if upriv is NULL, the code crashes. However, the caller
+in ezusb_probe can handle the error and print the failure message.
+The patch replaces the BUG_ON call to error return.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intersil/orinoco/orinoco_usb.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+index 2c7dd2a7350c1..b704e4bce171d 100644
+--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c
+@@ -1364,7 +1364,8 @@ static int ezusb_init(struct hermes *hw)
+ int retval;
+
+ BUG_ON(in_interrupt());
+- BUG_ON(!upriv);
++ if (!upriv)
++ return -EINVAL;
+
+ upriv->reply_count = 0;
+ /* Write the MAGIC number on the simulated registers to keep
+--
+2.20.1
+
--- /dev/null
+From f4371518408514d18a10a4e9e6986c3e0887cf6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 14:31:11 -0500
+Subject: padata: always acquire cpu_hotplug_lock before pinst->lock
+
+From: Daniel Jordan <daniel.m.jordan@oracle.com>
+
+[ Upstream commit 38228e8848cd7dd86ccb90406af32de0cad24be3 ]
+
+lockdep complains when padata's paths to update cpumasks via CPU hotplug
+and sysfs are both taken:
+
+ # echo 0 > /sys/devices/system/cpu/cpu1/online
+ # echo ff > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
+
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 5.4.0-rc8-padata-cpuhp-v3+ #1 Not tainted
+ ------------------------------------------------------
+ bash/205 is trying to acquire lock:
+ ffffffff8286bcd0 (cpu_hotplug_lock.rw_sem){++++}, at: padata_set_cpumask+0x2b/0x120
+
+ but task is already holding lock:
+ ffff8880001abfa0 (&pinst->lock){+.+.}, at: padata_set_cpumask+0x26/0x120
+
+ which lock already depends on the new lock.
+
+padata doesn't take cpu_hotplug_lock and pinst->lock in a consistent
+order. Which should be first? CPU hotplug calls into padata with
+cpu_hotplug_lock already held, so it should have priority.
+
+Fixes: 6751fb3c0e0c ("padata: Use get_online_cpus/put_online_cpus")
+Signed-off-by: Daniel Jordan <daniel.m.jordan@oracle.com>
+Cc: Eric Biggers <ebiggers@kernel.org>
+Cc: Herbert Xu <herbert@gondor.apana.org.au>
+Cc: Steffen Klassert <steffen.klassert@secunet.com>
+Cc: linux-crypto@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/padata.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/padata.c b/kernel/padata.c
+index cfab62923c452..c280cb153915f 100644
+--- a/kernel/padata.c
++++ b/kernel/padata.c
+@@ -671,8 +671,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ struct cpumask *serial_mask, *parallel_mask;
+ int err = -EINVAL;
+
+- mutex_lock(&pinst->lock);
+ get_online_cpus();
++ mutex_lock(&pinst->lock);
+
+ switch (cpumask_type) {
+ case PADATA_CPU_PARALLEL:
+@@ -690,8 +690,8 @@ int padata_set_cpumask(struct padata_instance *pinst, int cpumask_type,
+ err = __padata_set_cpumasks(pinst, parallel_mask, serial_mask);
+
+ out:
+- put_online_cpus();
+ mutex_unlock(&pinst->lock);
++ put_online_cpus();
+
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From 78c54255bbfbfa4260ef3e1b528438d4edec19d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 13:38:35 +0800
+Subject: PCI: Add generic quirk for increasing D3hot delay
+
+From: Daniel Drake <drake@endlessm.com>
+
+[ Upstream commit 62fe23df067715a21c4aef44068efe7ceaa8f627 ]
+
+Separate the D3 delay increase functionality out of quirk_radeon_pm() into
+its own function so that it can be shared with other quirks, including the
+AMD Ryzen XHCI quirk that will be introduced in a followup commit.
+
+Tweak the function name and message to indicate more clearly that the delay
+relates to a D3hot-to-D0 transition.
+
+Link: https://lore.kernel.org/r/20191127053836.31624-1-drake@endlessm.com
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 84f10cda539ea..798d46a266037 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1848,16 +1848,21 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x2609, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260a, quirk_intel_pcie_pm);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x260b, quirk_intel_pcie_pm);
+
++static void quirk_d3hot_delay(struct pci_dev *dev, unsigned int delay)
++{
++ if (dev->d3_delay >= delay)
++ return;
++
++ dev->d3_delay = delay;
++ pci_info(dev, "extending delay after power-on from D3hot to %d msec\n",
++ dev->d3_delay);
++}
++
+ static void quirk_radeon_pm(struct pci_dev *dev)
+ {
+ if (dev->subsystem_vendor == PCI_VENDOR_ID_APPLE &&
+- dev->subsystem_device == 0x00e2) {
+- if (dev->d3_delay < 20) {
+- dev->d3_delay = 20;
+- pci_info(dev, "extending delay after power-on from D3 to %d msec\n",
+- dev->d3_delay);
+- }
+- }
++ dev->subsystem_device == 0x00e2)
++ quirk_d3hot_delay(dev, 20);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+
+--
+2.20.1
+
--- /dev/null
+From 02731e623d097c8f99f02da1b0121be33d1427a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 13:38:36 +0800
+Subject: PCI: Increase D3 delay for AMD Ryzen5/7 XHCI controllers
+
+From: Daniel Drake <drake@endlessm.com>
+
+[ Upstream commit 3030df209aa8cf831b9963829bd9f94900ee8032 ]
+
+On Asus UX434DA (AMD Ryzen7 3700U) and Asus X512DK (AMD Ryzen5 3500U), the
+XHCI controller fails to resume from runtime suspend or s2idle, and USB
+becomes unusable from that point.
+
+ xhci_hcd 0000:03:00.4: Refused to change power state, currently in D3
+ xhci_hcd 0000:03:00.4: enabling device (0000 -> 0002)
+ xhci_hcd 0000:03:00.4: WARN: xHC restore state timeout
+ xhci_hcd 0000:03:00.4: PCI post-resume error -110!
+ xhci_hcd 0000:03:00.4: HC died; cleaning up
+
+During suspend, a transition to D3cold is attempted, however the affected
+platforms do not seem to cut the power to the PCI device when in this
+state, so the device stays in D3hot.
+
+Upon resume, the D3hot-to-D0 transition is successful only if the D3 delay
+is increased to 20ms. The transition failure does not appear to be
+detectable as a CRS condition. Add a PCI quirk to increase the delay on the
+affected hardware.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=205587
+Link: http://lkml.kernel.org/r/CAD8Lp47Vh69gQjROYG69=waJgL7hs1PwnLonL9+27S_TcRhixA@mail.gmail.com
+Link: https://lore.kernel.org/r/20191127053836.31624-2-drake@endlessm.com
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/quirks.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 798d46a266037..419dda6dbd166 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1866,6 +1866,22 @@ static void quirk_radeon_pm(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6741, quirk_radeon_pm);
+
++/*
++ * Ryzen5/7 XHCI controllers fail upon resume from runtime suspend or s2idle.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=205587
++ *
++ * The kernel attempts to transition these devices to D3cold, but that seems
++ * to be ineffective on the platforms in question; the PCI device appears to
++ * remain on in D3hot state. The D3hot-to-D0 transition then requires an
++ * extended delay in order to succeed.
++ */
++static void quirk_ryzen_xhci_d3hot(struct pci_dev *dev)
++{
++ quirk_d3hot_delay(dev, 20);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e0, quirk_ryzen_xhci_d3hot);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15e1, quirk_ryzen_xhci_d3hot);
++
+ #ifdef CONFIG_X86_IO_APIC
+ static int dmi_disable_ioapicreroute(const struct dmi_system_id *d)
+ {
+--
+2.20.1
+
--- /dev/null
+From 5f4fdfae402791692b8a971a1b42cdc196a8c346 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 17:45:11 +0000
+Subject: PCI: iproc: Apply quirk_paxc_bridge() for module as well as built-in
+
+From: Wei Liu <wei.liu@kernel.org>
+
+[ Upstream commit 574f29036fce385e28617547955dd6911d375025 ]
+
+Previously quirk_paxc_bridge() was applied when the iproc driver was
+built-in, but not when it was compiled as a module.
+
+This happened because it was under #ifdef CONFIG_PCIE_IPROC_PLATFORM:
+PCIE_IPROC_PLATFORM=y causes CONFIG_PCIE_IPROC_PLATFORM to be defined, but
+PCIE_IPROC_PLATFORM=m causes CONFIG_PCIE_IPROC_PLATFORM_MODULE to be
+defined.
+
+Move quirk_paxc_bridge() to pcie-iproc.c and drop the #ifdef so the quirk
+is always applied, whether iproc is built-in or a module.
+
+[bhelgaas: commit log, move to pcie-iproc.c, not pcie-iproc-platform.c]
+Link: https://lore.kernel.org/r/20191211174511.89713-1-wei.liu@kernel.org
+Signed-off-by: Wei Liu <wei.liu@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-iproc.c | 24 ++++++++++++++++++++++++
+ drivers/pci/quirks.c | 26 --------------------------
+ 2 files changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c
+index 9d5cbc75d5ae0..ec86414216f97 100644
+--- a/drivers/pci/controller/pcie-iproc.c
++++ b/drivers/pci/controller/pcie-iproc.c
+@@ -1526,6 +1526,30 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802,
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804,
+ quirk_paxc_disable_msi_parsing);
+
++static void quirk_paxc_bridge(struct pci_dev *pdev)
++{
++ /*
++ * The PCI config space is shared with the PAXC root port and the first
++ * Ethernet device. So, we need to workaround this by telling the PCI
++ * code that the bridge is not an Ethernet device.
++ */
++ if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
++ pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
++
++ /*
++ * MPSS is not being set properly (as it is currently 0). This is
++ * because that area of the PCI config space is hard coded to zero, and
++ * is not modifiable by firmware. Set this to 2 (e.g., 512 byte MPS)
++ * so that the MPS can be set to the real max value.
++ */
++ pdev->pcie_mpss = 2;
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
++
+ MODULE_AUTHOR("Ray Jui <rjui@broadcom.com>");
+ MODULE_DESCRIPTION("Broadcom iPROC PCIe common driver");
+ MODULE_LICENSE("GPL v2");
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 5b4c36ab15962..84f10cda539ea 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2358,32 +2358,6 @@ DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_BROADCOM,
+ PCI_DEVICE_ID_TIGON3_5719,
+ quirk_brcm_5719_limit_mrrs);
+
+-#ifdef CONFIG_PCIE_IPROC_PLATFORM
+-static void quirk_paxc_bridge(struct pci_dev *pdev)
+-{
+- /*
+- * The PCI config space is shared with the PAXC root port and the first
+- * Ethernet device. So, we need to workaround this by telling the PCI
+- * code that the bridge is not an Ethernet device.
+- */
+- if (pdev->hdr_type == PCI_HEADER_TYPE_BRIDGE)
+- pdev->class = PCI_CLASS_BRIDGE_PCI << 8;
+-
+- /*
+- * MPSS is not being set properly (as it is currently 0). This is
+- * because that area of the PCI config space is hard coded to zero, and
+- * is not modifiable by firmware. Set this to 2 (e.g., 512 byte MPS)
+- * so that the MPS can be set to the real max value.
+- */
+- pdev->pcie_mpss = 2;
+-}
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
+-#endif
+-
+ /*
+ * Originally in EDAC sources for i82875P: Intel tells BIOS developers to
+ * hide device 6 which configures the overflow device access containing the
+--
+2.20.1
+
--- /dev/null
+From 1e5dbe872018d60bbb4cba012d6566a7de175b5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 00:04:47 +0100
+Subject: pinctrl: baytrail: Do not clear IRQ flags on direct-irq enabled pins
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a23680594da7a9e2696dbcf4f023e9273e2fa40b ]
+
+Suspending Goodix touchscreens requires changing the interrupt pin to
+output before sending them a power-down command. Followed by wiggling
+the interrupt pin to wake the device up, after which it is put back
+in input mode.
+
+On Bay Trail devices with a Goodix touchscreen direct-irq mode is used
+in combination with listing the pin as a normal GpioIo resource.
+
+This works fine, until the goodix driver gets rmmod-ed and then insmod-ed
+again. In this case byt_gpio_disable_free() calls
+byt_gpio_clear_triggering() which clears the IRQ flags and after that the
+(direct) IRQ no longer triggers.
+
+This commit fixes this by adding a check for the BYT_DIRECT_IRQ_EN flag
+to byt_gpio_clear_triggering().
+
+Note that byt_gpio_clear_triggering() only gets called from
+byt_gpio_disable_free() for direct-irq enabled pins, as these are excluded
+from the irq_valid mask by byt_init_irq_valid_mask().
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 021e28ff1194e..a760d8bda0af7 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -950,7 +950,13 @@ static void byt_gpio_clear_triggering(struct byt_gpio *vg, unsigned int offset)
+
+ raw_spin_lock_irqsave(&byt_lock, flags);
+ value = readl(reg);
+- value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
++ /* Do not clear direct-irq enabled IRQs (from gpio_disable_free) */
++ if (value & BYT_DIRECT_IRQ_EN)
++ /* nothing to do */ ;
++ else
++ value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
++
+ writel(value, reg);
+ raw_spin_unlock_irqrestore(&byt_lock, flags);
+ }
+--
+2.20.1
+
--- /dev/null
+From 722dcdc28a34f85d2fde17347e5fbea639dac3de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:48:09 +0100
+Subject: pinctrl: sh-pfc: sh7264: Fix CAN function GPIOs
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 55b1cb1f03ad5eea39897d0c74035e02deddcff2 ]
+
+pinmux_func_gpios[] contains a hole due to the missing function GPIO
+definition for the "CTX0&CTX1" signal, which is the logical "AND" of the
+two CAN outputs.
+
+Fix this by:
+ - Renaming CRX0_CRX1_MARK to CTX0_CTX1_MARK, as PJ2MD[2:0]=010
+ configures the combined "CTX0&CTX1" output signal,
+ - Renaming CRX0X1_MARK to CRX0_CRX1_MARK, as PJ3MD[1:0]=10 configures
+ the shared "CRX0/CRX1" input signal, which is fed to both CAN
+ inputs,
+ - Adding the missing function GPIO definition for "CTX0&CTX1" to
+ pinmux_func_gpios[],
+ - Moving all CAN enums next to each other.
+
+See SH7262 Group, SH7264 Group User's Manual: Hardware, Rev. 4.00:
+ [1] Figure 1.2 (3) (Pin Assignment for the SH7264 Group (1-Mbyte
+ Version),
+ [2] Figure 1.2 (4) Pin Assignment for the SH7264 Group (640-Kbyte
+ Version,
+ [3] Table 1.4 List of Pins,
+ [4] Figure 20.29 Connection Example when Using This Module as 1-Channel
+ Module (64 Mailboxes x 1 Channel),
+ [5] Table 32.10 Multiplexed Pins (Port J),
+ [6] Section 32.2.30 (3) Port J Control Register 0 (PJCR0).
+
+Note that the last 2 disagree about PJ2MD[2:0], which is probably the
+root cause of this bug. But considering [4], "CTx0&CTx1" in [5] must
+be correct, and "CRx0&CRx1" in [6] must be wrong.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191218194812.12741-4-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7264.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7264.c b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+index e1c34e19222ee..3ddb9565ed804 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7264.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7264.c
+@@ -500,17 +500,15 @@ enum {
+ SD_WP_MARK, SD_CLK_MARK, SD_CMD_MARK,
+ CRX0_MARK, CRX1_MARK,
+ CTX0_MARK, CTX1_MARK,
++ CRX0_CRX1_MARK, CTX0_CTX1_MARK,
+
+ PWM1A_MARK, PWM1B_MARK, PWM1C_MARK, PWM1D_MARK,
+ PWM1E_MARK, PWM1F_MARK, PWM1G_MARK, PWM1H_MARK,
+ PWM2A_MARK, PWM2B_MARK, PWM2C_MARK, PWM2D_MARK,
+ PWM2E_MARK, PWM2F_MARK, PWM2G_MARK, PWM2H_MARK,
+ IERXD_MARK, IETXD_MARK,
+- CRX0_CRX1_MARK,
+ WDTOVF_MARK,
+
+- CRX0X1_MARK,
+-
+ /* DMAC */
+ TEND0_MARK, DACK0_MARK, DREQ0_MARK,
+ TEND1_MARK, DACK1_MARK, DREQ1_MARK,
+@@ -998,12 +996,12 @@ static const u16 pinmux_data[] = {
+
+ PINMUX_DATA(PJ3_DATA, PJ3MD_00),
+ PINMUX_DATA(CRX1_MARK, PJ3MD_01),
+- PINMUX_DATA(CRX0X1_MARK, PJ3MD_10),
++ PINMUX_DATA(CRX0_CRX1_MARK, PJ3MD_10),
+ PINMUX_DATA(IRQ1_PJ_MARK, PJ3MD_11),
+
+ PINMUX_DATA(PJ2_DATA, PJ2MD_000),
+ PINMUX_DATA(CTX1_MARK, PJ2MD_001),
+- PINMUX_DATA(CRX0_CRX1_MARK, PJ2MD_010),
++ PINMUX_DATA(CTX0_CTX1_MARK, PJ2MD_010),
+ PINMUX_DATA(CS2_MARK, PJ2MD_011),
+ PINMUX_DATA(SCK0_MARK, PJ2MD_100),
+ PINMUX_DATA(LCD_M_DISP_MARK, PJ2MD_101),
+@@ -1248,6 +1246,7 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ GPIO_FN(CTX1),
+ GPIO_FN(CRX1),
+ GPIO_FN(CTX0),
++ GPIO_FN(CTX0_CTX1),
+ GPIO_FN(CRX0),
+ GPIO_FN(CRX0_CRX1),
+
+--
+2.20.1
+
--- /dev/null
+From 0d03ce32e310632ad0f7af252742ba8a2fc66e4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:48:10 +0100
+Subject: pinctrl: sh-pfc: sh7269: Fix CAN function GPIOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 02aeb2f21530c98fc3ca51028eda742a3fafbd9f ]
+
+pinmux_func_gpios[] contains a hole due to the missing function GPIO
+definition for the "CTX0&CTX1" signal, which is the logical "AND" of the
+first two CAN outputs.
+
+A closer look reveals other issues:
+ - Some functionality is available on alternative pins, but the
+ PINMUX_DATA() entries is using the wrong marks,
+ - Several configurations are missing.
+
+Fix this by:
+ - Renaming CTX0CTX1CTX2_MARK, CRX0CRX1_PJ22_MARK, and
+ CRX0CRX1CRX2_PJ20_MARK to CTX0_CTX1_CTX2_MARK, CRX0_CRX1_PJ22_MARK,
+ resp. CRX0_CRX1_CRX2_PJ20_MARK for consistency with the
+ corresponding enum IDs,
+ - Adding all missing enum IDs and marks,
+ - Use the right (*_PJ2x) variants for alternative pins,
+ - Adding all missing configurations to pinmux_data[],
+ - Adding all missing function GPIO definitions to pinmux_func_gpios[].
+
+See SH7268 Group, SH7269 Group User’s Manual: Hardware, Rev. 2.00:
+ [1] Table 1.4 List of Pins
+ [2] Figure 23.29 Connection Example when Using Channels 0 and 1 as One
+ Channel (64 Mailboxes × 1 Channel) and Channel 2 as One Channel
+ (32 Mailboxes × 1 Channel),
+ [3] Figure 23.30 Connection Example when Using Channels 0, 1, and 2 as
+ One Channel (96 Mailboxes × 1 Channel),
+ [4] Table 48.3 Multiplexed Pins (Port B),
+ [5] Table 48.4 Multiplexed Pins (Port C),
+ [6] Table 48.10 Multiplexed Pins (Port J),
+ [7] Section 48.2.4 Port B Control Registers 0 to 5 (PBCR0 to PBCR5).
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20191218194812.12741-5-geert+renesas@glider.be
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sh/include/cpu-sh2a/cpu/sh7269.h | 11 ++++++--
+ drivers/pinctrl/sh-pfc/pfc-sh7269.c | 39 ++++++++++++++++++---------
+ 2 files changed, 36 insertions(+), 14 deletions(-)
+
+diff --git a/arch/sh/include/cpu-sh2a/cpu/sh7269.h b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+index d516e5d488180..b887cc402b712 100644
+--- a/arch/sh/include/cpu-sh2a/cpu/sh7269.h
++++ b/arch/sh/include/cpu-sh2a/cpu/sh7269.h
+@@ -78,8 +78,15 @@ enum {
+ GPIO_FN_WDTOVF,
+
+ /* CAN */
+- GPIO_FN_CTX1, GPIO_FN_CRX1, GPIO_FN_CTX0, GPIO_FN_CTX0_CTX1,
+- GPIO_FN_CRX0, GPIO_FN_CRX0_CRX1, GPIO_FN_CRX0_CRX1_CRX2,
++ GPIO_FN_CTX2, GPIO_FN_CRX2,
++ GPIO_FN_CTX1, GPIO_FN_CRX1,
++ GPIO_FN_CTX0, GPIO_FN_CRX0,
++ GPIO_FN_CTX0_CTX1, GPIO_FN_CRX0_CRX1,
++ GPIO_FN_CTX0_CTX1_CTX2, GPIO_FN_CRX0_CRX1_CRX2,
++ GPIO_FN_CTX2_PJ21, GPIO_FN_CRX2_PJ20,
++ GPIO_FN_CTX1_PJ23, GPIO_FN_CRX1_PJ22,
++ GPIO_FN_CTX0_CTX1_PJ23, GPIO_FN_CRX0_CRX1_PJ22,
++ GPIO_FN_CTX0_CTX1_CTX2_PJ21, GPIO_FN_CRX0_CRX1_CRX2_PJ20,
+
+ /* DMAC */
+ GPIO_FN_TEND0, GPIO_FN_DACK0, GPIO_FN_DREQ0,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index cfdb4fc177c3e..3df0c0d139d08 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -740,13 +740,12 @@ enum {
+ CRX0_MARK, CTX0_MARK,
+ CRX1_MARK, CTX1_MARK,
+ CRX2_MARK, CTX2_MARK,
+- CRX0_CRX1_MARK,
+- CRX0_CRX1_CRX2_MARK,
+- CTX0CTX1CTX2_MARK,
++ CRX0_CRX1_MARK, CTX0_CTX1_MARK,
++ CRX0_CRX1_CRX2_MARK, CTX0_CTX1_CTX2_MARK,
+ CRX1_PJ22_MARK, CTX1_PJ23_MARK,
+ CRX2_PJ20_MARK, CTX2_PJ21_MARK,
+- CRX0CRX1_PJ22_MARK,
+- CRX0CRX1CRX2_PJ20_MARK,
++ CRX0_CRX1_PJ22_MARK, CTX0_CTX1_PJ23_MARK,
++ CRX0_CRX1_CRX2_PJ20_MARK, CTX0_CTX1_CTX2_PJ21_MARK,
+
+ /* VDC */
+ DV_CLK_MARK,
+@@ -824,6 +823,7 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(CS3_MARK, PC8MD_001),
+ PINMUX_DATA(TXD7_MARK, PC8MD_010),
+ PINMUX_DATA(CTX1_MARK, PC8MD_011),
++ PINMUX_DATA(CTX0_CTX1_MARK, PC8MD_100),
+
+ PINMUX_DATA(PC7_DATA, PC7MD_000),
+ PINMUX_DATA(CKE_MARK, PC7MD_001),
+@@ -836,11 +836,12 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(CAS_MARK, PC6MD_001),
+ PINMUX_DATA(SCK7_MARK, PC6MD_010),
+ PINMUX_DATA(CTX0_MARK, PC6MD_011),
++ PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC6MD_100),
+
+ PINMUX_DATA(PC5_DATA, PC5MD_000),
+ PINMUX_DATA(RAS_MARK, PC5MD_001),
+ PINMUX_DATA(CRX0_MARK, PC5MD_011),
+- PINMUX_DATA(CTX0CTX1CTX2_MARK, PC5MD_100),
++ PINMUX_DATA(CTX0_CTX1_CTX2_MARK, PC5MD_100),
+ PINMUX_DATA(IRQ0_PC_MARK, PC5MD_101),
+
+ PINMUX_DATA(PC4_DATA, PC4MD_00),
+@@ -1292,30 +1293,32 @@ static const u16 pinmux_data[] = {
+ PINMUX_DATA(LCD_DATA23_PJ23_MARK, PJ23MD_010),
+ PINMUX_DATA(LCD_TCON6_MARK, PJ23MD_011),
+ PINMUX_DATA(IRQ3_PJ_MARK, PJ23MD_100),
+- PINMUX_DATA(CTX1_MARK, PJ23MD_101),
++ PINMUX_DATA(CTX1_PJ23_MARK, PJ23MD_101),
++ PINMUX_DATA(CTX0_CTX1_PJ23_MARK, PJ23MD_110),
+
+ PINMUX_DATA(PJ22_DATA, PJ22MD_000),
+ PINMUX_DATA(DV_DATA22_MARK, PJ22MD_001),
+ PINMUX_DATA(LCD_DATA22_PJ22_MARK, PJ22MD_010),
+ PINMUX_DATA(LCD_TCON5_MARK, PJ22MD_011),
+ PINMUX_DATA(IRQ2_PJ_MARK, PJ22MD_100),
+- PINMUX_DATA(CRX1_MARK, PJ22MD_101),
+- PINMUX_DATA(CRX0_CRX1_MARK, PJ22MD_110),
++ PINMUX_DATA(CRX1_PJ22_MARK, PJ22MD_101),
++ PINMUX_DATA(CRX0_CRX1_PJ22_MARK, PJ22MD_110),
+
+ PINMUX_DATA(PJ21_DATA, PJ21MD_000),
+ PINMUX_DATA(DV_DATA21_MARK, PJ21MD_001),
+ PINMUX_DATA(LCD_DATA21_PJ21_MARK, PJ21MD_010),
+ PINMUX_DATA(LCD_TCON4_MARK, PJ21MD_011),
+ PINMUX_DATA(IRQ1_PJ_MARK, PJ21MD_100),
+- PINMUX_DATA(CTX2_MARK, PJ21MD_101),
++ PINMUX_DATA(CTX2_PJ21_MARK, PJ21MD_101),
++ PINMUX_DATA(CTX0_CTX1_CTX2_PJ21_MARK, PJ21MD_110),
+
+ PINMUX_DATA(PJ20_DATA, PJ20MD_000),
+ PINMUX_DATA(DV_DATA20_MARK, PJ20MD_001),
+ PINMUX_DATA(LCD_DATA20_PJ20_MARK, PJ20MD_010),
+ PINMUX_DATA(LCD_TCON3_MARK, PJ20MD_011),
+ PINMUX_DATA(IRQ0_PJ_MARK, PJ20MD_100),
+- PINMUX_DATA(CRX2_MARK, PJ20MD_101),
+- PINMUX_DATA(CRX0CRX1CRX2_PJ20_MARK, PJ20MD_110),
++ PINMUX_DATA(CRX2_PJ20_MARK, PJ20MD_101),
++ PINMUX_DATA(CRX0_CRX1_CRX2_PJ20_MARK, PJ20MD_110),
+
+ PINMUX_DATA(PJ19_DATA, PJ19MD_000),
+ PINMUX_DATA(DV_DATA19_MARK, PJ19MD_001),
+@@ -1666,12 +1669,24 @@ static const struct pinmux_func pinmux_func_gpios[] = {
+ GPIO_FN(WDTOVF),
+
+ /* CAN */
++ GPIO_FN(CTX2),
++ GPIO_FN(CRX2),
+ GPIO_FN(CTX1),
+ GPIO_FN(CRX1),
+ GPIO_FN(CTX0),
+ GPIO_FN(CRX0),
++ GPIO_FN(CTX0_CTX1),
+ GPIO_FN(CRX0_CRX1),
++ GPIO_FN(CTX0_CTX1_CTX2),
+ GPIO_FN(CRX0_CRX1_CRX2),
++ GPIO_FN(CTX2_PJ21),
++ GPIO_FN(CRX2_PJ20),
++ GPIO_FN(CTX1_PJ23),
++ GPIO_FN(CRX1_PJ22),
++ GPIO_FN(CTX0_CTX1_PJ23),
++ GPIO_FN(CRX0_CRX1_PJ22),
++ GPIO_FN(CTX0_CTX1_CTX2_PJ21),
++ GPIO_FN(CRX0_CRX1_CRX2_PJ20),
+
+ /* DMAC */
+ GPIO_FN(TEND0),
+--
+2.20.1
+
--- /dev/null
+From 9770af6662ec2681a7f3bf6258f228502530d7a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:20:30 +0900
+Subject: PM / devfreq: rk3399_dmc: Add COMPILE_TEST and HAVE_ARM_SMCCC
+ dependency
+
+From: Chanwoo Choi <cw00.choi@samsung.com>
+
+[ Upstream commit eff5d31f7407fa9d31fb840106f1593399457298 ]
+
+To build test, add COMPILE_TEST depedency to both ARM_RK3399_DMC_DEVFREQ
+and DEVFREQ_EVENT_ROCKCHIP_DFI configuration. And ARM_RK3399_DMC_DEVFREQ
+used the SMCCC interface so that add HAVE_ARM_SMCCC dependency to prevent
+the build break.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/devfreq/Kconfig | 3 ++-
+ drivers/devfreq/event/Kconfig | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/devfreq/Kconfig b/drivers/devfreq/Kconfig
+index 6a172d338f6dc..4c4ec68b0566d 100644
+--- a/drivers/devfreq/Kconfig
++++ b/drivers/devfreq/Kconfig
+@@ -103,7 +103,8 @@ config ARM_TEGRA_DEVFREQ
+
+ config ARM_RK3399_DMC_DEVFREQ
+ tristate "ARM RK3399 DMC DEVFREQ Driver"
+- depends on ARCH_ROCKCHIP
++ depends on (ARCH_ROCKCHIP && HAVE_ARM_SMCCC) || \
++ (COMPILE_TEST && HAVE_ARM_SMCCC)
+ select DEVFREQ_EVENT_ROCKCHIP_DFI
+ select DEVFREQ_GOV_SIMPLE_ONDEMAND
+ select PM_DEVFREQ_EVENT
+diff --git a/drivers/devfreq/event/Kconfig b/drivers/devfreq/event/Kconfig
+index cd949800eed96..8851bc4e8e3e1 100644
+--- a/drivers/devfreq/event/Kconfig
++++ b/drivers/devfreq/event/Kconfig
+@@ -33,7 +33,7 @@ config DEVFREQ_EVENT_EXYNOS_PPMU
+
+ config DEVFREQ_EVENT_ROCKCHIP_DFI
+ tristate "ROCKCHIP DFI DEVFREQ event Driver"
+- depends on ARCH_ROCKCHIP
++ depends on ARCH_ROCKCHIP || COMPILE_TEST
+ help
+ This add the devfreq-event driver for Rockchip SoC. It provides DFI
+ (DDR Monitor Module) driver to count ddr load.
+--
+2.20.1
+
--- /dev/null
+From d7ff84dae39ba3543c43515e9079dfcb96661a21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 18:02:05 +1100
+Subject: powerpc/iov: Move VF pdev fixup into pcibios_fixup_iov()
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 965c94f309be58fbcc6c8d3e4f123376c5970d79 ]
+
+An ioda_pe for each VF is allocated in pnv_pci_sriov_enable() before
+the pci_dev for the VF is created. We need to set the pe->pdev pointer
+at some point after the pci_dev is created. Currently we do that in:
+
+pcibios_bus_add_device()
+ pnv_pci_dma_dev_setup() (via phb->ops.dma_dev_setup)
+ /* fixup is done here */
+ pnv_pci_ioda_dma_dev_setup() (via pnv_phb->dma_dev_setup)
+
+The fixup needs to be done before setting up DMA for for the VF's PE,
+but there's no real reason to delay it until this point. Move the
+fixup into pnv_pci_ioda_fixup_iov() so the ordering is:
+
+ pcibios_add_device()
+ pnv_pci_ioda_fixup_iov() (via ppc_md.pcibios_fixup_sriov)
+
+ pcibios_bus_add_device()
+ ...
+
+This isn't strictly required, but it's a slightly more logical place
+to do the fixup and it simplifies pnv_pci_dma_dev_setup().
+
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200110070207.439-4-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/powernv/pci-ioda.c | 29 +++++++++++++++++++----
+ arch/powerpc/platforms/powernv/pci.c | 14 -----------
+ 2 files changed, 25 insertions(+), 18 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 28adfe4dd04c5..ecd211c5f24a5 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -3015,9 +3015,6 @@ static void pnv_pci_ioda_fixup_iov_resources(struct pci_dev *pdev)
+ struct pci_dn *pdn;
+ int mul, total_vfs;
+
+- if (!pdev->is_physfn || pci_dev_is_added(pdev))
+- return;
+-
+ pdn = pci_get_pdn(pdev);
+ pdn->vfs_expanded = 0;
+ pdn->m64_single_mode = false;
+@@ -3092,6 +3089,30 @@ truncate_iov:
+ res->end = res->start - 1;
+ }
+ }
++
++static void pnv_pci_ioda_fixup_iov(struct pci_dev *pdev)
++{
++ if (WARN_ON(pci_dev_is_added(pdev)))
++ return;
++
++ if (pdev->is_virtfn) {
++ struct pnv_ioda_pe *pe = pnv_ioda_get_pe(pdev);
++
++ /*
++ * VF PEs are single-device PEs so their pdev pointer needs to
++ * be set. The pdev doesn't exist when the PE is allocated (in
++ * (pcibios_sriov_enable()) so we fix it up here.
++ */
++ pe->pdev = pdev;
++ WARN_ON(!(pe->flags & PNV_IODA_PE_VF));
++ } else if (pdev->is_physfn) {
++ /*
++ * For PFs adjust their allocated IOV resources to match what
++ * the PHB can support using it's M64 BAR table.
++ */
++ pnv_pci_ioda_fixup_iov_resources(pdev);
++ }
++}
+ #endif /* CONFIG_PCI_IOV */
+
+ static void pnv_ioda_setup_pe_res(struct pnv_ioda_pe *pe,
+@@ -3985,7 +4006,7 @@ static void __init pnv_pci_init_ioda_phb(struct device_node *np,
+ ppc_md.pcibios_default_alignment = pnv_pci_default_alignment;
+
+ #ifdef CONFIG_PCI_IOV
+- ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov_resources;
++ ppc_md.pcibios_fixup_sriov = pnv_pci_ioda_fixup_iov;
+ ppc_md.pcibios_iov_resource_alignment = pnv_pci_iov_resource_alignment;
+ ppc_md.pcibios_sriov_enable = pnv_pcibios_sriov_enable;
+ ppc_md.pcibios_sriov_disable = pnv_pcibios_sriov_disable;
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index aa95b8e0f66ad..b6fa900af5da5 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -820,20 +820,6 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
+ {
+ struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+ struct pnv_phb *phb = hose->private_data;
+-#ifdef CONFIG_PCI_IOV
+- struct pnv_ioda_pe *pe;
+-
+- /* Fix the VF pdn PE number */
+- if (pdev->is_virtfn) {
+- list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+- if (pe->rid == ((pdev->bus->number << 8) |
+- (pdev->devfn & 0xff))) {
+- pe->pdev = pdev;
+- break;
+- }
+- }
+- }
+-#endif /* CONFIG_PCI_IOV */
+
+ if (phb && phb->dma_dev_setup)
+ phb->dma_dev_setup(phb, pdev);
+--
+2.20.1
+
--- /dev/null
+From b5a1ed2fab6d26e7dc5c6fc7e97eb10217669ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 19:54:22 +1100
+Subject: powerpc/powernv/iov: Ensure the pdn for VFs always contains a valid
+ PE number
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 3b5b9997b331e77ce967eba2c4bc80dc3134a7fe ]
+
+On pseries there is a bug with adding hotplugged devices to an IOMMU
+group. For a number of dumb reasons fixing that bug first requires
+re-working how VFs are configured on PowerNV. For background, on
+PowerNV we use the pcibios_sriov_enable() hook to do two things:
+
+ 1. Create a pci_dn structure for each of the VFs, and
+ 2. Configure the PHB's internal BARs so the MMIO range for each VF
+ maps to a unique PE.
+
+Roughly speaking a PE is the hardware counterpart to a Linux IOMMU
+group since all the devices in a PE share the same IOMMU table. A PE
+also defines the set of devices that should be isolated in response to
+a PCI error (i.e. bad DMA, UR/CA, AER events, etc). When isolated all
+MMIO and DMA traffic to and from devicein the PE is blocked by the
+root complex until the PE is recovered by the OS.
+
+The requirement to block MMIO causes a giant headache because the P8
+PHB generally uses a fixed mapping between MMIO addresses and PEs. As
+a result we need to delay configuring the IOMMU groups for device
+until after MMIO resources are assigned. For physical devices (i.e.
+non-VFs) the PE assignment is done in pcibios_setup_bridge() which is
+called immediately after the MMIO resources for downstream
+devices (and the bridge's windows) are assigned. For VFs the setup is
+more complicated because:
+
+ a) pcibios_setup_bridge() is not called again when VFs are activated, and
+ b) The pci_dev for VFs are created by generic code which runs after
+ pcibios_sriov_enable() is called.
+
+The work around for this is a two step process:
+
+ 1. A fixup in pcibios_add_device() is used to initialised the cached
+ pe_number in pci_dn, then
+ 2. A bus notifier then adds the device to the IOMMU group for the PE
+ specified in pci_dn->pe_number.
+
+A side effect fixing the pseries bug mentioned in the first paragraph
+is moving the fixup out of pcibios_add_device() and into
+pcibios_bus_add_device(), which is called much later. This results in
+step 2. failing because pci_dn->pe_number won't be initialised when
+the bus notifier is run.
+
+We can fix this by removing the need for the fixup. The PE for a VF is
+known before the VF is even scanned so we can initialise
+pci_dn->pe_number pcibios_sriov_enable() instead. Unfortunately,
+moving the initialisation causes two problems:
+
+ 1. We trip the WARN_ON() in the current fixup code, and
+ 2. The EEH core clears pdn->pe_number when recovering a VF and
+ relies on the fixup to correctly re-set it.
+
+The only justification for either of these is a comment in
+eeh_rmv_device() suggesting that pdn->pe_number *must* be set to
+IODA_INVALID_PE in order for the VF to be scanned. However, this
+comment appears to have no basis in reality. Both bugs can be fixed by
+just deleting the code.
+
+Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191028085424.12006-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/eeh_driver.c | 6 ------
+ arch/powerpc/platforms/powernv/pci-ioda.c | 19 +++++++++++++++----
+ arch/powerpc/platforms/powernv/pci.c | 4 ----
+ 3 files changed, 15 insertions(+), 14 deletions(-)
+
+diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
+index af1f3d5f9a0f7..377d23f58197a 100644
+--- a/arch/powerpc/kernel/eeh_driver.c
++++ b/arch/powerpc/kernel/eeh_driver.c
+@@ -554,12 +554,6 @@ static void *eeh_rmv_device(struct eeh_dev *edev, void *userdata)
+
+ pci_iov_remove_virtfn(edev->physfn, pdn->vf_index);
+ edev->pdev = NULL;
+-
+- /*
+- * We have to set the VF PE number to invalid one, which is
+- * required to plug the VF successfully.
+- */
+- pdn->pe_number = IODA_INVALID_PE;
+ #endif
+ if (rmv_data)
+ list_add(&edev->rmv_list, &rmv_data->edev_list);
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index ee63749a2d47e..28adfe4dd04c5 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -1552,6 +1552,10 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+
+ /* Reserve PE for each VF */
+ for (vf_index = 0; vf_index < num_vfs; vf_index++) {
++ int vf_devfn = pci_iov_virtfn_devfn(pdev, vf_index);
++ int vf_bus = pci_iov_virtfn_bus(pdev, vf_index);
++ struct pci_dn *vf_pdn;
++
+ if (pdn->m64_single_mode)
+ pe_num = pdn->pe_num_map[vf_index];
+ else
+@@ -1564,13 +1568,11 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ pe->pbus = NULL;
+ pe->parent_dev = pdev;
+ pe->mve_number = -1;
+- pe->rid = (pci_iov_virtfn_bus(pdev, vf_index) << 8) |
+- pci_iov_virtfn_devfn(pdev, vf_index);
++ pe->rid = (vf_bus << 8) | vf_devfn;
+
+ pe_info(pe, "VF %04d:%02d:%02d.%d associated with PE#%x\n",
+ hose->global_number, pdev->bus->number,
+- PCI_SLOT(pci_iov_virtfn_devfn(pdev, vf_index)),
+- PCI_FUNC(pci_iov_virtfn_devfn(pdev, vf_index)), pe_num);
++ PCI_SLOT(vf_devfn), PCI_FUNC(vf_devfn), pe_num);
+
+ if (pnv_ioda_configure_pe(phb, pe)) {
+ /* XXX What do we do here ? */
+@@ -1584,6 +1586,15 @@ static void pnv_ioda_setup_vf_PE(struct pci_dev *pdev, u16 num_vfs)
+ list_add_tail(&pe->list, &phb->ioda.pe_list);
+ mutex_unlock(&phb->ioda.pe_list_mutex);
+
++ /* associate this pe to it's pdn */
++ list_for_each_entry(vf_pdn, &pdn->parent->child_list, list) {
++ if (vf_pdn->busno == vf_bus &&
++ vf_pdn->devfn == vf_devfn) {
++ vf_pdn->pe_number = pe_num;
++ break;
++ }
++ }
++
+ pnv_pci_ioda2_setup_dma_pe(phb, pe);
+ }
+ }
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index c846300b78368..aa95b8e0f66ad 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -822,16 +822,12 @@ void pnv_pci_dma_dev_setup(struct pci_dev *pdev)
+ struct pnv_phb *phb = hose->private_data;
+ #ifdef CONFIG_PCI_IOV
+ struct pnv_ioda_pe *pe;
+- struct pci_dn *pdn;
+
+ /* Fix the VF pdn PE number */
+ if (pdev->is_virtfn) {
+- pdn = pci_get_pdn(pdev);
+- WARN_ON(pdn->pe_number != IODA_INVALID_PE);
+ list_for_each_entry(pe, &phb->ioda.pe_list, list) {
+ if (pe->rid == ((pdev->bus->number << 8) |
+ (pdev->devfn & 0xff))) {
+- pdn->pe_number = pe->pe_number;
+ pe->pdev = pdev;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From f85aa34f60ae200e3e85e4774ed7c853a991e202 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Aug 2019 16:26:53 +1000
+Subject: powerpc/sriov: Remove VF eeh_dev state when disabling SR-IOV
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+[ Upstream commit 1fb4124ca9d456656a324f1ee29b7bf942f59ac8 ]
+
+When disabling virtual functions on an SR-IOV adapter we currently do not
+correctly remove the EEH state for the now-dead virtual functions. When
+removing the pci_dn that was created for the VF when SR-IOV was enabled
+we free the corresponding eeh_dev without removing it from the child device
+list of the eeh_pe that contained it. This can result in crashes due to the
+use-after-free.
+
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Reviewed-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Tested-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190821062655.19735-1-oohall@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/pci_dn.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/kernel/pci_dn.c b/arch/powerpc/kernel/pci_dn.c
+index ab147a1909c8b..7cecc3bd953b7 100644
+--- a/arch/powerpc/kernel/pci_dn.c
++++ b/arch/powerpc/kernel/pci_dn.c
+@@ -257,9 +257,22 @@ void remove_dev_pci_data(struct pci_dev *pdev)
+ continue;
+
+ #ifdef CONFIG_EEH
+- /* Release EEH device for the VF */
++ /*
++ * Release EEH state for this VF. The PCI core
++ * has already torn down the pci_dev for this VF, but
++ * we're responsible to removing the eeh_dev since it
++ * has the same lifetime as the pci_dn that spawned it.
++ */
+ edev = pdn_to_eeh_dev(pdn);
+ if (edev) {
++ /*
++ * We allocate pci_dn's for the totalvfs count,
++ * but only only the vfs that were activated
++ * have a configured PE.
++ */
++ if (edev->pe)
++ eeh_rmv_from_parent_pe(edev);
++
+ pdn->edev = NULL;
+ kfree(edev);
+ }
+--
+2.20.1
+
--- /dev/null
+From 7da6b779606647191d359ab3d6e5b2b80ce741b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 10:03:54 +0100
+Subject: pwm: omap-dmtimer: Remove PWM chip in .remove before making it
+ unfunctional
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 43efdc8f0e6d7088ec61bd55a73bf853f002d043 ]
+
+In the old code (e.g.) mutex_destroy() was called before
+pwmchip_remove(). Between these two calls it is possible that a PWM
+callback is used which tries to grab the mutex.
+
+Fixes: 6604c6556db9 ("pwm: Add PWM driver for OMAP using dual-mode timers")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-omap-dmtimer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index 2d585c101d52e..c6e710a713d31 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -364,6 +364,11 @@ put:
+ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+ {
+ struct pwm_omap_dmtimer_chip *omap = platform_get_drvdata(pdev);
++ int ret;
++
++ ret = pwmchip_remove(&omap->chip);
++ if (ret)
++ return ret;
+
+ if (pm_runtime_active(&omap->dm_timer_pdev->dev))
+ omap->pdata->stop(omap->dm_timer);
+@@ -372,7 +377,7 @@ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+
+ mutex_destroy(&omap->mutex);
+
+- return pwmchip_remove(&omap->chip);
++ return 0;
+ }
+
+ static const struct of_device_id pwm_omap_dmtimer_of_match[] = {
+--
+2.20.1
+
--- /dev/null
+From 773b1338c30fa72af4d10e5e34b464e421eaf42a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 10:03:55 +0100
+Subject: pwm: omap-dmtimer: Simplify error handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit c4cf7aa57eb83b108d2d9c6c37c143388fee2a4d ]
+
+Instead of doing error handling in the middle of ->probe(), move error
+handling and freeing the reference to timer to the end.
+
+This fixes a resource leak as dm_timer wasn't freed when allocating
+*omap failed.
+
+Implementation note: The put: label was never reached without a goto and
+ret being unequal to 0, so the removed return statement is fine.
+
+Fixes: 6604c6556db9 ("pwm: Add PWM driver for OMAP using dual-mode timers")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-omap-dmtimer.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pwm/pwm-omap-dmtimer.c b/drivers/pwm/pwm-omap-dmtimer.c
+index f45798679e3c0..2d585c101d52e 100644
+--- a/drivers/pwm/pwm-omap-dmtimer.c
++++ b/drivers/pwm/pwm-omap-dmtimer.c
+@@ -301,15 +301,10 @@ static int pwm_omap_dmtimer_probe(struct platform_device *pdev)
+ goto put;
+ }
+
+-put:
+- of_node_put(timer);
+- if (ret < 0)
+- return ret;
+-
+ omap = devm_kzalloc(&pdev->dev, sizeof(*omap), GFP_KERNEL);
+ if (!omap) {
+- pdata->free(dm_timer);
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto err_alloc_omap;
+ }
+
+ omap->pdata = pdata;
+@@ -342,13 +337,28 @@ put:
+ ret = pwmchip_add(&omap->chip);
+ if (ret < 0) {
+ dev_err(&pdev->dev, "failed to register PWM\n");
+- omap->pdata->free(omap->dm_timer);
+- return ret;
++ goto err_pwmchip_add;
+ }
+
++ of_node_put(timer);
++
+ platform_set_drvdata(pdev, omap);
+
+ return 0;
++
++err_pwmchip_add:
++
++ /*
++ * *omap is allocated using devm_kzalloc,
++ * so no free necessary here
++ */
++err_alloc_omap:
++
++ pdata->free(dm_timer);
++put:
++ of_node_put(timer);
++
++ return ret;
+ }
+
+ static int pwm_omap_dmtimer_remove(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 3121759548412974ff8322c7bf4f3996c59813b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 19:51:43 +0800
+Subject: pwm: Remove set but not set variable 'pwm'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit 9871abffc81048e20f02e15d6aa4558a44ad53ea ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+ drivers/pwm/pwm-pca9685.c: In function ‘pca9685_pwm_gpio_free’:
+ drivers/pwm/pwm-pca9685.c:162:21: warning: variable ‘pwm’ set but not used [-Wunused-but-set-variable]
+
+It is never used, and so can be removed. In that case, hold and release
+the lock 'pca->lock' can be removed since nothing will be done between
+them.
+
+Fixes: e926b12c611c ("pwm: Clear chip_data in pwm_put()")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-pca9685.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c
+index 567f5e2771c47..e1e5dfcb16f36 100644
+--- a/drivers/pwm/pwm-pca9685.c
++++ b/drivers/pwm/pwm-pca9685.c
+@@ -170,13 +170,9 @@ static void pca9685_pwm_gpio_set(struct gpio_chip *gpio, unsigned int offset,
+ static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset)
+ {
+ struct pca9685 *pca = gpiochip_get_data(gpio);
+- struct pwm_device *pwm;
+
+ pca9685_pwm_gpio_set(gpio, offset, 0);
+ pm_runtime_put(pca->chip.dev);
+- mutex_lock(&pca->lock);
+- pwm = &pca->chip.pwms[offset];
+- mutex_unlock(&pca->lock);
+ }
+
+ static int pca9685_pwm_gpio_get_direction(struct gpio_chip *chip,
+--
+2.20.1
+
--- /dev/null
+From 47a543d0eb19e8759d20779c463efa9abd940735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 31 Aug 2019 12:00:24 +0200
+Subject: pxa168fb: Fix the function used to release some memory in an error
+ handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3c911fe799d1c338d94b78e7182ad452c37af897 ]
+
+In the probe function, some resources are allocated using 'dma_alloc_wc()',
+they should be released with 'dma_free_wc()', not 'dma_free_coherent()'.
+
+We already use 'dma_free_wc()' in the remove function, but not in the
+error handling path of the probe function.
+
+Also, remove a useless 'PAGE_ALIGN()'. 'info->fix.smem_len' is already
+PAGE_ALIGNed.
+
+Fixes: 638772c7553f ("fb: add support of LCD display controller on pxa168/910 (base layer)")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Lubomir Rintel <lkundrak@v3.sk>
+CC: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190831100024.3248-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/pxa168fb.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/pxa168fb.c b/drivers/video/fbdev/pxa168fb.c
+index d059d04c63acd..20195d3dbf088 100644
+--- a/drivers/video/fbdev/pxa168fb.c
++++ b/drivers/video/fbdev/pxa168fb.c
+@@ -769,8 +769,8 @@ failed_free_cmap:
+ failed_free_clk:
+ clk_disable_unprepare(fbi->clk);
+ failed_free_fbmem:
+- dma_free_coherent(fbi->dev, info->fix.smem_len,
+- info->screen_base, fbi->fb_start_dma);
++ dma_free_wc(fbi->dev, info->fix.smem_len,
++ info->screen_base, fbi->fb_start_dma);
+ failed_free_info:
+ kfree(info);
+
+@@ -804,7 +804,7 @@ static int pxa168fb_remove(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+
+- dma_free_wc(fbi->dev, PAGE_ALIGN(info->fix.smem_len),
++ dma_free_wc(fbi->dev, info->fix.smem_len,
+ info->screen_base, info->fix.smem_start);
+
+ clk_disable_unprepare(fbi->clk);
+--
+2.20.1
+
--- /dev/null
+From 47e39a9f911baf60958890b1e26b98924e491397 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 16:53:37 +0100
+Subject: r8169: check that Realtek PHY driver module is loaded
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit f325937735498afb054a0195291bbf68d0b60be5 ]
+
+Some users complained about problems with r8169 and it turned out that
+the generic PHY driver was used instead instead of the dedicated one.
+In all cases reason was that r8169.ko was in initramfs, but realtek.ko
+not. Manually adding realtek.ko to initramfs fixed the issues.
+Root cause seems to be that tools like dracut and genkernel don't
+consider softdeps. Add a check for loaded Realtek PHY driver module
+and provide the user with a hint if it's not loaded.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index 4ab87fe845427..6ea43e48d5f97 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -7433,6 +7433,15 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ int chipset, region, i;
+ int jumbo_max, rc;
+
++ /* Some tools for creating an initramfs don't consider softdeps, then
++ * r8169.ko may be in initramfs, but realtek.ko not. Then the generic
++ * PHY driver is used that doesn't work with most chip versions.
++ */
++ if (!driver_find("RTL8201CP Ethernet", &mdio_bus_type)) {
++ dev_err(&pdev->dev, "realtek.ko not loaded, maybe it needs to be added to initramfs?\n");
++ return -ENOENT;
++ }
++
+ dev = devm_alloc_etherdev(&pdev->dev, sizeof (*tp));
+ if (!dev)
+ return -ENOMEM;
+--
+2.20.1
+
--- /dev/null
+From 6b6d3ab4e32e2080704de545082a1ee655481cb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 17:09:52 +0100
+Subject: radeon: insert 10ms sleep in dce5_crtc_load_lut
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+[ Upstream commit ec3d65082d7dabad6fa8f66a8ef166f2d522d6b2 ]
+
+Per at least one tester this is enough magic to recover the regression
+introduced for some people (but not all) in
+
+commit b8e2b0199cc377617dc238f5106352c06dcd3fa2
+Author: Peter Rosin <peda@axentia.se>
+Date: Tue Jul 4 12:36:57 2017 +0200
+
+ drm/fb-helper: factor out pseudo-palette
+
+which for radeon had the side-effect of refactoring out a seemingly
+redudant writing of the color palette.
+
+10ms in a fairly slow modeset path feels like an acceptable form of
+duct-tape, so maybe worth a shot and see what sticks.
+
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Michel Dänzer <michel.daenzer@amd.com>
+References: https://bugzilla.kernel.org/show_bug.cgi?id=198123
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/radeon_display.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index d8e2d7b3b8365..7d1e14f0140a2 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -121,6 +121,8 @@ static void dce5_crtc_load_lut(struct drm_crtc *crtc)
+
+ DRM_DEBUG_KMS("%d\n", radeon_crtc->crtc_id);
+
++ msleep(10);
++
+ WREG32(NI_INPUT_CSC_CONTROL + radeon_crtc->crtc_offset,
+ (NI_INPUT_CSC_GRPH_MODE(NI_INPUT_CSC_BYPASS) |
+ NI_INPUT_CSC_OVL_MODE(NI_INPUT_CSC_BYPASS)));
+--
+2.20.1
+
--- /dev/null
+From b05102cc822e8d03513b825e07762f0ce420149f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 22:01:04 +0100
+Subject: rbd: work around -Wuninitialized warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a55e601b2f02df5db7070e9a37bd655c9c576a52 ]
+
+gcc -O3 warns about a dummy variable that is passed
+down into rbd_img_fill_nodata without being initialized:
+
+drivers/block/rbd.c: In function 'rbd_img_fill_nodata':
+drivers/block/rbd.c:2573:13: error: 'dummy' is used uninitialized in this function [-Werror=uninitialized]
+ fctx->iter = *fctx->pos;
+
+Since this is a dummy, I assume the warning is harmless, but
+it's better to initialize it anyway and avoid the warning.
+
+Fixes: mmtom ("init/Kconfig: enable -O3 for all arches")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rbd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index b942f4c8cea8c..d3ad1b8c133e6 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2097,7 +2097,7 @@ static int rbd_img_fill_nodata(struct rbd_img_request *img_req,
+ u64 off, u64 len)
+ {
+ struct ceph_file_extent ex = { off, len };
+- union rbd_img_fill_iter dummy;
++ union rbd_img_fill_iter dummy = {};
+ struct rbd_img_fill_ctx fctx = {
+ .pos_type = OBJ_REQUEST_NODATA,
+ .pos = &dummy,
+--
+2.20.1
+
--- /dev/null
+From 3430cf64bfc1955e8b513e0e13901df7358e021d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 9 Nov 2019 09:42:13 -0800
+Subject: rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
+
+From: Paul E. McKenney <paulmck@kernel.org>
+
+[ Upstream commit 860c8802ace14c646864795e057349c9fb2d60ad ]
+
+Eric Dumazet supplied a KCSAN report of a bug that forces use
+of hlist_unhashed_lockless() from sk_unhashed():
+
+------------------------------------------------------------------------
+
+BUG: KCSAN: data-race in inet_unhash / inet_unhash
+
+write to 0xffff8880a69a0170 of 8 bytes by interrupt on cpu 1:
+ __hlist_nulls_del include/linux/list_nulls.h:88 [inline]
+ hlist_nulls_del_init_rcu include/linux/rculist_nulls.h:36 [inline]
+ __sk_nulls_del_node_init_rcu include/net/sock.h:676 [inline]
+ inet_unhash+0x38f/0x4a0 net/ipv4/inet_hashtables.c:612
+ tcp_set_state+0xfa/0x3e0 net/ipv4/tcp.c:2249
+ tcp_done+0x93/0x1e0 net/ipv4/tcp.c:3854
+ tcp_write_err+0x7e/0xc0 net/ipv4/tcp_timer.c:56
+ tcp_retransmit_timer+0x9b8/0x16d0 net/ipv4/tcp_timer.c:479
+ tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:599
+ tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:619
+ call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
+ expire_timers kernel/time/timer.c:1449 [inline]
+ __run_timers kernel/time/timer.c:1773 [inline]
+ __run_timers kernel/time/timer.c:1740 [inline]
+ run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
+ __do_softirq+0x115/0x33f kernel/softirq.c:292
+ invoke_softirq kernel/softirq.c:373 [inline]
+ irq_exit+0xbb/0xe0 kernel/softirq.c:413
+ exiting_irq arch/x86/include/asm/apic.h:536 [inline]
+ smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
+ apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
+ native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
+ arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
+ default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
+ cpuidle_idle_call kernel/sched/idle.c:154 [inline]
+ do_idle+0x1af/0x280 kernel/sched/idle.c:263
+ cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355
+ start_secondary+0x208/0x260 arch/x86/kernel/smpboot.c:264
+ secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
+
+read to 0xffff8880a69a0170 of 8 bytes by interrupt on cpu 0:
+ sk_unhashed include/net/sock.h:607 [inline]
+ inet_unhash+0x3d/0x4a0 net/ipv4/inet_hashtables.c:592
+ tcp_set_state+0xfa/0x3e0 net/ipv4/tcp.c:2249
+ tcp_done+0x93/0x1e0 net/ipv4/tcp.c:3854
+ tcp_write_err+0x7e/0xc0 net/ipv4/tcp_timer.c:56
+ tcp_retransmit_timer+0x9b8/0x16d0 net/ipv4/tcp_timer.c:479
+ tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:599
+ tcp_write_timer+0xd1/0xf0 net/ipv4/tcp_timer.c:619
+ call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
+ expire_timers kernel/time/timer.c:1449 [inline]
+ __run_timers kernel/time/timer.c:1773 [inline]
+ __run_timers kernel/time/timer.c:1740 [inline]
+ run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
+ __do_softirq+0x115/0x33f kernel/softirq.c:292
+ invoke_softirq kernel/softirq.c:373 [inline]
+ irq_exit+0xbb/0xe0 kernel/softirq.c:413
+ exiting_irq arch/x86/include/asm/apic.h:536 [inline]
+ smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
+ apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
+ native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71
+ arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571
+ default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
+ cpuidle_idle_call kernel/sched/idle.c:154 [inline]
+ do_idle+0x1af/0x280 kernel/sched/idle.c:263
+ cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:355
+ rest_init+0xec/0xf6 init/main.c:452
+ arch_call_rest_init+0x17/0x37
+ start_kernel+0x838/0x85e init/main.c:786
+ x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
+ x86_64_start_kernel+0x72/0x76 arch/x86/kernel/head64.c:471
+ secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine,
+BIOS Google 01/01/2011
+
+------------------------------------------------------------------------
+
+This commit therefore replaces C-language assignments with WRITE_ONCE()
+in include/linux/list_nulls.h and include/linux/rculist_nulls.h.
+
+Reported-by: Eric Dumazet <edumazet@google.com> # For KCSAN
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/list_nulls.h | 8 ++++----
+ include/linux/rculist_nulls.h | 8 ++++----
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
+index 3ef96743db8da..1ecd35664e0d3 100644
+--- a/include/linux/list_nulls.h
++++ b/include/linux/list_nulls.h
+@@ -72,10 +72,10 @@ static inline void hlist_nulls_add_head(struct hlist_nulls_node *n,
+ struct hlist_nulls_node *first = h->first;
+
+ n->next = first;
+- n->pprev = &h->first;
++ WRITE_ONCE(n->pprev, &h->first);
+ h->first = n;
+ if (!is_a_nulls(first))
+- first->pprev = &n->next;
++ WRITE_ONCE(first->pprev, &n->next);
+ }
+
+ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+@@ -85,13 +85,13 @@ static inline void __hlist_nulls_del(struct hlist_nulls_node *n)
+
+ WRITE_ONCE(*pprev, next);
+ if (!is_a_nulls(next))
+- next->pprev = pprev;
++ WRITE_ONCE(next->pprev, pprev);
+ }
+
+ static inline void hlist_nulls_del(struct hlist_nulls_node *n)
+ {
+ __hlist_nulls_del(n);
+- n->pprev = LIST_POISON2;
++ WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+
+ /**
+diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
+index 61974c4c566be..90f2e2232c6d7 100644
+--- a/include/linux/rculist_nulls.h
++++ b/include/linux/rculist_nulls.h
+@@ -34,7 +34,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ {
+ if (!hlist_nulls_unhashed(n)) {
+ __hlist_nulls_del(n);
+- n->pprev = NULL;
++ WRITE_ONCE(n->pprev, NULL);
+ }
+ }
+
+@@ -66,7 +66,7 @@ static inline void hlist_nulls_del_init_rcu(struct hlist_nulls_node *n)
+ static inline void hlist_nulls_del_rcu(struct hlist_nulls_node *n)
+ {
+ __hlist_nulls_del(n);
+- n->pprev = LIST_POISON2;
++ WRITE_ONCE(n->pprev, LIST_POISON2);
+ }
+
+ /**
+@@ -94,10 +94,10 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
+ struct hlist_nulls_node *first = h->first;
+
+ n->next = first;
+- n->pprev = &h->first;
++ WRITE_ONCE(n->pprev, &h->first);
+ rcu_assign_pointer(hlist_nulls_first_rcu(h), n);
+ if (!is_a_nulls(first))
+- first->pprev = &n->next;
++ WRITE_ONCE(first->pprev, &n->next);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From f69e3b8a1745bde4ba015a8f9887400479b2de7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Dec 2019 19:36:13 +0800
+Subject: RDMA/rxe: Fix error type of mmap_offset
+
+From: Jiewei Ke <kejiewei.cn@gmail.com>
+
+[ Upstream commit 6ca18d8927d468c763571f78c9a7387a69ffa020 ]
+
+The type of mmap_offset should be u64 instead of int to match the type of
+mminfo.offset. If otherwise, after we create several thousands of CQs, it
+will run into overflow issues.
+
+Link: https://lore.kernel.org/r/20191227113613.5020-1-kejiewei.cn@gmail.com
+Signed-off-by: Jiewei Ke <kejiewei.cn@gmail.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_verbs.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h
+index 6a75f96b90962..b4e24362edbb0 100644
+--- a/drivers/infiniband/sw/rxe/rxe_verbs.h
++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h
+@@ -407,7 +407,7 @@ struct rxe_dev {
+ struct list_head pending_mmaps;
+
+ spinlock_t mmap_offset_lock; /* guard mmap_offset */
+- int mmap_offset;
++ u64 mmap_offset;
+
+ atomic64_t stats_counters[RXE_NUM_OF_COUNTERS];
+
+--
+2.20.1
+
--- /dev/null
+From 17be9d6df64305f2e7dda4a82a6288af379cbaf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 14:33:10 +0000
+Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ]
+
+After device disassociation the uapi_objects are destroyed and freed,
+however it is still possible that core code can be holding a kref on the
+uobject. When it finally goes to uverbs_uobject_free() via the kref_put()
+it can trigger a use-after-free on the uapi_object.
+
+Since needs_kfree_rcu is a micro optimization that only benefits file
+uobjects, just get rid of it. There is no harm in using kfree_rcu even if
+it isn't required, and the number of involved objects is small.
+
+Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca
+Signed-off-by: Michael Guralnik <michaelgur@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/rdma_core.c | 23 +----------------------
+ include/rdma/uverbs_types.h | 1 -
+ 2 files changed, 1 insertion(+), 23 deletions(-)
+
+diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
+index c4118bcd51035..c2c9bd72b350f 100644
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject)
+
+ static void uverbs_uobject_free(struct kref *ref)
+ {
+- struct ib_uobject *uobj =
+- container_of(ref, struct ib_uobject, ref);
+-
+- if (uobj->uapi_object->type_class->needs_kfree_rcu)
+- kfree_rcu(uobj, rcu);
+- else
+- kfree(uobj);
++ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu);
+ }
+
+ void uverbs_uobject_put(struct ib_uobject *uobject)
+@@ -753,20 +747,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = {
+ .lookup_put = lookup_put_idr_uobject,
+ .destroy_hw = destroy_hw_idr_uobject,
+ .remove_handle = remove_handle_idr_uobject,
+- /*
+- * When we destroy an object, we first just lock it for WRITE and
+- * actually DESTROY it in the finalize stage. So, the problematic
+- * scenario is when we just started the finalize stage of the
+- * destruction (nothing was executed yet). Now, the other thread
+- * fetched the object for READ access, but it didn't lock it yet.
+- * The DESTROY thread continues and starts destroying the object.
+- * When the other thread continue - without the RCU, it would
+- * access freed memory. However, the rcu_read_lock delays the free
+- * until the rcu_read_lock of the READ operation quits. Since the
+- * exclusive lock of the object is still taken by the DESTROY flow, the
+- * READ operation will get -EBUSY and it'll just bail out.
+- */
+- .needs_kfree_rcu = true,
+ };
+ EXPORT_SYMBOL(uverbs_idr_class);
+
+@@ -954,7 +934,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = {
+ .lookup_put = lookup_put_fd_uobject,
+ .destroy_hw = destroy_hw_fd_uobject,
+ .remove_handle = remove_handle_fd_uobject,
+- .needs_kfree_rcu = false,
+ };
+ EXPORT_SYMBOL(uverbs_fd_class);
+
+diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h
+index acb1bfa3cc99a..f70155cc73979 100644
+--- a/include/rdma/uverbs_types.h
++++ b/include/rdma/uverbs_types.h
+@@ -97,7 +97,6 @@ struct uverbs_obj_type_class {
+ int __must_check (*destroy_hw)(struct ib_uobject *uobj,
+ enum rdma_remove_reason why);
+ void (*remove_handle)(struct ib_uobject *uobj);
+- u8 needs_kfree_rcu;
+ };
+
+ struct uverbs_obj_type {
+--
+2.20.1
+
--- /dev/null
+From 0b82a7b215c8043b3bdf2fa11a0d3d92cb5b808b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 17:47:09 +0100
+Subject: regulator: rk808: Lower log level on optional GPIOs being not
+ available
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit b8a039d37792067c1a380dc710361905724b9b2f ]
+
+RK808 can leverage a couple of GPIOs to tweak the ramp rate during DVS
+(Dynamic Voltage Scaling). These GPIOs are entirely optional but a
+dev_warn() appeared when cleaning this driver to use a more up-to-date
+gpiod API. At least reduce the log level to 'info' as it is totally
+fine to not populate these GPIO on a hardware design.
+
+This change is trivial but it is worth not polluting the logs during
+bringup phase by having real warnings and errors sorted out
+correctly.
+
+Fixes: a13eaf02e2d6 ("regulator: rk808: make better use of the gpiod API")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/r/20191203164709.11127-1-miquel.raynal@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rk808-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
+index 213b68743cc89..92498ac503035 100644
+--- a/drivers/regulator/rk808-regulator.c
++++ b/drivers/regulator/rk808-regulator.c
+@@ -714,7 +714,7 @@ static int rk808_regulator_dt_parse_pdata(struct device *dev,
+ }
+
+ if (!pdata->dvs_gpio[i]) {
+- dev_warn(dev, "there is no dvs%d gpio\n", i);
++ dev_info(dev, "there is no dvs%d gpio\n", i);
+ continue;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0a11657ca51fff6885eefb3fd916fc80d7db4231 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Dec 2019 11:35:58 +0100
+Subject: reiserfs: Fix spurious unlock in reiserfs_fill_super() error handling
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 4d5c1adaf893b8aa52525d2b81995e949bcb3239 ]
+
+When we fail to allocate string for journal device name we jump to
+'error' label which tries to unlock reiserfs write lock which is not
+held. Jump to 'error_unlocked' instead.
+
+Fixes: f32485be8397 ("reiserfs: delay reiserfs lock until journal initialization")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 6280efeceb0a2..de5eda33c92a0 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -1954,7 +1954,7 @@ static int reiserfs_fill_super(struct super_block *s, void *data, int silent)
+ if (!sbi->s_jdev) {
+ SWARN(silent, s, "", "Cannot allocate memory for "
+ "journal device name");
+- goto error;
++ goto error_unlocked;
+ }
+ }
+ #ifdef CONFIG_QUOTA
+--
+2.20.1
+
--- /dev/null
+From d8fdb98e900da6d261fcff07c7203379b9c4767a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 22:17:26 -0800
+Subject: reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
+
+From: Yunfeng Ye <yeyunfeng@huawei.com>
+
+[ Upstream commit aacee5446a2a1aa35d0a49dab289552578657fb4 ]
+
+The variable inode may be NULL in reiserfs_insert_item(), but there is
+no check before accessing the member of inode.
+
+Fix this by adding NULL pointer check before calling reiserfs_debug().
+
+Link: http://lkml.kernel.org/r/79c5135d-ff25-1cc9-4e99-9f572b88cc00@huawei.com
+Signed-off-by: Yunfeng Ye <yeyunfeng@huawei.com>
+Cc: zhengbin <zhengbin13@huawei.com>
+Cc: Hu Shiyuan <hushiyuan@huawei.com>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Jan Kara <jack@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/reiserfs/stree.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
+index 0037aea97d39a..2946713cb00d6 100644
+--- a/fs/reiserfs/stree.c
++++ b/fs/reiserfs/stree.c
+@@ -2250,7 +2250,8 @@ error_out:
+ /* also releases the path */
+ unfix_nodes(&s_ins_balance);
+ #ifdef REISERQUOTA_DEBUG
+- reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
++ if (inode)
++ reiserfs_debug(th->t_super, REISERFS_DEBUG_CODE,
+ "reiserquota insert_item(): freeing %u id=%u type=%c",
+ quota_bytes, inode->i_uid, head2type(ih));
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 6b5d2758e26a45fb1902e970357cb74a95a3fdf0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 May 2019 17:52:23 -0500
+Subject: remoteproc: Initialize rproc_class before use
+
+From: Brandon Maier <brandon.maier@rockwellcollins.com>
+
+[ Upstream commit a8f40111d184098cd2b3dc0c7170c42250a5fa09 ]
+
+The remoteproc_core and remoteproc drivers all initialize with module_init().
+However remoteproc drivers need the rproc_class during their probe. If one of
+the remoteproc drivers runs init and gets through probe before
+remoteproc_init() runs, a NULL pointer access of rproc_class's `glue_dirs`
+spinlock occurs.
+
+> Unable to handle kernel NULL pointer dereference at virtual address 000000dc
+> pgd = c0004000
+> [000000dc] *pgd=00000000
+> Internal error: Oops: 5 [#1] PREEMPT ARM
+> Modules linked in:
+> CPU: 0 PID: 1 Comm: swapper Tainted: G W 4.14.106-rt56 #1
+> Hardware name: Generic OMAP36xx (Flattened Device Tree)
+> task: c6050000 task.stack: c604a000
+> PC is at rt_spin_lock+0x40/0x6c
+> LR is at rt_spin_lock+0x28/0x6c
+> pc : [<c0523c90>] lr : [<c0523c78>] psr: 60000013
+> sp : c604bdc0 ip : 00000000 fp : 00000000
+> r10: 00000000 r9 : c61c7c10 r8 : c6269c20
+> r7 : c0905888 r6 : c6269c20 r5 : 00000000 r4 : 000000d4
+> r3 : 000000dc r2 : c6050000 r1 : 00000002 r0 : 000000d4
+> Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+...
+> [<c0523c90>] (rt_spin_lock) from [<c03b65a4>] (get_device_parent+0x54/0x17c)
+> [<c03b65a4>] (get_device_parent) from [<c03b6bec>] (device_add+0xe0/0x5b4)
+> [<c03b6bec>] (device_add) from [<c042adf4>] (rproc_add+0x18/0xd8)
+> [<c042adf4>] (rproc_add) from [<c01110e4>] (my_rproc_probe+0x158/0x204)
+> [<c01110e4>] (my_rproc_probe) from [<c03bb6b8>] (platform_drv_probe+0x34/0x70)
+> [<c03bb6b8>] (platform_drv_probe) from [<c03b9dd4>] (driver_probe_device+0x2c8/0x420)
+> [<c03b9dd4>] (driver_probe_device) from [<c03ba02c>] (__driver_attach+0x100/0x11c)
+> [<c03ba02c>] (__driver_attach) from [<c03b7d08>] (bus_for_each_dev+0x7c/0xc0)
+> [<c03b7d08>] (bus_for_each_dev) from [<c03b910c>] (bus_add_driver+0x1cc/0x264)
+> [<c03b910c>] (bus_add_driver) from [<c03ba714>] (driver_register+0x78/0xf8)
+> [<c03ba714>] (driver_register) from [<c010181c>] (do_one_initcall+0x100/0x190)
+> [<c010181c>] (do_one_initcall) from [<c0800de8>] (kernel_init_freeable+0x130/0x1d0)
+> [<c0800de8>] (kernel_init_freeable) from [<c051eee8>] (kernel_init+0x8/0x114)
+> [<c051eee8>] (kernel_init) from [<c01175b0>] (ret_from_fork+0x14/0x24)
+> Code: e2843008 e3c2203f f5d3f000 e5922010 (e193cf9f)
+> ---[ end trace 0000000000000002 ]---
+
+Signed-off-by: Brandon Maier <brandon.maier@rockwellcollins.com>
+Link: https://lore.kernel.org/r/20190530225223.136420-1-brandon.maier@rockwellcollins.com
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/remoteproc/remoteproc_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
+index aa6206706fe33..abbef17c97ee2 100644
+--- a/drivers/remoteproc/remoteproc_core.c
++++ b/drivers/remoteproc/remoteproc_core.c
+@@ -1786,7 +1786,7 @@ static int __init remoteproc_init(void)
+
+ return 0;
+ }
+-module_init(remoteproc_init);
++subsys_initcall(remoteproc_init);
+
+ static void __exit remoteproc_exit(void)
+ {
+--
+2.20.1
+
--- /dev/null
+From dc979eb0bc45ed32869909b0263c8cec86b1d803 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 29 Nov 2019 13:19:19 +0900
+Subject: reset: uniphier: Add SCSSI reset control for each channel
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit f4aec227e985e31d2fdc5608daf48e3de19157b7 ]
+
+SCSSI has reset controls for each channel in the SoCs newer than Pro4,
+so this adds missing reset controls for channel 1, 2 and 3. And more, this
+moves MCSSI reset ID after SCSSI.
+
+Fixes: 6b39fd590aeb ("reset: uniphier: add reset control support for SPI")
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Acked-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/reset-uniphier.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/reset/reset-uniphier.c b/drivers/reset/reset-uniphier.c
+index 5605745663ae0..adbecb2c7cd3a 100644
+--- a/drivers/reset/reset-uniphier.c
++++ b/drivers/reset/reset-uniphier.c
+@@ -202,8 +202,8 @@ static const struct uniphier_reset_data uniphier_pro5_sd_reset_data[] = {
+ #define UNIPHIER_PERI_RESET_FI2C(id, ch) \
+ UNIPHIER_RESETX((id), 0x114, 24 + (ch))
+
+-#define UNIPHIER_PERI_RESET_SCSSI(id) \
+- UNIPHIER_RESETX((id), 0x110, 17)
++#define UNIPHIER_PERI_RESET_SCSSI(id, ch) \
++ UNIPHIER_RESETX((id), 0x110, 17 + (ch))
+
+ #define UNIPHIER_PERI_RESET_MCSSI(id) \
+ UNIPHIER_RESETX((id), 0x114, 14)
+@@ -218,7 +218,7 @@ static const struct uniphier_reset_data uniphier_ld4_peri_reset_data[] = {
+ UNIPHIER_PERI_RESET_I2C(6, 2),
+ UNIPHIER_PERI_RESET_I2C(7, 3),
+ UNIPHIER_PERI_RESET_I2C(8, 4),
+- UNIPHIER_PERI_RESET_SCSSI(11),
++ UNIPHIER_PERI_RESET_SCSSI(11, 0),
+ UNIPHIER_RESET_END,
+ };
+
+@@ -234,8 +234,11 @@ static const struct uniphier_reset_data uniphier_pro4_peri_reset_data[] = {
+ UNIPHIER_PERI_RESET_FI2C(8, 4),
+ UNIPHIER_PERI_RESET_FI2C(9, 5),
+ UNIPHIER_PERI_RESET_FI2C(10, 6),
+- UNIPHIER_PERI_RESET_SCSSI(11),
+- UNIPHIER_PERI_RESET_MCSSI(12),
++ UNIPHIER_PERI_RESET_SCSSI(11, 0),
++ UNIPHIER_PERI_RESET_SCSSI(12, 1),
++ UNIPHIER_PERI_RESET_SCSSI(13, 2),
++ UNIPHIER_PERI_RESET_SCSSI(14, 3),
++ UNIPHIER_PERI_RESET_MCSSI(15),
+ UNIPHIER_RESET_END,
+ };
+
+--
+2.20.1
+
--- /dev/null
+From eb4262644016f293399e7128198facd54f2ba1b8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 00:55:29 +0700
+Subject: rtlwifi: rtl_pci: Fix -Wcast-function-type
+
+From: Phong Tran <tranmanphong@gmail.com>
+
+[ Upstream commit cb775c88da5d48a85d99d95219f637b6fad2e0e9 ]
+
+correct usage prototype of callback in tasklet_init().
+Report by https://github.com/KSPP/linux/issues/20
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/realtek/rtlwifi/pci.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c
+index 5d1fda16fc8c4..83749578fa8b3 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
+@@ -1082,13 +1082,15 @@ done:
+ return ret;
+ }
+
+-static void _rtl_pci_irq_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_irq_tasklet(unsigned long data)
+ {
++ struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ _rtl_pci_tx_chk_waitq(hw);
+ }
+
+-static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
++static void _rtl_pci_prepare_bcn_tasklet(unsigned long data)
+ {
++ struct ieee80211_hw *hw = (struct ieee80211_hw *)data;
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+@@ -1214,10 +1216,10 @@ static void _rtl_pci_init_struct(struct ieee80211_hw *hw,
+
+ /*task */
+ tasklet_init(&rtlpriv->works.irq_tasklet,
+- (void (*)(unsigned long))_rtl_pci_irq_tasklet,
++ _rtl_pci_irq_tasklet,
+ (unsigned long)hw);
+ tasklet_init(&rtlpriv->works.irq_prepare_bcn_tasklet,
+- (void (*)(unsigned long))_rtl_pci_prepare_bcn_tasklet,
++ _rtl_pci_prepare_bcn_tasklet,
+ (unsigned long)hw);
+ INIT_WORK(&rtlpriv->works.lps_change_work,
+ rtl_lps_change_work_callback);
+--
+2.20.1
+
--- /dev/null
+From 9d0a0a5fcbbaab01b86dc958e936febac6bb2624 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 14:46:00 +0100
+Subject: s390: adjust -mpacked-stack support check for clang 10
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 253b3c4b2920e07ce9e2b18800b9b65245e2fafa ]
+
+clang 10 introduces -mpacked-stack compiler option implementation. At the
+same time currently it does not support a combination of -mpacked-stack
+and -mbackchain. This leads to the following build error:
+
+clang: error: unsupported option '-mpacked-stack with -mbackchain' for
+target 's390x-ibm-linux'
+
+If/when clang adds support for a combination of -mpacked-stack and
+-mbackchain it would also require -msoft-float (like gcc does). According
+to Ulrich Weigand "stack slot assigned to the kernel backchain overlaps
+the stack slot assigned to the FPR varargs (both are required to be
+placed immediately after the saved r15 slot if present)."
+
+Extend -mpacked-stack compiler option support check to include all 3
+options -mpacked-stack -mbackchain -msoft-float which must present to
+support -mpacked-stack with -mbackchain.
+
+Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/s390/Makefile b/arch/s390/Makefile
+index e6c2e8925fefa..4bccde36cb161 100644
+--- a/arch/s390/Makefile
++++ b/arch/s390/Makefile
+@@ -63,7 +63,7 @@ cflags-y += -Wa,-I$(srctree)/arch/$(ARCH)/include
+ #
+ cflags-$(CONFIG_FRAME_POINTER) += -fno-optimize-sibling-calls
+
+-ifeq ($(call cc-option-yn,-mpacked-stack),y)
++ifeq ($(call cc-option-yn,-mpacked-stack -mbackchain -msoft-float),y)
+ cflags-$(CONFIG_PACK_STACK) += -mpacked-stack -D__PACK_STACK
+ aflags-$(CONFIG_PACK_STACK) += -D__PACK_STACK
+ endif
+--
+2.20.1
+
--- /dev/null
+From 4c329072cf5e7736755414319f4f8c4d655bc232 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 14:33:39 +0100
+Subject: s390/ftrace: generate traced function stack frame
+
+From: Vasily Gorbik <gor@linux.ibm.com>
+
+[ Upstream commit 45f7a0da600d3c409b5ad8d5ddddacd98ddc8840 ]
+
+Currently backtrace from ftraced function does not contain ftraced
+function itself. e.g. for "path_openat":
+
+arch_stack_walk+0x15c/0x2d8
+stack_trace_save+0x50/0x68
+stack_trace_call+0x15e/0x3d8
+ftrace_graph_caller+0x0/0x1c <-- ftrace code
+do_filp_open+0x7c/0xe8 <-- ftraced function caller
+do_open_execat+0x76/0x1b8
+open_exec+0x52/0x78
+load_elf_binary+0x180/0x1160
+search_binary_handler+0x8e/0x288
+load_script+0x2a8/0x2b8
+search_binary_handler+0x8e/0x288
+__do_execve_file.isra.39+0x6fa/0xb40
+__s390x_sys_execve+0x56/0x68
+system_call+0xdc/0x2d8
+
+Ftraced function is expected in the backtrace by ftrace kselftests, which
+are now failing. It would also be nice to have it for clarity reasons.
+
+"ftrace_caller" itself is called without stack frame allocated for it
+and does not store its caller (ftraced function). Instead it simply
+allocates a stack frame for "ftrace_trace_function" and sets backchain
+to point to ftraced function stack frame (which contains ftraced function
+caller in saved r14).
+
+To fix this issue make "ftrace_caller" allocate a stack frame
+for itself just to store ftraced function for the stack unwinder.
+As a result backtrace looks like the following:
+
+arch_stack_walk+0x15c/0x2d8
+stack_trace_save+0x50/0x68
+stack_trace_call+0x15e/0x3d8
+ftrace_graph_caller+0x0/0x1c <-- ftrace code
+path_openat+0x6/0xd60 <-- ftraced function
+do_filp_open+0x7c/0xe8 <-- ftraced function caller
+do_open_execat+0x76/0x1b8
+open_exec+0x52/0x78
+load_elf_binary+0x180/0x1160
+search_binary_handler+0x8e/0x288
+load_script+0x2a8/0x2b8
+search_binary_handler+0x8e/0x288
+__do_execve_file.isra.39+0x6fa/0xb40
+__s390x_sys_execve+0x56/0x68
+system_call+0xdc/0x2d8
+
+Reported-by: Sven Schnelle <sven.schnelle@ibm.com>
+Tested-by: Sven Schnelle <sven.schnelle@ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/mcount.S | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S
+index e93fbf02490cf..83afd5b78e16a 100644
+--- a/arch/s390/kernel/mcount.S
++++ b/arch/s390/kernel/mcount.S
+@@ -25,6 +25,12 @@ ENTRY(ftrace_stub)
+ #define STACK_PTREGS (STACK_FRAME_OVERHEAD)
+ #define STACK_PTREGS_GPRS (STACK_PTREGS + __PT_GPRS)
+ #define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW)
++#ifdef __PACK_STACK
++/* allocate just enough for r14, r15 and backchain */
++#define TRACED_FUNC_FRAME_SIZE 24
++#else
++#define TRACED_FUNC_FRAME_SIZE STACK_FRAME_OVERHEAD
++#endif
+
+ ENTRY(_mcount)
+ BR_EX %r14
+@@ -38,9 +44,16 @@ ENTRY(ftrace_caller)
+ #if !(defined(CC_USING_HOTPATCH) || defined(CC_USING_NOP_MCOUNT))
+ aghi %r0,MCOUNT_RETURN_FIXUP
+ #endif
+- aghi %r15,-STACK_FRAME_SIZE
++ # allocate stack frame for ftrace_caller to contain traced function
++ aghi %r15,-TRACED_FUNC_FRAME_SIZE
+ stg %r1,__SF_BACKCHAIN(%r15)
++ stg %r0,(__SF_GPRS+8*8)(%r15)
++ stg %r15,(__SF_GPRS+9*8)(%r15)
++ # allocate pt_regs and stack frame for ftrace_trace_function
++ aghi %r15,-STACK_FRAME_SIZE
+ stg %r1,(STACK_PTREGS_GPRS+15*8)(%r15)
++ aghi %r1,-TRACED_FUNC_FRAME_SIZE
++ stg %r1,__SF_BACKCHAIN(%r15)
+ stg %r0,(STACK_PTREGS_PSW+8)(%r15)
+ stmg %r2,%r14,(STACK_PTREGS_GPRS+2*8)(%r15)
+ #ifdef CONFIG_HAVE_MARCH_Z196_FEATURES
+--
+2.20.1
+
--- /dev/null
+From c4a84cb6dfbb8564906a5f4c29aafa7298cc607f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 09:16:59 +0100
+Subject: s390/pci: Fix possible deadlock in recover_store()
+
+From: Niklas Schnelle <schnelle@linux.ibm.com>
+
+[ Upstream commit 576c75e36c689bec6a940e807bae27291ab0c0de ]
+
+With zpci_disable() working, lockdep detected a potential deadlock
+(lockdep output at the end).
+
+The deadlock is between recovering a PCI function via the
+
+/sys/bus/pci/devices/<dev>/recover
+
+attribute vs powering it off via
+
+/sys/bus/pci/slots/<slot>/power.
+
+The fix is analogous to the changes in commit 0ee223b2e1f6 ("scsi: core:
+Avoid that SCSI device removal through sysfs triggers a deadlock")
+that fixed a potential deadlock on removing a SCSI device via sysfs.
+
+[ 204.830107] ======================================================
+[ 204.830109] WARNING: possible circular locking dependency detected
+[ 204.830111] 5.5.0-rc2-06072-gbc03ecc9a672 #6 Tainted: G W
+[ 204.830112] ------------------------------------------------------
+[ 204.830113] bash/1034 is trying to acquire lock:
+[ 204.830115] 0000000192a1a610 (kn->count#200){++++}, at: kernfs_remove_by_name_ns+0x5c/0xa8
+[ 204.830122]
+ but task is already holding lock:
+[ 204.830123] 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48
+[ 204.830128]
+ which lock already depends on the new lock.
+
+[ 204.830129]
+ the existing dependency chain (in reverse order) is:
+[ 204.830130]
+ -> #1 (pci_rescan_remove_lock){+.+.}:
+[ 204.830134] validate_chain+0x93a/0xd08
+[ 204.830136] __lock_acquire+0x4ae/0x9d0
+[ 204.830137] lock_acquire+0x114/0x280
+[ 204.830140] __mutex_lock+0xa2/0x960
+[ 204.830142] mutex_lock_nested+0x32/0x40
+[ 204.830145] recover_store+0x4c/0xa8
+[ 204.830147] kernfs_fop_write+0xe6/0x218
+[ 204.830151] vfs_write+0xb0/0x1b8
+[ 204.830152] ksys_write+0x6c/0xf8
+[ 204.830154] system_call+0xd8/0x2d8
+[ 204.830155]
+ -> #0 (kn->count#200){++++}:
+[ 204.830187] check_noncircular+0x1e6/0x240
+[ 204.830189] check_prev_add+0xfc/0xdb0
+[ 204.830190] validate_chain+0x93a/0xd08
+[ 204.830192] __lock_acquire+0x4ae/0x9d0
+[ 204.830193] lock_acquire+0x114/0x280
+[ 204.830194] __kernfs_remove.part.0+0x2e4/0x360
+[ 204.830196] kernfs_remove_by_name_ns+0x5c/0xa8
+[ 204.830198] remove_files.isra.0+0x4c/0x98
+[ 204.830199] sysfs_remove_group+0x66/0xc8
+[ 204.830201] sysfs_remove_groups+0x46/0x68
+[ 204.830204] device_remove_attrs+0x52/0x90
+[ 204.830207] device_del+0x182/0x418
+[ 204.830208] pci_remove_bus_device+0x8a/0x130
+[ 204.830210] pci_stop_and_remove_bus_device_locked+0x3a/0x48
+[ 204.830212] disable_slot+0x68/0x100
+[ 204.830213] power_write_file+0x7c/0x130
+[ 204.830215] kernfs_fop_write+0xe6/0x218
+[ 204.830217] vfs_write+0xb0/0x1b8
+[ 204.830218] ksys_write+0x6c/0xf8
+[ 204.830220] system_call+0xd8/0x2d8
+[ 204.830221]
+ other info that might help us debug this:
+
+[ 204.830223] Possible unsafe locking scenario:
+
+[ 204.830224] CPU0 CPU1
+[ 204.830225] ---- ----
+[ 204.830226] lock(pci_rescan_remove_lock);
+[ 204.830227] lock(kn->count#200);
+[ 204.830229] lock(pci_rescan_remove_lock);
+[ 204.830231] lock(kn->count#200);
+[ 204.830233]
+ *** DEADLOCK ***
+
+[ 204.830234] 4 locks held by bash/1034:
+[ 204.830235] #0: 00000001b6fbc498 (sb_writers#4){.+.+}, at: vfs_write+0x158/0x1b8
+[ 204.830239] #1: 000000018c9f5090 (&of->mutex){+.+.}, at: kernfs_fop_write+0xaa/0x218
+[ 204.830242] #2: 00000001f7da0810 (kn->count#235){.+.+}, at: kernfs_fop_write+0xb6/0x218
+[ 204.830245] #3: 00000000c16134a8 (pci_rescan_remove_lock){+.+.}, at: pci_stop_and_remove_bus_device_locked+0x26/0x48
+[ 204.830248]
+ stack backtrace:
+[ 204.830250] CPU: 2 PID: 1034 Comm: bash Tainted: G W 5.5.0-rc2-06072-gbc03ecc9a672 #6
+[ 204.830252] Hardware name: IBM 8561 T01 703 (LPAR)
+[ 204.830253] Call Trace:
+[ 204.830257] [<00000000c05e10c0>] show_stack+0x88/0xf0
+[ 204.830260] [<00000000c112dca4>] dump_stack+0xa4/0xe0
+[ 204.830261] [<00000000c0694c06>] check_noncircular+0x1e6/0x240
+[ 204.830263] [<00000000c0695bec>] check_prev_add+0xfc/0xdb0
+[ 204.830264] [<00000000c06971da>] validate_chain+0x93a/0xd08
+[ 204.830266] [<00000000c06994c6>] __lock_acquire+0x4ae/0x9d0
+[ 204.830267] [<00000000c069867c>] lock_acquire+0x114/0x280
+[ 204.830269] [<00000000c09ca15c>] __kernfs_remove.part.0+0x2e4/0x360
+[ 204.830270] [<00000000c09cb5c4>] kernfs_remove_by_name_ns+0x5c/0xa8
+[ 204.830272] [<00000000c09cee14>] remove_files.isra.0+0x4c/0x98
+[ 204.830274] [<00000000c09cf2ae>] sysfs_remove_group+0x66/0xc8
+[ 204.830276] [<00000000c09cf356>] sysfs_remove_groups+0x46/0x68
+[ 204.830278] [<00000000c0e3dfe2>] device_remove_attrs+0x52/0x90
+[ 204.830280] [<00000000c0e40382>] device_del+0x182/0x418
+[ 204.830281] [<00000000c0dcfd7a>] pci_remove_bus_device+0x8a/0x130
+[ 204.830283] [<00000000c0dcfe92>] pci_stop_and_remove_bus_device_locked+0x3a/0x48
+[ 204.830285] [<00000000c0de7190>] disable_slot+0x68/0x100
+[ 204.830286] [<00000000c0de6514>] power_write_file+0x7c/0x130
+[ 204.830288] [<00000000c09cc846>] kernfs_fop_write+0xe6/0x218
+[ 204.830290] [<00000000c08f3480>] vfs_write+0xb0/0x1b8
+[ 204.830291] [<00000000c08f378c>] ksys_write+0x6c/0xf8
+[ 204.830293] [<00000000c1154374>] system_call+0xd8/0x2d8
+[ 204.830294] INFO: lockdep is turned off.
+
+Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
+Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/pci/pci_sysfs.c | 63 ++++++++++++++++++++++++++-------------
+ 1 file changed, 42 insertions(+), 21 deletions(-)
+
+diff --git a/arch/s390/pci/pci_sysfs.c b/arch/s390/pci/pci_sysfs.c
+index 430c14b006d17..0e11fc023fe78 100644
+--- a/arch/s390/pci/pci_sysfs.c
++++ b/arch/s390/pci/pci_sysfs.c
+@@ -13,6 +13,8 @@
+ #include <linux/stat.h>
+ #include <linux/pci.h>
+
++#include "../../../drivers/pci/pci.h"
++
+ #include <asm/sclp.h>
+
+ #define zpci_attr(name, fmt, member) \
+@@ -40,31 +42,50 @@ zpci_attr(segment3, "0x%02x\n", pfip[3]);
+ static ssize_t recover_store(struct device *dev, struct device_attribute *attr,
+ const char *buf, size_t count)
+ {
++ struct kernfs_node *kn;
+ struct pci_dev *pdev = to_pci_dev(dev);
+ struct zpci_dev *zdev = to_zpci(pdev);
+- int ret;
+-
+- if (!device_remove_file_self(dev, attr))
+- return count;
+-
++ int ret = 0;
++
++ /* Can't use device_remove_self() here as that would lead us to lock
++ * the pci_rescan_remove_lock while holding the device' kernfs lock.
++ * This would create a possible deadlock with disable_slot() which is
++ * not directly protected by the device' kernfs lock but takes it
++ * during the device removal which happens under
++ * pci_rescan_remove_lock.
++ *
++ * This is analogous to sdev_store_delete() in
++ * drivers/scsi/scsi_sysfs.c
++ */
++ kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
++ WARN_ON_ONCE(!kn);
++ /* device_remove_file() serializes concurrent calls ignoring all but
++ * the first
++ */
++ device_remove_file(dev, attr);
++
++ /* A concurrent call to recover_store() may slip between
++ * sysfs_break_active_protection() and the sysfs file removal.
++ * Once it unblocks from pci_lock_rescan_remove() the original pdev
++ * will already be removed.
++ */
+ pci_lock_rescan_remove();
+- pci_stop_and_remove_bus_device(pdev);
+- ret = zpci_disable_device(zdev);
+- if (ret)
+- goto error;
+-
+- ret = zpci_enable_device(zdev);
+- if (ret)
+- goto error;
+-
+- pci_rescan_bus(zdev->bus);
++ if (pci_dev_is_added(pdev)) {
++ pci_stop_and_remove_bus_device(pdev);
++ ret = zpci_disable_device(zdev);
++ if (ret)
++ goto out;
++
++ ret = zpci_enable_device(zdev);
++ if (ret)
++ goto out;
++ pci_rescan_bus(zdev->bus);
++ }
++out:
+ pci_unlock_rescan_remove();
+-
+- return count;
+-
+-error:
+- pci_unlock_rescan_remove();
+- return ret;
++ if (kn)
++ sysfs_unbreak_active_protection(kn);
++ return ret ? ret : count;
+ }
+ static DEVICE_ATTR_WO(recover);
+
+--
+2.20.1
+
--- /dev/null
+From d07dc053bfd124d880ab2ba5ed8465c1c91a5132 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 18:42:20 -0700
+Subject: scsi: aic7xxx: Adjust indentation in ahc_find_syncrate
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 4dbc96ad65c45cdd4e895ed7ae4c151b780790c5 ]
+
+Clang warns:
+
+../drivers/scsi/aic7xxx/aic7xxx_core.c:2317:5: warning: misleading
+indentation; statement is not part of the previous 'if'
+[-Wmisleading-indentation]
+ if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
+ ^
+../drivers/scsi/aic7xxx/aic7xxx_core.c:2310:4: note: previous statement
+is here
+ if (syncrate == &ahc_syncrates[maxsync])
+ ^
+1 warning generated.
+
+This warning occurs because there is a space amongst the tabs on this
+line. Remove it so that the indentation is consistent with the Linux kernel
+coding style and clang no longer warns.
+
+This has been a problem since the beginning of git history hence no fixes
+tag.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/817
+Link: https://lore.kernel.org/r/20191218014220.52746-1-natechancellor@gmail.com
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/aic7xxx/aic7xxx_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/aic7xxx/aic7xxx_core.c b/drivers/scsi/aic7xxx/aic7xxx_core.c
+index 915a34f141e4f..49e02e8745533 100644
+--- a/drivers/scsi/aic7xxx/aic7xxx_core.c
++++ b/drivers/scsi/aic7xxx/aic7xxx_core.c
+@@ -2321,7 +2321,7 @@ ahc_find_syncrate(struct ahc_softc *ahc, u_int *period,
+ * At some speeds, we only support
+ * ST transfers.
+ */
+- if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
++ if ((syncrate->sxfr_u2 & ST_SXFR) != 0)
+ *ppr_options &= ~MSG_EXT_PPR_DT_REQ;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From f41a901a0db5ec6893df7e9b6737e6163049e39b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Dec 2019 15:31:48 -0500
+Subject: scsi: iscsi: Don't destroy session if there are outstanding
+ connections
+
+From: Nick Black <nlb@google.com>
+
+[ Upstream commit 54155ed4199c7aa3fd20866648024ab63c96d579 ]
+
+A faulty userspace that calls destroy_session() before destroying the
+connections can trigger the failure. This patch prevents the issue by
+refusing to destroy the session if there are outstanding connections.
+
+------------[ cut here ]------------
+kernel BUG at mm/slub.c:306!
+invalid opcode: 0000 [#1] SMP PTI
+CPU: 1 PID: 1224 Comm: iscsid Not tainted 5.4.0-rc2.iscsi+ #7
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
+RIP: 0010:__slab_free+0x181/0x350
+[...]
+[ 1209.686056] RSP: 0018:ffffa93d4074fae0 EFLAGS: 00010246
+[ 1209.686694] RAX: ffff934efa5ad800 RBX: 000000008010000a RCX: ffff934efa5ad800
+[ 1209.687651] RDX: ffff934efa5ad800 RSI: ffffeb4041e96b00 RDI: ffff934efd402c40
+[ 1209.688582] RBP: ffffa93d4074fb80 R08: 0000000000000001 R09: ffffffffbb5dfa26
+[ 1209.689425] R10: ffff934efa5ad800 R11: 0000000000000001 R12: ffffeb4041e96b00
+[ 1209.690285] R13: ffff934efa5ad800 R14: ffff934efd402c40 R15: 0000000000000000
+[ 1209.691213] FS: 00007f7945dfb540(0000) GS:ffff934efda80000(0000) knlGS:0000000000000000
+[ 1209.692316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 1209.693013] CR2: 000055877fd3da80 CR3: 0000000077384000 CR4: 00000000000006e0
+[ 1209.693897] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 1209.694773] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 1209.695631] Call Trace:
+[ 1209.695957] ? __wake_up_common_lock+0x8a/0xc0
+[ 1209.696712] iscsi_pool_free+0x26/0x40
+[ 1209.697263] iscsi_session_teardown+0x2f/0xf0
+[ 1209.698117] iscsi_sw_tcp_session_destroy+0x45/0x60
+[ 1209.698831] iscsi_if_rx+0xd88/0x14e0
+[ 1209.699370] netlink_unicast+0x16f/0x200
+[ 1209.699932] netlink_sendmsg+0x21a/0x3e0
+[ 1209.700446] sock_sendmsg+0x4f/0x60
+[ 1209.700902] ___sys_sendmsg+0x2ae/0x320
+[ 1209.701451] ? cp_new_stat+0x150/0x180
+[ 1209.701922] __sys_sendmsg+0x59/0xa0
+[ 1209.702357] do_syscall_64+0x52/0x160
+[ 1209.702812] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 1209.703419] RIP: 0033:0x7f7946433914
+[...]
+[ 1209.706084] RSP: 002b:00007fffb99f2378 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+[ 1209.706994] RAX: ffffffffffffffda RBX: 000055bc869eac20 RCX: 00007f7946433914
+[ 1209.708082] RDX: 0000000000000000 RSI: 00007fffb99f2390 RDI: 0000000000000005
+[ 1209.709120] RBP: 00007fffb99f2390 R08: 000055bc84fe9320 R09: 00007fffb99f1f07
+[ 1209.710110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000038
+[ 1209.711085] R13: 000055bc8502306e R14: 0000000000000000 R15: 0000000000000000
+ Modules linked in:
+ ---[ end trace a2d933ede7f730d8 ]---
+
+Link: https://lore.kernel.org/r/20191226203148.2172200-1-krisman@collabora.com
+Signed-off-by: Nick Black <nlb@google.com>
+Co-developed-by: Salman Qazi <sqazi@google.com>
+Signed-off-by: Salman Qazi <sqazi@google.com>
+Co-developed-by: Junho Ryu <jayr@google.com>
+Signed-off-by: Junho Ryu <jayr@google.com>
+Co-developed-by: Khazhismel Kumykov <khazhy@google.com>
+Signed-off-by: Khazhismel Kumykov <khazhy@google.com>
+Co-developed-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Signed-off-by: Gabriel Krisman Bertazi <krisman@collabora.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/iscsi_tcp.c | 4 ++++
+ drivers/scsi/scsi_transport_iscsi.c | 26 +++++++++++++++++++++++---
+ 2 files changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
+index 55181d28291e7..7212e3a13fe6b 100644
+--- a/drivers/scsi/iscsi_tcp.c
++++ b/drivers/scsi/iscsi_tcp.c
+@@ -892,6 +892,10 @@ free_host:
+ static void iscsi_sw_tcp_session_destroy(struct iscsi_cls_session *cls_session)
+ {
+ struct Scsi_Host *shost = iscsi_session_to_shost(cls_session);
++ struct iscsi_session *session = cls_session->dd_data;
++
++ if (WARN_ON_ONCE(session->leadconn))
++ return;
+
+ iscsi_tcp_r2tpool_free(cls_session->dd_data);
+ iscsi_session_teardown(cls_session);
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index 4c4781e5974f0..c0fb9e7890807 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -2945,6 +2945,24 @@ iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ return err;
+ }
+
++static int iscsi_session_has_conns(int sid)
++{
++ struct iscsi_cls_conn *conn;
++ unsigned long flags;
++ int found = 0;
++
++ spin_lock_irqsave(&connlock, flags);
++ list_for_each_entry(conn, &connlist, conn_list) {
++ if (iscsi_conn_get_sid(conn) == sid) {
++ found = 1;
++ break;
++ }
++ }
++ spin_unlock_irqrestore(&connlock, flags);
++
++ return found;
++}
++
+ static int
+ iscsi_set_iface_params(struct iscsi_transport *transport,
+ struct iscsi_uevent *ev, uint32_t len)
+@@ -3522,10 +3540,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ break;
+ case ISCSI_UEVENT_DESTROY_SESSION:
+ session = iscsi_session_lookup(ev->u.d_session.sid);
+- if (session)
+- transport->destroy_session(session);
+- else
++ if (!session)
+ err = -EINVAL;
++ else if (iscsi_session_has_conns(ev->u.d_session.sid))
++ err = -EBUSY;
++ else
++ transport->destroy_session(session);
+ break;
+ case ISCSI_UEVENT_UNBIND_SESSION:
+ session = iscsi_session_lookup(ev->u.d_session.sid);
+--
+2.20.1
+
--- /dev/null
+From 2c930f0736c0093bd72f20f5c6ab5cca56cf954e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 22:53:33 -0800
+Subject: scsi: ufs: Complete pending requests in host reset and restore path
+
+From: Can Guo <cang@codeaurora.org>
+
+[ Upstream commit 2df74b6985b51e77756e2e8faa16c45ca3ba53c5 ]
+
+In UFS host reset and restore path, before probe, we stop and start the
+host controller once. After host controller is stopped, the pending
+requests, if any, are cleared from the doorbell, but no completion IRQ
+would be raised due to the hba is stopped. These pending requests shall be
+completed along with the first NOP_OUT command (as it is the first command
+which can raise a transfer completion IRQ) sent during probe. Since the
+OCSs of these pending requests are not SUCCESS (because they are not yet
+literally finished), their UPIUs shall be dumped. When there are multiple
+pending requests, the UPIU dump can be overwhelming and may lead to
+stability issues because it is in atomic context. Therefore, before probe,
+complete these pending requests right after host controller is stopped and
+silence the UPIU dump from them.
+
+Link: https://lore.kernel.org/r/1574751214-8321-5-git-send-email-cang@qti.qualcomm.com
+Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
+Reviewed-by: Bean Huo <beanhuo@micron.com>
+Tested-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 24 ++++++++++--------------
+ drivers/scsi/ufs/ufshcd.h | 2 ++
+ 2 files changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index f4fcaee41dc26..b3dee24917a86 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -4809,7 +4809,7 @@ ufshcd_transfer_rsp_status(struct ufs_hba *hba, struct ufshcd_lrb *lrbp)
+ break;
+ } /* end of switch */
+
+- if (host_byte(result) != DID_OK)
++ if ((host_byte(result) != DID_OK) && !hba->silence_err_logs)
+ ufshcd_print_trs(hba, 1 << lrbp->task_tag, true);
+ return result;
+ }
+@@ -5341,8 +5341,8 @@ static void ufshcd_err_handler(struct work_struct *work)
+
+ /*
+ * if host reset is required then skip clearing the pending
+- * transfers forcefully because they will automatically get
+- * cleared after link startup.
++ * transfers forcefully because they will get cleared during
++ * host reset and restore
+ */
+ if (needs_reset)
+ goto skip_pending_xfer_clear;
+@@ -5996,9 +5996,15 @@ static int ufshcd_host_reset_and_restore(struct ufs_hba *hba)
+ int err;
+ unsigned long flags;
+
+- /* Reset the host controller */
++ /*
++ * Stop the host controller and complete the requests
++ * cleared by h/w
++ */
+ spin_lock_irqsave(hba->host->host_lock, flags);
+ ufshcd_hba_stop(hba, false);
++ hba->silence_err_logs = true;
++ ufshcd_complete_requests(hba);
++ hba->silence_err_logs = false;
+ spin_unlock_irqrestore(hba->host->host_lock, flags);
+
+ /* scale up clocks to max frequency before full reinitialization */
+@@ -6032,22 +6038,12 @@ out:
+ static int ufshcd_reset_and_restore(struct ufs_hba *hba)
+ {
+ int err = 0;
+- unsigned long flags;
+ int retries = MAX_HOST_RESET_RETRIES;
+
+ do {
+ err = ufshcd_host_reset_and_restore(hba);
+ } while (err && --retries);
+
+- /*
+- * After reset the door-bell might be cleared, complete
+- * outstanding requests in s/w here.
+- */
+- spin_lock_irqsave(hba->host->host_lock, flags);
+- ufshcd_transfer_req_compl(hba);
+- ufshcd_tmc_handler(hba);
+- spin_unlock_irqrestore(hba->host->host_lock, flags);
+-
+ return err;
+ }
+
+diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h
+index 33fdd3f281ae8..4554a4b725b54 100644
+--- a/drivers/scsi/ufs/ufshcd.h
++++ b/drivers/scsi/ufs/ufshcd.h
+@@ -489,6 +489,7 @@ struct ufs_stats {
+ * @uic_error: UFS interconnect layer error status
+ * @saved_err: sticky error mask
+ * @saved_uic_err: sticky UIC error mask
++ * @silence_err_logs: flag to silence error logs
+ * @dev_cmd: ufs device management command information
+ * @last_dme_cmd_tstamp: time stamp of the last completed DME command
+ * @auto_bkops_enabled: to track whether bkops is enabled in device
+@@ -645,6 +646,7 @@ struct ufs_hba {
+ u32 saved_err;
+ u32 saved_uic_err;
+ struct ufs_stats ufs_stats;
++ bool silence_err_logs;
+
+ /* Device management request data */
+ struct ufs_dev_cmd dev_cmd;
+--
+2.20.1
+
--- /dev/null
+From e13531d5c492e95c9633adb41d32c363f4cfe34a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 11:27:54 +0000
+Subject: selftests: bpf: Reset global state between reuseport test runs
+
+From: Lorenz Bauer <lmb@cloudflare.com>
+
+[ Upstream commit 51bad0f05616c43d6d34b0a19bcc9bdab8e8fb39 ]
+
+Currently, there is a lot of false positives if a single reuseport test
+fails. This is because expected_results and the result map are not cleared.
+
+Zero both after individual test runs, which fixes the mentioned false
+positives.
+
+Fixes: 91134d849a0e ("bpf: Test BPF_PROG_TYPE_SK_REUSEPORT")
+Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20200124112754.19664-5-lmb@cloudflare.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/bpf/test_select_reuseport.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/test_select_reuseport.c b/tools/testing/selftests/bpf/test_select_reuseport.c
+index 75646d9b34aaa..cdbbdab2725fc 100644
+--- a/tools/testing/selftests/bpf/test_select_reuseport.c
++++ b/tools/testing/selftests/bpf/test_select_reuseport.c
+@@ -30,7 +30,7 @@
+ #define REUSEPORT_ARRAY_SIZE 32
+
+ static int result_map, tmp_index_ovr_map, linum_map, data_check_map;
+-static enum result expected_results[NR_RESULTS];
++static __u32 expected_results[NR_RESULTS];
+ static int sk_fds[REUSEPORT_ARRAY_SIZE];
+ static int reuseport_array, outer_map;
+ static int select_by_skb_data_prog;
+@@ -610,7 +610,19 @@ static void setup_per_test(int type, unsigned short family, bool inany)
+
+ static void cleanup_per_test(void)
+ {
+- int i, err;
++ int i, err, zero = 0;
++
++ memset(expected_results, 0, sizeof(expected_results));
++
++ for (i = 0; i < NR_RESULTS; i++) {
++ err = bpf_map_update_elem(result_map, &i, &zero, BPF_ANY);
++ RET_IF(err, "reset elem in result_map",
++ "i:%u err:%d errno:%d\n", i, err, errno);
++ }
++
++ err = bpf_map_update_elem(linum_map, &zero, &zero, BPF_ANY);
++ RET_IF(err, "reset line number in linum_map", "err:%d errno:%d\n",
++ err, errno);
+
+ for (i = 0; i < REUSEPORT_ARRAY_SIZE; i++)
+ close(sk_fds[i]);
+--
+2.20.1
+
--- /dev/null
+From 819c84f55bb17747c7251583ea81336f3024e7c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 20:39:46 -0500
+Subject: selinux: ensure we cleanup the internal AVC counters on error in
+ avc_insert()
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit d8db60cb23e49a92cf8cada3297395c7fa50fdf8 ]
+
+Fix avc_insert() to call avc_node_kill() if we've already allocated
+an AVC node and the code fails to insert the node in the cache.
+
+Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
+Reported-by: rsiddoji@codeaurora.org
+Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/avc.c | 51 ++++++++++++++++++++----------------------
+ 1 file changed, 24 insertions(+), 27 deletions(-)
+
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 0622cae510461..83eef39c8a799 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -689,40 +689,37 @@ static struct avc_node *avc_insert(struct selinux_avc *avc,
+ struct avc_node *pos, *node = NULL;
+ int hvalue;
+ unsigned long flag;
++ spinlock_t *lock;
++ struct hlist_head *head;
+
+ if (avc_latest_notif_update(avc, avd->seqno, 1))
+- goto out;
++ return NULL;
+
+ node = avc_alloc_node(avc);
+- if (node) {
+- struct hlist_head *head;
+- spinlock_t *lock;
+- int rc = 0;
+-
+- hvalue = avc_hash(ssid, tsid, tclass);
+- avc_node_populate(node, ssid, tsid, tclass, avd);
+- rc = avc_xperms_populate(node, xp_node);
+- if (rc) {
+- kmem_cache_free(avc_node_cachep, node);
+- return NULL;
+- }
+- head = &avc->avc_cache.slots[hvalue];
+- lock = &avc->avc_cache.slots_lock[hvalue];
++ if (!node)
++ return NULL;
+
+- spin_lock_irqsave(lock, flag);
+- hlist_for_each_entry(pos, head, list) {
+- if (pos->ae.ssid == ssid &&
+- pos->ae.tsid == tsid &&
+- pos->ae.tclass == tclass) {
+- avc_node_replace(avc, node, pos);
+- goto found;
+- }
++ avc_node_populate(node, ssid, tsid, tclass, avd);
++ if (avc_xperms_populate(node, xp_node)) {
++ avc_node_kill(avc, node);
++ return NULL;
++ }
++
++ hvalue = avc_hash(ssid, tsid, tclass);
++ head = &avc->avc_cache.slots[hvalue];
++ lock = &avc->avc_cache.slots_lock[hvalue];
++ spin_lock_irqsave(lock, flag);
++ hlist_for_each_entry(pos, head, list) {
++ if (pos->ae.ssid == ssid &&
++ pos->ae.tsid == tsid &&
++ pos->ae.tclass == tclass) {
++ avc_node_replace(avc, node, pos);
++ goto found;
+ }
+- hlist_add_head_rcu(&node->list, head);
+-found:
+- spin_unlock_irqrestore(lock, flag);
+ }
+-out:
++ hlist_add_head_rcu(&node->list, head);
++found:
++ spin_unlock_irqrestore(lock, flag);
+ return node;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 75bf35acba40940273b3fe64988023fdddd8a88e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 17:25:47 +0530
+Subject: selinux: ensure we cleanup the internal AVC counters on error in
+ avc_update()
+
+From: Jaihind Yadav <jaihindyadav@codeaurora.org>
+
+[ Upstream commit 030b995ad9ece9fa2d218af4429c1c78c2342096 ]
+
+In AVC update we don't call avc_node_kill() when avc_xperms_populate()
+fails, resulting in the avc->avc_cache.active_nodes counter having a
+false value. In last patch this changes was missed , so correcting it.
+
+Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
+Signed-off-by: Jaihind Yadav <jaihindyadav@codeaurora.org>
+Signed-off-by: Ravi Kumar Siddojigari <rsiddoji@codeaurora.org>
+[PM: merge fuzz, minor description cleanup]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/avc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 83eef39c8a799..d52be7b9f08c8 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -896,7 +896,7 @@ static int avc_update_node(struct selinux_avc *avc,
+ if (orig->ae.xp_node) {
+ rc = avc_xperms_populate(node, orig->ae.xp_node);
+ if (rc) {
+- kmem_cache_free(avc_node_cachep, node);
++ avc_node_kill(avc, node);
+ goto out_unlock;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From e7782936359e03bcc7fd2d3dc54e858048ddd1f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Nov 2019 12:22:45 -0500
+Subject: selinux: fall back to ref-walk if audit is required
+
+From: Stephen Smalley <sds@tycho.nsa.gov>
+
+[ Upstream commit 0188d5c025ca8fe756ba3193bd7d150139af5a88 ]
+
+commit bda0be7ad994 ("security: make inode_follow_link RCU-walk aware")
+passed down the rcu flag to the SELinux AVC, but failed to adjust the
+test in slow_avc_audit() to also return -ECHILD on LSM_AUDIT_DATA_DENTRY.
+Previously, we only returned -ECHILD if generating an audit record with
+LSM_AUDIT_DATA_INODE since this was only relevant from inode_permission.
+Move the handling of MAY_NOT_BLOCK to avc_audit() and its inlined
+equivalent in selinux_inode_permission() immediately after we determine
+that audit is required, and always fall back to ref-walk in this case.
+
+Fixes: bda0be7ad994 ("security: make inode_follow_link RCU-walk aware")
+Reported-by: Will Deacon <will@kernel.org>
+Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/selinux/avc.c | 24 +++++-------------------
+ security/selinux/hooks.c | 11 +++++++----
+ security/selinux/include/avc.h | 8 +++++---
+ 3 files changed, 17 insertions(+), 26 deletions(-)
+
+diff --git a/security/selinux/avc.c b/security/selinux/avc.c
+index 5de18a6d5c3f0..0622cae510461 100644
+--- a/security/selinux/avc.c
++++ b/security/selinux/avc.c
+@@ -496,7 +496,7 @@ static inline int avc_xperms_audit(struct selinux_state *state,
+ if (likely(!audited))
+ return 0;
+ return slow_avc_audit(state, ssid, tsid, tclass, requested,
+- audited, denied, result, ad, 0);
++ audited, denied, result, ad);
+ }
+
+ static void avc_node_free(struct rcu_head *rhead)
+@@ -766,8 +766,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
+ noinline int slow_avc_audit(struct selinux_state *state,
+ u32 ssid, u32 tsid, u16 tclass,
+ u32 requested, u32 audited, u32 denied, int result,
+- struct common_audit_data *a,
+- unsigned int flags)
++ struct common_audit_data *a)
+ {
+ struct common_audit_data stack_data;
+ struct selinux_audit_data sad;
+@@ -777,17 +776,6 @@ noinline int slow_avc_audit(struct selinux_state *state,
+ a->type = LSM_AUDIT_DATA_NONE;
+ }
+
+- /*
+- * When in a RCU walk do the audit on the RCU retry. This is because
+- * the collection of the dname in an inode audit message is not RCU
+- * safe. Note this may drop some audits when the situation changes
+- * during retry. However this is logically just as if the operation
+- * happened a little later.
+- */
+- if ((a->type == LSM_AUDIT_DATA_INODE) &&
+- (flags & MAY_NOT_BLOCK))
+- return -ECHILD;
+-
+ sad.tclass = tclass;
+ sad.requested = requested;
+ sad.ssid = ssid;
+@@ -860,16 +848,14 @@ static int avc_update_node(struct selinux_avc *avc,
+ /*
+ * If we are in a non-blocking code path, e.g. VFS RCU walk,
+ * then we must not add permissions to a cache entry
+- * because we cannot safely audit the denial. Otherwise,
++ * because we will not audit the denial. Otherwise,
+ * during the subsequent blocking retry (e.g. VFS ref walk), we
+ * will find the permissions already granted in the cache entry
+ * and won't audit anything at all, leading to silent denials in
+ * permissive mode that only appear when in enforcing mode.
+ *
+- * See the corresponding handling in slow_avc_audit(), and the
+- * logic in selinux_inode_follow_link and selinux_inode_permission
+- * for the VFS MAY_NOT_BLOCK flag, which is transliterated into
+- * AVC_NONBLOCKING for avc_has_perm_noaudit().
++ * See the corresponding handling of MAY_NOT_BLOCK in avc_audit()
++ * and selinux_inode_permission().
+ */
+ if (flags & AVC_NONBLOCKING)
+ return 0;
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 040c843968dc6..c574285966f9d 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -3171,8 +3171,7 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
+
+ static noinline int audit_inode_permission(struct inode *inode,
+ u32 perms, u32 audited, u32 denied,
+- int result,
+- unsigned flags)
++ int result)
+ {
+ struct common_audit_data ad;
+ struct inode_security_struct *isec = inode->i_security;
+@@ -3183,7 +3182,7 @@ static noinline int audit_inode_permission(struct inode *inode,
+
+ rc = slow_avc_audit(&selinux_state,
+ current_sid(), isec->sid, isec->sclass, perms,
+- audited, denied, result, &ad, flags);
++ audited, denied, result, &ad);
+ if (rc)
+ return rc;
+ return 0;
+@@ -3230,7 +3229,11 @@ static int selinux_inode_permission(struct inode *inode, int mask)
+ if (likely(!audited))
+ return rc;
+
+- rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
++ /* fall back to ref-walk if we have to generate audit */
++ if (flags & MAY_NOT_BLOCK)
++ return -ECHILD;
++
++ rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
+ if (rc2)
+ return rc2;
+ return rc;
+diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
+index 74ea50977c201..cf4cc3ef959b5 100644
+--- a/security/selinux/include/avc.h
++++ b/security/selinux/include/avc.h
+@@ -100,8 +100,7 @@ static inline u32 avc_audit_required(u32 requested,
+ int slow_avc_audit(struct selinux_state *state,
+ u32 ssid, u32 tsid, u16 tclass,
+ u32 requested, u32 audited, u32 denied, int result,
+- struct common_audit_data *a,
+- unsigned flags);
++ struct common_audit_data *a);
+
+ /**
+ * avc_audit - Audit the granting or denial of permissions.
+@@ -135,9 +134,12 @@ static inline int avc_audit(struct selinux_state *state,
+ audited = avc_audit_required(requested, avd, result, 0, &denied);
+ if (likely(!audited))
+ return 0;
++ /* fall back to ref-walk if we have to generate audit */
++ if (flags & MAY_NOT_BLOCK)
++ return -ECHILD;
+ return slow_avc_audit(state, ssid, tsid, tclass,
+ requested, audited, denied, result,
+- a, flags);
++ a);
+ }
+
+ #define AVC_STRICT 1 /* Ignore permissive mode. */
+--
+2.20.1
+
revert-kvm-nvmx-use-correct-root-level-for-nested-ep.patch
revert-kvm-vmx-add-non-canonical-check-on-writes-to-.patch
kvm-nvmx-use-correct-root-level-for-nested-ept-shado.patch
+drm-gma500-fixup-fbdev-stolen-size-usage-evaluation.patch
+nfsd4-avoid-null-deference-on-strange-copy-compounds.patch
+soc-fsl-qe-change-return-type-of-cpm_muram_alloc-to-.patch
+cpu-hotplug-stop_machine-fix-stop_machine-vs-hotplug.patch
+brcmfmac-fix-use-after-free-in-brcmf_sdio_readframes.patch
+leds-pca963x-fix-open-drain-initialization.patch
+ext4-fix-ext4_dax_read-write-inode-locking-sequence-.patch
+alsa-ctl-allow-tlv-read-operation-for-callback-type-.patch
+gianfar-fix-tx-timestamping-with-a-stacked-dsa-drive.patch
+pinctrl-sh-pfc-sh7264-fix-can-function-gpios.patch
+pxa168fb-fix-the-function-used-to-release-some-memor.patch
+media-i2c-mt9v032-fix-enum-mbus-codes-and-frame-size.patch
+powerpc-powernv-iov-ensure-the-pdn-for-vfs-always-co.patch
+gpio-gpio-grgpio-fix-possible-sleep-in-atomic-contex.patch
+iommu-vt-d-fix-off-by-one-in-pasid-allocation.patch
+char-random-silence-a-lockdep-splat-with-printk.patch
+media-sti-bdisp-fix-a-possible-sleep-in-atomic-conte.patch
+pinctrl-baytrail-do-not-clear-irq-flags-on-direct-ir.patch
+efi-x86-map-the-entire-efi-vendor-string-before-copy.patch
+mips-loongson-fix-potential-null-dereference-in-loon.patch
+sparc-add-.exit.data-section.patch
+uio-fix-a-sleep-in-atomic-context-bug-in-uio_dmem_ge.patch
+usb-gadget-udc-fix-possible-sleep-in-atomic-context-.patch
+usb-dwc2-fix-in-fifo-allocation.patch
+clocksource-drivers-bcm2835_timer-fix-memory-leak-of.patch
+kselftest-minimise-dependency-of-get_size-on-c-libra.patch
+jbd2-clear-jbd2_abort-flag-before-journal_reset-to-u.patch
+x86-sysfb-fix-check-for-bad-vram-size.patch
+pwm-omap-dmtimer-simplify-error-handling.patch
+s390-pci-fix-possible-deadlock-in-recover_store.patch
+powerpc-iov-move-vf-pdev-fixup-into-pcibios_fixup_io.patch
+tracing-fix-tracing_stat-return-values-in-error-hand.patch
+tracing-fix-very-unlikely-race-of-registering-two-st.patch
+arm-8952-1-disable-kmemleak-on-xip-kernels.patch
+ext4-jbd2-ensure-panic-when-aborting-with-zero-errno.patch
+ath10k-correct-the-dma-direction-for-management-tx-b.patch
+drm-amd-display-retrain-dongles-when-sink_count-beco.patch
+nbd-add-a-flush_workqueue-in-nbd_start_device.patch
+kvm-s390-enotsupp-eopnotsupp-fixups.patch
+kconfig-fix-broken-dependency-in-randconfig-generate.patch
+clk-qcom-rcg2-don-t-crash-if-our-parent-can-t-be-fou.patch
+drm-amdgpu-remove-4-set-but-not-used-variable-in-amd.patch
+drm-amdgpu-ensure-ret-is-always-initialized-when-usi.patch
+regulator-rk808-lower-log-level-on-optional-gpios-be.patch
+net-wan-fsl_ucc_hdlc-reject-muram-offsets-above-64k.patch
+nfc-port100-convert-cpu_to_le16-le16_to_cpu-e1-e2-to.patch
+selinux-fall-back-to-ref-walk-if-audit-is-required.patch
+arm64-dts-allwinner-h6-add-pmu-mode.patch
+arm-dts-allwinner-h3-add-pmu-node.patch
+selinux-ensure-we-cleanup-the-internal-avc-counters-.patch
+arm64-dts-qcom-msm8996-disable-usb2-phy-suspend-by-c.patch
+padata-always-acquire-cpu_hotplug_lock-before-pinst-.patch
+arm-dts-imx6-rdu2-disable-wp-for-usdhc2-and-usdhc3.patch
+arm-dts-imx6-rdu2-limit-usbh1-to-full-speed.patch
+pci-iproc-apply-quirk_paxc_bridge-for-module-as-well.patch
+media-cx23885-add-support-for-avermedia-ce310b.patch
+pci-add-generic-quirk-for-increasing-d3hot-delay.patch
+pci-increase-d3-delay-for-amd-ryzen5-7-xhci-controll.patch
+media-v4l2-device.h-explicitly-compare-grp-id-mask-t.patch
+reiserfs-fix-spurious-unlock-in-reiserfs_fill_super-.patch
+r8169-check-that-realtek-phy-driver-module-is-loaded.patch
+fore200e-fix-incorrect-checks-of-null-pointer-derefe.patch
+isdn-don-t-mark-kcapi_proc_exit-as-__exit.patch
+netfilter-nft_tunnel-add-the-missing-erspan_version-.patch
+alsa-usx2y-adjust-indentation-in-snd_usx2y_hwdep_dsp.patch
+b43legacy-fix-wcast-function-type.patch
+ipw2x00-fix-wcast-function-type.patch
+iwlegacy-fix-wcast-function-type.patch
+rtlwifi-rtl_pci-fix-wcast-function-type.patch
+orinoco-avoid-assertion-in-case-of-null-pointer.patch
+acpica-disassembler-create-buffer-fields-in-acpi_par.patch
+scsi-ufs-complete-pending-requests-in-host-reset-and.patch
+scsi-aic7xxx-adjust-indentation-in-ahc_find_syncrate.patch
+drm-mediatek-handle-events-when-enabling-disabling-c.patch
+arm-dts-r8a7779-add-device-node-for-arm-global-timer.patch
+selinux-ensure-we-cleanup-the-internal-avc-counters-.patch-24846
+dmaengine-store-module-owner-in-dma_device-struct.patch
+dmaengine-imx-sdma-fix-memory-leak.patch
+crypto-chtls-fixed-memory-leak.patch
+x86-vdso-provide-missing-include-file.patch
+pm-devfreq-rk3399_dmc-add-compile_test-and-have_arm_.patch
+pinctrl-sh-pfc-sh7269-fix-can-function-gpios.patch
+reset-uniphier-add-scssi-reset-control-for-each-chan.patch
+rdma-rxe-fix-error-type-of-mmap_offset.patch
+clk-sunxi-ng-add-mux-and-pll-notifiers-for-a64-cpu-c.patch
+alsa-sh-fix-unused-variable-warnings.patch
+clk-uniphier-add-scssi-clock-gate-for-each-channel.patch
+alsa-sh-fix-compile-warning-wrt-const.patch
+tools-lib-api-fs-fix-gcc9-stringop-truncation-compil.patch
+x86-unwind-orc-fix-config_modules-build-warning.patch
+acpi-button-add-dmi-quirk-for-razer-blade-stealth-13.patch
+mlx5-work-around-high-stack-usage-with-gcc.patch
+drm-remove-the-newline-for-crc-source-name.patch
+arm-dts-stm32-add-power-supply-for-dsi-panel-on-stm3.patch
+usbip-fix-unsafe-unaligned-pointer-usage.patch
+udf-fix-free-space-reporting-for-metadata-and-virtua.patch
+staging-rtl8188-avoid-excessive-stack-usage.patch
+ib-hfi1-add-software-counter-for-ctxt0-seq-drop.patch
+soc-tegra-fuse-correct-straps-address-for-older-tegr.patch
+efi-x86-don-t-panic-or-bug-on-non-critical-error-con.patch
+rcu-use-write_once-for-assignments-to-pprev-for-hlis.patch
+input-edt-ft5x06-work-around-first-register-access-e.patch
+x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch
+wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch
+asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
+rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
+tty-synclinkmp-adjust-indentation-in-several-functio.patch
+tty-synclink_gt-adjust-indentation-in-several-functi.patch
+visorbus-fix-uninitialized-variable-access.patch
+driver-core-platform-prevent-resouce-overflow-from-c.patch
+driver-core-print-device-when-resources-present-in-r.patch
+bpf-return-ebadrqc-for-invalid-map-type-in-__bpf_tx_.patch
+vme-bridges-reduce-stack-usage.patch
+drm-nouveau-secboot-gm20b-initialize-pointer-in-gm20.patch
+drm-nouveau-gr-gk20a-gm200-add-terminators-to-method.patch
+drm-nouveau-fix-copy-paste-error-in-nouveau_fence_wa.patch
+drm-nouveau-drm-ttm-remove-set-but-not-used-variable.patch
+drm-nouveau-fault-gv100-fix-memory-leak-on-module-un.patch
+drm-vmwgfx-prevent-memory-leak-in-vmw_cmdbuf_res_add.patch
+usb-musb-omap2430-get-rid-of-musb-.set_vbus-for-omap.patch
+iommu-arm-smmu-v3-use-write_once-when-changing-valid.patch
+f2fs-set-i_linkable-early-to-avoid-wrong-access-by-v.patch
+f2fs-free-sysfs-kobject.patch
+scsi-iscsi-don-t-destroy-session-if-there-are-outsta.patch
+arm64-fix-alternatives-with-llvm-s-integrated-assemb.patch
+drm-amd-display-fixup-dml-dependencies.patch
+watchdog-softlockup-enforce-that-timestamp-is-valid-.patch
+acpi-iort-fix-number-of-ids-handling-in-iort_id_map.patch
+f2fs-fix-memleak-of-kobject.patch
+x86-mm-fix-nx-bit-clearing-issue-in-kernel_map_pages.patch
+pwm-omap-dmtimer-remove-pwm-chip-in-.remove-before-m.patch
+cmd64x-potential-buffer-overflow-in-cmd64x_program_t.patch
+ide-serverworks-potential-overflow-in-svwks_set_pio_.patch
+pwm-remove-set-but-not-set-variable-pwm.patch
+btrfs-fix-possible-null-pointer-dereference-in-integ.patch
+btrfs-safely-advance-counter-when-looking-up-bio-csu.patch
+btrfs-device-stats-log-when-stats-are-zeroed.patch
+module-avoid-setting-info-name-early-in-case-we-can-.patch
+remoteproc-initialize-rproc_class-before-use.patch
+irqchip-mbigen-set-driver-.suppress_bind_attrs-to-av.patch
+alsa-hda-hdmi-add-retry-logic-to-parse_intel_hdmi.patch
+kbuild-use-s-instead-of-e-for-precise-cc-option-test.patch
+x86-decoder-add-test-opcode-to-group3-2.patch
+s390-adjust-mpacked-stack-support-check-for-clang-10.patch
+s390-ftrace-generate-traced-function-stack-frame.patch
+driver-core-platform-fix-u32-greater-or-equal-to-zer.patch
+alsa-hda-add-docking-station-support-for-lenovo-thin.patch
+drm-nouveau-mmu-fix-comptag-memory-leak.patch
+powerpc-sriov-remove-vf-eeh_dev-state-when-disabling.patch
+bcache-cached_dev_free-needs-to-put-the-sb-page.patch
+iommu-vt-d-remove-unnecessary-warn_on_once.patch
+selftests-bpf-reset-global-state-between-reuseport-t.patch
+jbd2-switch-to-use-jbd2_journal_abort-when-failed-to.patch
+jbd2-make-sure-eshutdown-to-be-recorded-in-the-journ.patch
+arm-8951-1-fix-kexec-compilation-issue.patch
+hostap-adjust-indentation-in-prism2_hostapd_add_sta.patch
+iwlegacy-ensure-loop-counter-addr-does-not-wrap-and-.patch
+cifs-fix-null-dereference-in-match_prepath.patch
+bpf-map_seq_next-should-always-increase-position-ind.patch
+ceph-check-availability-of-mds-cluster-on-mount-afte.patch
+rbd-work-around-wuninitialized-warning.patch
+irqchip-gic-v3-only-provision-redistributors-that-ar.patch
+drm-nouveau-disp-nv50-prevent-oops-when-no-channel-m.patch
+ftrace-fpid_next-should-increase-position-index.patch
+trigger_next-should-increase-position-index.patch
+radeon-insert-10ms-sleep-in-dce5_crtc_load_lut.patch
+ocfs2-fix-a-null-pointer-dereference-when-call-ocfs2.patch
+lib-scatterlist.c-adjust-indentation-in-__sg_alloc_t.patch
+reiserfs-prevent-null-pointer-dereference-in-reiserf.patch
+bcache-explicity-type-cast-in-bset_bkey_last.patch
+irqchip-gic-v3-its-reference-to-its_invall_cmd-descr.patch
+iwlwifi-mvm-fix-thermal-zone-registration.patch
+microblaze-prevent-the-overflow-of-the-start.patch
+brd-check-and-limit-max_part-par.patch
+drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_la.patch
+drm-amdgpu-smu10-fix-smu10_get_clock_by_type_with_vo.patch
+nfs-fix-memory-leaks.patch
+help_next-should-increase-position-index.patch
+cifs-log-warning-message-once-if-out-of-disk-space.patch
+virtio_balloon-prevent-pfn-array-overflow.patch
+mlxsw-spectrum_dpipe-add-missing-error-path.patch
+drm-amdgpu-display-handle-multiple-numbers-of-fclks-.patch
--- /dev/null
+From e766160fc3817ce0d3ef35e29dfaf66555bcfb0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Nov 2019 15:55:40 +0100
+Subject: soc: fsl: qe: change return type of cpm_muram_alloc() to s32
+
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+
+[ Upstream commit 800cd6fb76f0ec7711deb72a86c924db1ae42648 ]
+
+There are a number of problems with cpm_muram_alloc() and its
+callers. Most callers assign the return value to some variable and
+then use IS_ERR_VALUE to check for allocation failure. However, when
+that variable is not sizeof(long), this leads to warnings - and it is
+indeed broken to do e.g.
+
+ u32 foo = cpm_muram_alloc();
+ if (IS_ERR_VALUE(foo))
+
+on a 64-bit platform, since the condition
+
+ foo >= (unsigned long)-ENOMEM
+
+is tautologically false. There are also callers that ignore the
+possibility of error, and then there are those that check for error by
+comparing the return value to 0...
+
+One could fix that by changing all callers to store the return value
+temporarily in an "unsigned long" and test that. However, use of
+IS_ERR_VALUE() is error-prone and should be restricted to things which
+are inherently long-sized (stuff in pt_regs etc.). Instead, let's aim
+for changing to the standard kernel style
+
+ int foo = cpm_muram_alloc();
+ if (foo < 0)
+ deal_with_it()
+ some->where = foo;
+
+Changing the return type from unsigned long to s32 (aka signed int)
+doesn't change the value that gets stored into any of the callers'
+variables except if the caller was storing the result in a u64 _and_
+the allocation failed, so in itself this patch should be a no-op.
+
+Another problem with cpm_muram_alloc() is that it can certainly
+validly return 0 - and except if some cpm_muram_alloc_fixed() call
+interferes, the very first cpm_muram_alloc() call will return just
+that. But that shows that both ucc_slow_free() and ucc_fast_free() are
+buggy, since they assume that a value of 0 means "that field was never
+allocated". We'll later change cpm_muram_free() to accept (and ignore)
+a negative offset, so callers can use a sentinel of -1 instead of 0
+and just unconditionally call cpm_muram_free().
+
+Reviewed-by: Timur Tabi <timur@kernel.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/qe_common.c | 29 ++++++++++++++++-------------
+ include/soc/fsl/qe/qe.h | 16 ++++++++--------
+ 2 files changed, 24 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/soc/fsl/qe/qe_common.c b/drivers/soc/fsl/qe/qe_common.c
+index 104e68d9b84f2..4f60724b06b7c 100644
+--- a/drivers/soc/fsl/qe/qe_common.c
++++ b/drivers/soc/fsl/qe/qe_common.c
+@@ -35,7 +35,7 @@ static phys_addr_t muram_pbase;
+
+ struct muram_block {
+ struct list_head head;
+- unsigned long start;
++ s32 start;
+ int size;
+ };
+
+@@ -113,13 +113,14 @@ out_muram:
+ * @algo: algorithm for alloc.
+ * @data: data for genalloc's algorithm.
+ *
+- * This function returns an offset into the muram area.
++ * This function returns a non-negative offset into the muram area, or
++ * a negative errno on failure.
+ */
+-static unsigned long cpm_muram_alloc_common(unsigned long size,
+- genpool_algo_t algo, void *data)
++static s32 cpm_muram_alloc_common(unsigned long size,
++ genpool_algo_t algo, void *data)
+ {
+ struct muram_block *entry;
+- unsigned long start;
++ s32 start;
+
+ if (!muram_pool && cpm_muram_init())
+ goto out2;
+@@ -140,7 +141,7 @@ static unsigned long cpm_muram_alloc_common(unsigned long size,
+ out1:
+ gen_pool_free(muram_pool, start, size);
+ out2:
+- return (unsigned long)-ENOMEM;
++ return -ENOMEM;
+ }
+
+ /*
+@@ -148,13 +149,14 @@ out2:
+ * @size: number of bytes to allocate
+ * @align: requested alignment, in bytes
+ *
+- * This function returns an offset into the muram area.
++ * This function returns a non-negative offset into the muram area, or
++ * a negative errno on failure.
+ * Use cpm_dpram_addr() to get the virtual address of the area.
+ * Use cpm_muram_free() to free the allocation.
+ */
+-unsigned long cpm_muram_alloc(unsigned long size, unsigned long align)
++s32 cpm_muram_alloc(unsigned long size, unsigned long align)
+ {
+- unsigned long start;
++ s32 start;
+ unsigned long flags;
+ struct genpool_data_align muram_pool_data;
+
+@@ -171,7 +173,7 @@ EXPORT_SYMBOL(cpm_muram_alloc);
+ * cpm_muram_free - free a chunk of multi-user ram
+ * @offset: The beginning of the chunk as returned by cpm_muram_alloc().
+ */
+-int cpm_muram_free(unsigned long offset)
++int cpm_muram_free(s32 offset)
+ {
+ unsigned long flags;
+ int size;
+@@ -197,13 +199,14 @@ EXPORT_SYMBOL(cpm_muram_free);
+ * cpm_muram_alloc_fixed - reserve a specific region of multi-user ram
+ * @offset: offset of allocation start address
+ * @size: number of bytes to allocate
+- * This function returns an offset into the muram area
++ * This function returns @offset if the area was available, a negative
++ * errno otherwise.
+ * Use cpm_dpram_addr() to get the virtual address of the area.
+ * Use cpm_muram_free() to free the allocation.
+ */
+-unsigned long cpm_muram_alloc_fixed(unsigned long offset, unsigned long size)
++s32 cpm_muram_alloc_fixed(unsigned long offset, unsigned long size)
+ {
+- unsigned long start;
++ s32 start;
+ unsigned long flags;
+ struct genpool_data_fixed muram_pool_data_fixed;
+
+diff --git a/include/soc/fsl/qe/qe.h b/include/soc/fsl/qe/qe.h
+index b3d1aff5e8ad5..deb6238416947 100644
+--- a/include/soc/fsl/qe/qe.h
++++ b/include/soc/fsl/qe/qe.h
+@@ -102,26 +102,26 @@ static inline void qe_reset(void) {}
+ int cpm_muram_init(void);
+
+ #if defined(CONFIG_CPM) || defined(CONFIG_QUICC_ENGINE)
+-unsigned long cpm_muram_alloc(unsigned long size, unsigned long align);
+-int cpm_muram_free(unsigned long offset);
+-unsigned long cpm_muram_alloc_fixed(unsigned long offset, unsigned long size);
++s32 cpm_muram_alloc(unsigned long size, unsigned long align);
++int cpm_muram_free(s32 offset);
++s32 cpm_muram_alloc_fixed(unsigned long offset, unsigned long size);
+ void __iomem *cpm_muram_addr(unsigned long offset);
+ unsigned long cpm_muram_offset(void __iomem *addr);
+ dma_addr_t cpm_muram_dma(void __iomem *addr);
+ #else
+-static inline unsigned long cpm_muram_alloc(unsigned long size,
+- unsigned long align)
++static inline s32 cpm_muram_alloc(unsigned long size,
++ unsigned long align)
+ {
+ return -ENOSYS;
+ }
+
+-static inline int cpm_muram_free(unsigned long offset)
++static inline int cpm_muram_free(s32 offset)
+ {
+ return -ENOSYS;
+ }
+
+-static inline unsigned long cpm_muram_alloc_fixed(unsigned long offset,
+- unsigned long size)
++static inline s32 cpm_muram_alloc_fixed(unsigned long offset,
++ unsigned long size)
+ {
+ return -ENOSYS;
+ }
+--
+2.20.1
+
--- /dev/null
+From 66f68265998fc061e5d7f77fbab4601b8e0b447a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 21:23:03 +0300
+Subject: soc/tegra: fuse: Correct straps' address for older Tegra124 device
+ trees
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 2d9ea1934f8ef0dfb862d103389562cc28b4fc03 ]
+
+Trying to read out Chip ID before APBMISC registers are mapped won't
+succeed, in a result Tegra124 gets a wrong address for the HW straps
+register if machine uses an old outdated device tree.
+
+Fixes: 297c4f3dcbff ("soc/tegra: fuse: Restrict legacy code to 32-bit ARM")
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/tegra/fuse/tegra-apbmisc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/tegra/fuse/tegra-apbmisc.c b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+index e5a4d8f98b10e..d1cbb0fe1691a 100644
+--- a/drivers/soc/tegra/fuse/tegra-apbmisc.c
++++ b/drivers/soc/tegra/fuse/tegra-apbmisc.c
+@@ -135,7 +135,7 @@ void __init tegra_init_apbmisc(void)
+ apbmisc.flags = IORESOURCE_MEM;
+
+ /* strapping options */
+- if (tegra_get_chip_id() == TEGRA124) {
++ if (of_machine_is_compatible("nvidia,tegra124")) {
+ straps.start = 0x7000e864;
+ straps.end = 0x7000e867;
+ } else {
+--
+2.20.1
+
--- /dev/null
+From cf523c28d82a1c3498d5d40cff0d79fcc988461a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 00:07:42 -0800
+Subject: sparc: Add .exit.data section.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 548f0b9a5f4cffa0cecf62eb12aa8db682e4eee6 ]
+
+This fixes build errors of all sorts.
+
+Also, emit .exit.text unconditionally.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/vmlinux.lds.S | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
+index 61afd787bd0c7..59b6df13ddead 100644
+--- a/arch/sparc/kernel/vmlinux.lds.S
++++ b/arch/sparc/kernel/vmlinux.lds.S
+@@ -172,12 +172,14 @@ SECTIONS
+ }
+ PERCPU_SECTION(SMP_CACHE_BYTES)
+
+-#ifdef CONFIG_JUMP_LABEL
+ . = ALIGN(PAGE_SIZE);
+ .exit.text : {
+ EXIT_TEXT
+ }
+-#endif
++
++ .exit.data : {
++ EXIT_DATA
++ }
+
+ . = ALIGN(PAGE_SIZE);
+ __init_end = .;
+--
+2.20.1
+
--- /dev/null
+From 670b0c783ecc897fc35dfc448cc2110cf12c8cf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jan 2020 22:48:21 +0100
+Subject: staging: rtl8188: avoid excessive stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit c497ae2077c055b85c1bf04f3d182a84bd8f365b ]
+
+The rtl8188 copy of the os_dep support code causes a
+warning about a very significant stack usage in the translate_scan()
+function:
+
+drivers/staging/rtl8188eu/os_dep/ioctl_linux.c: In function 'translate_scan':
+drivers/staging/rtl8188eu/os_dep/ioctl_linux.c:306:1: error: the frame size of 1560 bytes is larger than 1400 bytes [-Werror=frame-larger-than=]
+
+Use the same trick as in the rtl8723bs copy of the same function, and
+allocate it dynamically.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200104214832.558198-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtl8188eu/os_dep/ioctl_linux.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+index bee3c3a7a7a99..2db4444267a74 100644
+--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
++++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+@@ -229,18 +229,21 @@ static char *translate_scan(struct adapter *padapter,
+
+ /* parsing WPA/WPA2 IE */
+ {
+- u8 buf[MAX_WPA_IE_LEN];
++ u8 *buf;
+ u8 wpa_ie[255], rsn_ie[255];
+ u16 wpa_len = 0, rsn_len = 0;
+ u8 *p;
+
++ buf = kzalloc(MAX_WPA_IE_LEN, GFP_ATOMIC);
++ if (!buf)
++ return start;
++
+ rtw_get_sec_ie(pnetwork->network.ies, pnetwork->network.ie_length, rsn_ie, &rsn_len, wpa_ie, &wpa_len);
+ RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: ssid =%s\n", pnetwork->network.Ssid.Ssid));
+ RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("rtw_wx_get_scan: wpa_len =%d rsn_len =%d\n", wpa_len, rsn_len));
+
+ if (wpa_len > 0) {
+ p = buf;
+- memset(buf, 0, MAX_WPA_IE_LEN);
+ p += sprintf(p, "wpa_ie=");
+ for (i = 0; i < wpa_len; i++)
+ p += sprintf(p, "%02x", wpa_ie[i]);
+@@ -257,7 +260,6 @@ static char *translate_scan(struct adapter *padapter,
+ }
+ if (rsn_len > 0) {
+ p = buf;
+- memset(buf, 0, MAX_WPA_IE_LEN);
+ p += sprintf(p, "rsn_ie=");
+ for (i = 0; i < rsn_len; i++)
+ p += sprintf(p, "%02x", rsn_ie[i]);
+@@ -271,6 +273,7 @@ static char *translate_scan(struct adapter *padapter,
+ iwe.u.data.length = rsn_len;
+ start = iwe_stream_add_point(info, start, stop, &iwe, rsn_ie);
+ }
++ kfree(buf);
+ }
+
+ {/* parsing WPS IE */
+--
+2.20.1
+
--- /dev/null
+From ea60fe96180c6f6b62f8c309ba170c4f067f3e1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 08:01:09 +0000
+Subject: tools lib api fs: Fix gcc9 stringop-truncation compilation error
+
+From: Andrey Zhizhikin <andrey.z@gmail.com>
+
+[ Upstream commit 6794200fa3c9c3e6759dae099145f23e4310f4f7 ]
+
+GCC9 introduced string hardening mechanisms, which exhibits the error
+during fs api compilation:
+
+error: '__builtin_strncpy' specified bound 4096 equals destination size
+[-Werror=stringop-truncation]
+
+This comes when the length of copy passed to strncpy is is equal to
+destination size, which could potentially lead to buffer overflow.
+
+There is a need to mitigate this potential issue by limiting the size of
+destination by 1 and explicitly terminate the destination with NULL.
+
+Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
+Reviewed-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Andrii Nakryiko <andriin@fb.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Cc: bpf@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Link: http://lore.kernel.org/lkml/20191211080109.18765-1-andrey.zhizhikin@leica-geosystems.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/api/fs/fs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
+index 7aba8243a0e7c..bd021a0eeef8c 100644
+--- a/tools/lib/api/fs/fs.c
++++ b/tools/lib/api/fs/fs.c
+@@ -210,6 +210,7 @@ static bool fs__env_override(struct fs *fs)
+ size_t name_len = strlen(fs->name);
+ /* name + "_PATH" + '\0' */
+ char upper_name[name_len + 5 + 1];
++
+ memcpy(upper_name, fs->name, name_len);
+ mem_toupper(upper_name, name_len);
+ strcpy(&upper_name[name_len], "_PATH");
+@@ -219,7 +220,8 @@ static bool fs__env_override(struct fs *fs)
+ return false;
+
+ fs->found = true;
+- strncpy(fs->path, override_path, sizeof(fs->path));
++ strncpy(fs->path, override_path, sizeof(fs->path) - 1);
++ fs->path[sizeof(fs->path) - 1] = '\0';
+ return true;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a0d948efbabf8870d0e4bdebc4871d2e2c31ee5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Sep 2014 22:49:41 +0100
+Subject: tracing: Fix tracing_stat return values in error handling paths
+
+From: Luis Henriques <luis.henriques@canonical.com>
+
+[ Upstream commit afccc00f75bbbee4e4ae833a96c2d29a7259c693 ]
+
+tracing_stat_init() was always returning '0', even on the error paths. It
+now returns -ENODEV if tracing_init_dentry() fails or -ENOMEM if it fails
+to created the 'trace_stat' debugfs directory.
+
+Link: http://lkml.kernel.org/r/1410299381-20108-1-git-send-email-luis.henriques@canonical.com
+
+Fixes: ed6f1c996bfe4 ("tracing: Check return value of tracing_init_dentry()")
+Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
+[ Pulled from the archeological digging of my INBOX ]
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_stat.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index 75bf1bcb4a8a5..bf68af63538b4 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -278,18 +278,22 @@ static int tracing_stat_init(void)
+
+ d_tracing = tracing_init_dentry();
+ if (IS_ERR(d_tracing))
+- return 0;
++ return -ENODEV;
+
+ stat_dir = tracefs_create_dir("trace_stat", d_tracing);
+- if (!stat_dir)
++ if (!stat_dir) {
+ pr_warn("Could not create tracefs 'trace_stat' entry\n");
++ return -ENOMEM;
++ }
+ return 0;
+ }
+
+ static int init_stat_file(struct stat_session *session)
+ {
+- if (!stat_dir && tracing_stat_init())
+- return -ENODEV;
++ int ret;
++
++ if (!stat_dir && (ret = tracing_stat_init()))
++ return ret;
+
+ session->file = tracefs_create_file(session->ts->name, 0644,
+ stat_dir,
+--
+2.20.1
+
--- /dev/null
+From 501905e2db58c8ba71b7425ae62a8b853482a48c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 17:47:49 -0500
+Subject: tracing: Fix very unlikely race of registering two stat tracers
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit dfb6cd1e654315168e36d947471bd2a0ccd834ae ]
+
+Looking through old emails in my INBOX, I came across a patch from Luis
+Henriques that attempted to fix a race of two stat tracers registering the
+same stat trace (extremely unlikely, as this is done in the kernel, and
+probably doesn't even exist). The submitted patch wasn't quite right as it
+needed to deal with clean up a bit better (if two stat tracers were the
+same, it would have the same files).
+
+But to make the code cleaner, all we needed to do is to keep the
+all_stat_sessions_mutex held for most of the registering function.
+
+Link: http://lkml.kernel.org/r/1410299375-20068-1-git-send-email-luis.henriques@canonical.com
+
+Fixes: 002bb86d8d42f ("tracing/ftrace: separate events tracing and stats tracing engine")
+Reported-by: Luis Henriques <luis.henriques@canonical.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_stat.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index bf68af63538b4..92b76f9e25edd 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -306,7 +306,7 @@ static int init_stat_file(struct stat_session *session)
+ int register_stat_tracer(struct tracer_stat *trace)
+ {
+ struct stat_session *session, *node;
+- int ret;
++ int ret = -EINVAL;
+
+ if (!trace)
+ return -EINVAL;
+@@ -317,17 +317,15 @@ int register_stat_tracer(struct tracer_stat *trace)
+ /* Already registered? */
+ mutex_lock(&all_stat_sessions_mutex);
+ list_for_each_entry(node, &all_stat_sessions, session_list) {
+- if (node->ts == trace) {
+- mutex_unlock(&all_stat_sessions_mutex);
+- return -EINVAL;
+- }
++ if (node->ts == trace)
++ goto out;
+ }
+- mutex_unlock(&all_stat_sessions_mutex);
+
++ ret = -ENOMEM;
+ /* Init the session */
+ session = kzalloc(sizeof(*session), GFP_KERNEL);
+ if (!session)
+- return -ENOMEM;
++ goto out;
+
+ session->ts = trace;
+ INIT_LIST_HEAD(&session->session_list);
+@@ -336,15 +334,16 @@ int register_stat_tracer(struct tracer_stat *trace)
+ ret = init_stat_file(session);
+ if (ret) {
+ destroy_session(session);
+- return ret;
++ goto out;
+ }
+
++ ret = 0;
+ /* Register */
+- mutex_lock(&all_stat_sessions_mutex);
+ list_add_tail(&session->session_list, &all_stat_sessions);
++ out:
+ mutex_unlock(&all_stat_sessions_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ void unregister_stat_tracer(struct tracer_stat *trace)
+--
+2.20.1
+
--- /dev/null
+From 4ffa569cec3502213b946c9e7bfb04b54e57800d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 Jan 2020 10:03:06 +0300
+Subject: trigger_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 6722b23e7a2ace078344064a9735fb73e554e9ef ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+Without patch:
+ # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger
+ dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset
+ n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ # Available triggers:
+ # traceon traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ 6+1 records in
+ 6+1 records out
+ 206 bytes copied, 0.00027916 s, 738 kB/s
+
+Notice the printing of "# Available triggers:..." after the line.
+
+With the patch:
+ # dd bs=30 skip=1 if=/sys/kernel/tracing/events/sched/sched_switch/trigger
+ dd: /sys/kernel/tracing/events/sched/sched_switch/trigger: cannot skip to specified offset
+ n traceoff snapshot stacktrace enable_event disable_event enable_hist disable_hist hist
+ 2+1 records in
+ 2+1 records out
+ 88 bytes copied, 0.000526867 s, 167 kB/s
+
+It only prints the end of the file, and does not restart.
+
+Link: http://lkml.kernel.org/r/3c35ee24-dd3a-8119-9c19-552ed253388a@virtuozzo.com
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/trace_events_trigger.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index b05d1b6a62911..9300e8bbf08ac 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -115,9 +115,10 @@ static void *trigger_next(struct seq_file *m, void *t, loff_t *pos)
+ {
+ struct trace_event_file *event_file = event_file_data(m->private);
+
+- if (t == SHOW_AVAILABLE_TRIGGERS)
++ if (t == SHOW_AVAILABLE_TRIGGERS) {
++ (*pos)++;
+ return NULL;
+-
++ }
+ return seq_list_next(t, &event_file->triggers, pos);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 44045bca4566f80b30b8dd481d28957d65d57b28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 19:39:13 -0700
+Subject: tty: synclink_gt: Adjust indentation in several functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 446e76873b5e4e70bdee5db2f2a894d5b4a7d081 ]
+
+Clang warns:
+
+../drivers/tty/synclink_gt.c:1337:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (C_CRTSCTS(tty)) {
+ ^
+../drivers/tty/synclink_gt.c:1335:2: note: previous statement is here
+ if (I_IXOFF(tty))
+ ^
+../drivers/tty/synclink_gt.c:2563:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+ ^
+../drivers/tty/synclink_gt.c:2561:2: note: previous statement is here
+ if (I_INPCK(info->port.tty))
+ ^
+../drivers/tty/synclink_gt.c:3221:3: warning: misleading indentation;
+statement is not part of the previous 'else' [-Wmisleading-indentation]
+ set_signals(info);
+ ^
+../drivers/tty/synclink_gt.c:3219:2: note: previous statement is here
+ else
+ ^
+3 warnings generated.
+
+The indentation on these lines is not at all consistent, tabs and spaces
+are mixed together. Convert to just using tabs to be consistent with the
+Linux kernel coding style and eliminate these warnings from clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/822
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218023912.13827-1-natechancellor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/synclink_gt.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c
+index b88ecf102764e..e9779b03ee565 100644
+--- a/drivers/tty/synclink_gt.c
++++ b/drivers/tty/synclink_gt.c
+@@ -1335,10 +1335,10 @@ static void throttle(struct tty_struct * tty)
+ DBGINFO(("%s throttle\n", info->device_name));
+ if (I_IXOFF(tty))
+ send_xchar(tty, STOP_CHAR(tty));
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals &= ~SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1360,10 +1360,10 @@ static void unthrottle(struct tty_struct * tty)
+ else
+ send_xchar(tty, START_CHAR(tty));
+ }
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -2561,8 +2561,8 @@ static void change_params(struct slgt_info *info)
+ info->read_status_mask = IRQ_RXOVER;
+ if (I_INPCK(info->port.tty))
+ info->read_status_mask |= MASK_PARITY | MASK_FRAMING;
+- if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- info->read_status_mask |= MASK_BREAK;
++ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++ info->read_status_mask |= MASK_BREAK;
+ if (I_IGNPAR(info->port.tty))
+ info->ignore_status_mask |= MASK_PARITY | MASK_FRAMING;
+ if (I_IGNBRK(info->port.tty)) {
+@@ -3193,7 +3193,7 @@ static int tiocmset(struct tty_struct *tty,
+ info->signals &= ~SerialSignal_DTR;
+
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return 0;
+ }
+@@ -3204,7 +3204,7 @@ static int carrier_raised(struct tty_port *port)
+ struct slgt_info *info = container_of(port, struct slgt_info, port);
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ return (info->signals & SerialSignal_DCD) ? 1 : 0;
+ }
+@@ -3219,7 +3219,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ info->signals |= SerialSignal_RTS | SerialSignal_DTR;
+ else
+ info->signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 27d8beb33fb747152b915276d887ccbea8bc37b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 19:47:20 -0700
+Subject: tty: synclinkmp: Adjust indentation in several functions
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 1feedf61e7265128244f6993f23421f33dd93dbc ]
+
+Clang warns:
+
+../drivers/tty/synclinkmp.c:1456:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (C_CRTSCTS(tty)) {
+ ^
+../drivers/tty/synclinkmp.c:1453:2: note: previous statement is here
+ if (I_IXOFF(tty))
+ ^
+../drivers/tty/synclinkmp.c:2473:8: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ info->port.tty->hw_stopped = 0;
+ ^
+../drivers/tty/synclinkmp.c:2471:7: note: previous statement is here
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ ^
+../drivers/tty/synclinkmp.c:2482:8: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ info->port.tty->hw_stopped = 1;
+ ^
+../drivers/tty/synclinkmp.c:2480:7: note: previous statement is here
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ ^
+../drivers/tty/synclinkmp.c:2809:3: warning: misleading indentation;
+statement is not part of the previous 'if' [-Wmisleading-indentation]
+ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+ ^
+../drivers/tty/synclinkmp.c:2807:2: note: previous statement is here
+ if (I_INPCK(info->port.tty))
+ ^
+../drivers/tty/synclinkmp.c:3246:3: warning: misleading indentation;
+statement is not part of the previous 'else' [-Wmisleading-indentation]
+ set_signals(info);
+ ^
+../drivers/tty/synclinkmp.c:3244:2: note: previous statement is here
+ else
+ ^
+5 warnings generated.
+
+The indentation on these lines is not at all consistent, tabs and spaces
+are mixed together. Convert to just using tabs to be consistent with the
+Linux kernel coding style and eliminate these warnings from clang.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/823
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Link: https://lore.kernel.org/r/20191218024720.3528-1-natechancellor@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/synclinkmp.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/tty/synclinkmp.c b/drivers/tty/synclinkmp.c
+index 1e4d5b9c981a4..57c2c647af61e 100644
+--- a/drivers/tty/synclinkmp.c
++++ b/drivers/tty/synclinkmp.c
+@@ -1454,10 +1454,10 @@ static void throttle(struct tty_struct * tty)
+ if (I_IXOFF(tty))
+ send_xchar(tty, STOP_CHAR(tty));
+
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->serial_signals &= ~SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -1483,10 +1483,10 @@ static void unthrottle(struct tty_struct * tty)
+ send_xchar(tty, START_CHAR(tty));
+ }
+
+- if (C_CRTSCTS(tty)) {
++ if (C_CRTSCTS(tty)) {
+ spin_lock_irqsave(&info->lock,flags);
+ info->serial_signals |= SerialSignal_RTS;
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+ }
+@@ -2471,7 +2471,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ if (status & SerialSignal_CTS) {
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ printk("CTS tx start...");
+- info->port.tty->hw_stopped = 0;
++ info->port.tty->hw_stopped = 0;
+ tx_start(info);
+ info->pending_bh |= BH_TRANSMIT;
+ return;
+@@ -2480,7 +2480,7 @@ static void isr_io_pin( SLMP_INFO *info, u16 status )
+ if (!(status & SerialSignal_CTS)) {
+ if ( debug_level >= DEBUG_LEVEL_ISR )
+ printk("CTS tx stop...");
+- info->port.tty->hw_stopped = 1;
++ info->port.tty->hw_stopped = 1;
+ tx_stop(info);
+ }
+ }
+@@ -2807,8 +2807,8 @@ static void change_params(SLMP_INFO *info)
+ info->read_status_mask2 = OVRN;
+ if (I_INPCK(info->port.tty))
+ info->read_status_mask2 |= PE | FRME;
+- if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
+- info->read_status_mask1 |= BRKD;
++ if (I_BRKINT(info->port.tty) || I_PARMRK(info->port.tty))
++ info->read_status_mask1 |= BRKD;
+ if (I_IGNPAR(info->port.tty))
+ info->ignore_status_mask2 |= PE | FRME;
+ if (I_IGNBRK(info->port.tty)) {
+@@ -3178,7 +3178,7 @@ static int tiocmget(struct tty_struct *tty)
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ result = ((info->serial_signals & SerialSignal_RTS) ? TIOCM_RTS : 0) |
+@@ -3216,7 +3216,7 @@ static int tiocmset(struct tty_struct *tty,
+ info->serial_signals &= ~SerialSignal_DTR;
+
+ spin_lock_irqsave(&info->lock,flags);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ return 0;
+@@ -3228,7 +3228,7 @@ static int carrier_raised(struct tty_port *port)
+ unsigned long flags;
+
+ spin_lock_irqsave(&info->lock,flags);
+- get_signals(info);
++ get_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+
+ return (info->serial_signals & SerialSignal_DCD) ? 1 : 0;
+@@ -3244,7 +3244,7 @@ static void dtr_rts(struct tty_port *port, int on)
+ info->serial_signals |= SerialSignal_RTS | SerialSignal_DTR;
+ else
+ info->serial_signals &= ~(SerialSignal_RTS | SerialSignal_DTR);
+- set_signals(info);
++ set_signals(info);
+ spin_unlock_irqrestore(&info->lock,flags);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a1c28e1286c9bb6454d6388c9602ac20f720f2ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 16:36:49 +0100
+Subject: udf: Fix free space reporting for metadata and virtual partitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit a4a8b99ec819ca60b49dc582a4287ef03411f117 ]
+
+Free space on filesystems with metadata or virtual partition maps
+currently gets misreported. This is because these partitions are just
+remapped onto underlying real partitions from which keep track of free
+blocks. Take this remapping into account when counting free blocks as
+well.
+
+Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
+Reported-by: Pali Rohár <pali.rohar@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/udf/super.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 6fd0f14e9dd22..1676a175cd7a8 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -2469,17 +2469,29 @@ static unsigned int udf_count_free_table(struct super_block *sb,
+ static unsigned int udf_count_free(struct super_block *sb)
+ {
+ unsigned int accum = 0;
+- struct udf_sb_info *sbi;
++ struct udf_sb_info *sbi = UDF_SB(sb);
+ struct udf_part_map *map;
++ unsigned int part = sbi->s_partition;
++ int ptype = sbi->s_partmaps[part].s_partition_type;
++
++ if (ptype == UDF_METADATA_MAP25) {
++ part = sbi->s_partmaps[part].s_type_specific.s_metadata.
++ s_phys_partition_ref;
++ } else if (ptype == UDF_VIRTUAL_MAP15 || ptype == UDF_VIRTUAL_MAP20) {
++ /*
++ * Filesystems with VAT are append-only and we cannot write to
++ * them. Let's just report 0 here.
++ */
++ return 0;
++ }
+
+- sbi = UDF_SB(sb);
+ if (sbi->s_lvid_bh) {
+ struct logicalVolIntegrityDesc *lvid =
+ (struct logicalVolIntegrityDesc *)
+ sbi->s_lvid_bh->b_data;
+- if (le32_to_cpu(lvid->numOfPartitions) > sbi->s_partition) {
++ if (le32_to_cpu(lvid->numOfPartitions) > part) {
+ accum = le32_to_cpu(
+- lvid->freeSpaceTable[sbi->s_partition]);
++ lvid->freeSpaceTable[part]);
+ if (accum == 0xFFFFFFFF)
+ accum = 0;
+ }
+@@ -2488,7 +2500,7 @@ static unsigned int udf_count_free(struct super_block *sb)
+ if (accum)
+ return accum;
+
+- map = &sbi->s_partmaps[sbi->s_partition];
++ map = &sbi->s_partmaps[part];
+ if (map->s_partition_flags & UDF_PART_FLAG_UNALLOC_BITMAP) {
+ accum += udf_count_free_bitmap(sb,
+ map->s_uspace.s_bitmap);
+--
+2.20.1
+
--- /dev/null
+From 609d35e5918c9cbbc59c51934732eeddbdd1d9d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 17:44:05 +0800
+Subject: uio: fix a sleep-in-atomic-context bug in
+ uio_dmem_genirq_irqcontrol()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit b74351287d4bd90636c3f48bc188c2f53824c2d4 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+kernel/irq/manage.c, 523:
+ synchronize_irq in disable_irq
+drivers/uio/uio_dmem_genirq.c, 140:
+ disable_irq in uio_dmem_genirq_irqcontrol
+drivers/uio/uio_dmem_genirq.c, 134:
+ _raw_spin_lock_irqsave in uio_dmem_genirq_irqcontrol
+
+synchronize_irq() can sleep at runtime.
+
+To fix this bug, disable_irq() is called without holding the spinlock.
+
+This bug is found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20191218094405.6009-1-baijiaju1990@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/uio/uio_dmem_genirq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
+index e1134a4d97f3f..a00b4aee6c799 100644
+--- a/drivers/uio/uio_dmem_genirq.c
++++ b/drivers/uio/uio_dmem_genirq.c
+@@ -135,11 +135,13 @@ static int uio_dmem_genirq_irqcontrol(struct uio_info *dev_info, s32 irq_on)
+ if (irq_on) {
+ if (test_and_clear_bit(0, &priv->flags))
+ enable_irq(dev_info->irq);
++ spin_unlock_irqrestore(&priv->lock, flags);
+ } else {
+- if (!test_and_set_bit(0, &priv->flags))
++ if (!test_and_set_bit(0, &priv->flags)) {
++ spin_unlock_irqrestore(&priv->lock, flags);
+ disable_irq(dev_info->irq);
++ }
+ }
+- spin_unlock_irqrestore(&priv->lock, flags);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From c6777cc25eb857483d4b825aa40ed9ab599fc690 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 11:34:31 +0000
+Subject: usb: dwc2: Fix IN FIFO allocation
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit 644139f8b64d818f6345351455f14471510879a5 ]
+
+On chips with fewer FIFOs than endpoints (for example RK3288 which has 9
+endpoints, but only 6 which are cabable of input), the DPTXFSIZN
+registers above the FIFO count may return invalid values.
+
+With logging added on startup, I see:
+
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=1 sz=256
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=2 sz=128
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=3 sz=128
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=4 sz=64
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=5 sz=64
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=6 sz=32
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=7 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=8 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=9 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=10 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=11 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=12 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=13 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=14 sz=0
+ dwc2 ff580000.usb: dwc2_hsotg_init_fifo: ep=15 sz=0
+
+but:
+
+ # cat /sys/kernel/debug/ff580000.usb/fifo
+ Non-periodic FIFOs:
+ RXFIFO: Size 275
+ NPTXFIFO: Size 16, Start 0x00000113
+
+ Periodic TXFIFOs:
+ DPTXFIFO 1: Size 256, Start 0x00000123
+ DPTXFIFO 2: Size 128, Start 0x00000223
+ DPTXFIFO 3: Size 128, Start 0x000002a3
+ DPTXFIFO 4: Size 64, Start 0x00000323
+ DPTXFIFO 5: Size 64, Start 0x00000363
+ DPTXFIFO 6: Size 32, Start 0x000003a3
+ DPTXFIFO 7: Size 0, Start 0x000003e3
+ DPTXFIFO 8: Size 0, Start 0x000003a3
+ DPTXFIFO 9: Size 256, Start 0x00000123
+
+so it seems that FIFO 9 is mirroring FIFO 1.
+
+Fix the allocation by using the FIFO count instead of the endpoint count
+when selecting a FIFO for an endpoint.
+
+Acked-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index f64d1cd08fb67..17f3e7b4d4fed 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -3918,11 +3918,12 @@ static int dwc2_hsotg_ep_enable(struct usb_ep *ep,
+ * a unique tx-fifo even if it is non-periodic.
+ */
+ if (dir_in && hsotg->dedicated_fifos) {
++ unsigned fifo_count = dwc2_hsotg_tx_fifo_count(hsotg);
+ u32 fifo_index = 0;
+ u32 fifo_size = UINT_MAX;
+
+ size = hs_ep->ep.maxpacket * hs_ep->mc;
+- for (i = 1; i < hsotg->num_of_eps; ++i) {
++ for (i = 1; i <= fifo_count; ++i) {
+ if (hsotg->fifo_map & (1 << i))
+ continue;
+ val = dwc2_readl(hsotg, DPTXFSIZN(i));
+--
+2.20.1
+
--- /dev/null
+From 644899d6828699c3bacdc524dd119b5f46f0af1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 11:43:49 +0800
+Subject: usb: gadget: udc: fix possible sleep-in-atomic-context bugs in
+ gr_probe()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 9c1ed62ae0690dfe5d5e31d8f70e70a95cb48e52 ]
+
+The driver may sleep while holding a spinlock.
+The function call path (from bottom to top) in Linux 4.19 is:
+
+drivers/usb/gadget/udc/core.c, 1175:
+ kzalloc(GFP_KERNEL) in usb_add_gadget_udc_release
+drivers/usb/gadget/udc/core.c, 1272:
+ usb_add_gadget_udc_release in usb_add_gadget_udc
+drivers/usb/gadget/udc/gr_udc.c, 2186:
+ usb_add_gadget_udc in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+drivers/usb/gadget/udc/core.c, 1195:
+ mutex_lock in usb_add_gadget_udc_release
+drivers/usb/gadget/udc/core.c, 1272:
+ usb_add_gadget_udc_release in usb_add_gadget_udc
+drivers/usb/gadget/udc/gr_udc.c, 2186:
+ usb_add_gadget_udc in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+drivers/usb/gadget/udc/gr_udc.c, 212:
+ debugfs_create_file in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2197:
+ gr_dfs_create in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+drivers/usb/gadget/udc/gr_udc.c, 2114:
+ devm_request_threaded_irq in gr_request_irq
+drivers/usb/gadget/udc/gr_udc.c, 2202:
+ gr_request_irq in gr_probe
+drivers/usb/gadget/udc/gr_udc.c, 2183:
+ spin_lock in gr_probe
+
+kzalloc(GFP_KERNEL), mutex_lock(), debugfs_create_file() and
+devm_request_threaded_irq() can sleep at runtime.
+
+To fix these possible bugs, usb_add_gadget_udc(), gr_dfs_create() and
+gr_request_irq() are called without handling the spinlock.
+
+These bugs are found by a static analysis tool STCheck written by myself.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/gr_udc.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index 729e60e495641..e50108f9a374e 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -2180,8 +2180,6 @@ static int gr_probe(struct platform_device *pdev)
+ return -ENOMEM;
+ }
+
+- spin_lock(&dev->lock);
+-
+ /* Inside lock so that no gadget can use this udc until probe is done */
+ retval = usb_add_gadget_udc(dev->dev, &dev->gadget);
+ if (retval) {
+@@ -2190,15 +2188,21 @@ static int gr_probe(struct platform_device *pdev)
+ }
+ dev->added = 1;
+
++ spin_lock(&dev->lock);
++
+ retval = gr_udc_init(dev);
+- if (retval)
++ if (retval) {
++ spin_unlock(&dev->lock);
+ goto out;
+-
+- gr_dfs_create(dev);
++ }
+
+ /* Clear all interrupt enables that might be left on since last boot */
+ gr_disable_interrupts_and_pullup(dev);
+
++ spin_unlock(&dev->lock);
++
++ gr_dfs_create(dev);
++
+ retval = gr_request_irq(dev, dev->irq);
+ if (retval) {
+ dev_err(dev->dev, "Failed to request irq %d\n", dev->irq);
+@@ -2227,8 +2231,6 @@ static int gr_probe(struct platform_device *pdev)
+ dev_info(dev->dev, "regs: %p, irq %d\n", dev->regs, dev->irq);
+
+ out:
+- spin_unlock(&dev->lock);
+-
+ if (retval)
+ gr_remove(pdev);
+
+--
+2.20.1
+
--- /dev/null
+From 20c8ab894d6f133f8a1b7c048072f24ee90f4487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 07:25:26 -0600
+Subject: usb: musb: omap2430: Get rid of musb .set_vbus for omap2430 glue
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 91b6dec32e5c25fbdbb564d1e5af23764ec17ef1 ]
+
+We currently have musb_set_vbus() called from two different paths. Mostly
+it gets called from the USB PHY via omap_musb_set_mailbox(), but in some
+cases it can get also called from musb_stage0_irq() rather via .set_vbus:
+
+(musb_set_host [musb_hdrc])
+(omap2430_musb_set_vbus [omap2430])
+(musb_stage0_irq [musb_hdrc])
+(musb_interrupt [musb_hdrc])
+(omap2430_musb_interrupt [omap2430])
+
+This is racy and will not work with introducing generic helper functions
+for musb_set_host() and musb_set_peripheral(). We want to get rid of the
+busy loops in favor of usleep_range().
+
+Let's just get rid of .set_vbus for omap2430 glue layer and let the PHY
+code handle VBUS with musb_set_vbus(). Note that in the follow-up patch
+we can completely remove omap2430_musb_set_vbus(), but let's do it in a
+separate patch as this change may actually turn out to be needed as a
+fix.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200115132547.364-5-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/musb/omap2430.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
+index b1dd81fb5f55e..24e622c056383 100644
+--- a/drivers/usb/musb/omap2430.c
++++ b/drivers/usb/musb/omap2430.c
+@@ -361,8 +361,6 @@ static const struct musb_platform_ops omap2430_ops = {
+ .init = omap2430_musb_init,
+ .exit = omap2430_musb_exit,
+
+- .set_vbus = omap2430_musb_set_vbus,
+-
+ .enable = omap2430_musb_enable,
+ .disable = omap2430_musb_disable,
+
+--
+2.20.1
+
--- /dev/null
+From 7dcfecb1d879cf6e8e16700168a165f1080ea2be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 8 Jan 2020 18:24:16 -0700
+Subject: usbip: Fix unsafe unaligned pointer usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 585c91f40d201bc564d4e76b83c05b3b5363fe7e ]
+
+Fix unsafe unaligned pointer usage in usbip network interfaces. usbip tool
+build fails with new gcc -Werror=address-of-packed-member checks.
+
+usbip_network.c: In function ‘usbip_net_pack_usb_device’:
+usbip_network.c:79:32: error: taking address of packed member of ‘struct usbip_usb_device’ may result in an unaligned pointer value [-Werror=address-of-packed-member]
+ 79 | usbip_net_pack_uint32_t(pack, &udev->busnum);
+
+Fix with minor changes to pass by value instead of by address.
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20200109012416.2875-1-skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/usb/usbip/src/usbip_network.c | 40 +++++++++++++++++------------
+ tools/usb/usbip/src/usbip_network.h | 12 +++------
+ 2 files changed, 27 insertions(+), 25 deletions(-)
+
+diff --git a/tools/usb/usbip/src/usbip_network.c b/tools/usb/usbip/src/usbip_network.c
+index 8ffcd47d96385..902f55208e239 100644
+--- a/tools/usb/usbip/src/usbip_network.c
++++ b/tools/usb/usbip/src/usbip_network.c
+@@ -62,39 +62,39 @@ void usbip_setup_port_number(char *arg)
+ info("using port %d (\"%s\")", usbip_port, usbip_port_string);
+ }
+
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num)
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num)
+ {
+ uint32_t i;
+
+ if (pack)
+- i = htonl(*num);
++ i = htonl(num);
+ else
+- i = ntohl(*num);
++ i = ntohl(num);
+
+- *num = i;
++ return i;
+ }
+
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num)
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num)
+ {
+ uint16_t i;
+
+ if (pack)
+- i = htons(*num);
++ i = htons(num);
+ else
+- i = ntohs(*num);
++ i = ntohs(num);
+
+- *num = i;
++ return i;
+ }
+
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev)
+ {
+- usbip_net_pack_uint32_t(pack, &udev->busnum);
+- usbip_net_pack_uint32_t(pack, &udev->devnum);
+- usbip_net_pack_uint32_t(pack, &udev->speed);
++ udev->busnum = usbip_net_pack_uint32_t(pack, udev->busnum);
++ udev->devnum = usbip_net_pack_uint32_t(pack, udev->devnum);
++ udev->speed = usbip_net_pack_uint32_t(pack, udev->speed);
+
+- usbip_net_pack_uint16_t(pack, &udev->idVendor);
+- usbip_net_pack_uint16_t(pack, &udev->idProduct);
+- usbip_net_pack_uint16_t(pack, &udev->bcdDevice);
++ udev->idVendor = usbip_net_pack_uint16_t(pack, udev->idVendor);
++ udev->idProduct = usbip_net_pack_uint16_t(pack, udev->idProduct);
++ udev->bcdDevice = usbip_net_pack_uint16_t(pack, udev->bcdDevice);
+ }
+
+ void usbip_net_pack_usb_interface(int pack __attribute__((unused)),
+@@ -141,6 +141,14 @@ ssize_t usbip_net_send(int sockfd, void *buff, size_t bufflen)
+ return usbip_net_xmit(sockfd, buff, bufflen, 1);
+ }
+
++static inline void usbip_net_pack_op_common(int pack,
++ struct op_common *op_common)
++{
++ op_common->version = usbip_net_pack_uint16_t(pack, op_common->version);
++ op_common->code = usbip_net_pack_uint16_t(pack, op_common->code);
++ op_common->status = usbip_net_pack_uint32_t(pack, op_common->status);
++}
++
+ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ {
+ struct op_common op_common;
+@@ -152,7 +160,7 @@ int usbip_net_send_op_common(int sockfd, uint32_t code, uint32_t status)
+ op_common.code = code;
+ op_common.status = status;
+
+- PACK_OP_COMMON(1, &op_common);
++ usbip_net_pack_op_common(1, &op_common);
+
+ rc = usbip_net_send(sockfd, &op_common, sizeof(op_common));
+ if (rc < 0) {
+@@ -176,7 +184,7 @@ int usbip_net_recv_op_common(int sockfd, uint16_t *code, int *status)
+ goto err;
+ }
+
+- PACK_OP_COMMON(0, &op_common);
++ usbip_net_pack_op_common(0, &op_common);
+
+ if (op_common.version != USBIP_VERSION) {
+ err("USBIP Kernel and tool version mismatch: %d %d:",
+diff --git a/tools/usb/usbip/src/usbip_network.h b/tools/usb/usbip/src/usbip_network.h
+index 555215eae43e9..83b4c5344f721 100644
+--- a/tools/usb/usbip/src/usbip_network.h
++++ b/tools/usb/usbip/src/usbip_network.h
+@@ -32,12 +32,6 @@ struct op_common {
+
+ } __attribute__((packed));
+
+-#define PACK_OP_COMMON(pack, op_common) do {\
+- usbip_net_pack_uint16_t(pack, &(op_common)->version);\
+- usbip_net_pack_uint16_t(pack, &(op_common)->code);\
+- usbip_net_pack_uint32_t(pack, &(op_common)->status);\
+-} while (0)
+-
+ /* ---------------------------------------------------------------------- */
+ /* Dummy Code */
+ #define OP_UNSPEC 0x00
+@@ -163,11 +157,11 @@ struct op_devlist_reply_extra {
+ } while (0)
+
+ #define PACK_OP_DEVLIST_REPLY(pack, reply) do {\
+- usbip_net_pack_uint32_t(pack, &(reply)->ndev);\
++ (reply)->ndev = usbip_net_pack_uint32_t(pack, (reply)->ndev);\
+ } while (0)
+
+-void usbip_net_pack_uint32_t(int pack, uint32_t *num);
+-void usbip_net_pack_uint16_t(int pack, uint16_t *num);
++uint32_t usbip_net_pack_uint32_t(int pack, uint32_t num);
++uint16_t usbip_net_pack_uint16_t(int pack, uint16_t num);
+ void usbip_net_pack_usb_device(int pack, struct usbip_usb_device *udev);
+ void usbip_net_pack_usb_interface(int pack, struct usbip_usb_interface *uinf);
+
+--
+2.20.1
+
--- /dev/null
+From 7d6ee2a5666597613d5a266790a2076c2f2bcd69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Feb 2020 02:40:58 -0500
+Subject: virtio_balloon: prevent pfn array overflow
+
+From: Michael S. Tsirkin <mst@redhat.com>
+
+[ Upstream commit 6e9826e77249355c09db6ba41cd3f84e89f4b614 ]
+
+Make sure, at build time, that pfn array is big enough to hold a single
+page. It happens to be true since the PAGE_SHIFT value at the moment is
+20, which is 1M - exactly 256 4K balloon pages.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/virtio/virtio_balloon.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 14ac36ca8fbd3..1afcbef397ab7 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -126,6 +126,8 @@ static void set_page_pfns(struct virtio_balloon *vb,
+ {
+ unsigned int i;
+
++ BUILD_BUG_ON(VIRTIO_BALLOON_PAGES_PER_PAGE > VIRTIO_BALLOON_ARRAY_PFNS_MAX);
++
+ /*
+ * Set balloon pfns pointing at this page.
+ * Note that the first pfn points at start of the page.
+--
+2.20.1
+
--- /dev/null
+From b4dc189b4920655a0194e8e7b045cec259278abe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:29:40 +0100
+Subject: visorbus: fix uninitialized variable access
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit caf82f727e69b647f09d57a1fc56e69d22a5f483 ]
+
+The setup_crash_devices_work_queue function only partially initializes
+the message it sends to chipset_init, leading to undefined behavior:
+
+drivers/visorbus/visorchipset.c: In function 'setup_crash_devices_work_queue':
+drivers/visorbus/visorchipset.c:333:6: error: '((unsigned char*)&msg.hdr.flags)[0]' is used uninitialized in this function [-Werror=uninitialized]
+ if (inmsg->hdr.flags.response_expected)
+
+Set up the entire structure, zero-initializing the 'response_expected'
+flag.
+
+This was apparently found by the patch that added the -O3 build option
+in Kconfig.
+
+Fixes: 12e364b9f08a ("staging: visorchipset driver to provide registration and other services")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107202950.782951-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/visorbus/visorchipset.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c
+index ca752b8f495fa..cb1eb7e05f871 100644
+--- a/drivers/visorbus/visorchipset.c
++++ b/drivers/visorbus/visorchipset.c
+@@ -1210,14 +1210,17 @@ static void setup_crash_devices_work_queue(struct work_struct *work)
+ {
+ struct controlvm_message local_crash_bus_msg;
+ struct controlvm_message local_crash_dev_msg;
+- struct controlvm_message msg;
++ struct controlvm_message msg = {
++ .hdr.id = CONTROLVM_CHIPSET_INIT,
++ .cmd.init_chipset = {
++ .bus_count = 23,
++ .switch_count = 0,
++ },
++ };
+ u32 local_crash_msg_offset;
+ u16 local_crash_msg_count;
+
+ /* send init chipset msg */
+- msg.hdr.id = CONTROLVM_CHIPSET_INIT;
+- msg.cmd.init_chipset.bus_count = 23;
+- msg.cmd.init_chipset.switch_count = 0;
+ chipset_init(&msg);
+ /* get saved message count */
+ if (visorchannel_read(chipset_dev->controlvm_channel,
+--
+2.20.1
+
--- /dev/null
+From 7c30a392cad918043b2064f88666734816a8a555 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:05:43 +0100
+Subject: vme: bridges: reduce stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7483e7a939c074d887450ef1c4d9ccc5909405f8 ]
+
+With CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3, the stack usage in vme_fake
+grows above the warning limit:
+
+drivers/vme/bridges/vme_fake.c: In function 'fake_master_read':
+drivers/vme/bridges/vme_fake.c:610:1: error: the frame size of 1160 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+drivers/vme/bridges/vme_fake.c: In function 'fake_master_write':
+drivers/vme/bridges/vme_fake.c:797:1: error: the frame size of 1160 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+The problem is that in some configurations, each call to
+fake_vmereadX() puts another variable on the stack.
+
+Reduce the amount of inlining to get back to the previous state,
+with no function using more than 200 bytes each.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107200610.3482901-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vme/bridges/vme_fake.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/vme/bridges/vme_fake.c b/drivers/vme/bridges/vme_fake.c
+index 7d83691047f47..685a43bdc2a1d 100644
+--- a/drivers/vme/bridges/vme_fake.c
++++ b/drivers/vme/bridges/vme_fake.c
+@@ -418,8 +418,9 @@ static void fake_lm_check(struct fake_driver *bridge, unsigned long long addr,
+ }
+ }
+
+-static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u8 fake_vmeread8(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u8 retval = 0xff;
+ int i;
+@@ -450,8 +451,9 @@ static u8 fake_vmeread8(struct fake_driver *bridge, unsigned long long addr,
+ return retval;
+ }
+
+-static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u16 fake_vmeread16(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u16 retval = 0xffff;
+ int i;
+@@ -482,8 +484,9 @@ static u16 fake_vmeread16(struct fake_driver *bridge, unsigned long long addr,
+ return retval;
+ }
+
+-static u32 fake_vmeread32(struct fake_driver *bridge, unsigned long long addr,
+- u32 aspace, u32 cycle)
++static noinline_for_stack u32 fake_vmeread32(struct fake_driver *bridge,
++ unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ u32 retval = 0xffffffff;
+ int i;
+@@ -613,8 +616,9 @@ out:
+ return retval;
+ }
+
+-static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite8(struct fake_driver *bridge,
++ u8 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+@@ -643,8 +647,9 @@ static void fake_vmewrite8(struct fake_driver *bridge, u8 *buf,
+
+ }
+
+-static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite16(struct fake_driver *bridge,
++ u16 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+@@ -673,8 +678,9 @@ static void fake_vmewrite16(struct fake_driver *bridge, u16 *buf,
+
+ }
+
+-static void fake_vmewrite32(struct fake_driver *bridge, u32 *buf,
+- unsigned long long addr, u32 aspace, u32 cycle)
++static noinline_for_stack void fake_vmewrite32(struct fake_driver *bridge,
++ u32 *buf, unsigned long long addr,
++ u32 aspace, u32 cycle)
+ {
+ int i;
+ unsigned long long start, end, offset;
+--
+2.20.1
+
--- /dev/null
+From 3a2d2e54c3d76bdeb07b88ecab9eaf5a227a9a85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jan 2020 13:04:42 +0100
+Subject: wan: ixp4xx_hss: fix compile-testing on 64-bit
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 504c28c853ec5c626900b914b5833daf0581a344 ]
+
+Change the driver to use portable integer types to avoid
+warnings during compile testing:
+
+drivers/net/wan/ixp4xx_hss.c:863:21: error: cast to 'u32 *' (aka 'unsigned int *') from smaller integer type 'int' [-Werror,-Wint-to-pointer-cast]
+ memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
+ ^
+drivers/net/wan/ixp4xx_hss.c:979:12: error: incompatible pointer types passing 'u32 *' (aka 'unsigned int *') to parameter of type 'dma_addr_t *' (aka 'unsigned long long *') [-Werror,-Wincompatible-pointer-types]
+ &port->desc_tab_phys)))
+ ^~~~~~~~~~~~~~~~~~~~
+include/linux/dmapool.h:27:20: note: passing argument to parameter 'handle' here
+ dma_addr_t *handle);
+ ^
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wan/ixp4xx_hss.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
+index 6a505c26a3e74..a269ed63d90f7 100644
+--- a/drivers/net/wan/ixp4xx_hss.c
++++ b/drivers/net/wan/ixp4xx_hss.c
+@@ -261,7 +261,7 @@ struct port {
+ struct hss_plat_info *plat;
+ buffer_t *rx_buff_tab[RX_DESCS], *tx_buff_tab[TX_DESCS];
+ struct desc *desc_tab; /* coherent */
+- u32 desc_tab_phys;
++ dma_addr_t desc_tab_phys;
+ unsigned int id;
+ unsigned int clock_type, clock_rate, loopback;
+ unsigned int initialized, carrier;
+@@ -861,7 +861,7 @@ static int hss_hdlc_xmit(struct sk_buff *skb, struct net_device *dev)
+ dev->stats.tx_dropped++;
+ return NETDEV_TX_OK;
+ }
+- memcpy_swab32(mem, (u32 *)((int)skb->data & ~3), bytes / 4);
++ memcpy_swab32(mem, (u32 *)((uintptr_t)skb->data & ~3), bytes / 4);
+ dev_kfree_skb(skb);
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 3b9098a87e678e6dfac0b96d92dcab8c092c2936 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 19:17:02 +0100
+Subject: watchdog/softlockup: Enforce that timestamp is valid on boot
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 11e31f608b499f044f24b20be73f1dcab3e43f8a ]
+
+Robert reported that during boot the watchdog timestamp is set to 0 for one
+second which is the indicator for a watchdog reset.
+
+The reason for this is that the timestamp is in seconds and the time is
+taken from sched clock and divided by ~1e9. sched clock starts at 0 which
+means that for the first second during boot the watchdog timestamp is 0,
+i.e. reset.
+
+Use ULONG_MAX as the reset indicator value so the watchdog works correctly
+right from the start. ULONG_MAX would only conflict with a real timestamp
+if the system reaches an uptime of 136 years on 32bit and almost eternity
+on 64bit.
+
+Reported-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/87o8v3uuzl.fsf@nanos.tec.linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/watchdog.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index bbc4940f21af6..6d60701dc6361 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -161,6 +161,8 @@ static void lockup_detector_update_enable(void)
+
+ #ifdef CONFIG_SOFTLOCKUP_DETECTOR
+
++#define SOFTLOCKUP_RESET ULONG_MAX
++
+ /* Global variables, exported for sysctl */
+ unsigned int __read_mostly softlockup_panic =
+ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE;
+@@ -267,7 +269,7 @@ notrace void touch_softlockup_watchdog_sched(void)
+ * Preemption can be enabled. It doesn't matter which CPU's timestamp
+ * gets zeroed here, so use the raw_ operation.
+ */
+- raw_cpu_write(watchdog_touch_ts, 0);
++ raw_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+
+ notrace void touch_softlockup_watchdog(void)
+@@ -291,14 +293,14 @@ void touch_all_softlockup_watchdogs(void)
+ * the softlockup check.
+ */
+ for_each_cpu(cpu, &watchdog_allowed_mask)
+- per_cpu(watchdog_touch_ts, cpu) = 0;
++ per_cpu(watchdog_touch_ts, cpu) = SOFTLOCKUP_RESET;
+ wq_watchdog_touch(-1);
+ }
+
+ void touch_softlockup_watchdog_sync(void)
+ {
+ __this_cpu_write(softlockup_touch_sync, true);
+- __this_cpu_write(watchdog_touch_ts, 0);
++ __this_cpu_write(watchdog_touch_ts, SOFTLOCKUP_RESET);
+ }
+
+ static int is_softlockup(unsigned long touch_ts)
+@@ -376,7 +378,7 @@ static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
+ /* .. and repeat */
+ hrtimer_forward_now(hrtimer, ns_to_ktime(sample_period));
+
+- if (touch_ts == 0) {
++ if (touch_ts == SOFTLOCKUP_RESET) {
+ if (unlikely(__this_cpu_read(softlockup_touch_sync))) {
+ /*
+ * If the time stamp was touched atomically
+--
+2.20.1
+
--- /dev/null
+From 746d5b9359b349e536cb4430c27dd313cf2f85b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 13:11:54 +0900
+Subject: x86/decoder: Add TEST opcode to Group3-2
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 8b7e20a7ba54836076ff35a28349dabea4cec48f ]
+
+Add TEST opcode to Group3-2 reg=001b as same as Group3-1 does.
+
+Commit
+
+ 12a78d43de76 ("x86/decoder: Add new TEST instruction pattern")
+
+added a TEST opcode assignment to f6 XX/001/XXX (Group 3-1), but did
+not add f7 XX/001/XXX (Group 3-2).
+
+Actually, this TEST opcode variant (ModRM.reg /1) is not described in
+the Intel SDM Vol2 but in AMD64 Architecture Programmer's Manual Vol.3,
+Appendix A.2 Table A-6. ModRM.reg Extensions for the Primary Opcode Map.
+
+Without this fix, Randy found a warning by insn_decoder_test related
+to this issue as below.
+
+ HOSTCC arch/x86/tools/insn_decoder_test
+ HOSTCC arch/x86/tools/insn_sanity
+ TEST posttest
+ arch/x86/tools/insn_decoder_test: warning: Found an x86 instruction decoder bug, please report this.
+ arch/x86/tools/insn_decoder_test: warning: ffffffff81000bf1: f7 0b 00 01 08 00 testl $0x80100,(%rbx)
+ arch/x86/tools/insn_decoder_test: warning: objdump says 6 bytes, but insn_get_length() says 2
+ arch/x86/tools/insn_decoder_test: warning: Decoded and checked 11913894 instructions with 1 failures
+ TEST posttest
+ arch/x86/tools/insn_sanity: Success: decoded and checked 1000000 random instructions with 0 errors (seed:0x871ce29c)
+
+To fix this error, add the TEST opcode according to AMD64 APM Vol.3.
+
+ [ bp: Massage commit message. ]
+
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Link: https://lkml.kernel.org/r/157966631413.9580.10311036595431878351.stgit@devnote2
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/x86-opcode-map.txt | 2 +-
+ tools/objtool/arch/x86/lib/x86-opcode-map.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
+index 0a0e9112f2842..5cb9f009f2be3 100644
+--- a/arch/x86/lib/x86-opcode-map.txt
++++ b/arch/x86/lib/x86-opcode-map.txt
+@@ -909,7 +909,7 @@ EndTable
+
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+index 0a0e9112f2842..5cb9f009f2be3 100644
+--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt
++++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+@@ -909,7 +909,7 @@ EndTable
+
+ GrpTable: Grp3_2
+ 0: TEST Ev,Iz
+-1:
++1: TEST Ev,Iz
+ 2: NOT Ev
+ 3: NEG Ev
+ 4: MUL rAX,Ev
+--
+2.20.1
+
--- /dev/null
+From 55cb8d2e94f23d99b215a3a89daeea060df7cbfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 18:22:36 +0100
+Subject: x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+[ Upstream commit 75fbef0a8b6b4bb19b9a91b5214f846c2dc5139e ]
+
+The following commit:
+
+ 15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()")
+
+modified kernel_map_pages_in_pgd() to manage writable permissions
+of memory mappings in the EFI page table in a different way, but
+in the process, it removed the ability to clear NX attributes from
+read-only mappings, by clobbering the clear mask if _PAGE_RW is not
+being requested.
+
+Failure to remove the NX attribute from read-only mappings is
+unlikely to be a security issue, but it does prevent us from
+tightening the permissions in the EFI page tables going forward,
+so let's fix it now.
+
+Fixes: 15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Link: https://lore.kernel.org/r/20200113172245.27925-5-ardb@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/pageattr.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
+index e2d4b25c7aa44..101f3ad0d6ad1 100644
+--- a/arch/x86/mm/pageattr.c
++++ b/arch/x86/mm/pageattr.c
+@@ -2126,19 +2126,13 @@ int kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+ .pgd = pgd,
+ .numpages = numpages,
+ .mask_set = __pgprot(0),
+- .mask_clr = __pgprot(0),
++ .mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW)),
+ .flags = 0,
+ };
+
+ if (!(__supported_pte_mask & _PAGE_NX))
+ goto out;
+
+- if (!(page_flags & _PAGE_NX))
+- cpa.mask_clr = __pgprot(_PAGE_NX);
+-
+- if (!(page_flags & _PAGE_RW))
+- cpa.mask_clr = __pgprot(_PAGE_RW);
+-
+ if (!(page_flags & _PAGE_ENC))
+ cpa.mask_clr = pgprot_encrypted(cpa.mask_clr);
+
+--
+2.20.1
+
--- /dev/null
+From 891d672bf37082631e9bdd219d3a3e97f219e8e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jan 2020 20:54:27 +0800
+Subject: x86/nmi: Remove irq_work from the long duration NMI handler
+
+From: Changbin Du <changbin.du@gmail.com>
+
+[ Upstream commit 248ed51048c40d36728e70914e38bffd7821da57 ]
+
+First, printk() is NMI-context safe now since the safe printk() has been
+implemented and it already has an irq_work to make NMI-context safe.
+
+Second, this NMI irq_work actually does not work if a NMI handler causes
+panic by watchdog timeout. It has no chance to run in such case, while
+the safe printk() will flush its per-cpu buffers before panicking.
+
+While at it, repurpose the irq_work callback into a function which
+concentrates the NMI duration checking and makes the code easier to
+follow.
+
+ [ bp: Massage. ]
+
+Signed-off-by: Changbin Du <changbin.du@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20200111125427.15662-1-changbin.du@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/include/asm/nmi.h | 1 -
+ arch/x86/kernel/nmi.c | 20 +++++++++-----------
+ 2 files changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
+index 75ded1d13d98d..9d5d949e662e1 100644
+--- a/arch/x86/include/asm/nmi.h
++++ b/arch/x86/include/asm/nmi.h
+@@ -41,7 +41,6 @@ struct nmiaction {
+ struct list_head list;
+ nmi_handler_t handler;
+ u64 max_duration;
+- struct irq_work irq_work;
+ unsigned long flags;
+ const char *name;
+ };
+diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
+index 086cf1d1d71d8..0f8b9b900b0e7 100644
+--- a/arch/x86/kernel/nmi.c
++++ b/arch/x86/kernel/nmi.c
+@@ -102,18 +102,22 @@ static int __init nmi_warning_debugfs(void)
+ }
+ fs_initcall(nmi_warning_debugfs);
+
+-static void nmi_max_handler(struct irq_work *w)
++static void nmi_check_duration(struct nmiaction *action, u64 duration)
+ {
+- struct nmiaction *a = container_of(w, struct nmiaction, irq_work);
++ u64 whole_msecs = READ_ONCE(action->max_duration);
+ int remainder_ns, decimal_msecs;
+- u64 whole_msecs = READ_ONCE(a->max_duration);
++
++ if (duration < nmi_longest_ns || duration < action->max_duration)
++ return;
++
++ action->max_duration = duration;
+
+ remainder_ns = do_div(whole_msecs, (1000 * 1000));
+ decimal_msecs = remainder_ns / 1000;
+
+ printk_ratelimited(KERN_INFO
+ "INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n",
+- a->handler, whole_msecs, decimal_msecs);
++ action->handler, whole_msecs, decimal_msecs);
+ }
+
+ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+@@ -140,11 +144,7 @@ static int nmi_handle(unsigned int type, struct pt_regs *regs)
+ delta = sched_clock() - delta;
+ trace_nmi_handler(a->handler, (int)delta, thishandled);
+
+- if (delta < nmi_longest_ns || delta < a->max_duration)
+- continue;
+-
+- a->max_duration = delta;
+- irq_work_queue(&a->irq_work);
++ nmi_check_duration(a, delta);
+ }
+
+ rcu_read_unlock();
+@@ -162,8 +162,6 @@ int __register_nmi_handler(unsigned int type, struct nmiaction *action)
+ if (!action->handler)
+ return -EINVAL;
+
+- init_irq_work(&action->irq_work, nmi_max_handler);
+-
+ raw_spin_lock_irqsave(&desc->lock, flags);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 46179ed33d10423b3b60a686cbe0ac60569836d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 18:04:10 -0500
+Subject: x86/sysfb: Fix check for bad VRAM size
+
+From: Arvind Sankar <nivedita@alum.mit.edu>
+
+[ Upstream commit dacc9092336be20b01642afe1a51720b31f60369 ]
+
+When checking whether the reported lfb_size makes sense, the height
+* stride result is page-aligned before seeing whether it exceeds the
+reported size.
+
+This doesn't work if height * stride is not an exact number of pages.
+For example, as reported in the kernel bugzilla below, an 800x600x32 EFI
+framebuffer gets skipped because of this.
+
+Move the PAGE_ALIGN to after the check vs size.
+
+Reported-by: Christopher Head <chead@chead.ca>
+Tested-by: Christopher Head <chead@chead.ca>
+Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206051
+Link: https://lkml.kernel.org/r/20200107230410.2291947-1-nivedita@alum.mit.edu
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/sysfb_simplefb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/sysfb_simplefb.c b/arch/x86/kernel/sysfb_simplefb.c
+index 85195d447a922..f3215346e47fd 100644
+--- a/arch/x86/kernel/sysfb_simplefb.c
++++ b/arch/x86/kernel/sysfb_simplefb.c
+@@ -94,11 +94,11 @@ __init int create_simplefb(const struct screen_info *si,
+ if (si->orig_video_isVGA == VIDEO_TYPE_VLFB)
+ size <<= 16;
+ length = mode->height * mode->stride;
+- length = PAGE_ALIGN(length);
+ if (length > size) {
+ printk(KERN_WARNING "sysfb: VRAM smaller than advertised\n");
+ return -EINVAL;
+ }
++ length = PAGE_ALIGN(length);
+
+ /* setup IORESOURCE_MEM as framebuffer memory */
+ memset(&res, 0, sizeof(res));
+--
+2.20.1
+
--- /dev/null
+From 21942850076d93de514aff13ee631987540e2c14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Dec 2019 11:07:29 +0800
+Subject: x86/unwind/orc: Fix !CONFIG_MODULES build warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shile Zhang <shile.zhang@linux.alibaba.com>
+
+[ Upstream commit 22a7fa8848c5e881d87ef2f7f3c2ea77b286e6f9 ]
+
+To fix follwowing warning due to ORC sort moved to build time:
+
+ arch/x86/kernel/unwind_orc.c:210:12: warning: ‘orc_sort_cmp’ defined but not used [-Wunused-function]
+ arch/x86/kernel/unwind_orc.c:190:13: warning: ‘orc_sort_swap’ defined but not used [-Wunused-function]
+
+Signed-off-by: Shile Zhang <shile.zhang@linux.alibaba.com>
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/c9c81536-2afc-c8aa-c5f8-c7618ecd4f54@linux.alibaba.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/unwind_orc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/unwind_orc.c b/arch/x86/kernel/unwind_orc.c
+index 89be1be1790c4..a3cb70fbe941a 100644
+--- a/arch/x86/kernel/unwind_orc.c
++++ b/arch/x86/kernel/unwind_orc.c
+@@ -176,6 +176,8 @@ static struct orc_entry *orc_find(unsigned long ip)
+ return orc_ftrace_find(ip);
+ }
+
++#ifdef CONFIG_MODULES
++
+ static void orc_sort_swap(void *_a, void *_b, int size)
+ {
+ struct orc_entry *orc_a, *orc_b;
+@@ -218,7 +220,6 @@ static int orc_sort_cmp(const void *_a, const void *_b)
+ return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
+ }
+
+-#ifdef CONFIG_MODULES
+ void unwind_module_init(struct module *mod, void *_orc_ip, size_t orc_ip_size,
+ void *_orc, size_t orc_size)
+ {
+--
+2.20.1
+
--- /dev/null
+From 30d75357e07412351529feb85e5fd31724f336c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 21:36:07 -0500
+Subject: x86/vdso: Provide missing include file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Valdis Klētnieks <valdis.kletnieks@vt.edu>
+
+[ Upstream commit bff47c2302cc249bcd550b17067f8dddbd4b6f77 ]
+
+When building with C=1, sparse issues a warning:
+
+ CHECK arch/x86/entry/vdso/vdso32-setup.c
+ arch/x86/entry/vdso/vdso32-setup.c:28:28: warning: symbol 'vdso32_enabled' was not declared. Should it be static?
+
+Provide the missing header file.
+
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/36224.1575599767@turing-police
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/entry/vdso/vdso32-setup.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c
+index 42d4c89f990ed..ddff0ca6f5098 100644
+--- a/arch/x86/entry/vdso/vdso32-setup.c
++++ b/arch/x86/entry/vdso/vdso32-setup.c
+@@ -11,6 +11,7 @@
+ #include <linux/smp.h>
+ #include <linux/kernel.h>
+ #include <linux/mm_types.h>
++#include <linux/elf.h>
+
+ #include <asm/processor.h>
+ #include <asm/vdso.h>
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
