--- /dev/null
+From f1077f75ca05b85e24945cc8c7dc808b5b85c293 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Nov 2018 23:07:14 +0300
+Subject: ACPI: fix acpi_find_child_device() invocation in
+ acpi_preset_companion()
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+[ Upstream commit f8c6d1402b89f22a3647705d63cbd171aa19a77e ]
+
+acpi_find_child_device() accepts boolean not pointer as last argument.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+[ rjw: Subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/acpi.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index d7a9700b93339..4bb3bca75004d 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -99,7 +99,7 @@ static inline bool has_acpi_companion(struct device *dev)
+ static inline void acpi_preset_companion(struct device *dev,
+ struct acpi_device *parent, u64 addr)
+ {
+- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL));
++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false));
+ }
+
+ static inline const char *acpi_dev_name(struct acpi_device *adev)
+--
+2.20.1
+
--- /dev/null
+From 0f3b0f1674ecb55be09661de8cf4ac94d4ebf828 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 01:17:14 +0800
+Subject: ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
+
+From: paulhsia <paulhsia@chromium.org>
+
+[ Upstream commit f5cdc9d4003a2f66ea57b3edd3e04acc2b1a4439 ]
+
+If the nullity check for `substream->runtime` is outside of the lock
+region, it is possible to have a null runtime in the critical section
+if snd_pcm_detach_substream is called right before the lock.
+
+Signed-off-by: paulhsia <paulhsia@chromium.org>
+Link: https://lore.kernel.org/r/20191112171715.128727-2-paulhsia@chromium.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 729a85a6211d6..80453266a2def 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1803,11 +1803,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ struct snd_pcm_runtime *runtime;
+ unsigned long flags;
+
+- if (PCM_RUNTIME_CHECK(substream))
++ if (snd_BUG_ON(!substream))
+ return;
+- runtime = substream->runtime;
+
+ snd_pcm_stream_lock_irqsave(substream, flags);
++ if (PCM_RUNTIME_CHECK(substream))
++ goto _unlock;
++ runtime = substream->runtime;
++
+ if (!snd_pcm_running(substream) ||
+ snd_pcm_update_hw_ptr0(substream, 1) < 0)
+ goto _end;
+@@ -1818,6 +1821,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ #endif
+ _end:
+ kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
++ _unlock:
+ snd_pcm_stream_unlock_irqrestore(substream, flags);
+ }
+ EXPORT_SYMBOL(snd_pcm_period_elapsed);
+--
+2.20.1
+
--- /dev/null
+From 5f84755f0811a843e5acc219037e5899a1bc0d90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Nov 2018 12:34:10 +0000
+Subject: altera-stapl: check for a null key before strcasecmp'ing it
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9ccb645683ef46e3c52c12c088a368baa58447d4 ]
+
+Currently the null check on key is occurring after the strcasecmp on
+the key, hence there is a potential null pointer dereference on key.
+Fix this by checking if key is null first. Also replace the == 0
+check on strcasecmp with just the ! operator.
+
+Detected by CoverityScan, CID#1248787 ("Dereference before null check")
+
+Fixes: fa766c9be58b ("[media] Altera FPGA firmware download module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/altera-stapl/altera.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
+index f53e217e963f5..494e263daa748 100644
+--- a/drivers/misc/altera-stapl/altera.c
++++ b/drivers/misc/altera-stapl/altera.c
+@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size,
+ key_ptr = &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i)])];
+- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) &&
+- (key != NULL)) {
++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) {
+ status = 0;
+
+ value_ptr = &p[note_strings +
+--
+2.20.1
+
--- /dev/null
+From 9311069f18c17b191693051722ae04ab10cc6760 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 10:12:30 +0100
+Subject: ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
+
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+
+[ Upstream commit 344eb5539abf3e0b6ce22568c03e86450073e097 ]
+
+getuser() and putuser() (and there underscored variants) use two
+strb[t]/ldrb[t] instructions when they are asked to get/put 16-bits.
+This means that the read/write is not atomic even when performed to a
+16-bit-aligned address.
+
+This leads to problems with vhost: vhost uses __getuser() to read the
+vring's 16-bit avail.index field, and if it happens to observe a partial
+update of the index, wrong descriptors will be used which will lead to a
+breakdown of the virtio communication. A similar problem exists for
+__putuser() which is used to write to the vring's used.index field.
+
+The reason these functions use strb[t]/ldrb[t] is because strht/ldrht
+instructions did not exist until ARMv6T2/ARMv7. So we should be easily
+able to fix this on ARMv7. Also, since all ARMv6 processors also don't
+actually use the unprivileged instructions anymore for uaccess (since
+CONFIG_CPU_USE_DOMAINS is not used) we can easily fix them too.
+
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess.h | 18 ++++++++++++++++++
+ arch/arm/lib/getuser.S | 11 +++++++++++
+ arch/arm/lib/putuser.S | 20 ++++++++++----------
+ 3 files changed, 39 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index a5807b67ca8a3..fe47d24955ea0 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -349,6 +349,13 @@ do { \
+ #define __get_user_asm_byte(x, addr, err) \
+ __get_user_asm(x, addr, err, ldrb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __get_user_asm_half(x, addr, err) \
++ __get_user_asm(x, addr, err, ldrh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __get_user_asm_half(x, __gu_addr, err) \
+ ({ \
+@@ -367,6 +374,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __get_user_asm_word(x, addr, err) \
+ __get_user_asm(x, addr, err, ldr)
+ #endif
+@@ -442,6 +451,13 @@ do { \
+ #define __put_user_asm_byte(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, strb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __put_user_asm_half(x, __pu_addr, err) \
++ __put_user_asm(x, __pu_addr, err, strh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __put_user_asm_half(x, __pu_addr, err) \
+ ({ \
+@@ -458,6 +474,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __put_user_asm_word(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, str)
+
+diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
+index 746e7801dcdf7..b2e4bc3a635e2 100644
+--- a/arch/arm/lib/getuser.S
++++ b/arch/arm/lib/getuser.S
+@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1)
+
+ ENTRY(__get_user_2)
+ check_uaccess r0, 2, r1, r2, __get_user_bad
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(ldrh) r2, [r0]
++
++#else
++
+ #ifdef CONFIG_CPU_USE_DOMAINS
+ rb .req ip
+ 2: ldrbt r2, [r0], #1
+@@ -56,6 +62,9 @@ rb .req r0
+ #else
+ orr r2, rb, r2, lsl #8
+ #endif
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ mov r0, #0
+ ret lr
+ ENDPROC(__get_user_2)
+@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8)
+ .pushsection __ex_table, "a"
+ .long 1b, __get_user_bad
+ .long 2b, __get_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __get_user_bad
++#endif
+ .long 4b, __get_user_bad
+ .long 5b, __get_user_bad8
+ .long 6b, __get_user_bad8
+diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
+index 38d660d3705f4..515eeaa9975c6 100644
+--- a/arch/arm/lib/putuser.S
++++ b/arch/arm/lib/putuser.S
+@@ -41,16 +41,13 @@ ENDPROC(__put_user_1)
+
+ ENTRY(__put_user_2)
+ check_uaccess r0, 2, r1, ip, __put_user_bad
+- mov ip, r2, lsr #8
+-#ifdef CONFIG_THUMB2_KERNEL
+-#ifndef __ARMEB__
+-2: TUSER(strb) r2, [r0]
+-3: TUSER(strb) ip, [r0, #1]
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(strh) r2, [r0]
++
+ #else
+-2: TUSER(strb) ip, [r0]
+-3: TUSER(strb) r2, [r0, #1]
+-#endif
+-#else /* !CONFIG_THUMB2_KERNEL */
++
++ mov ip, r2, lsr #8
+ #ifndef __ARMEB__
+ 2: TUSER(strb) r2, [r0], #1
+ 3: TUSER(strb) ip, [r0]
+@@ -58,7 +55,8 @@ ENTRY(__put_user_2)
+ 2: TUSER(strb) ip, [r0], #1
+ 3: TUSER(strb) r2, [r0]
+ #endif
+-#endif /* CONFIG_THUMB2_KERNEL */
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
+ mov r0, #0
+ ret lr
+ ENDPROC(__put_user_2)
+@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad)
+ .pushsection __ex_table, "a"
+ .long 1b, __put_user_bad
+ .long 2b, __put_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __put_user_bad
++#endif
+ .long 4b, __put_user_bad
+ .long 5b, __put_user_bad
+ .long 6b, __put_user_bad
+--
+2.20.1
+
--- /dev/null
+From 2c1c59ff5936068c66547ca5158be55b5478b7d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Oct 2018 13:28:37 +0200
+Subject: ARM: debug: enable UART1 for socfpga Cyclone5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Péron <peron.clem@gmail.com>
+
+[ Upstream commit f6628486c8489e91c513b62608f89ccdb745600d ]
+
+Cyclone5 and Arria10 doesn't have the same memory map for UART1.
+
+Split the SOCFPGA_UART1 into 2 options to allow debugging on UART1 for Cyclone5.
+
+Signed-off-by: Clément Péron <peron.clem@gmail.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig.debug | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index fd4b679945d3a..b14f154919a5d 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1023,14 +1023,21 @@ choice
+ Say Y here if you want kernel low-level debugging support
+ on SOCFPGA(Cyclone 5 and Arria 5) based platforms.
+
+- config DEBUG_SOCFPGA_UART1
++ config DEBUG_SOCFPGA_ARRIA10_UART1
+ depends on ARCH_SOCFPGA
+- bool "Use SOCFPGA UART1 for low-level debug"
++ bool "Use SOCFPGA Arria10 UART1 for low-level debug"
+ select DEBUG_UART_8250
+ help
+ Say Y here if you want kernel low-level debugging support
+ on SOCFPGA(Arria 10) based platforms.
+
++ config DEBUG_SOCFPGA_CYCLONE5_UART1
++ depends on ARCH_SOCFPGA
++ bool "Use SOCFPGA Cyclone 5 UART1 for low-level debug"
++ select DEBUG_UART_8250
++ help
++ Say Y here if you want kernel low-level debugging support
++ on SOCFPGA(Cyclone 5 and Arria 5) based platforms.
+
+ config DEBUG_SUN9I_UART0
+ bool "Kernel low-level debugging messages via sun9i UART0"
+@@ -1585,7 +1592,8 @@ config DEBUG_UART_PHYS
+ default 0xfe800000 if ARCH_IOP32X
+ default 0xff690000 if DEBUG_RK32_UART2
+ default 0xffc02000 if DEBUG_SOCFPGA_UART0
+- default 0xffc02100 if DEBUG_SOCFPGA_UART1
++ default 0xffc02100 if DEBUG_SOCFPGA_ARRIA10_UART1
++ default 0xffc03000 if DEBUG_SOCFPGA_CYCLONE5_UART1
+ default 0xffd82340 if ARCH_IOP13XX
+ default 0xffe40000 if DEBUG_RCAR_GEN1_SCIF0
+ default 0xffe42000 if DEBUG_RCAR_GEN1_SCIF2
+@@ -1689,7 +1697,8 @@ config DEBUG_UART_VIRT
+ default 0xfeb30c00 if DEBUG_KEYSTONE_UART0
+ default 0xfeb31000 if DEBUG_KEYSTONE_UART1
+ default 0xfec02000 if DEBUG_SOCFPGA_UART0
+- default 0xfec02100 if DEBUG_SOCFPGA_UART1
++ default 0xfec02100 if DEBUG_SOCFPGA_ARRIA10_UART1
++ default 0xfec03000 if DEBUG_SOCFPGA_CYCLONE5_UART1
+ default 0xfec12000 if (DEBUG_MVEBU_UART0 || DEBUG_MVEBU_UART0_ALTERNATE) && ARCH_MVEBU
+ default 0xfec12100 if DEBUG_MVEBU_UART1_ALTERNATE
+ default 0xfec10000 if DEBUG_SIRFATLAS7_UART0
+@@ -1737,9 +1746,9 @@ config DEBUG_UART_8250_WORD
+ depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250
+ depends on DEBUG_UART_8250_SHIFT >= 2
+ default y if DEBUG_PICOXCELL_UART || \
+- DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_UART1 || \
+- DEBUG_KEYSTONE_UART0 || DEBUG_KEYSTONE_UART1 || \
+- DEBUG_ALPINE_UART0 || \
++ DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_ARRIA10_UART1 || \
++ DEBUG_SOCFPGA_CYCLONE5_UART1 || DEBUG_KEYSTONE_UART0 || \
++ DEBUG_KEYSTONE_UART1 || DEBUG_ALPINE_UART0 || \
+ DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \
+ DEBUG_DAVINCI_DA8XX_UART2 || \
+ DEBUG_BCM_KONA_UART || DEBUG_RK32_UART2
+--
+2.20.1
+
--- /dev/null
+From 536fa7d95260294526be36bb5476c6ecce3cafba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 16:54:28 +0100
+Subject: ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 6035cbcceb069f87296b3cd0bc4736ad5618bf47 ]
+
+DWC2 hardware module integrated in Samsung SoCs requires some quirks to
+operate properly, so use Samsung SoC specific compatible to notify driver
+to apply respective fixes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
+index aa06a02c3ff59..5ba6622549097 100644
+--- a/arch/arm/boot/dts/exynos3250.dtsi
++++ b/arch/arm/boot/dts/exynos3250.dtsi
+@@ -359,7 +359,7 @@
+ };
+
+ hsotg: hsotg@12480000 {
+- compatible = "snps,dwc2";
++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2";
+ reg = <0x12480000 0x20000>;
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cmu CLK_USBOTG>;
+--
+2.20.1
+
--- /dev/null
+From 208431682224827dd5eb7ad41ed3ceca050780d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 18:53:06 +0100
+Subject: ARM: dts: mmp2: fix the gpio interrupt cell number
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 400583983f8a8e95ec02c9c9e2b50188753a87fb ]
+
+gpio-pxa uses two cell to encode the interrupt source: the pin number
+and the trigger type. Adjust the device node accordingly.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/mmp2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi
+index 47e5b63339d18..e95deed6a7973 100644
+--- a/arch/arm/boot/dts/mmp2.dtsi
++++ b/arch/arm/boot/dts/mmp2.dtsi
+@@ -180,7 +180,7 @@
+ clocks = <&soc_clocks MMP2_CLK_GPIO>;
+ resets = <&soc_clocks MMP2_CLK_GPIO>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ ranges;
+
+ gcb0: gpio@d4019000 {
+--
+2.20.1
+
--- /dev/null
+From 6c87046fdf7ccb307a1e859a8812a06a3f6237dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 14:54:51 +0100
+Subject: ARM: dts: pxa: clean up USB controller nodes
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit c40ad24254f1dbd54f2df5f5f524130dc1862122 ]
+
+PXA25xx SoCs don't have a USB controller, so drop the node from the
+common pxa2xx.dtsi base file. Both pxa27x and pxa3xx have a dedicated
+node already anyway.
+
+While at it, unify the names for the nodes across all pxa platforms.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Reported-by: Sergey Yanovich <ynvich@gmail.com>
+Link: https://patchwork.kernel.org/patch/8375421/
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa27x.dtsi | 2 +-
+ arch/arm/boot/dts/pxa2xx.dtsi | 7 -------
+ arch/arm/boot/dts/pxa3xx.dtsi | 2 +-
+ 3 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 3228ad5fb725f..ccbecad9c5c7c 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -35,7 +35,7 @@
+ clocks = <&clks CLK_NONE>;
+ };
+
+- pxa27x_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi
+index e4ebcde17837c..a03bca81ae8a6 100644
+--- a/arch/arm/boot/dts/pxa2xx.dtsi
++++ b/arch/arm/boot/dts/pxa2xx.dtsi
+@@ -117,13 +117,6 @@
+ status = "disabled";
+ };
+
+- usb0: ohci@4c000000 {
+- compatible = "marvell,pxa-ohci";
+- reg = <0x4c000000 0x10000>;
+- interrupts = <3>;
+- status = "disabled";
+- };
+-
+ mmc0: mmc@41100000 {
+ compatible = "marvell,pxa-mmc";
+ reg = <0x41100000 0x1000>;
+diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi
+index 55c75b67351cb..affa5b6f6da14 100644
+--- a/arch/arm/boot/dts/pxa3xx.dtsi
++++ b/arch/arm/boot/dts/pxa3xx.dtsi
+@@ -189,7 +189,7 @@
+ status = "disabled";
+ };
+
+- pxa3xx_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+--
+2.20.1
+
--- /dev/null
+From 014adf5437d9e2f011c90febee77ff2561465a11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 13:12:48 -0600
+Subject: ARM: dts: realview: Fix some more duplicate regulator nodes
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit f3b2f758ec1e6cdb13c925647cbd8ad4938b78fb ]
+
+There's a bug in dtc in checking for duplicate node names when there's
+another section (e.g. "/ { };"). In this case, skeleton.dtsi provides
+another section. Upon removal of skeleton.dtsi, the dtb fails to build
+due to a duplicate node 'fixedregulator@0'. As both nodes were pretty
+much the same 3.3V fixed regulator, it hasn't really mattered. Fix this
+by renaming the nodes to something unique. In the process, drop the
+unit-address which shouldn't be present wtihout reg property.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-pb1176.dts | 4 ++--
+ arch/arm/boot/dts/arm-realview-pb11mp.dts | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index c1fd5615ddfe3..939c108c24a6c 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -45,7 +45,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -53,7 +53,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+index e306f1cceb4ec..95037c48182de 100644
+--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+@@ -145,7 +145,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -153,7 +153,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+--
+2.20.1
+
--- /dev/null
+From 2073072808d9d760b523da120aac5357dbc6cfb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 19:05:47 -0600
+Subject: ARM: dts: realview-pbx: Fix duplicate regulator nodes
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 7f4b001b7f6e0480b5bdab9cd8ce1711e43e5cb5 ]
+
+There's a bug in dtc in checking for duplicate node names when there's
+another section (e.g. "/ { };"). In this case, skeleton.dtsi provides
+another section. Upon removal of skeleton.dtsi, the dtb fails to build
+due to a duplicate node 'fixedregulator@0'. As both nodes were pretty
+much the same 3.3V fixed regulator, it hasn't really mattered. Fix this
+by renaming the nodes to something unique. In the process, drop the
+unit-address which shouldn't be present wtihout reg property.
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-pbx.dtsi | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+index 2bf3958b2e6b9..068293254fbb8 100644
+--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi
++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+@@ -43,7 +43,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -51,7 +51,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+@@ -539,4 +539,3 @@
+ };
+ };
+ };
+-
+--
+2.20.1
+
--- /dev/null
+From e1e6efb68785bfe17d5f4cfde0eccacdfa54ceaa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 15:35:04 -0200
+Subject: ARM: dts: rockchip: Assign the proper GPIO clocks for rv1108
+
+From: Otavio Salvador <otavio@ossystems.com.br>
+
+[ Upstream commit efc2e0bd9594060915696a418564aefd0270b1d6 ]
+
+It is not correct to assign the 24MHz clock oscillator to the GPIO
+ports.
+
+Fix it by assigning the proper GPIO clocks instead.
+
+Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
+Tested-by: Fabio Berton <fabio.berton@ossystems.com.br>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rv1108.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi
+index 6013d2f888c33..aa4119eaea987 100644
+--- a/arch/arm/boot/dts/rv1108.dtsi
++++ b/arch/arm/boot/dts/rv1108.dtsi
+@@ -522,7 +522,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x20030000 0x100>;
+ interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO0_PMU>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -535,7 +535,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10310000 0x100>;
+ interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO1>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -548,7 +548,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10320000 0x100>;
+ interrupts = <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO2>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -561,7 +561,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10330000 0x100>;
+ interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO3>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+--
+2.20.1
+
--- /dev/null
+From 14873fad9ddbbcf801f0c2260490d85dc2d52562 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 15:24:13 +0000
+Subject: ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit 03d9f8fa2bfdc791865624d3adc29070cf67814e ]
+
+There is no functional change from this, but it is confusing to find two
+copies of vcc_sys and no vcc_flash when looking in
+/sys/class/regulator/*/name.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+index b9c471fcbd42b..862c2248fcb6d 100644
+--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi
++++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+@@ -63,7 +63,7 @@
+
+ vcc_flash: flash-regulator {
+ compatible = "regulator-fixed";
+- regulator-name = "vcc_sys";
++ regulator-name = "vcc_flash";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ startup-delay-us = <150>;
+--
+2.20.1
+
--- /dev/null
+From a0461ea423455dc132d48762c03970dbf24aed88 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 15:35:03 -0200
+Subject: ARM: dts: rockchip: Fix the PMU interrupt number for rv1108
+
+From: Otavio Salvador <otavio@ossystems.com.br>
+
+[ Upstream commit c955b7aec510145129ca7aaea6ecbf6d748f5ebf ]
+
+According to the Rockchip vendor tree the PMU interrupt number is
+76, so fix it accordingly.
+
+Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
+Tested-by: Fabio Berton <fabio.berton@ossystems.com.br>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rv1108.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi
+index e7cd1315db1b7..6013d2f888c33 100644
+--- a/arch/arm/boot/dts/rv1108.dtsi
++++ b/arch/arm/boot/dts/rv1108.dtsi
+@@ -101,7 +101,7 @@
+
+ arm-pmu {
+ compatible = "arm,cortex-a7-pmu";
+- interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+ timer {
+--
+2.20.1
+
--- /dev/null
+From a27210343063443c00448f9e1af950ec11321011 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:00:22 +0200
+Subject: ARM: dts: sun5i: a10s: Fix HDMI output DTC warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit ed5fc60b909427be6ca93d3e07a0a5f296d7000a ]
+
+Our HDMI output endpoint on the A10s DTSI has a warning under DTC: "graph
+node has single child node 'endpoint', #address-cells/#size-cells are not
+necessary". Fix this by removing those properties.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun5i-a10s.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
+index 18f25c5e75aeb..396fb6632bf07 100644
+--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
++++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
+@@ -104,8 +104,6 @@
+ };
+
+ hdmi_out: port@1 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ reg = <1>;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From ddd09a8697aeb02054aa9eb52408cbe0a2dd6a86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 10:58:01 +0100
+Subject: ARM: dts: sun8i: v3s: Change pinctrl nodes to avoid warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 438a44ce7e51ce571f942433c6c7cb87c4c0effd ]
+
+All our pinctrl nodes were using a node name convention with a unit-address
+to differentiate the different muxing options. However, since those nodes
+didn't have a reg property, they were generating warnings in DTC.
+
+In order to accomodate for this, convert the old nodes to the syntax we've
+been using for the new SoCs, including removing the letter suffix of the
+node labels to the bank of those pins to make things more readable.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts | 4 ++--
+ arch/arm/boot/dts/sun8i-v3s.dtsi | 10 +++++-----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
+index 387fc2aa546d6..333df90e8037c 100644
+--- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
++++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
+@@ -78,7 +78,7 @@
+ };
+
+ &mmc0 {
+- pinctrl-0 = <&mmc0_pins_a>;
++ pinctrl-0 = <&mmc0_pins>;
+ pinctrl-names = "default";
+ broken-cd;
+ bus-width = <4>;
+@@ -87,7 +87,7 @@
+ };
+
+ &uart0 {
+- pinctrl-0 = <&uart0_pins_a>;
++ pinctrl-0 = <&uart0_pb_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
+index 3a06dc5b37467..da5823c6fa3e6 100644
+--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
+@@ -292,17 +292,17 @@
+ interrupt-controller;
+ #interrupt-cells = <3>;
+
+- i2c0_pins: i2c0 {
++ i2c0_pins: i2c0-pins {
+ pins = "PB6", "PB7";
+ function = "i2c0";
+ };
+
+- uart0_pins_a: uart0@0 {
++ uart0_pb_pins: uart0-pb-pins {
+ pins = "PB8", "PB9";
+ function = "uart0";
+ };
+
+- mmc0_pins_a: mmc0@0 {
++ mmc0_pins: mmc0-pins {
+ pins = "PF0", "PF1", "PF2", "PF3",
+ "PF4", "PF5";
+ function = "mmc0";
+@@ -310,7 +310,7 @@
+ bias-pull-up;
+ };
+
+- mmc1_pins: mmc1 {
++ mmc1_pins: mmc1-pins {
+ pins = "PG0", "PG1", "PG2", "PG3",
+ "PG4", "PG5";
+ function = "mmc1";
+@@ -318,7 +318,7 @@
+ bias-pull-up;
+ };
+
+- spi0_pins: spi0 {
++ spi0_pins: spi0-pins {
+ pins = "PC0", "PC1", "PC2", "PC3";
+ function = "spi0";
+ };
+--
+2.20.1
+
--- /dev/null
+From b17e0ba4d24b034b382e245bf41de917ac07aa66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 13:11:42 -0600
+Subject: ARM: dts: sunxi: Fix PMU compatible strings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 5719ac19fc32d892434939c1756c2f9a8322e6ef ]
+
+"arm,cortex-a15-pmu" is not a valid fallback compatible string for an
+Cortex-A7 PMU, so drop it.
+
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun6i-a31.dtsi | 2 +-
+ arch/arm/boot/dts/sun7i-a20.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
+index eef072a21acca..0bb82d0442a59 100644
+--- a/arch/arm/boot/dts/sun6i-a31.dtsi
++++ b/arch/arm/boot/dts/sun6i-a31.dtsi
+@@ -173,7 +173,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
+index 96bee776e1456..77f04dbdf9967 100644
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -171,7 +171,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 2cbfe58f1c22f58e4d283013eea76bdfca7c2a98 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 21:46:41 +0200
+Subject: ARM: OMAP1/2: fix SoC name printing
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 04a92358b3964988c78dfe370a559ae550383886 ]
+
+Currently we get extra newlines on OMAP1/2 when the SoC name is printed:
+
+[ 0.000000] OMAP1510
+[ 0.000000] revision 2 handled as 15xx id: bc058c9b93111a16
+
+[ 0.000000] OMAP2420
+[ 0.000000]
+
+Fix by using pr_cont.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/id.c | 6 +++---
+ arch/arm/mach-omap2/id.c | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c
+index 52de382fc8047..7e49dfda3d2f4 100644
+--- a/arch/arm/mach-omap1/id.c
++++ b/arch/arm/mach-omap1/id.c
+@@ -200,10 +200,10 @@ void __init omap_check_revision(void)
+ printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type);
+ }
+
+- printk(KERN_INFO "OMAP%04x", omap_revision >> 16);
++ pr_info("OMAP%04x", omap_revision >> 16);
+ if ((omap_revision >> 8) & 0xff)
+- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff);
+- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n",
++ pr_cont("%x", (omap_revision >> 8) & 0xff);
++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n",
+ die_rev, omap_revision & 0xff, system_serial_low,
+ system_serial_high);
+ }
+diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
+index 16cb1c195fd8e..79d71b1eae594 100644
+--- a/arch/arm/mach-omap2/id.c
++++ b/arch/arm/mach-omap2/id.c
+@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void)
+
+ pr_info("%s", soc_name);
+ if ((omap_rev() >> 8) & 0x0f)
+- pr_info("%s", soc_rev);
+- pr_info("\n");
++ pr_cont("%s", soc_rev);
++ pr_cont("\n");
+ }
+
+ #define OMAP3_SHOW_FEATURE(feat) \
+--
+2.20.1
+
--- /dev/null
+From a15e0cd445c157de8a67682e927ef86aa1597e04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:48 +0100
+Subject: arm64: dts: meson-gxbb-nanopi-k2: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit f0783f5edb52af14ecaae6c5ce4f38e0a358f5d8 ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: 12ada0513d7a ("ARM64: dts: meson-gxbb-nanopi-k2: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+index 4b17a76959b2f..c83c028e95af0 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+@@ -178,7 +178,7 @@
+ pinctrl-names = "default";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX", "UART RX", "Power Control", "Power Key In",
+ "VCCK En", "CON1 Header Pin31",
+ "I2S Header Pin6", "IR In", "I2S Header Pin7",
+@@ -186,7 +186,7 @@
+ "I2S Header Pin5", "HDMI CEC", "SYS LED";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk",
+ "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2",
+--
+2.20.1
+
--- /dev/null
+From ad66bbfd234843d3bf53331772a9ad5a0f3c8973 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:49 +0100
+Subject: arm64: dts: meson-gxbb-odroidc2: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 2165b006b65d609140dafafcb14cce5a4aaacbab ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: b03c7d6438bb ("ARM64: dts: meson-gxbb-odroidc2: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+index c3c65b06ba76b..4ea23df81f212 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -189,7 +189,7 @@
+ pinctrl-names = "default";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX", "UART RX", "VCCK En", "TF 3V3/1V8 En",
+ "USB HUB nRESET", "USB OTG Power En",
+ "J7 Header Pin2", "IR In", "J7 Header Pin4",
+@@ -197,7 +197,7 @@
+ "HDMI CEC", "SYS LED";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk",
+ "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2",
+--
+2.20.1
+
--- /dev/null
+From b1c4eeeb2c6e92b8363e834b17008d357c655d64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:50 +0100
+Subject: arm64: dts: meson-gxl-khadas-vim: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 5b78012636f537344bd551934387f5772c38ba80 ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: 60795933b709 ("ARM64: dts: meson-gxl-khadas-vim: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+index edc512ad0bac3..fb5db5f33e8c3 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+@@ -112,7 +112,7 @@
+ linux,rc-map-name = "rc-geekbox";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX",
+ "UART RX",
+ "Power Key In",
+@@ -125,7 +125,7 @@
+ "SYS LED";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "", "", "", "", "", "", "",
+ "", "", "", "", "", "", "",
+--
+2.20.1
+
--- /dev/null
+From 1def23eeb06724a69cc96235c95e79105d0a3d8f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:47 +0100
+Subject: arm64: dts: meson-gxl-libretech-cc: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 11fa9774612decea87144d7f950a9c53a4fe3050 ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: 47884c5c746e ("ARM64: dts: meson-gxl-libretech-cc: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index 0814b6b29b86a..e2c71753e3278 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -139,7 +139,7 @@
+ };
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX",
+ "UART RX",
+ "Blue LED",
+@@ -152,7 +152,7 @@
+ "7J1 Header Pin13";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "", "", "", "", "", "", "",
+ "", "", "", "", "", "", "",
+--
+2.20.1
+
--- /dev/null
+From d87b6b8fde8f24c39899cde985792637aeb7d1c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 17:47:25 +0100
+Subject: arm64: tegra: Fix power key interrupt type on Jetson TX2
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 6f13f10b3bbfed3b29c812f0f65bef802ce05e3c ]
+
+In order for the correct interrupt type to be configured, the event
+action for the power key needs to be "asserted".
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+index c71d762bf697b..a658a253e973e 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+@@ -2,6 +2,7 @@
+ /dts-v1/;
+
+ #include <dt-bindings/input/linux-event-codes.h>
++#include <dt-bindings/input/gpio-keys.h>
+
+ #include "tegra186-p3310.dtsi"
+
+@@ -60,6 +61,7 @@
+ linux,input-type = <EV_KEY>;
+ linux,code = <KEY_POWER>;
+ debounce-interval = <10>;
++ wakeup-event-action = <EV_ACT_ASSERTED>;
+ wakeup-source;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 82d733db725b8d05aa09dfcc1e80f785c58edfae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 06:33:16 +0000
+Subject: ASoC: au8540: use 64-bit arithmetic instead of 32-bit
+
+From: Young_X <YangX92@hotmail.com>
+
+[ Upstream commit cd7fdc45bc69a62b4e22c6e875f1f1aea566256d ]
+
+Add suffix ULL to constant 256 in order to give the compiler complete
+information about the proper arithmetic to use.
+
+Notice that such constant is used in a context that expects an
+expression of type u64 (64 bits, unsigned) and the following
+expression is currently being evaluated using 32-bit arithmetic:
+
+ 256 * fs * 2 * mclk_src_scaling[i].param
+
+Signed-off-by: Young_X <YangX92@hotmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8540.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c
+index f9c9933acffb6..c0c64f90a61b7 100644
+--- a/sound/soc/codecs/nau8540.c
++++ b/sound/soc/codecs/nau8540.c
+@@ -548,7 +548,7 @@ static int nau8540_calc_fll_param(unsigned int fll_in,
+ fvco_max = 0;
+ fvco_sel = ARRAY_SIZE(mclk_src_scaling);
+ for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
+- fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
++ fvco = 256ULL * fs * 2 * mclk_src_scaling[i].param;
+ if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
+ fvco_max < fvco) {
+ fvco_max = fvco;
+--
+2.20.1
+
--- /dev/null
+From bdf3e5605c548f736def7277364fe86f7040766a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 07:35:34 +0000
+Subject: ASoC: rsnd: tidyup registering method for rsnd_kctrl_new()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 9c698e8481a15237a5b1db5f8391dd66d59e42a4 ]
+
+Current rsnd dvc.c is using flags to avoid duplicating register for
+MIXer case. OTOH, commit e894efef9ac7 ("ASoC: core: add support to card
+rebind") allows to rebind sound card without rebinding all drivers.
+
+Because of above patch and dvc.c flags, it can't re-register kctrl if
+only sound card was rebinded, because dvc is keeping old flags.
+(Of course it will be no problem if rsnd driver also be rebinded,
+but it is not purpose of above patch).
+
+This patch checks current card registered kctrl when registering.
+In MIXer case, it can avoid duplicate register if card already has same
+kctrl. In rebind case, it can re-register kctrl because card registered
+kctl had been removed when unbinding.
+
+This patch is updated version of commit b918f1bc7f1ce ("ASoC: rsnd: DVC
+kctrl sets once")
+
+Reported-by: Nguyen Viet Dung <dung.nguyen.aj@renesas.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Nguyen Viet Dung <dung.nguyen.aj@renesas.com>
+Cc: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/core.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index ab0bbef7eb48a..bb06dd72ca9a7 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -1278,6 +1278,18 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
+ };
+ int ret;
+
++ /*
++ * 1) Avoid duplicate register (ex. MIXer case)
++ * 2) re-register if card was rebinded
++ */
++ list_for_each_entry(kctrl, &card->controls, list) {
++ struct rsnd_kctrl_cfg *c = kctrl->private_data;
++
++ if (strcmp(kctrl->id.name, name) == 0 &&
++ c->mod == mod)
++ return 0;
++ }
++
+ if (size > RSND_MAX_CHANNELS)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 2b10712047bd2002790fabe542f1a687ccbe5190 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 13:11:41 -0400
+Subject: audit_get_nd(): don't unlock parent too early
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 69924b89687a2923e88cc42144aea27868913d0e ]
+
+if the child has been negative and just went positive
+under us, we want coherent d_is_positive() and ->d_inode.
+Don't unlock the parent until we'd done that work...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/audit_watch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index 4a98f6e314a9b..35f1d706bd5b4 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -365,12 +365,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent)
+ struct dentry *d = kern_path_locked(watch->path, parent);
+ if (IS_ERR(d))
+ return PTR_ERR(d);
+- inode_unlock(d_backing_inode(parent->dentry));
+ if (d_is_positive(d)) {
+ /* update watch filter fields */
+ watch->dev = d->d_sb->s_dev;
+ watch->ino = d_backing_inode(d)->i_ino;
+ }
++ inode_unlock(d_backing_inode(parent->dentry));
+ dput(d);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 826605051e7050d7550f631ffd078de030eb8065 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 00:03:11 -0400
+Subject: autofs: fix a leak in autofs_expire_indirect()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 03ad0d703df75c43f78bd72e16124b5b94a95188 ]
+
+if the second call of should_expire() in there ends up
+grabbing and returning a new reference to dentry, we need
+to drop it before continuing.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/autofs4/expire.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index 141f9bc213a3d..94a0017c923b1 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -472,9 +472,10 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
+ */
+ flags &= ~AUTOFS_EXP_LEAVES;
+ found = should_expire(expired, mnt, timeout, how);
+- if (!found || found != expired)
+- /* Something has changed, continue */
++ if (found != expired) { // something has changed, continue
++ dput(found);
+ goto next;
++ }
+
+ if (expired != dentry)
+ dput(dentry);
+--
+2.20.1
+
--- /dev/null
+From ae7d7eb22d450e7679c65d528695e93cd816ddd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 11:06:37 +0100
+Subject: clk: renesas: r8a77995: Correct parent clock of DU
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 515b2915ee08060ad4f6a3b3de38c5c2c5258e8b ]
+
+According to the R-Car Gen3 Hardware Manual Rev 1.00, the parent clock
+of the DU module clocks on R-Car D3 is S1D1.
+
+Fixes: d71e851d82c6cfe5 ("clk: renesas: cpg-mssr: Add R8A77995 support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a77995-cpg-mssr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+index e594cf8ee63b6..8434d5530fb15 100644
+--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+@@ -141,8 +141,8 @@ static const struct mssr_mod_clk r8a77995_mod_clks[] __initconst = {
+ DEF_MOD("vspbs", 627, R8A77995_CLK_S0D1),
+ DEF_MOD("ehci0", 703, R8A77995_CLK_S3D2),
+ DEF_MOD("hsusb", 704, R8A77995_CLK_S3D2),
+- DEF_MOD("du1", 723, R8A77995_CLK_S2D1),
+- DEF_MOD("du0", 724, R8A77995_CLK_S2D1),
++ DEF_MOD("du1", 723, R8A77995_CLK_S1D1),
++ DEF_MOD("du0", 724, R8A77995_CLK_S1D1),
+ DEF_MOD("lvds", 727, R8A77995_CLK_S2D1),
+ DEF_MOD("vin7", 804, R8A77995_CLK_S1D2),
+ DEF_MOD("vin6", 805, R8A77995_CLK_S1D2),
+--
+2.20.1
+
--- /dev/null
+From caf34dd775b5fe8069b9c31c10091191b1f121ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Nov 2018 13:16:12 +0900
+Subject: clk: rockchip: fix I2S1 clock gate register for rk3328
+
+From: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+
+[ Upstream commit 5c73ac2f8b70834a603eb2d92eb0bb464634420b ]
+
+This patch fixes definition of I2S1 clock gate register for rk3328.
+Current setting is not related I2S clocks.
+ - bit6 of CRU_CLKGATE_CON0 means clk_ddrmon_en
+ - bit6 of CRU_CLKGATE_CON1 means clk_i2s1_en
+
+Signed-off-by: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3328.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index 33d1cf4e6d803..0e5222d1944b5 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -392,7 +392,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ RK3328_CLKGATE_CON(1), 5, GFLAGS,
+ &rk3328_i2s1_fracmux),
+ GATE(SCLK_I2S1, "clk_i2s1", "i2s1_pre", CLK_SET_RATE_PARENT,
+- RK3328_CLKGATE_CON(0), 6, GFLAGS),
++ RK3328_CLKGATE_CON(1), 6, GFLAGS),
+ COMPOSITE_NODIV(SCLK_I2S1_OUT, "i2s1_out", mux_i2s1out_p, 0,
+ RK3328_CLKSEL_CON(8), 12, 1, MFLAGS,
+ RK3328_CLKGATE_CON(1), 7, GFLAGS),
+--
+2.20.1
+
--- /dev/null
+From 8f64fb54737d8b3d9806e2c46eba7046110ac8cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Nov 2018 13:18:02 +0900
+Subject: clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328
+
+From: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+
+[ Upstream commit df7b1f2e0a4ae0fceff261e29cde63dafcf2360f ]
+
+This patch fixes mistakes in HCLK_I2S1_8CH for running I2S1
+successfully.
+
+Signed-off-by: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/dt-bindings/clock/rk3328-cru.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/dt-bindings/clock/rk3328-cru.h b/include/dt-bindings/clock/rk3328-cru.h
+index d2b26a4b43ebd..4a9db1b2669b8 100644
+--- a/include/dt-bindings/clock/rk3328-cru.h
++++ b/include/dt-bindings/clock/rk3328-cru.h
+@@ -178,7 +178,7 @@
+ #define HCLK_TSP 309
+ #define HCLK_GMAC 310
+ #define HCLK_I2S0_8CH 311
+-#define HCLK_I2S1_8CH 313
++#define HCLK_I2S1_8CH 312
+ #define HCLK_I2S2_2CH 313
+ #define HCLK_SPDIF_8CH 314
+ #define HCLK_VOP 315
+--
+2.20.1
+
--- /dev/null
+From 475fdb7472cafbaafc6a7680281f9f9238840537 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 12:17:30 +0100
+Subject: clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit ac8cb53829a6ba119082e067f5bc8fab3611ce6a ]
+
+Similar to commit a9f0c0e56371 ("clk: rockchip: fix rk3188 sclk_smc
+gate data") there is one other gate clock in the rk3188 clock driver
+with a similar wrong ordering, the sclk_mac_lbtest. So fix it as well.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3188.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 022fecc9bcdf9..8cdfcd77e3ad9 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -362,8 +362,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ RK2928_CLKGATE_CON(2), 5, GFLAGS),
+ MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT,
+ RK2928_CLKSEL_CON(21), 4, 1, MFLAGS),
+- GATE(0, "sclk_mac_lbtest", "sclk_macref",
+- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS),
++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0,
++ RK2928_CLKGATE_CON(2), 12, GFLAGS),
+
+ COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0,
+ RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS,
+--
+2.20.1
+
--- /dev/null
+From d40aa9ea8f7a51da30ee6ad7ad82b00b9a63c529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 15:45:49 +0000
+Subject: clk: rockchip: fix rk3188 sclk_smc gate data
+
+From: Finley Xiao <finley.xiao@rock-chips.com>
+
+[ Upstream commit a9f0c0e563717b9f63b3bb1c4a7c2df436a206d9 ]
+
+Fix sclk_smc gate data.
+Change variable order, flags come before the register address.
+
+Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
+Signed-off-by: Johan Jonker <jbx9999@hotmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3188.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 2b0d772b4f432..022fecc9bcdf9 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -391,8 +391,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ * Clock-Architecture Diagram 4
+ */
+
+- GATE(SCLK_SMC, "sclk_smc", "hclk_peri",
+- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS),
++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0,
++ RK2928_CLKGATE_CON(2), 4, GFLAGS),
+
+ COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0,
+ RK2928_CLKSEL_CON(25), 0, 7, DFLAGS,
+--
+2.20.1
+
--- /dev/null
+From f14edf2f16f570a834a03f0ea8bfc66fac7b3c62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 16:46:08 +0530
+Subject: clk: sunxi-ng: a64: Fix gate bit of DSI DPHY
+
+From: Jagan Teki <jagan@amarulasolutions.com>
+
+[ Upstream commit ee678706e46d0d185c27cc214ad97828e0643159 ]
+
+DSI DPHY gate bit on MIPI DSI clock register is bit 15
+not bit 30.
+
+Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 36a30a3cfad71..eaafc038368f5 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -565,7 +565,7 @@ static const char * const dsi_dphy_parents[] = { "pll-video0", "pll-periph0" };
+ static const u8 dsi_dphy_table[] = { 0, 2, };
+ static SUNXI_CCU_M_WITH_MUX_TABLE_GATE(dsi_dphy_clk, "dsi-dphy",
+ dsi_dphy_parents, dsi_dphy_table,
+- 0x168, 0, 4, 8, 2, BIT(31), CLK_SET_RATE_PARENT);
++ 0x168, 0, 4, 8, 2, BIT(15), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu",
+ 0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT);
+--
+2.20.1
+
--- /dev/null
+From d073896a5c96033ec8e97807e1021667aaa93801 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 13:33:28 +0800
+Subject: clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 7bb7d29cffdd24bf419516d14b6768591e74069e ]
+
+The third parent of CSI_MCLK is PLL_PERIPH1, not PLL_PERIPH0.
+Fix it.
+
+Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+index 1729ff6a5aaed..b09acda71abe9 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+@@ -460,7 +460,7 @@ static const char * const csi_sclk_parents[] = { "pll-periph0", "pll-periph1" };
+ static SUNXI_CCU_M_WITH_MUX_GATE(csi_sclk_clk, "csi-sclk", csi_sclk_parents,
+ 0x134, 16, 4, 24, 3, BIT(31), 0);
+
+-static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph0" };
++static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph1" };
+ static SUNXI_CCU_M_WITH_MUX_GATE(csi_mclk_clk, "csi-mclk", csi_mclk_parents,
+ 0x134, 0, 5, 8, 3, BIT(15), 0);
+
+--
+2.20.1
+
--- /dev/null
+From a497c5065b929eee4d1dabdf60f1ba43c9887d5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:58:58 +0530
+Subject: crypto: bcm - fix normal/non key hash algorithm failure
+
+From: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+
+[ Upstream commit 4f0129d13e69bad0363fd75553fb22897b32c379 ]
+
+Remove setkey() callback handler for normal/non key
+hash algorithms and keep it for AES-CBC/CMAC which needs key.
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/bcm/cipher.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index b6be383a51a6a..84422435f39b4 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -4637,12 +4637,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg)
+ hash->halg.statesize = sizeof(struct spu_hash_export_s);
+
+ if (driver_alg->auth_info.mode != HASH_MODE_HMAC) {
+- hash->setkey = ahash_setkey;
+ hash->init = ahash_init;
+ hash->update = ahash_update;
+ hash->final = ahash_final;
+ hash->finup = ahash_finup;
+ hash->digest = ahash_digest;
++ if ((driver_alg->auth_info.alg == HASH_ALG_AES) &&
++ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) ||
++ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) {
++ hash->setkey = ahash_setkey;
++ }
+ } else {
+ hash->setkey = ahash_hmac_setkey;
+ hash->init = ahash_hmac_init;
+--
+2.20.1
+
--- /dev/null
+From a267269ec2dc70a8247475fd69f07d08374822ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 11:36:18 +0300
+Subject: crypto: ecc - check for invalid values in the key verification test
+
+From: Vitaly Chikunov <vt@altlinux.org>
+
+[ Upstream commit 2eb4942b6609d35a4e835644a33203b0aef7443d ]
+
+Currently used scalar multiplication algorithm (Matthieu Rivain, 2011)
+have invalid values for scalar == 1, n-1, and for regularized version
+n-2, which was previously not checked. Verify that they are not used as
+private keys.
+
+Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/ecc.c | 42 ++++++++++++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+diff --git a/crypto/ecc.c b/crypto/ecc.c
+index 18f32f2a5e1c9..3b422e24e647e 100644
+--- a/crypto/ecc.c
++++ b/crypto/ecc.c
+@@ -904,30 +904,43 @@ static inline void ecc_swap_digits(const u64 *in, u64 *out,
+ out[i] = __swab64(in[ndigits - 1 - i]);
+ }
+
+-int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
+- const u64 *private_key, unsigned int private_key_len)
++static int __ecc_is_key_valid(const struct ecc_curve *curve,
++ const u64 *private_key, unsigned int ndigits)
+ {
+- int nbytes;
+- const struct ecc_curve *curve = ecc_get_curve(curve_id);
++ u64 one[ECC_MAX_DIGITS] = { 1, };
++ u64 res[ECC_MAX_DIGITS];
+
+ if (!private_key)
+ return -EINVAL;
+
+- nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+-
+- if (private_key_len != nbytes)
++ if (curve->g.ndigits != ndigits)
+ return -EINVAL;
+
+- if (vli_is_zero(private_key, ndigits))
++ /* Make sure the private key is in the range [2, n-3]. */
++ if (vli_cmp(one, private_key, ndigits) != -1)
+ return -EINVAL;
+-
+- /* Make sure the private key is in the range [1, n-1]. */
+- if (vli_cmp(curve->n, private_key, ndigits) != 1)
++ vli_sub(res, curve->n, one, ndigits);
++ vli_sub(res, res, one, ndigits);
++ if (vli_cmp(res, private_key, ndigits) != 1)
+ return -EINVAL;
+
+ return 0;
+ }
+
++int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
++ const u64 *private_key, unsigned int private_key_len)
++{
++ int nbytes;
++ const struct ecc_curve *curve = ecc_get_curve(curve_id);
++
++ nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
++
++ if (private_key_len != nbytes)
++ return -EINVAL;
++
++ return __ecc_is_key_valid(curve, private_key, ndigits);
++}
++
+ /*
+ * ECC private keys are generated using the method of extra random bits,
+ * equivalent to that described in FIPS 186-4, Appendix B.4.1.
+@@ -971,11 +984,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey)
+ if (err)
+ return err;
+
+- if (vli_is_zero(priv, ndigits))
+- return -EINVAL;
+-
+- /* Make sure the private key is in the range [1, n-1]. */
+- if (vli_cmp(curve->n, priv, ndigits) != 1)
++ /* Make sure the private key is in the valid range. */
++ if (__ecc_is_key_valid(curve, priv, ndigits))
+ return -EINVAL;
+
+ ecc_swap_digits(priv, privkey, ndigits);
+--
+2.20.1
+
--- /dev/null
+From 3af5e1ac03cb58b335c339e71f139a267e16d483 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 14:52:01 +0530
+Subject: cxgb4vf: fix memleak in mac_hlist initialization
+
+From: Arjun Vynipadath <arjun@chelsio.com>
+
+[ Upstream commit 24357e06ba511ad874d664d39475dbb01c1ca450 ]
+
+mac_hlist was initialized during adapter_up, which will be called
+every time a vf device is first brought up, or every time when device
+is brought up again after bringing all devices down. This means our
+state of previous list is lost, causing a memleak if entries are
+present in the list. To fix that, move list init to the condition
+that performs initial one time adapter setup.
+
+Signed-off-by: Arjun Vynipadath <arjun@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+index 8996ebbd222e0..26ba18ea08c6a 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+@@ -714,6 +714,10 @@ static int adapter_up(struct adapter *adapter)
+
+ if (adapter->flags & USING_MSIX)
+ name_msix_vecs(adapter);
++
++ /* Initialize hash mac addr list*/
++ INIT_LIST_HEAD(&adapter->mac_hlist);
++
+ adapter->flags |= FULL_INIT_DONE;
+ }
+
+@@ -739,8 +743,6 @@ static int adapter_up(struct adapter *adapter)
+ enable_rx(adapter);
+ t4vf_sge_start(adapter);
+
+- /* Initialize hash mac addr list*/
+- INIT_LIST_HEAD(&adapter->mac_hlist);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0b7ecdc58f2d20cd6d431bc9dcb52836169b6472 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 15:27:37 -0600
+Subject: dlm: fix invalid cluster name warning
+
+From: David Teigland <teigland@redhat.com>
+
+[ Upstream commit 3595c559326d0b660bb088a88e22e0ca630a0e35 ]
+
+The warning added in commit 3b0e761ba83
+ "dlm: print log message when cluster name is not set"
+
+did not account for the fact that lockspaces created
+from userland do not supply a cluster name, so bogus
+warnings are printed every time a userland lockspace
+is created.
+
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/user.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/dlm/user.c b/fs/dlm/user.c
+index 1f0c071d4a861..02de11695d0ba 100644
+--- a/fs/dlm/user.c
++++ b/fs/dlm/user.c
+@@ -25,6 +25,7 @@
+ #include "lvb_table.h"
+ #include "user.h"
+ #include "ast.h"
++#include "config.h"
+
+ static const char name_prefix[] = "dlm";
+ static const struct file_operations device_fops;
+@@ -404,7 +405,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- error = dlm_new_lockspace(params->name, NULL, params->flags,
++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags,
+ DLM_USER_LVB_LEN, NULL, NULL, NULL,
+ &lockspace);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From 0b08576382a257de4626bdbac90e3434e4a083aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 11:17:40 -0600
+Subject: dlm: fix missing idr_destroy for recover_idr
+
+From: David Teigland <teigland@redhat.com>
+
+[ Upstream commit 8fc6ed9a3508a0435b9270c313600799d210d319 ]
+
+Which would leak memory for the idr internals.
+
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lockspace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index 610f72ae7ad67..9c8c9a09b4a6d 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -807,6 +807,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)
+
+ dlm_delete_debug_file(ls);
+
++ idr_destroy(&ls->ls_recover_idr);
+ kfree(ls->ls_recover_buf);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 64e968e1648199fecf81485906fc2e004fdee903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 20:39:50 +0300
+Subject: dlm: fix possible call to kfree() for non-initialized pointer
+
+From: Denis V. Lunev <den@openvz.org>
+
+[ Upstream commit 58a923adf4d9aca8bf7205985c9c8fc531c65d72 ]
+
+Technically dlm_config_nodes() could return error and keep nodes
+uninitialized. After that on the fail path of we'll call kfree()
+for that uninitialized value.
+
+The patch is simple - we should just initialize nodes with NULL.
+
+Signed-off-by: Denis V. Lunev <den@openvz.org>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/member.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dlm/member.c b/fs/dlm/member.c
+index cad6d85911a80..0bc43b35d2c53 100644
+--- a/fs/dlm/member.c
++++ b/fs/dlm/member.c
+@@ -671,7 +671,7 @@ int dlm_ls_stop(struct dlm_ls *ls)
+ int dlm_ls_start(struct dlm_ls *ls)
+ {
+ struct dlm_recover *rv, *rv_old;
+- struct dlm_config_node *nodes;
++ struct dlm_config_node *nodes = NULL;
+ int error, count;
+
+ rv = kzalloc(sizeof(*rv), GFP_NOFS);
+--
+2.20.1
+
--- /dev/null
+From bf2f18551075a9898b6c7cbb8b674037680e8478 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 15:25:00 +0800
+Subject: dlm: NULL check before kmem_cache_destroy is not needed
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit f31a89692830061bceba8469607e4e4b0f900159 ]
+
+kmem_cache_destroy(NULL) is safe, so removes NULL check before
+freeing the mem. This patch also fix ifnullfree.cocci warnings.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/memory.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c
+index 7cd24bccd4fe5..37be29f21d04d 100644
+--- a/fs/dlm/memory.c
++++ b/fs/dlm/memory.c
+@@ -38,10 +38,8 @@ int __init dlm_memory_init(void)
+
+ void dlm_memory_exit(void)
+ {
+- if (lkb_cache)
+- kmem_cache_destroy(lkb_cache);
+- if (rsb_cache)
+- kmem_cache_destroy(rsb_cache);
++ kmem_cache_destroy(lkb_cache);
++ kmem_cache_destroy(rsb_cache);
+ }
+
+ char *dlm_allocate_lvb(struct dlm_ls *ls)
+@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb)
+ struct dlm_user_args *ua;
+ ua = lkb->lkb_ua;
+ if (ua) {
+- if (ua->lksb.sb_lvbptr)
+- kfree(ua->lksb.sb_lvbptr);
++ kfree(ua->lksb.sb_lvbptr);
+ kfree(ua);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From aa3b850bad289b3523c4987f398a42fe57340903 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:29:21 +0200
+Subject: dma-mapping: fix return type of dma_set_max_seg_size()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit c9d76d0655c06b8c1f944e46c4fd9e9cf4b331c0 ]
+
+The function dma_set_max_seg_size() can return either 0 on success or
+-EIO on error. Change its return type from unsigned int to int to
+capture this.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 7bf3b99e6fbb1..9aee5f345e299 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -650,8 +650,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev)
+ return SZ_64K;
+ }
+
+-static inline unsigned int dma_set_max_seg_size(struct device *dev,
+- unsigned int size)
++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size)
+ {
+ if (dev->dma_parms) {
+ dev->dma_parms->max_segment_size = size;
+--
+2.20.1
+
--- /dev/null
+From e2159eb787bb0108793e896aeb700ad626da6687 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 11:33:48 +0800
+Subject: dmaengine: coh901318: Fix a double-lock bug
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 627469e4445b9b12e0229b3bdf8564d5ce384dd7 ]
+
+The function coh901318_alloc_chan_resources() calls spin_lock_irqsave()
+before calling coh901318_config().
+But coh901318_config() calls spin_lock_irqsave() again in its
+definition, which may cause a double-lock bug.
+
+Because coh901318_config() is only called by
+coh901318_alloc_chan_resources(), the bug fix is to remove the
+calls to spin-lock and -unlock functions in coh901318_config().
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/coh901318.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
+index 74794c9859f60..a8886abf0c75c 100644
+--- a/drivers/dma/coh901318.c
++++ b/drivers/dma/coh901318.c
+@@ -1802,8 +1802,6 @@ static int coh901318_config(struct coh901318_chan *cohc,
+ int channel = cohc->id;
+ void __iomem *virtbase = cohc->base->virtbase;
+
+- spin_lock_irqsave(&cohc->lock, flags);
+-
+ if (param)
+ p = param;
+ else
+@@ -1823,8 +1821,6 @@ static int coh901318_config(struct coh901318_chan *cohc,
+ coh901318_set_conf(cohc, p->config);
+ coh901318_set_ctrl(cohc, p->ctrl_lli_last);
+
+- spin_unlock_irqrestore(&cohc->lock, flags);
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a56d68e5bb1045742d3b9f4cbe15595e3400eb9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Nov 2018 17:17:21 +0100
+Subject: dmaengine: dw-dmac: implement dma protection control setting
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+[ Upstream commit 7b0c03ecc42fb223baf015877fee9d517c2c8af1 ]
+
+This patch adds a new device-tree property that allows to
+specify the dma protection control bits for the all of the
+DMA controller's channel uniformly.
+
+Setting the "correct" bits can have a huge impact on the
+PPC460EX and APM82181 that use this DMA engine in combination
+with a DesignWare' SATA-II core (sata_dwc_460ex driver).
+
+In the OpenWrt Forum, the user takimata reported that:
+|It seems your patch unleashed the full power of the SATA port.
+|Where I was previously hitting a really hard limit at around
+|82 MB/s for reading and 27 MB/s for writing, I am now getting this:
+|
+|root@OpenWrt:/mnt# time dd if=/dev/zero of=tempfile bs=1M count=1024
+|1024+0 records in
+|1024+0 records out
+|real 0m 13.65s
+|user 0m 0.01s
+|sys 0m 11.89s
+|
+|root@OpenWrt:/mnt# time dd if=tempfile of=/dev/null bs=1M count=1024
+|1024+0 records in
+|1024+0 records out
+|real 0m 8.41s
+|user 0m 0.01s
+|sys 0m 4.70s
+|
+|This means: 121 MB/s reading and 75 MB/s writing!
+|
+|The drive is a WD Green WD10EARX taken from an older MBL Single.
+|I repeated the test a few times with even larger files to rule out
+|any caching, I'm still seeing the same great performance. OpenWrt is
+|now completely on par with the original MBL firmware's performance.
+
+Another user And.short reported:
+|I can report that your fix worked! Boots up fine with two
+|drives even with more partitions, and no more reboot on
+|concurrent disk access!
+
+A closer look into the sata_dwc_460ex code revealed that
+the driver did initally set the correct protection control
+bits. However, this feature was lost when the sata_dwc_460ex
+driver was converted to the generic DMA driver framework.
+
+BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/55
+BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/50
+Fixes: 8b3444852a2b ("sata_dwc_460ex: move to generic DMA driver")
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw/core.c | 2 ++
+ drivers/dma/dw/platform.c | 6 ++++++
+ drivers/dma/dw/regs.h | 4 ++++
+ include/linux/platform_data/dma-dw.h | 6 ++++++
+ 4 files changed, 18 insertions(+)
+
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 0f389e008ce64..055d83b6cb68a 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(struct dw_dma_chan *dwc)
+
+ static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc)
+ {
++ struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+ u32 cfghi = DWC_CFGH_FIFO_MODE;
+ u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority);
+ bool hs_polarity = dwc->dws.hs_polarity;
+
+ cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id);
+ cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id);
++ cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl);
+
+ /* Set polarity of handshake interface */
+ cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0;
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index bc31fe8020619..46a519e07195c 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *pdev)
+ pdata->multi_block[tmp] = 1;
+ }
+
++ if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) {
++ if (tmp > CHAN_PROTCTL_MASK)
++ return NULL;
++ pdata->protctl = tmp;
++ }
++
+ return pdata;
+ }
+ #else
+diff --git a/drivers/dma/dw/regs.h b/drivers/dma/dw/regs.h
+index 09e7dfdbb7907..646c9c960c071 100644
+--- a/drivers/dma/dw/regs.h
++++ b/drivers/dma/dw/regs.h
+@@ -200,6 +200,10 @@ enum dw_dma_msize {
+ #define DWC_CFGH_FCMODE (1 << 0)
+ #define DWC_CFGH_FIFO_MODE (1 << 1)
+ #define DWC_CFGH_PROTCTL(x) ((x) << 2)
++#define DWC_CFGH_PROTCTL_DATA (0 << 2) /* data access - always set */
++#define DWC_CFGH_PROTCTL_PRIV (1 << 2) /* privileged -> AHB HPROT[1] */
++#define DWC_CFGH_PROTCTL_BUFFER (2 << 2) /* bufferable -> AHB HPROT[2] */
++#define DWC_CFGH_PROTCTL_CACHE (4 << 2) /* cacheable -> AHB HPROT[3] */
+ #define DWC_CFGH_DS_UPD_EN (1 << 5)
+ #define DWC_CFGH_SS_UPD_EN (1 << 6)
+ #define DWC_CFGH_SRC_PER(x) ((x) << 7)
+diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h
+index 896cb71a382cb..1a1d58ebffbf1 100644
+--- a/include/linux/platform_data/dma-dw.h
++++ b/include/linux/platform_data/dma-dw.h
+@@ -49,6 +49,7 @@ struct dw_dma_slave {
+ * @data_width: Maximum data width supported by hardware per AHB master
+ * (in bytes, power of 2)
+ * @multi_block: Multi block transfers supported by hardware per channel.
++ * @protctl: Protection control signals setting per channel.
+ */
+ struct dw_dma_platform_data {
+ unsigned int nr_channels;
+@@ -65,6 +66,11 @@ struct dw_dma_platform_data {
+ unsigned char nr_masters;
+ unsigned char data_width[DW_DMA_MAX_NR_MASTERS];
+ unsigned char multi_block[DW_DMA_MAX_NR_CHANNELS];
++#define CHAN_PROTCTL_PRIVILEGED BIT(0)
++#define CHAN_PROTCTL_BUFFERABLE BIT(1)
++#define CHAN_PROTCTL_CACHEABLE BIT(2)
++#define CHAN_PROTCTL_MASK GENMASK(2, 0)
++ unsigned char protctl;
+ };
+
+ #endif /* _PLATFORM_DATA_DMA_DW_H */
+--
+2.20.1
+
--- /dev/null
+From e449a06088839de5982c39772720aa61910f5a7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Sep 2018 11:18:00 -0600
+Subject: dmaengine: xilinx_dma: Fix 64-bit simple CDMA transfer
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+
+[ Upstream commit 0e03aca2659ef7a85eaff1a1ca9b0b498002ede8 ]
+
+In AXI CDMA simple mode also pass MSB bits of source and destination
+address to xilinx_write function. This fixes simple CDMA operation
+mode using 64-bit addressing.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Reviewed-by: Appana Durga Kedareswara Rao <appana.durga.rao@xilinx.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 2db352308e5c0..c5d22c5d12a06 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -1182,8 +1182,10 @@ static void xilinx_cdma_start_transfer(struct xilinx_dma_chan *chan)
+
+ hw = &segment->hw;
+
+- xilinx_write(chan, XILINX_CDMA_REG_SRCADDR, hw->src_addr);
+- xilinx_write(chan, XILINX_CDMA_REG_DSTADDR, hw->dest_addr);
++ xilinx_write(chan, XILINX_CDMA_REG_SRCADDR,
++ xilinx_prep_dma_addr_t(hw->src_addr));
++ xilinx_write(chan, XILINX_CDMA_REG_DSTADDR,
++ xilinx_prep_dma_addr_t(hw->dest_addr));
+
+ /* Start the transfer */
+ dma_ctrl_write(chan, XILINX_DMA_REG_BTT,
+--
+2.20.1
+
--- /dev/null
+From f5281421d504f0e42b8fec476ab015753409c8ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 22:08:29 -0500
+Subject: exportfs_decode_fh(): negative pinned may become positive without the
+ parent locked
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a2ece088882666e1dc7113744ac912eb161e3f87 ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exportfs/expfs.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index c22cc9d2a5c9a..a561ae17cf435 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -508,26 +508,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
+ * inode is actually connected to the parent.
+ */
+ err = exportfs_get_name(mnt, target_dir, nbuf, result);
+- if (!err) {
+- inode_lock(target_dir->d_inode);
+- nresult = lookup_one_len(nbuf, target_dir,
+- strlen(nbuf));
+- inode_unlock(target_dir->d_inode);
+- if (!IS_ERR(nresult)) {
+- if (nresult->d_inode) {
+- dput(result);
+- result = nresult;
+- } else
+- dput(nresult);
+- }
++ if (err) {
++ dput(target_dir);
++ goto err_result;
+ }
+
++ inode_lock(target_dir->d_inode);
++ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf));
++ if (!IS_ERR(nresult)) {
++ if (unlikely(nresult->d_inode != result->d_inode)) {
++ dput(nresult);
++ nresult = ERR_PTR(-ESTALE);
++ }
++ }
++ inode_unlock(target_dir->d_inode);
+ /*
+ * At this point we are done with the parent, but it's pinned
+ * by the child dentry anyway.
+ */
+ dput(target_dir);
+
++ if (IS_ERR(nresult)) {
++ err = PTR_ERR(nresult);
++ goto err_result;
++ }
++ dput(result);
++ result = nresult;
++
+ /*
+ * And finally make sure the dentry is actually acceptable
+ * to NFSD.
+--
+2.20.1
+
--- /dev/null
+From 3702df8ed3b8ecb9fba77e962837668ed58d666f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 16:38:47 +0100
+Subject: extcon: max8997: Fix lack of path setting in USB device mode
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit a2dc50914744eea9f83a70a5db0486be625e5dc0 ]
+
+MAX8997 driver disables automatic path selection from MicroUSB connector
+and manually sets path to either UART or USB lines. However the code for
+setting USB path worked only for USB host mode (when ID pin is set
+to ground). When standard USB cable (USB device mode) is connected, path
+registers are not touched. This means that once the non-USB accessory is
+connected to MAX8997-operated micro USB port, the path is no longer set
+to USB and USB device mode doesn't work. This patch fixes it by setting
+USB path both for USB and USB host modes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-max8997.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
+index 4a0612fb9c070..b9b48d45a6dc4 100644
+--- a/drivers/extcon/extcon-max8997.c
++++ b/drivers/extcon/extcon-max8997.c
+@@ -321,12 +321,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info,
+ {
+ int ret = 0;
+
+- if (usb_type == MAX8997_USB_HOST) {
+- ret = max8997_muic_set_path(info, info->path_usb, attached);
+- if (ret < 0) {
+- dev_err(info->dev, "failed to update muic register\n");
+- return ret;
+- }
++ ret = max8997_muic_set_path(info, info->path_usb, attached);
++ if (ret < 0) {
++ dev_err(info->dev, "failed to update muic register\n");
++ return ret;
+ }
+
+ switch (usb_type) {
+--
+2.20.1
+
--- /dev/null
+From abffa547833db2ad433ffb0f1d69cdaa0f6cf742 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 20:37:55 +0800
+Subject: f2fs: change segment to section in f2fs_ioc_gc_range
+
+From: Yunlong Song <yunlong.song@huawei.com>
+
+[ Upstream commit 67b0e42b768c9ddc3fd5ca1aee3db815cfaa635c ]
+
+f2fs_ioc_gc_range skips blocks_per_seg each time, however, f2fs_gc moves
+blocks of section each time, so fix it from segment to section.
+
+Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index d68b0132718a6..a90173b856f6d 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2029,7 +2029,7 @@ do_more:
+ }
+
+ ret = f2fs_gc(sbi, range.sync, true, GET_SEGNO(sbi, range.start));
+- range.start += sbi->blocks_per_seg;
++ range.start += BLKS_PER_SEC(sbi);
+ if (range.start <= end)
+ goto do_more;
+ out:
+--
+2.20.1
+
--- /dev/null
+From 0100d9caa05ec38ac0c2d771abab6c785a3cd9c7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Oct 2018 16:08:30 +0800
+Subject: f2fs: fix count of seg_freed to make sec_freed correct
+
+From: Yunlong Song <yunlong.song@huawei.com>
+
+[ Upstream commit d6c66cd19ef322fe0d51ba09ce1b7f386acab04a ]
+
+When sbi->segs_per_sec > 1, and if some segno has 0 valid blocks before
+gc starts, do_garbage_collect will skip counting seg_freed++, and this
+will cause seg_freed < sbi->segs_per_sec and finally skip sec_freed++.
+
+Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 67120181dc2af..9865f6d52fe48 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -952,9 +952,9 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+ GET_SUM_BLOCK(sbi, segno));
+ f2fs_put_page(sum_page, 0);
+
+- if (get_valid_blocks(sbi, segno, false) == 0 ||
+- !PageUptodate(sum_page) ||
+- unlikely(f2fs_cp_error(sbi)))
++ if (get_valid_blocks(sbi, segno, false) == 0)
++ goto freed;
++ if (!PageUptodate(sum_page) || unlikely(f2fs_cp_error(sbi)))
+ goto next;
+
+ sum = page_address(sum_page);
+@@ -981,6 +981,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+
+ stat_inc_seg_count(sbi, type, gc_type);
+
++freed:
+ if (gc_type == FG_GC &&
+ get_valid_blocks(sbi, segno, false) == 0)
+ seg_freed++;
+--
+2.20.1
+
--- /dev/null
+From 25a8d46a5793d7f1f886e105a8d118932c5a03f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 13:31:41 +0530
+Subject: f2fs: fix to allow node segment for GC by ioctl path
+
+From: Sahitya Tummala <stummala@codeaurora.org>
+
+[ Upstream commit 08ac9a3870f6babb2b1fff46118536ca8a71ef19 ]
+
+Allow node type segments also to be GC'd via f2fs ioctl
+F2FS_IOC_GARBAGE_COLLECT_RANGE.
+
+Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 9865f6d52fe48..c2e4c6ce2cf79 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -330,8 +330,7 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi,
+ p.min_cost = get_max_cost(sbi, &p);
+
+ if (*result != NULL_SEGNO) {
+- if (IS_DATASEG(get_seg_entry(sbi, *result)->type) &&
+- get_valid_blocks(sbi, *result, false) &&
++ if (get_valid_blocks(sbi, *result, false) &&
+ !sec_usage_check(sbi, GET_SEC_FROM_SEG(sbi, *result)))
+ p.min_segno = *result;
+ goto out;
+--
+2.20.1
+
--- /dev/null
+From 49040b1da03ab1907b12c241c41c397150df8aca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 21:32:25 -0500
+Subject: firmware: qcom: scm: fix compilation error when disabled
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 16ad9501b1f2edebe24f8cf3c09da0695871986b ]
+
+This fixes the case when CONFIG_QCOM_SCM is not enabled, and linux/errno.h
+has not been included previously.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/qcom_scm.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/linux/qcom_scm.h b/include/linux/qcom_scm.h
+index e5380471c2cd2..428278a44c7db 100644
+--- a/include/linux/qcom_scm.h
++++ b/include/linux/qcom_scm.h
+@@ -44,6 +44,9 @@ extern int qcom_scm_restore_sec_cfg(u32 device_id, u32 spare);
+ extern int qcom_scm_iommu_secure_ptbl_size(u32 spare, size_t *size);
+ extern int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare);
+ #else
++
++#include <linux/errno.h>
++
+ static inline
+ int qcom_scm_set_cold_boot_addr(void *entry, const cpumask_t *cpus)
+ {
+--
+2.20.1
+
--- /dev/null
+From e9a7aca3aa68e11cfdd522a9d343c0b8be2a26a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 16:36:48 +0800
+Subject: i2c: core: fix use after free in of_i2c_notify
+
+From: Wen Yang <wenyang@linux.alibaba.com>
+
+[ Upstream commit a4c2fec16f5e6a5fee4865e6e0e91e2bc2d10f37 ]
+
+We can't use "adap->dev" after it has been freed.
+
+Fixes: 5bf4fa7daea6 ("i2c: break out OF support into separate file")
+Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-of.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c
+index 8d474bb1dc157..17d727e0b8424 100644
+--- a/drivers/i2c/i2c-core-of.c
++++ b/drivers/i2c/i2c-core-of.c
+@@ -238,14 +238,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
+ }
+
+ client = of_i2c_register_device(adap, rd->dn);
+- put_device(&adap->dev);
+-
+ if (IS_ERR(client)) {
+ dev_err(&adap->dev, "failed to create client for '%pOF'\n",
+ rd->dn);
++ put_device(&adap->dev);
+ of_node_clear_flag(rd->dn, OF_POPULATED);
+ return notifier_from_errno(PTR_ERR(client));
+ }
++ put_device(&adap->dev);
+ break;
+ case OF_RECONFIG_CHANGE_REMOVE:
+ /* already depopulated? */
+--
+2.20.1
+
--- /dev/null
+From 64cafbc646115e5e53fe57fa5dc08b27bfc25cb7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:29:13 +0100
+Subject: i2c: imx: don't print error message on probe defer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit fece4978510e43f09c8cd386fee15210e8c68493 ]
+
+Probe deferral is a normal operating condition in the probe function,
+so don't spam the log with an error in this case.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-imx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index b73dd837fb533..26f83029f64ae 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1088,7 +1088,8 @@ static int i2c_imx_probe(struct platform_device *pdev)
+ /* Get I2C clock */
+ i2c_imx->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(i2c_imx->clk)) {
+- dev_err(&pdev->dev, "can't get I2C clock\n");
++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "can't get I2C clock\n");
+ return PTR_ERR(i2c_imx->clk);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 49fe468d20db423142703dd3c92abfdf1787f26a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 14:33:28 -0700
+Subject: i40e: don't restart nway if autoneg not supported
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 7c3758f7839377ab67529cc50264a640636c47af ]
+
+On link types that do not support autoneg, we cannot attempt to restart
+nway negotiation. This results in a dead link that requires a power
+cycle to remedy.
+
+Fix this by saving off the autoneg state and checking this value before
+we try to restart nway.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index ef22793d6a032..751ac56168843 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -969,6 +969,7 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ i40e_status status;
+ u8 aq_failures;
+ int err = 0;
++ u32 is_an;
+
+ /* Changing the port's flow control is not supported if this isn't the
+ * port's controlling PF
+@@ -981,15 +982,14 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ if (vsi != pf->vsi[pf->lan_vsi])
+ return -EOPNOTSUPP;
+
+- if (pause->autoneg != ((hw_link_info->an_info & I40E_AQ_AN_COMPLETED) ?
+- AUTONEG_ENABLE : AUTONEG_DISABLE)) {
++ is_an = hw_link_info->an_info & I40E_AQ_AN_COMPLETED;
++ if (pause->autoneg != is_an) {
+ netdev_info(netdev, "To change autoneg please use: ethtool -s <dev> autoneg <on|off>\n");
+ return -EOPNOTSUPP;
+ }
+
+ /* If we have link and don't have autoneg */
+- if (!test_bit(__I40E_DOWN, pf->state) &&
+- !(hw_link_info->an_info & I40E_AQ_AN_COMPLETED)) {
++ if (!test_bit(__I40E_DOWN, pf->state) && !is_an) {
+ /* Send message that it might not necessarily work*/
+ netdev_info(netdev, "Autoneg did not complete so changing settings may not result in an actual change.\n");
+ }
+@@ -1040,7 +1040,7 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ err = -EAGAIN;
+ }
+
+- if (!test_bit(__I40E_DOWN, pf->state)) {
++ if (!test_bit(__I40E_DOWN, pf->state) && is_an) {
+ /* Give it a little more time to try to come back */
+ msleep(75);
+ if (!test_bit(__I40E_DOWN, pf->state))
+--
+2.20.1
+
--- /dev/null
+From 8736b44e775ec831f0bc80085d2884dd92e84f0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:32:48 -0800
+Subject: IB/hfi1: Close VNIC sdma_progress sleep window
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 18912c4524385dd6532c682cb9d4f6aa39ba8d47 ]
+
+The call to sdma_progress() is called outside the wait lock.
+
+In this case, there is a race condition where sdma_progress() can return
+false and the sdma_engine can idle. If that happens, there will be no
+more sdma interrupts to cause the wakeup and the vnic_sdma xmit will hang.
+
+Fix by moving the lock to enclose the sdma_progress() call.
+
+Also, delete the tx_retry. The need for this was removed by:
+commit bcad29137a97 ("IB/hfi1: Serve the most starved iowait entry first")
+
+Fixes: 64551ede6cd1 ("IB/hfi1: VNIC SDMA support")
+Reviewed-by: Gary Leshner <Gary.S.Leshner@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/vnic_sdma.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+index c3c96c5869ed4..718dcdef946ee 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c
++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+@@ -57,7 +57,6 @@
+
+ #define HFI1_VNIC_TXREQ_NAME_LEN 32
+ #define HFI1_VNIC_SDMA_DESC_WTRMRK 64
+-#define HFI1_VNIC_SDMA_RETRY_COUNT 1
+
+ /*
+ * struct vnic_txreq - VNIC transmit descriptor
+@@ -67,7 +66,6 @@
+ * @pad: pad buffer
+ * @plen: pad length
+ * @pbc_val: pbc value
+- * @retry_count: tx retry count
+ */
+ struct vnic_txreq {
+ struct sdma_txreq txreq;
+@@ -77,8 +75,6 @@ struct vnic_txreq {
+ unsigned char pad[HFI1_VNIC_MAX_PAD];
+ u16 plen;
+ __le64 pbc_val;
+-
+- u32 retry_count;
+ };
+
+ static void vnic_sdma_complete(struct sdma_txreq *txreq,
+@@ -196,7 +192,6 @@ int hfi1_vnic_send_dma(struct hfi1_devdata *dd, u8 q_idx,
+ ret = build_vnic_tx_desc(sde, tx, pbc);
+ if (unlikely(ret))
+ goto free_desc;
+- tx->retry_count = 0;
+
+ ret = sdma_send_txreq(sde, &vnic_sdma->wait, &tx->txreq,
+ vnic_sdma->pkts_sent);
+@@ -238,14 +233,14 @@ static int hfi1_vnic_sdma_sleep(struct sdma_engine *sde,
+ struct hfi1_vnic_sdma *vnic_sdma =
+ container_of(wait, struct hfi1_vnic_sdma, wait);
+ struct hfi1_ibdev *dev = &vnic_sdma->dd->verbs_dev;
+- struct vnic_txreq *tx = container_of(txreq, struct vnic_txreq, txreq);
+
+- if (sdma_progress(sde, seq, txreq))
+- if (tx->retry_count++ < HFI1_VNIC_SDMA_RETRY_COUNT)
+- return -EAGAIN;
++ write_seqlock(&dev->iowait_lock);
++ if (sdma_progress(sde, seq, txreq)) {
++ write_sequnlock(&dev->iowait_lock);
++ return -EAGAIN;
++ }
+
+ vnic_sdma->state = HFI1_VNIC_SDMA_Q_DEFERRED;
+- write_seqlock(&dev->iowait_lock);
+ if (list_empty(&vnic_sdma->wait.list))
+ iowait_queue(pkts_sent, wait, &sde->dmawait);
+ write_sequnlock(&dev->iowait_lock);
+--
+2.20.1
+
--- /dev/null
+From 1875cbfe03a392d3b9ab0a030ddfefea0acff94d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:19:04 -0800
+Subject: IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state
+
+From: Kaike Wan <kaike.wan@intel.com>
+
+[ Upstream commit c1a797c0818e0122c7ec8422edd971cfec9b15ea ]
+
+When it is requested to change its physical state back to Offline while in
+the process to go up, DC8051 will set the ERROR field in the
+DC8051_DBG_ERR_INFO_SET_BY_8051 register. This ERROR field will remain
+until the next time when DC8051 transitions from Offline to Polling.
+Subsequently, when the host requests DC8051 to change its physical state
+to Polling again, it may receive a DC8051 interrupt with the stale ERROR
+field still in DC8051_DBG_ERR_INFO_SET_BY_8051. If the host link state has
+been changed to Polling, this stale ERROR will force the host to
+transition to Offline state, resulting in a vicious cycle of Polling
+->Offline->Polling->Offline. On the other hand, if the host link state is
+still Offline when the stale ERROR is received, the stale ERROR will be
+ignored, and the link will come up correctly. This patch implements the
+correct behavior by changing host link state to Polling only after DC8051
+changes its physical state to Polling.
+
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Krzysztof Goreczny <krzysztof.goreczny@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 47 ++++++++++++++++++++++++++++++-
+ 1 file changed, 46 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 9dcdc0a8685e7..9f78bb07744c7 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -1074,6 +1074,8 @@ static void log_state_transition(struct hfi1_pportdata *ppd, u32 state);
+ static void log_physical_state(struct hfi1_pportdata *ppd, u32 state);
+ static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state,
+ int msecs);
++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd,
++ int msecs);
+ static void read_planned_down_reason_code(struct hfi1_devdata *dd, u8 *pdrrc);
+ static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr);
+ static void handle_temp_err(struct hfi1_devdata *dd);
+@@ -10731,13 +10733,15 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+ break;
+
+ ppd->port_error_action = 0;
+- ppd->host_link_state = HLS_DN_POLL;
+
+ if (quick_linkup) {
+ /* quick linkup does not go into polling */
+ ret = do_quick_linkup(dd);
+ } else {
+ ret1 = set_physical_link_state(dd, PLS_POLLING);
++ if (!ret1)
++ ret1 = wait_phys_link_out_of_offline(ppd,
++ 3000);
+ if (ret1 != HCMD_SUCCESS) {
+ dd_dev_err(dd,
+ "Failed to transition to Polling link state, return 0x%x\n",
+@@ -10745,6 +10749,14 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+ ret = -EINVAL;
+ }
+ }
++
++ /*
++ * Change the host link state after requesting DC8051 to
++ * change its physical state so that we can ignore any
++ * interrupt with stale LNI(XX) error, which will not be
++ * cleared until DC8051 transitions to Polling state.
++ */
++ ppd->host_link_state = HLS_DN_POLL;
+ ppd->offline_disabled_reason =
+ HFI1_ODR_MASK(OPA_LINKDOWN_REASON_NONE);
+ /*
+@@ -12870,6 +12882,39 @@ static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+ return read_state;
+ }
+
++/*
++ * wait_phys_link_out_of_offline - wait for any out of offline state
++ * @ppd: port device
++ * @msecs: the number of milliseconds to wait
++ *
++ * Wait up to msecs milliseconds for any out of offline physical link
++ * state change to occur.
++ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT.
++ */
++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd,
++ int msecs)
++{
++ u32 read_state;
++ unsigned long timeout;
++
++ timeout = jiffies + msecs_to_jiffies(msecs);
++ while (1) {
++ read_state = read_physical_state(ppd->dd);
++ if ((read_state & 0xF0) != PLS_OFFLINE)
++ break;
++ if (time_after(jiffies, timeout)) {
++ dd_dev_err(ppd->dd,
++ "timeout waiting for phy link out of offline. Read state 0x%x, %dms\n",
++ read_state, msecs);
++ return -ETIMEDOUT;
++ }
++ usleep_range(1950, 2050); /* sleep 2ms-ish */
++ }
++
++ log_state_transition(ppd, read_state);
++ return read_state;
++}
++
+ #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
+ (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
+
+--
+2.20.1
+
--- /dev/null
+From 2365d43740c54918c801d3aefed980782bd295ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 17:04:54 -0800
+Subject: Input: cyttsp4_core - fix use after free bug
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 79aae6acbef16f720a7949f8fc6ac69816c79d62 ]
+
+The device md->input is used after it is released. Setting the device
+data to NULL is unnecessary as the device is never used again. Instead,
+md->input should be assigned NULL to avoid accessing the freed memory
+accidently. Besides, checking md->si against NULL is superfluous as it
+points to a variable address, which cannot be NULL.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/1572936379-6423-1-git-send-email-bianpan2016@163.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/cyttsp4_core.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
+index beaf61ce775b7..a9af83de88bb2 100644
+--- a/drivers/input/touchscreen/cyttsp4_core.c
++++ b/drivers/input/touchscreen/cyttsp4_core.c
+@@ -1972,11 +1972,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ /* get sysinfo */
+ md->si = &cd->sysinfo;
+- if (!md->si) {
+- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n",
+- __func__, md->si);
+- goto error_get_sysinfo;
+- }
+
+ rc = cyttsp4_setup_input_device(cd);
+ if (rc)
+@@ -1986,8 +1981,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ error_init_input:
+ input_free_device(md->input);
+-error_get_sysinfo:
+- input_set_drvdata(md->input, NULL);
+ error_alloc_failed:
+ dev_err(dev, "%s failed.\n", __func__);
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 3240d7f95ad4bcd1bfee7b57e1a4af8835762f12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 13:31:10 -0800
+Subject: iomap: sub-block dio needs to zeroout beyond EOF
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit b450672fb66b4a991a5b55ee24209ac7ae7690ce ]
+
+If we are doing sub-block dio that extends EOF, we need to zero
+the unused tail of the block to initialise the data in it it. If we
+do not zero the tail of the block, then an immediate mmap read of
+the EOF block will expose stale data beyond EOF to userspace. Found
+with fsx running sub-block DIO sizes vs MAPREAD/MAPWRITE operations.
+
+Fix this by detecting if the end of the DIO write is beyond EOF
+and zeroing the tail if necessary.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/iomap.c b/fs/iomap.c
+index 467d98bf70542..1cf160ced0d46 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -941,7 +941,14 @@ iomap_dio_actor(struct inode *inode, loff_t pos, loff_t length,
+ dio->submit.cookie = submit_bio(bio);
+ } while (nr_pages);
+
+- if (need_zeroout) {
++ /*
++ * We need to zeroout the tail of a sub-block write if the extent type
++ * requires zeroing or the write extends beyond EOF. If we don't zero
++ * the block tail in the latter case, we can expose stale data via mmap
++ * reads of the EOF block.
++ */
++ if (need_zeroout ||
++ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
+ /* zero out from the end of the write to the end of the block */
+ pad = pos & (fs_block_size - 1);
+ if (pad)
+--
+2.20.1
+
--- /dev/null
+From f88ffd053ad629db259b45bdef0d3c61f2acd162 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Nov 2018 05:27:39 -0800
+Subject: iw_cxgb4: only reconnect with MPAv1 if the peer aborts
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit 9828ca654b52848e7eb7dcc9b0994ff130dd4546 ]
+
+Only retry connection setup with MPAv1 if the peer actually aborted the
+connection upon receiving the MPAv2 start message. This avoids retrying
+with MPAv1 in the case where the connection was aborted due to retransmit
+timeouts.
+
+Fixes: d2fe99e86bb2 ("RDMA/cxgb4: Add support for MPAv2 Enhanced RDMA Negotiation")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index bb36cdf82a8d6..cdde7048891c0 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2774,7 +2774,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
+ break;
+ case MPA_REQ_SENT:
+ (void)stop_ep_timer(ep);
+- if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1))
++ if (status != CPL_ERR_CONN_RESET || mpa_rev == 1 ||
++ (mpa_rev == 2 && ep->tried_with_mpa_v1))
+ connect_reply_upcall(ep, -ECONNRESET);
+ else {
+ /*
+--
+2.20.1
+
--- /dev/null
+From 827de7b81d5ba034236d6f9e8158c7a4b5d3ea1f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jul 2018 21:57:50 +0300
+Subject: iwlwifi: mvm: Send non offchannel traffic via AP sta
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit dc1aca22f8f38b7e2ad7b118db87404d11e68771 ]
+
+TDLS discovery response frame is a unicast direct frame to the peer.
+Since we don't have a STA for this peer, this frame goes through
+iwl_tx_skb_non_sta(). As the result aux_sta and some completely
+arbitrary queue would be selected for this frame, resulting in a queue
+hang. Fix that by sending such frames through AP sta instead.
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 77ed6ecf5ee54..b86c7a36d3f17 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -822,6 +822,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
+ !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
+ sta = NULL;
+
++ /* If there is no sta, and it's not offchannel - send through AP */
++ if (info->control.vif->type == NL80211_IFTYPE_STATION &&
++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) {
++ struct iwl_mvm_vif *mvmvif =
++ iwl_mvm_vif_from_mac80211(info->control.vif);
++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
++
++ if (ap_sta_id < IWL_MVM_STATION_COUNT) {
++ /* mac80211 holds rcu read lock */
++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
++ if (IS_ERR_OR_NULL(sta))
++ goto drop;
++ }
++ }
++
+ if (sta) {
+ if (iwl_mvm_defer_tx(mvm, sta, skb))
+ return;
+--
+2.20.1
+
--- /dev/null
+From db0a75c4d9143a08d935d8c8f659b5965a4419f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 23:12:33 +0200
+Subject: iwlwifi: mvm: synchronize TID queue removal
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 06bc6f6ed4ae0246a5e52094d1be90906a1361c7 ]
+
+When we mark a TID as no longer having a queue, there's no
+guarantee the TX path isn't using this txq_id right now,
+having accessed it just before we reset the value. To fix
+this, add synchronize_net() when we change the TIDs from
+having a queue to not having one, so that we can then be
+sure that the TX path is no longer accessing that queue.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index d16e2ed4419fe..0cfdbaa2af3a7 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -436,6 +436,16 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue)
+
+ rcu_read_unlock();
+
++ /*
++ * The TX path may have been using this TXQ_ID from the tid_data,
++ * so make sure it's no longer running so that we can safely reuse
++ * this TXQ later. We've set all the TIDs to IWL_MVM_INVALID_QUEUE
++ * above, but nothing guarantees we've stopped using them. Thus,
++ * without this, we could get to iwl_mvm_disable_txq() and remove
++ * the queue while still sending frames to it.
++ */
++ synchronize_net();
++
+ return disable_agg_tids;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 474be47eec6efbfbc715d133fdb676c8abcdf314 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 13:51:47 +0200
+Subject: iwlwifi: pcie: don't consider IV len in A-MSDU
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+[ Upstream commit cb1a4badf59275eb7221dcec621e8154917eabd1 ]
+
+From gen2 PN is totally offloaded to hardware (also the space for the
+IV isn't part of the skb). As you can see in mvm/mac80211.c:3545, the
+MAC for cipher types CCMP/GCMP doesn't set
+IEEE80211_KEY_FLAG_PUT_IV_SPACE for gen2 NICs.
+
+This causes all the AMSDU data to be corrupted with cipher enabled.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 20 +++++++------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 6f45c8148b279..bbb39d6ec2ee3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -232,27 +232,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ struct ieee80211_hdr *hdr = (void *)skb->data;
+ unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room;
+ unsigned int mss = skb_shinfo(skb)->gso_size;
+- u16 length, iv_len, amsdu_pad;
++ u16 length, amsdu_pad;
+ u8 *start_hdr;
+ struct iwl_tso_hdr_page *hdr_page;
+ struct page **page_ptr;
+ struct tso_t tso;
+
+- /* if the packet is protected, then it must be CCMP or GCMP */
+- iv_len = ieee80211_has_protected(hdr->frame_control) ?
+- IEEE80211_CCMP_HDR_LEN : 0;
+-
+ trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd),
+ &dev_cmd->hdr, start_len, 0);
+
+ ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb);
+ snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb);
+- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len;
++ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len;
+ amsdu_pad = 0;
+
+ /* total amount of header we may need for this A-MSDU */
+ hdr_room = DIV_ROUND_UP(total_len, mss) *
+- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;
++ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr));
+
+ /* Our device supports 9 segments at most, it will fit in 1 page */
+ hdr_page = get_page_hdr(trans, hdr_room);
+@@ -263,14 +259,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ start_hdr = hdr_page->pos;
+ page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs);
+ *page_ptr = hdr_page->page;
+- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len);
+- hdr_page->pos += iv_len;
+
+ /*
+- * Pull the ieee80211 header + IV to be able to use TSO core,
++ * Pull the ieee80211 header to be able to use TSO core,
+ * we will restore it for the tx_status flow.
+ */
+- skb_pull(skb, hdr_len + iv_len);
++ skb_pull(skb, hdr_len);
+
+ /*
+ * Remove the length of all the headers that we don't actually
+@@ -348,8 +342,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ }
+ }
+
+- /* re -add the WiFi header and IV */
+- skb_push(skb, hdr_len + iv_len);
++ /* re -add the WiFi header */
++ skb_push(skb, hdr_len);
+
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From e22ea6fcb1c3655de6f71156ef204754cba2cd16 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 08:11:54 +0900
+Subject: kbuild: fix single target build for external module
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit e07db28eea38ed4e332b3a89f3995c86b713cb5b ]
+
+Building a single target in an external module fails due to missing
+.tmp_versions directory.
+
+For example,
+
+ $ make -C /lib/modules/$(uname -r)/build M=$PWD foo.o
+
+will fail in the following way:
+
+ CC [M] /home/masahiro/foo/foo.o
+/bin/sh: 1: cannot create /home/masahiro/foo/.tmp_versions/foo.mod: Directory nonexistent
+
+This is because $(cmd_crmodverdir) is executed only before building
+/, %/, %.ko single targets of external modules. Create .tmp_versions
+in the 'prepare' target.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index d97288c0754fe..4de172b2e1fba 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1529,9 +1529,6 @@ else # KBUILD_EXTMOD
+
+ # We are always building modules
+ KBUILD_MODULES := 1
+-PHONY += crmodverdir
+-crmodverdir:
+- $(cmd_crmodverdir)
+
+ PHONY += $(objtree)/Module.symvers
+ $(objtree)/Module.symvers:
+@@ -1543,7 +1540,7 @@ $(objtree)/Module.symvers:
+
+ module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD))
+ PHONY += $(module-dirs) modules
+-$(module-dirs): crmodverdir $(objtree)/Module.symvers
++$(module-dirs): prepare $(objtree)/Module.symvers
+ $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
+
+ modules: $(module-dirs)
+@@ -1584,7 +1581,8 @@ help:
+
+ # Dummies...
+ PHONY += prepare scripts
+-prepare: ;
++prepare:
++ $(cmd_crmodverdir)
+ scripts: ;
+ endif # KBUILD_EXTMOD
+
+@@ -1709,17 +1707,14 @@ endif
+
+ # Modules
+ /: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ # Make sure the latest headers are built for Documentation
+ Documentation/ samples/: headers_install
+ %/: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ %.ko: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir) $(@:.ko=.o)
+ $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
+--
+2.20.1
+
--- /dev/null
+From 1f61fecd76553711c0637aa683aa433e4ef04f76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 11:36:52 -0500
+Subject: lockd: fix decoding of TEST results
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit b8db159239b3f51e2b909859935cc25cb3ff3eed ]
+
+We fail to advance the read pointer when reading the stat.oh field that
+identifies the lock-holder in a TEST result.
+
+This turns out not to matter if the server is knfsd, which always
+returns a zero-length field. But other servers (Ganesha is an example)
+may not do this. The result is bad values in fcntl F_GETLK results.
+
+Fix this.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/clnt4xdr.c | 22 ++++++----------------
+ fs/lockd/clntxdr.c | 22 ++++++----------------
+ 2 files changed, 12 insertions(+), 32 deletions(-)
+
+diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
+index 00d5ef5f99f73..214a2fa1f1e39 100644
+--- a/fs/lockd/clnt4xdr.c
++++ b/fs/lockd/clnt4xdr.c
+@@ -128,24 +128,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
+index 2c6176387143c..747b9c8c940ac 100644
+--- a/fs/lockd/clntxdr.c
++++ b/fs/lockd/clntxdr.c
+@@ -125,24 +125,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 9402e57a880f38eefc6871896cd932b15e516f3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 11:14:38 +0800
+Subject: math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
+
+From: Vincent Chen <vincentc@andestech.com>
+
+[ Upstream commit 83312f1b7ae205dca647bf52bbe2d51303cdedfb ]
+
+_FP_ROUND_ZERO is defined as 0 and used as a statemente in macro
+_FP_ROUND. This generates "error: statement with no effect
+[-Werror=unused-value]" from gcc. Defining _FP_ROUND_ZERO as (void)0 to
+fix it.
+
+This modification is quoted from glibc 'commit <In libc/:>
+(8ed1e7d5894000c155acbd06f)'
+
+Signed-off-by: Vincent Chen <vincentc@andestech.com>
+Acked-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/math-emu/soft-fp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
+index 3f284bc031809..5650c16283830 100644
+--- a/include/math-emu/soft-fp.h
++++ b/include/math-emu/soft-fp.h
+@@ -138,7 +138,7 @@ do { \
+ _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \
+ } while (0)
+
+-#define _FP_ROUND_ZERO(wc, X) 0
++#define _FP_ROUND_ZERO(wc, X) (void)0
+
+ #define _FP_ROUND_PINF(wc, X) \
+ do { \
+--
+2.20.1
+
--- /dev/null
+From 98ba21f573fc4842264eefebb8d31913da9d43c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 03:44:20 -0400
+Subject: media: cec: report Vendor ID after initialization
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 7f02ac77c768ba2bcdd0ce719c1fca0870ffe2fb ]
+
+The CEC specification requires that the Vendor ID (if any) is reported
+after a logical address was claimed.
+
+This was never done, so add support for this.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/cec-adap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index f8a808d45034e..27e57915eb4d1 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1403,6 +1403,13 @@ configured:
+ las->log_addr[i],
+ cec_phys_addr_exp(adap->phys_addr));
+ cec_transmit_msg_fh(adap, &msg, NULL, false);
++
++ /* Report Vendor ID */
++ if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) {
++ cec_msg_device_vendor_id(&msg,
++ adap->log_addrs.vendor_id);
++ cec_transmit_msg_fh(adap, &msg, NULL, false);
++ }
+ }
+ adap->kthread_config = NULL;
+ complete(&adap->config_completion);
+--
+2.20.1
+
--- /dev/null
+From 0139af208d3499abd38af388a359691015e605a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 05:40:54 -0500
+Subject: media: coda: fix memory corruption in case more than 32 instances are
+ opened
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f ]
+
+The ffz() return value is undefined if the instance mask does not
+contain any zeros. If it returned 32, the following set_bit would
+corrupt the debugfs_root pointer.
+Switch to IDA for context index allocation. This also removes the
+artificial 32 instance limit for all except CodaDx6.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/coda/coda-common.c | 26 +++++++++--------------
+ drivers/media/platform/coda/coda.h | 3 ++-
+ 2 files changed, 12 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 5b87c488ee111..ab5d00a4eb342 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -17,6 +17,7 @@
+ #include <linux/firmware.h>
+ #include <linux/gcd.h>
+ #include <linux/genalloc.h>
++#include <linux/idr.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/irq.h>
+@@ -1931,17 +1932,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq,
+ return coda_queue_init(priv, dst_vq);
+ }
+
+-static int coda_next_free_instance(struct coda_dev *dev)
+-{
+- int idx = ffz(dev->instance_mask);
+-
+- if ((idx < 0) ||
+- (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES))
+- return -EBUSY;
+-
+- return idx;
+-}
+-
+ /*
+ * File operations
+ */
+@@ -1950,7 +1940,8 @@ static int coda_open(struct file *file)
+ {
+ struct video_device *vdev = video_devdata(file);
+ struct coda_dev *dev = video_get_drvdata(vdev);
+- struct coda_ctx *ctx = NULL;
++ struct coda_ctx *ctx;
++ unsigned int max = ~0;
+ char *name;
+ int ret;
+ int idx;
+@@ -1959,12 +1950,13 @@ static int coda_open(struct file *file)
+ if (!ctx)
+ return -ENOMEM;
+
+- idx = coda_next_free_instance(dev);
++ if (dev->devtype->product == CODA_DX6)
++ max = CODADX6_MAX_INSTANCES - 1;
++ idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL);
+ if (idx < 0) {
+ ret = idx;
+ goto err_coda_max;
+ }
+- set_bit(idx, &dev->instance_mask);
+
+ name = kasprintf(GFP_KERNEL, "context%d", idx);
+ if (!name) {
+@@ -2072,8 +2064,8 @@ err_clk_per:
+ err_pm_get:
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
+ err_coda_name_init:
++ ida_free(&dev->ida, ctx->idx);
+ err_coda_max:
+ kfree(ctx);
+ return ret;
+@@ -2115,7 +2107,7 @@ static int coda_release(struct file *file)
+ pm_runtime_put_sync(&dev->plat_dev->dev);
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
++ ida_free(&dev->ida, ctx->idx);
+ if (ctx->ops->release)
+ ctx->ops->release(ctx);
+ debugfs_remove_recursive(ctx->debugfs_entry);
+@@ -2558,6 +2550,7 @@ static int coda_probe(struct platform_device *pdev)
+
+ mutex_init(&dev->dev_mutex);
+ mutex_init(&dev->coda_mutex);
++ ida_init(&dev->ida);
+
+ dev->debugfs_root = debugfs_create_dir("coda", NULL);
+ if (!dev->debugfs_root)
+@@ -2645,6 +2638,7 @@ static int coda_remove(struct platform_device *pdev)
+ coda_free_aux_buf(dev, &dev->tempbuf);
+ coda_free_aux_buf(dev, &dev->workbuf);
+ debugfs_remove_recursive(dev->debugfs_root);
++ ida_destroy(&dev->ida);
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
+index 389a882cc3dab..2b187f83e5447 100644
+--- a/drivers/media/platform/coda/coda.h
++++ b/drivers/media/platform/coda/coda.h
+@@ -16,6 +16,7 @@
+ #define __CODA_H__
+
+ #include <linux/debugfs.h>
++#include <linux/idr.h>
+ #include <linux/irqreturn.h>
+ #include <linux/mutex.h>
+ #include <linux/kfifo.h>
+@@ -94,7 +95,7 @@ struct coda_dev {
+ struct workqueue_struct *workqueue;
+ struct v4l2_m2m_dev *m2m_dev;
+ struct list_head instances;
+- unsigned long instance_mask;
++ struct ida ida;
+ struct dentry *debugfs_root;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 7125603265e340687316a7f3869a71a67ecd5e45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 08:25:53 -0500
+Subject: media: pulse8-cec: return 0 when invalidating the logical address
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit 2e84eb9affac43eeaf834992888b72426a8cd442 ]
+
+Return 0 when invalidating the logical address. The cec core produces
+a warning for drivers that do this.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Torbjorn Jansson <torbjorn.jansson@mbox200.swipnet.se>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pulse8-cec/pulse8-cec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+index 50146f263d904..12da631c0fda0 100644
+--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+@@ -585,7 +585,7 @@ unlock:
+ else
+ pulse8->config_pending = true;
+ mutex_unlock(&pulse8->config_lock);
+- return err;
++ return log_addr == CEC_LOG_ADDR_INVALID ? 0 : err;
+ }
+
+ static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
+--
+2.20.1
+
--- /dev/null
+From f2702601fff75dec35d80b3ce09cc6ef217e9de0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Nov 2018 11:14:54 -0500
+Subject: media: stkwebcam: Bugfix for wrong return values
+
+From: Andreas Pape <ap@ca-pape.de>
+
+[ Upstream commit 3c28b91380dd1183347d32d87d820818031ebecf ]
+
+usb_control_msg returns in case of a successfully sent message the number
+of sent bytes as a positive number. Don't use this value as a return value
+for stk_camera_read_reg, as a non-zero return value is used as an error
+condition in some cases when stk_camera_read_reg is called.
+
+Signed-off-by: Andreas Pape <ap@ca-pape.de>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/stkwebcam/stk-webcam.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
+index a7da1356a36ef..6992e84f8a8bb 100644
+--- a/drivers/media/usb/stkwebcam/stk-webcam.c
++++ b/drivers/media/usb/stkwebcam/stk-webcam.c
+@@ -164,7 +164,11 @@ int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value)
+ *value = *buf;
+
+ kfree(buf);
+- return ret;
++
++ if (ret < 0)
++ return ret;
++ else
++ return 0;
+ }
+
+ static int stk_start_stream(struct stk_camera *dev)
+--
+2.20.1
+
--- /dev/null
+From 4fb53c75ec30e5575014bc529fb959bdd32e0bb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 12:56:41 -0500
+Subject: media: vimc: fix start stream when link is disabled
+
+From: Helen Fornazier <helen.koike@collabora.com>
+
+[ Upstream commit e159b6074c82fe31b79aad672e02fa204dbbc6d8 ]
+
+If link is disabled, media_entity_remote_pad returns NULL, causing a
+NULL pointer deference.
+Ignore links that are not enabled instead.
+
+Signed-off-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vimc/vimc-common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c
+index 743554de724d8..a9ab3871ccda2 100644
+--- a/drivers/media/platform/vimc/vimc-common.c
++++ b/drivers/media/platform/vimc/vimc-common.c
+@@ -241,6 +241,8 @@ int vimc_pipeline_s_stream(struct media_entity *ent, int enable)
+
+ /* Start the stream in the subdevice direct connected */
+ pad = media_entity_remote_pad(&ent->pads[i]);
++ if (!pad)
++ continue;
+
+ if (!is_media_entity_v4l2_subdev(pad->entity))
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From e71eb6d47b3fd8f3cb3992ebaa0022bc1885dab9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 22:12:17 +0200
+Subject: MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible
+ definition
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 1c6121c39677175bd372076020948e184bad4b6b ]
+
+cn58xx is compatible with cn50xx, so use the latter.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+[paul.burton@mips.com: s/cn52xx/cn50xx/ in commit message.]
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c | 2 +-
+ arch/mips/include/asm/octeon/cvmx-pko.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+index 8241fc6aa17d8..3839feba68f20 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id)
+ } else {
+ union cvmx_pko_mem_debug8 debug8;
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- return debug8.cn58xx.doorbell;
++ return debug8.cn50xx.doorbell;
+ }
+ case CVMX_CMD_QUEUE_ZIP:
+ case CVMX_CMD_QUEUE_DFA:
+diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h
+index 5f47f76ed510a..20eb9c46a75ab 100644
+--- a/arch/mips/include/asm/octeon/cvmx-pko.h
++++ b/arch/mips/include/asm/octeon/cvmx-pko.h
+@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear,
+ pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num);
+ cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64);
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- status->doorbell = debug8.cn58xx.doorbell;
++ status->doorbell = debug8.cn50xx.doorbell;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 44f75b2807e36dc6f4d38aedf478f37da7b0a241 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 00:37:29 +0200
+Subject: MIPS: OCTEON: octeon-platform: fix typing
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 2cf1c8933dd93088cfb5f8f58b3bb9bbdf1781b9 ]
+
+Use correct type for fdt_property nameoff field.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/21204/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/octeon-platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index 1d92efb82c372..e1e24118c169e 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -501,7 +501,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr)
+ if (phy_addr >= 256 && alt_phy > 0) {
+ const struct fdt_property *phy_prop;
+ struct fdt_property *alt_prop;
+- u32 phy_handle_name;
++ fdt32_t phy_handle_name;
+
+ /* Use the alt phy node instead.*/
+ phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL);
+--
+2.20.1
+
--- /dev/null
+From 82fcc83982a3f03e63b568d3365e9506c0186ad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 22:42:37 +0000
+Subject: MIPS: SiByte: Enable ZONE_DMA32 for LittleSur
+
+From: Maciej W. Rozycki <macro@linux-mips.org>
+
+[ Upstream commit 756d6d836dbfb04a5a486bc2ec89397aa4533737 ]
+
+The LittleSur board is marked for high memory support and therefore
+clearly must provide a way to have enough memory installed for some to
+be present outside the low 4GiB physical address range. With the memory
+map of the BCM1250 SOC it has been built around it means over 1GiB of
+actual DRAM, as only the first 1GiB is mapped in the low 4GiB physical
+address range[1].
+
+Complement commit cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need
+DMA32.") then and also enable ZONE_DMA32 for LittleSur.
+
+References:
+
+[1] "BCM1250/BCM1125/BCM1125H User Manual", Revision 1250_1125-UM100-R,
+ Broadcom Corporation, 21 Oct 2002, Section 3: "System Overview",
+ "Memory Map", pp. 34-38
+
+Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Patchwork: https://patchwork.linux-mips.org/patch/21107/
+Fixes: cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need DMA32.")
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index ae4450e891abc..7e267d657c561 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -812,6 +812,7 @@ config SIBYTE_LITTLESUR
+ select SYS_SUPPORTS_BIG_ENDIAN
+ select SYS_SUPPORTS_HIGHMEM
+ select SYS_SUPPORTS_LITTLE_ENDIAN
++ select ZONE_DMA32 if 64BIT
+
+ config SIBYTE_SENTOSA
+ bool "Sibyte BCM91250E-Sentosa"
+--
+2.20.1
+
--- /dev/null
+From 807fd44a432e339b68ab5f918907821740838866 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 21:18:07 -0500
+Subject: mlx4: Use snprintf instead of complicated strcpy
+
+From: Qian Cai <cai@gmx.us>
+
+[ Upstream commit 0fbc9b8b4ea3f688a5da141a64f97aa33ad02ae9 ]
+
+This fixes a compilation warning in sysfs.c
+
+drivers/infiniband/hw/mlx4/sysfs.c:360:2: warning: 'strncpy' output may be
+truncated copying 8 bytes from a string of length 31
+[-Wstringop-truncation]
+
+By eliminating the temporary stack buffer.
+
+Signed-off-by: Qian Cai <cai@gmx.us>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/sysfs.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
+index e219093d27645..d2da28d613f2c 100644
+--- a/drivers/infiniband/hw/mlx4/sysfs.c
++++ b/drivers/infiniband/hw/mlx4/sysfs.c
+@@ -353,16 +353,12 @@ err:
+
+ static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max)
+ {
+- char base_name[9];
+-
+- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */
+- strlcpy(name, pci_name(dev->dev->persist->pdev), max);
+- strncpy(base_name, name, 8); /*till xxxx:yy:*/
+- base_name[8] = '\0';
+- /* with no ARI only 3 last bits are used so when the fn is higher than 8
++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n
++ * with no ARI only 3 last bits are used so when the fn is higher than 8
+ * need to add it to the dev num, so count in the last number will be
+ * modulo 8 */
+- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8));
++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev),
++ i / 8, i % 8);
+ }
+
+ struct mlx4_port {
+--
+2.20.1
+
--- /dev/null
+From 4c70a38018ff938fc6622497198a83c93a360f57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 17:44:52 +0000
+Subject: mlxsw: spectrum_router: Relax GRE decap matching check
+
+From: Nir Dotan <nird@mellanox.com>
+
+[ Upstream commit da93d2913fdf43d5cde3c5a53ac9cc29684d5c7c ]
+
+GRE decap offload is configured when local routes prefix correspond to the
+local address of one of the offloaded GRE tunnels. The matching check was
+found to be too strict, such that for a flat GRE configuration, in which
+the overlay and underlay traffic share the same non-default VRF, decap flow
+was not offloaded.
+
+Relax the check for decap flow offloading. A match occurs if the local
+address of the tunnel matches the local route address while both share the
+same VRF table.
+
+Fixes: 4607f6d26950 ("mlxsw: spectrum_router: Support IPv4 underlay decap")
+Signed-off-by: Nir Dotan <nird@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 3ed4fb346f235..5b9a5c3834d9e 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -1252,15 +1252,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp,
+ {
+ u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN;
+ enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt;
+- struct net_device *ipip_ul_dev;
+
+ if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto)
+ return false;
+
+- ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev);
+ return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip,
+- ul_tb_id, ipip_entry) &&
+- (!ipip_ul_dev || ipip_ul_dev == ul_dev);
++ ul_tb_id, ipip_entry);
+ }
+
+ /* Given decap parameters, find the corresponding IPIP entry. */
+--
+2.20.1
+
--- /dev/null
+From 5ed2aeb59a4fbff9083f0ab8de83df7ba14dd55a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 15:08:32 -0800
+Subject: mm/vmstat.c: fix NUMA statistics updates
+
+From: Janne Huttunen <janne.huttunen@nokia.com>
+
+[ Upstream commit 13c9aaf7fa01cc7600c61981609feadeef3354ec ]
+
+Scan through the whole array to see if an update is needed. While we're
+at it, use sizeof() to be safe against any possible type changes in the
+future.
+
+The bug here is that we wouldn't sync per-cpu counters into global ones
+if there was an update of numa_stats for higher cpus. Highly
+theoretical one though because it is much more probable that zone_stats
+are updated so we would refresh anyway. So I wouldn't bother to mark
+this for stable, yet something nice to fix.
+
+[mhocko@suse.com: changelog enhancement]
+Link: http://lkml.kernel.org/r/1541601517-17282-1-git-send-email-janne.huttunen@nokia.com
+Fixes: 1d90ca897cb0 ("mm: update NUMA counter threshold size")
+Signed-off-by: Janne Huttunen <janne.huttunen@nokia.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/vmstat.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index ba91683264134..e2197b03da574 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1805,12 +1805,13 @@ static bool need_update(int cpu)
+
+ /*
+ * The fast way of checking if there are any vmstat diffs.
+- * This works because the diffs are byte sized items.
+ */
+- if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS))
++ if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS *
++ sizeof(p->vm_stat_diff[0])))
+ return true;
+ #ifdef CONFIG_NUMA
+- if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS))
++ if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS *
++ sizeof(p->vm_numa_stat_diff[0])))
+ return true;
+ #endif
+ }
+--
+2.20.1
+
--- /dev/null
+From 45c9fbd1f8398bdb6801ef19fb2a6c6a0d5a29c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 13:14:13 -0800
+Subject: modpost: skip ELF local symbols during section mismatch check
+
+From: Paul Walmsley <paul.walmsley@sifive.com>
+
+[ Upstream commit a4d26f1a0958bb1c2b60c6f1e67c6f5d43e2647b ]
+
+During development of a serial console driver with a gcc 8.2.0
+toolchain for RISC-V, the following modpost warning appeared:
+
+----
+WARNING: vmlinux.o(.data+0x19b10): Section mismatch in reference from the variable .LANCHOR1 to the function .init.text:sifive_serial_console_setup()
+The variable .LANCHOR1 references
+the function __init sifive_serial_console_setup()
+If the reference is valid then annotate the
+variable with __init* or __refdata (see linux/init.h) or name the variable:
+*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console
+----
+
+".LANCHOR1" is an ELF local symbol, automatically created by gcc's section
+anchor generation code:
+
+https://gcc.gnu.org/onlinedocs/gccint/Anchored-Addresses.html
+
+https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/varasm.c;h=cd9591a45617464946dcf9a126dde277d9de9804;hb=9fb89fa845c1b2e0a18d85ada0b077c84508ab78#l7473
+
+This was verified by compiling the kernel with -fno-section-anchors
+and observing that the ".LANCHOR1" ELF local symbol disappeared, and
+modpost no longer warned about the section mismatch. The serial
+driver code idiom triggering the warning is standard Linux serial
+driver practice that has a specific whitelist inclusion in modpost.c.
+
+I'm neither a modpost nor an ELF expert, but naively, it doesn't seem
+useful for modpost to report section mismatch warnings caused by ELF
+local symbols by default. Local symbols have compiler-generated
+names, and thus bypass modpost's whitelisting algorithm, which relies
+on the presence of a non-autogenerated symbol name. This increases
+the likelihood that false positive warnings will be generated (as in
+the above case).
+
+Thus, disable section mismatch reporting on ELF local symbols. The
+rationale here is similar to that of commit 2e3a10a1551d ("ARM: avoid
+ARM binutils leaking ELF local symbols") and of similar code already
+present in modpost.c:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/mod/modpost.c?h=v4.19-rc4&id=7876320f88802b22d4e2daf7eb027dd14175a0f8#n1256
+
+This third version of the patch implements a suggestion from Masahiro
+Yamada <yamada.masahiro@socionext.com> to restructure the code as an
+additional pattern matching step inside secref_whitelist(), and
+further improves the patch description.
+
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index c22041a4fc360..b6eb929899c55 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1174,6 +1174,14 @@ static const struct sectioncheck *section_mismatch(
+ * fromsec = text section
+ * refsymname = *.constprop.*
+ *
++ * Pattern 6:
++ * Hide section mismatch warnings for ELF local symbols. The goal
++ * is to eliminate false positive modpost warnings caused by
++ * compiler-generated ELF local symbol names such as ".LANCHOR1".
++ * Autogenerated symbol names bypass modpost's "Pattern 2"
++ * whitelisting, which relies on pattern-matching against symbol
++ * names to work. (One situation where gcc can autogenerate ELF
++ * local symbols is when "-fsection-anchors" is used.)
+ **/
+ static int secref_whitelist(const struct sectioncheck *mismatch,
+ const char *fromsec, const char *fromsym,
+@@ -1212,6 +1220,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
+ match(fromsym, optim_symbols))
+ return 0;
+
++ /* Check for pattern 6 */
++ if (strstarts(fromsym, ".L"))
++ return 0;
++
+ return 1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0d8412b211c17f6880c42bf9a1335fd99f6f1a22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Nov 2018 21:18:30 +0100
+Subject: mtd: fix mtd_oobavail() incoherent returned value
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 4348433d8c0234f44adb6e12112e69343f50f0c5 ]
+
+mtd_oobavail() returns either mtd->oovabail or mtd->oobsize. Both
+values are unsigned 32-bit entities, so there is no reason to pretend
+returning a signed one.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mtd/mtd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
+index 6cd0f6b7658b3..aadc2ee050f16 100644
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -401,7 +401,7 @@ static inline struct device_node *mtd_get_of_node(struct mtd_info *mtd)
+ return dev_of_node(&mtd->dev);
+ }
+
+-static inline int mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops)
++static inline u32 mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops)
+ {
+ return ops->mode == MTD_OPS_AUTO_OOB ? mtd->oobavail : mtd->oobsize;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7e1c436e89c0f3628aeeaebd9a13e59d06f4c110 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 14:00:11 +0000
+Subject: net: aquantia: fix RSS table and key sizes
+
+From: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+
+[ Upstream commit 474fb1150d40780e71f0b569aeac4f375df3af3d ]
+
+Set RSS indirection table and RSS hash key sizes to their real size.
+
+Signed-off-by: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_cfg.h | 4 ++--
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+index 57e796870595b..ea4b7e97c61ea 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+@@ -40,8 +40,8 @@
+ #define AQ_CFG_IS_LRO_DEF 1U
+
+ /* RSS */
+-#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 128U
+-#define AQ_CFG_RSS_HASHKEY_SIZE 320U
++#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 64U
++#define AQ_CFG_RSS_HASHKEY_SIZE 40U
+
+ #define AQ_CFG_IS_RSS_DEF 1U
+ #define AQ_CFG_NUM_RSS_QUEUES_DEF AQ_CFG_VECS_DEF
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index cc658a29cc33e..a69f5f1ad32a8 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -43,7 +43,7 @@ static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
+ struct aq_rss_parameters *rss_params = &cfg->aq_rss;
+ int i = 0;
+
+- static u8 rss_key[40] = {
++ static u8 rss_key[AQ_CFG_RSS_HASHKEY_SIZE] = {
+ 0x1e, 0xad, 0x71, 0x87, 0x65, 0xfc, 0x26, 0x7d,
+ 0x0d, 0x45, 0x67, 0x74, 0xcd, 0x06, 0x1a, 0x18,
+ 0xb6, 0xc1, 0xf0, 0xc7, 0xbb, 0x18, 0xbe, 0xf8,
+--
+2.20.1
+
--- /dev/null
+From db0f3aad14bd988512b1df301137916cc2547cde Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 18:51:01 +0100
+Subject: net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing
+ MII_PHYSID2
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+[ Upstream commit ddc49acb659a2d8bfc5fdb0de0ef197712c11d75 ]
+
+We already have a workaround for a couple of switches whose internal
+PHYs only have the Marvel OUI, but no model number. We detect such
+PHYs and give them the 6390 ID as the model number. However the
+mv88e6161 has two SERDES interfaces in the same address range as its
+internal PHYs. These suffer from the same problem, the Marvell OUI,
+but no model number. As a result, these SERDES interfaces were getting
+the same PHY ID as the mv88e6390, even though they are not PHYs, and
+the Marvell PHY driver was trying to drive them.
+
+Add a special case to stop this from happen.
+
+Reported-by: Chris Healy <Chris.Healy@zii.aero>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index be17194487c68..10ea01459a36b 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2196,11 +2196,22 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
+ mutex_unlock(&chip->reg_lock);
+
+ if (reg == MII_PHYSID2) {
+- /* Some internal PHYS don't have a model number. Use
+- * the mv88e6390 family model number instead.
+- */
+- if (!(val & 0x3f0))
+- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4;
++ /* Some internal PHYs don't have a model number. */
++ if (chip->info->family != MV88E6XXX_FAMILY_6165)
++ /* Then there is the 6165 family. It gets is
++ * PHYs correct. But it can also have two
++ * SERDES interfaces in the PHY address
++ * space. And these don't have a model
++ * number. But they are not PHYs, so we don't
++ * want to give them something a PHY driver
++ * will recognise.
++ *
++ * Use the mv88e6390 family model number
++ * instead, for anything which really could be
++ * a PHY,
++ */
++ if (!(val & 0x3f0))
++ val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4;
+ }
+
+ return err ? err : val;
+--
+2.20.1
+
--- /dev/null
+From b15092d04324e756c99ca97ded0125b4caa0a724 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 23:43:24 +0800
+Subject: net: ep93xx_eth: fix mismatch of request_mem_region in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 3df70afe8d33f4977d0e0891bdcfb639320b5257 ]
+
+The driver calls release_resource in remove to match request_mem_region
+in probe, which is incorrect.
+Fix it by using the right one, release_mem_region.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cirrus/ep93xx_eth.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+index e2a702996db41..82bd918bf967f 100644
+--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+@@ -767,6 +767,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ {
+ struct net_device *dev;
+ struct ep93xx_priv *ep;
++ struct resource *mem;
+
+ dev = platform_get_drvdata(pdev);
+ if (dev == NULL)
+@@ -782,8 +783,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ iounmap(ep->base_addr);
+
+ if (ep->res != NULL) {
+- release_resource(ep->res);
+- kfree(ep->res);
++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ release_mem_region(mem->start, resource_size(mem));
+ }
+
+ free_netdev(dev);
+--
+2.20.1
+
--- /dev/null
+From 9b930666594c46db2c0d927349e2959d64817b5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 16:00:20 +0200
+Subject: net: ethernet: ti: cpts: correct debug for expired txq skb
+
+From: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+
+[ Upstream commit d0e14c4d9bcef0d4aa1057d2959adaa6f18d4a17 ]
+
+The msgtype and seqid that is smth that belongs to event for
+comparison but not for staled txq skb.
+
+Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index 7d1281d812480..23c953496a0d1 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -116,9 +116,7 @@ static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event)
+ mtype, seqid);
+ } else if (time_after(jiffies, skb_cb->tmo)) {
+ /* timeout any expired skbs over 1s */
+- dev_dbg(cpts->dev,
+- "expiring tx timestamp mtype %u seqid %04x\n",
+- mtype, seqid);
++ dev_dbg(cpts->dev, "expiring tx timestamp from txq\n");
+ __skb_unlink(skb, &cpts->txq);
+ dev_consume_skb_any(skb);
+ }
+--
+2.20.1
+
--- /dev/null
+From f589fdb7f85af6d87f6557871394de7a10ea7bae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 17:40:25 +0200
+Subject: net/mlx4_core: Fix return codes of unsupported operations
+
+From: Erez Alfasi <ereza@mellanox.com>
+
+[ Upstream commit 95aac2cdafd8c8298c9b2589c52f44db0d824e0e ]
+
+Functions __set_port_type and mlx4_check_port_params returned
+-EINVAL while the proper return code is -EOPNOTSUPP as a
+result of an unsupported operation. All drivers should generate
+this and all users should check for it when detecting an
+unsupported functionality.
+
+Signed-off-by: Erez Alfasi <ereza@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/main.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index c273a3ebb8e8e..12d4b891301b6 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -199,7 +199,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev,
+ for (i = 0; i < dev->caps.num_ports - 1; i++) {
+ if (port_type[i] != port_type[i + 1]) {
+ mlx4_err(dev, "Only same port types supported on this HCA, aborting\n");
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+ }
+ }
+@@ -208,7 +208,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev,
+ if (!(port_type[i] & dev->caps.supported_type[i+1])) {
+ mlx4_err(dev, "Requested port type for port %d is not supported on this HCA\n",
+ i + 1);
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+ }
+ return 0;
+@@ -1152,8 +1152,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ mlx4_err(mdev,
+ "Requested port type for port %d is not supported on this HCA\n",
+ info->port);
+- err = -EINVAL;
+- goto err_sup;
++ return -EOPNOTSUPP;
+ }
+
+ mlx4_stop_sense(mdev);
+@@ -1175,7 +1174,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ for (i = 1; i <= mdev->caps.num_ports; i++) {
+ if (mdev->caps.possible_type[i] == MLX4_PORT_TYPE_AUTO) {
+ mdev->caps.possible_type[i] = mdev->caps.port_type[i];
+- err = -EINVAL;
++ err = -EOPNOTSUPP;
+ }
+ }
+ }
+@@ -1201,7 +1200,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ out:
+ mlx4_start_sense(mdev);
+ mutex_unlock(&priv->port_mutex);
+-err_sup:
++
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f56abf0d224c456300410f5981b05e5bf785c4ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 21:10:08 +0200
+Subject: net/mlx5: Release resource on error flow
+
+From: Moni Shoua <monis@mellanox.com>
+
+[ Upstream commit 698114968a22f6c0c9f42e983ba033cc36bb7217 ]
+
+Fix reference counting leakage when the event handler aborts due to an
+unsupported event for the resource type.
+
+Fixes: a14c2d4beee5 ("net/mlx5_core: Warn on unsupported events of QP/RQ/SQ")
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/qp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+index 889130edb7152..5f091c6ea049d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+@@ -124,7 +124,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
+ if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) {
+ mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n",
+ event_type, rsn);
+- return;
++ goto out;
+ }
+
+ switch (common->res) {
+@@ -138,7 +138,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
+ default:
+ mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn);
+ }
+-
++out:
+ mlx5_core_put_rsc(common);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fdf52fb1830f177e7ace868e8183619527bc9a8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 05:47:33 +0000
+Subject: net-next/hinic:fix a bug in set mac address
+
+From: Xue Chaojing <xuechaojing@huawei.com>
+
+[ Upstream commit 9ea72dc9430306b77c73a8a21beb51437cde1d6d ]
+
+In add_mac_addr(), if the MAC address is a muliticast address,
+it will not be set, which causes the network card fail to receive
+the multicast packet. This patch fixes this bug.
+
+Signed-off-by: Xue Chaojing <xuechaojing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/huawei/hinic/hinic_main.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+index a696b5b2d40e6..44c73215d0264 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+@@ -598,9 +598,6 @@ static int add_mac_addr(struct net_device *netdev, const u8 *addr)
+ u16 vid = 0;
+ int err;
+
+- if (!is_valid_ether_addr(addr))
+- return -EADDRNOTAVAIL;
+-
+ netif_info(nic_dev, drv, netdev, "set mac addr = %02x %02x %02x %02x %02x %02x\n",
+ addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+
+@@ -724,6 +721,7 @@ static void set_rx_mode(struct work_struct *work)
+ {
+ struct hinic_rx_mode_work *rx_mode_work = work_to_rx_mode_work(work);
+ struct hinic_dev *nic_dev = rx_mode_work_to_nic_dev(rx_mode_work);
++ struct netdev_hw_addr *ha;
+
+ netif_info(nic_dev, drv, nic_dev->netdev, "set rx mode work\n");
+
+@@ -731,6 +729,9 @@ static void set_rx_mode(struct work_struct *work)
+
+ __dev_uc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr);
+ __dev_mc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr);
++
++ netdev_for_each_mc_addr(ha, nic_dev->netdev)
++ add_mac_addr(nic_dev->netdev, ha->addr);
+ }
+
+ static void hinic_set_rx_mode(struct net_device *netdev)
+--
+2.20.1
+
--- /dev/null
+From 344b6d63772563548b424504cc346aa2c3c20a5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 16:46:43 +0100
+Subject: net/smc: use after free fix in smc_wr_tx_put_slot()
+
+From: Ursula Braun <ursula.braun@linux.ibm.com>
+
+[ Upstream commit e438bae43c1e08e688c09c410407b59fc1c173b4 ]
+
+In smc_wr_tx_put_slot() field pend->idx is used after being
+cleared. That means always idx 0 is cleared in the wr_tx_mask.
+This results in a broken administration of available WR send
+payload buffers.
+
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_wr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
+index de4537f66832a..ed6736a1a112e 100644
+--- a/net/smc/smc_wr.c
++++ b/net/smc/smc_wr.c
+@@ -223,12 +223,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
+
+ pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
+ if (pend->idx < link->wr_tx_cnt) {
++ u32 idx = pend->idx;
++
+ /* clear the full struct smc_wr_tx_pend including .priv */
+ memset(&link->wr_tx_pends[pend->idx], 0,
+ sizeof(link->wr_tx_pends[pend->idx]));
+ memset(&link->wr_tx_bufs[pend->idx], 0,
+ sizeof(link->wr_tx_bufs[pend->idx]));
+- test_and_clear_bit(pend->idx, link->wr_tx_mask);
++ test_and_clear_bit(idx, link->wr_tx_mask);
+ return 1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e01581de9fff417a1258d64be4ef2ae62feebca6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 09:50:27 +0100
+Subject: net/x25: fix called/calling length calculation in
+ x25_parse_address_block
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit d449ba3d581ed29f751a59792fdc775572c66904 ]
+
+The length of the called and calling address was not calculated
+correctly (BCD encoding).
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 1b830a6ee3ff6..6e7ad4c6f83c8 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb,
+ }
+
+ len = *skb->data;
+- needed = 1 + (len >> 4) + (len & 0x0f);
++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2;
+
+ if (!pskb_may_pull(skb, needed)) {
+ /* packet is too short to hold the addresses it claims
+--
+2.20.1
+
--- /dev/null
+From c8dc3744001a42336eb210ee7fc8900576e6ed20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 09:50:28 +0100
+Subject: net/x25: fix null_x25_address handling
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 06137619f061f498c2924f6543fa45b7d39f0501 ]
+
+o x25_find_listener(): the compare for the null_x25_address was wrong.
+ We have to check the x25_addr of the listener socket instead of the
+ x25_addr of the incomming call.
+
+ o x25_bind(): it was not possible to bind a socket to null_x25_address
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 6e7ad4c6f83c8..a156b6dc3a724 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr,
+ sk_for_each(s, &x25_list)
+ if ((!strcmp(addr->x25_addr,
+ x25_sk(s)->source_addr.x25_addr) ||
+- !strcmp(addr->x25_addr,
++ !strcmp(x25_sk(s)->source_addr.x25_addr,
+ null_x25_address.x25_addr)) &&
+ s->sk_state == TCP_LISTEN) {
+ /*
+@@ -684,11 +684,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out;
+ }
+
+- len = strlen(addr->sx25_addr.x25_addr);
+- for (i = 0; i < len; i++) {
+- if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+- rc = -EINVAL;
+- goto out;
++ /* check for the null_x25_address */
++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
++
++ len = strlen(addr->sx25_addr.x25_addr);
++ for (i = 0; i < len; i++) {
++ if (!isdigit(addr->sx25_addr.x25_addr[i])) {
++ rc = -EINVAL;
++ goto out;
++ }
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 48129fc9640434ce543627a52d6c13609b8c2905 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2019 17:19:15 +0100
+Subject: NFC: nxp-nci: Fix NULL pointer dereference after I2C communication
+ error
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit a71a29f50de1ef97ab55c151a1598eb12dde379d ]
+
+I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci
+result in a NULL pointer dereference at the moment:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ Oops: 0002 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1
+ RIP: 0010:skb_queue_tail+0x25/0x50
+ Call Trace:
+ nci_recv_frame+0x36/0x90 [nci]
+ nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c]
+ ? preempt_count_add+0x68/0xa0
+ ? irq_forced_thread_fn+0x80/0x80
+ irq_thread_fn+0x20/0x60
+ irq_thread+0xee/0x180
+ ? wake_threads_waitq+0x30/0x30
+ kthread+0xfb/0x130
+ ? irq_thread_check_affinity+0xd0/0xd0
+ ? kthread_park+0x90/0x90
+ ret_from_fork+0x1f/0x40
+
+Afterward the kernel must be rebooted to work properly again.
+
+This happens because it attempts to call nci_recv_frame() with skb == NULL.
+However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any
+NULL checks for skb, causing the NULL pointer dereference.
+
+Change the code to call only nxp_nci_fw_recv_frame() in case of an error.
+Make sure to log it so it is obvious that a communication error occurred.
+The error above then becomes:
+
+ nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
+ nci: __nci_request: wait_for_completion_interruptible_timeout failed 0
+ nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
+
+Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index 198585bbc7711..d9492cffd00e5 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -236,8 +236,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id)
+
+ if (r == -EREMOTEIO) {
+ phy->hard_fault = r;
+- skb = NULL;
+- } else if (r < 0) {
++ if (info->mode == NXP_NCI_MODE_FW)
++ nxp_nci_fw_recv_frame(phy->ndev, NULL);
++ }
++ if (r < 0) {
+ nfc_err(&client->dev, "Read failed with error %d\n", r);
+ goto exit_irq_handled;
+ }
+--
+2.20.1
+
--- /dev/null
+From 32e984b23899baeaa8b8690b4b9f492e0e2a38e1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:35:08 -0500
+Subject: nfsd: fix a warning in __cld_pipe_upcall()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit b493fd31c0b89d9453917e977002de58bebc3802 ]
+
+__cld_pipe_upcall() emits a "do not call blocking ops when
+!TASK_RUNNING" warning due to the dput() call in rpc_queue_upcall().
+Fix it by using a completion instead of hand coding the wait.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4recover.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
+index 66eaeb1e8c2ce..dc9586feab317 100644
+--- a/fs/nfsd/nfs4recover.c
++++ b/fs/nfsd/nfs4recover.c
+@@ -661,7 +661,7 @@ struct cld_net {
+ struct cld_upcall {
+ struct list_head cu_list;
+ struct cld_net *cu_net;
+- struct task_struct *cu_task;
++ struct completion cu_done;
+ struct cld_msg cu_msg;
+ };
+
+@@ -670,23 +670,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg)
+ {
+ int ret;
+ struct rpc_pipe_msg msg;
++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg);
+
+ memset(&msg, 0, sizeof(msg));
+ msg.data = cmsg;
+ msg.len = sizeof(*cmsg);
+
+- /*
+- * Set task state before we queue the upcall. That prevents
+- * wake_up_process in the downcall from racing with schedule.
+- */
+- set_current_state(TASK_UNINTERRUPTIBLE);
+ ret = rpc_queue_upcall(pipe, &msg);
+ if (ret < 0) {
+- set_current_state(TASK_RUNNING);
+ goto out;
+ }
+
+- schedule();
++ wait_for_completion(&cup->cu_done);
+
+ if (msg.errno < 0)
+ ret = msg.errno;
+@@ -753,7 +748,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ if (copy_from_user(&cup->cu_msg, src, mlen) != 0)
+ return -EFAULT;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ return mlen;
+ }
+
+@@ -768,7 +763,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
+ if (msg->errno >= 0)
+ return;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ }
+
+ static const struct rpc_pipe_ops cld_upcall_ops = {
+@@ -899,7 +894,7 @@ restart_search:
+ goto restart_search;
+ }
+ }
+- new->cu_task = current;
++ init_completion(&new->cu_done);
+ new->cu_msg.cm_vers = CLD_UPCALL_VERSION;
+ put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid);
+ new->cu_net = cn;
+--
+2.20.1
+
--- /dev/null
+From cd1f45a098260c4038b22913c9f3d5d948b770d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 16:04:25 +0800
+Subject: nfsd: Return EPERM, not EACCES, in some SETATTR cases
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 255fbca65137e25b12bced18ec9a014dc77ecda0 ]
+
+As the man(2) page for utime/utimes states, EPERM is returned when the
+second parameter of utime or utimes is not NULL, the caller's effective UID
+does not match the owner of the file, and the caller is not privileged.
+
+However, in a NFS directory mounted from knfsd, it will return EACCES
+(from nfsd_setattr-> fh_verify->nfsd_permission). This patch fixes
+that.
+
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/vfs.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index f55527ef21e84..06d1f2edf2ec6 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -396,10 +396,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ bool get_write_count;
+ bool size_change = (iap->ia_valid & ATTR_SIZE);
+
+- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
++ if (iap->ia_valid & ATTR_SIZE) {
+ accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+- if (iap->ia_valid & ATTR_SIZE)
+ ftype = S_IFREG;
++ }
++
++ /*
++ * If utimes(2) and friends are called with times not NULL, we should
++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission
++ * will return EACCESS, when the caller's effective UID does not match
++ * the owner of the file, and the caller is not privileged. In this
++ * situation, we should return EPERM(notify_change will return this).
++ */
++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) {
++ accmode |= NFSD_MAY_OWNER_OVERRIDE;
++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET)))
++ accmode |= NFSD_MAY_WRITE;
++ }
+
+ /* Callers that do fh_verify should do the fh_want_write: */
+ get_write_count = !fhp->fh_dentry;
+--
+2.20.1
+
--- /dev/null
+From 69a836ffeb23342e0dbbe2c85d3de79afeaaee59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Nov 2018 20:34:11 -0500
+Subject: pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit 7ed07855773814337b9814f1c3e866df52ebce68 ]
+
+When attempting to setup up a gpio hog, device probing will repeatedly
+fail with -EPROBE_DEFERED errors. It is caused by a circular dependency
+between the gpio and pinctrl frameworks. If the gpio-ranges property is
+present in device tree, then the gpio framework will handle the gpio pin
+registration and eliminate the circular dependency.
+
+See Christian Lamparter's commit a86caa9ba5d7 ("pinctrl: msm: fix
+gpio-hog related boot issues") for a detailed commit message that
+explains the issue in much more detail. The code comment in this commit
+came from Christian's commit.
+
+I did not test this change against any hardware supported by this
+particular driver, however I was able to validate this same fix works
+for pinctrl-spmi-gpio.c using a LG Nexus 5 (hammerhead) phone.
+
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+index 0e153bae322ee..6bed433e54205 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -762,12 +762,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = gpiochip_add_pin_range(&pctrl->chip,
+- dev_name(pctrl->dev),
+- 0, 0, pctrl->chip.ngpio);
+- if (ret) {
+- dev_err(pctrl->dev, "failed to add pin range\n");
+- goto unregister_gpiochip;
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev),
++ 0, 0, pctrl->chip.ngpio);
++ if (ret) {
++ dev_err(pctrl->dev, "failed to add pin range\n");
++ goto unregister_gpiochip;
++ }
+ }
+
+ platform_set_drvdata(pdev, pctrl);
+--
+2.20.1
+
--- /dev/null
+From 10a7167c6301ea85fe0f61672ada0a42fc829da0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 17:07:25 +0100
+Subject: pinctrl: sh-pfc: r8a7792: Fix VIN versioned groups
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 11c8f8df85e77329d5a3cacc08682722cb80b95b ]
+
+Versioned VIN groups can appear on different sets of pins. Using the
+VIN_DATA_PIN_GROUP macro now supports proper naming of said groups
+through an optional 'version' argument.
+
+Use the 'version' argument for said macro to fix naming of versioned
+groups for the R-Car V2H R8A7792 SoC.
+
+Fixes: 7dd74bb1f058 ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+index cc3597f66605a..b3814ca009b02 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+@@ -1747,10 +1747,10 @@ static const struct sh_pfc_pin_group pinmux_groups[] = {
+ VIN_DATA_PIN_GROUP(vin1_data, 12),
+ VIN_DATA_PIN_GROUP(vin1_data, 10),
+ VIN_DATA_PIN_GROUP(vin1_data, 8),
+- VIN_DATA_PIN_GROUP(vin1_data_b, 24),
+- VIN_DATA_PIN_GROUP(vin1_data_b, 20),
++ VIN_DATA_PIN_GROUP(vin1_data, 24, _b),
++ VIN_DATA_PIN_GROUP(vin1_data, 20, _b),
+ SH_PFC_PIN_GROUP(vin1_data18_b),
+- VIN_DATA_PIN_GROUP(vin1_data_b, 16),
++ VIN_DATA_PIN_GROUP(vin1_data, 16, _b),
+ SH_PFC_PIN_GROUP(vin1_sync),
+ SH_PFC_PIN_GROUP(vin1_field),
+ SH_PFC_PIN_GROUP(vin1_clkenb),
+--
+2.20.1
+
--- /dev/null
+From f160e4648b01a56cd9a3dee1d9c2850256be5746 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 09:37:46 +1030
+Subject: powerpc/math-emu: Update macros from GCC
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit b682c8692442711684befe413cf93cf01c5324ea ]
+
+The add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros originate
+from GCC's longlong.h which in turn was copied from GMP's longlong.h a
+few decades ago.
+
+This was found when compiling with clang:
+
+ arch/powerpc/math-emu/fnmsub.c:46:2: error: invalid use of a cast in a
+ inline asm context requiring an l-value: remove the cast or build with
+ -fheinous-gnu-extensions
+ FP_ADD_D(R, T, B);
+ ^~~~~~~~~~~~~~~~~
+ ...
+
+ ./arch/powerpc/include/asm/sfp-machine.h:283:27: note: expanded from
+ macro 'sub_ddmmss'
+ : "=r" ((USItype)(sh)), \
+ ~~~~~~~~~~^~~
+
+Segher points out: this was fixed in GCC over 16 years ago
+( https://gcc.gnu.org/r56600 ), and in GMP (where it comes from)
+presumably before that.
+
+Update the add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros to
+the latest GCC version in order to git rid of the invalid casts. These
+were taken as-is from GCC's longlong in order to make future syncs
+obvious. Other parts of sfp-machine.h were left as-is as the file
+contains more features than present in longlong.h.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/260
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/sfp-machine.h | 92 ++++++++------------------
+ 1 file changed, 29 insertions(+), 63 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h
+index d89beaba26ff9..8b957aabb826d 100644
+--- a/arch/powerpc/include/asm/sfp-machine.h
++++ b/arch/powerpc/include/asm/sfp-machine.h
+@@ -213,30 +213,18 @@
+ * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow
+ * (i.e. carry out) is not stored anywhere, and is lost.
+ */
+-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+ else \
+- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \
++ : "=r" (sh), "=&r" (sl) \
++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \
+ } while (0)
+
+ /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to
+@@ -248,44 +236,24 @@
+ * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere,
+ * and is lost.
+ */
+-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (ah) && (ah) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+ else if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+ else \
+- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \
++ : "=r" (sh), "=&r" (sl) \
++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \
+ } while (0)
+
+ /* asm fragments for mul and div */
+@@ -294,13 +262,10 @@
+ * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype
+ * word product in HIGH_PROD and LOW_PROD.
+ */
+-#define umul_ppmm(ph, pl, m0, m1) \
++#define umul_ppmm(ph, pl, m0, m1) \
+ do { \
+ USItype __m0 = (m0), __m1 = (m1); \
+- __asm__ ("mulhwu %0,%1,%2" \
+- : "=r" ((USItype)(ph)) \
+- : "%r" (__m0), \
+- "r" (__m1)); \
++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \
+ (pl) = __m0 * __m1; \
+ } while (0)
+
+@@ -312,9 +277,10 @@
+ * significant bit of DENOMINATOR must be 1, then the pre-processor symbol
+ * UDIV_NEEDS_NORMALIZATION is defined to 1.
+ */
+-#define udiv_qrnnd(q, r, n1, n0, d) \
++#define udiv_qrnnd(q, r, n1, n0, d) \
+ do { \
+- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \
++ UWtype __d1, __d0, __q1, __q0; \
++ UWtype __r1, __r0, __m; \
+ __d1 = __ll_highpart (d); \
+ __d0 = __ll_lowpart (d); \
+ \
+@@ -325,7 +291,7 @@
+ if (__r1 < __m) \
+ { \
+ __q1--, __r1 += (d); \
+- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \
++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\
+ if (__r1 < __m) \
+ __q1--, __r1 += (d); \
+ } \
+--
+2.20.1
+
--- /dev/null
+From a419a84083ce8ad7309bd1a8f0b3dcb7c501e739 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 16:39:01 -0800
+Subject: pstore/ram: Avoid NULL deref in ftrace merging failure path
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 8665569e97dd52920713b95675409648986b5b0d ]
+
+Given corruption in the ftrace records, it might be possible to allocate
+tmp_prz without assigning prz to it, but still marking it as needing to
+be freed, which would cause at least a NULL dereference.
+
+smatch warnings:
+fs/pstore/ram.c:340 ramoops_pstore_read() error: we previously assumed 'prz' could be null (see line 255)
+
+https://lists.01.org/pipermail/kbuild-all/2018-December/055528.html
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 2fbea82bbb89 ("pstore: Merge per-CPU ftrace records into one")
+Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 40bfc6c583749..1e675be10926d 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -297,6 +297,7 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record)
+ GFP_KERNEL);
+ if (!tmp_prz)
+ return -ENOMEM;
++ prz = tmp_prz;
+ free_prz = true;
+
+ while (cxt->ftrace_read_cnt < cxt->max_ftrace_cnt) {
+@@ -319,7 +320,6 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record)
+ goto out;
+ }
+ record->id = 0;
+- prz = tmp_prz;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0996fab836ae7ed472a1d40d2cf16176aa45713c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 10:33:29 +0800
+Subject: RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN
+
+From: Sirong Wang <wangsirong@huawei.com>
+
+[ Upstream commit 531eb45b3da4267fc2a64233ba256c8ffb02edd2 ]
+
+Size of pointer to buf field of struct hns_roce_hem_chunk should be
+considered when calculating HNS_ROCE_HEM_CHUNK_LEN, or sg table size will
+be larger than expected when allocating hem.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Link: https://lore.kernel.org/r/1572575610-52530-2-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Sirong Wang <wangsirong@huawei.com>
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h
+index 435748858252d..8e8917ebb013b 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h
+@@ -52,7 +52,7 @@ enum {
+
+ #define HNS_ROCE_HEM_CHUNK_LEN \
+ ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \
+- (sizeof(struct scatterlist)))
++ (sizeof(struct scatterlist) + sizeof(void *)))
+
+ enum {
+ HNS_ROCE_HEM_PAGE_SHIFT = 12,
+--
+2.20.1
+
--- /dev/null
+From 240cffb8becbf639d8095c3dc469525685d54c85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 19:19:30 -0800
+Subject: regulator: Fix return value of _set_load() stub
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit f1abf67217de91f5cd3c757ae857632ca565099a ]
+
+The stub implementation of _set_load() returns a mode value which is
+within the bounds of valid return codes for success (the documentation
+just says that failures are negative error codes) but not sensible or
+what the actual implementation does. Fix it to just return 0.
+
+Reported-by: Cheng-Yi Chiang <cychiang@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/regulator/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
+index 25602afd48447..f3f76051e8b00 100644
+--- a/include/linux/regulator/consumer.h
++++ b/include/linux/regulator/consumer.h
+@@ -508,7 +508,7 @@ static inline int regulator_get_error_flags(struct regulator *regulator,
+
+ static inline int regulator_set_load(struct regulator *regulator, int load_uA)
+ {
+- return REGULATOR_MODE_NORMAL;
++ return 0;
+ }
+
+ static inline int regulator_allow_bypass(struct regulator *regulator,
+--
+2.20.1
+
--- /dev/null
+From b5e0573ce51b0ca69e1596c4028a8b6a74aac40e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 14:38:47 +0800
+Subject: rsxx: add missed destroy_workqueue calls in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit dcb77e4b274b8f13ac6482dfb09160cd2fae9a40 ]
+
+The driver misses calling destroy_workqueue in remove like what is done
+when probe fails.
+Add the missed calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rsxx/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
+index 34997df132e24..6beafaa335c71 100644
+--- a/drivers/block/rsxx/core.c
++++ b/drivers/block/rsxx/core.c
+@@ -1025,8 +1025,10 @@ static void rsxx_pci_remove(struct pci_dev *dev)
+
+ cancel_work_sync(&card->event_work);
+
++ destroy_workqueue(card->event_wq);
+ rsxx_destroy_dev(card);
+ rsxx_dma_destroy(card);
++ destroy_workqueue(card->creg_ctrl.creg_wq);
+
+ spin_lock_irqsave(&card->irq_lock, flags);
+ rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
+--
+2.20.1
+
--- /dev/null
+From 3500a1a7e3f34def361a4722e39466e03f598c65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 14:34:02 +0200
+Subject: rtc: dt-binding: abx80x: fix resistance scale
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 73852e56827f5cb5db9d6e8dd8191fc2f2e8f424 ]
+
+The abracon,tc-resistor property value is in kOhm.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/rtc/abracon,abx80x.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+index be789685a1c24..18b892d010d87 100644
+--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+@@ -27,4 +27,4 @@ and valid to enable charging:
+
+ - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V)
+ - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output
+- resistor, the other values are in ohm.
++ resistor, the other values are in kOhm.
+--
+2.20.1
+
--- /dev/null
+From 9b86a00b0a7dc56b386e0396e145281c1c726a29 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:19:51 +0100
+Subject: rtc: max8997: Fix the returned value in case of error in
+ 'max8997_rtc_read_alarm()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 41ef3878203cd9218d92eaa07df4b85a2cb128fb ]
+
+In case of error, we return 0.
+This is spurious and not consistent with the other functions of the driver.
+Propagate the error code instead.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-max8997.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c
+index db984d4bf9526..4cce5bd448f65 100644
+--- a/drivers/rtc/rtc-max8997.c
++++ b/drivers/rtc/rtc-max8997.c
+@@ -221,7 +221,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+
+ out:
+ mutex_unlock(&info->lock);
+- return 0;
++ return ret;
+ }
+
+ static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info)
+--
+2.20.1
+
--- /dev/null
+From 7a87f02b2067017c158c0c578cada0368321e971 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 12:32:50 +0100
+Subject: rtc: s3c-rtc: Avoid using broken ALMYEAR register
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 50c8aec4212a966817e868056efc9bfbb73337c0 ]
+
+(RTC,ALM)YEAR registers of Exynos built-in RTC device contains 3 BCD
+characters. s3c-rtc driver uses only 2 lower of them and supports years
+from 2000..2099 range. The third BCD value is typically set to 0, but it
+looks that handling of it is broken in the hardware. It sometimes
+defaults to a random (even non-BCD) value. This is not an issue
+for handling RTCYEAR register, because bcd2bin() properly handles only
+8bit values (2 BCD characters, the third one is skipped). The problem
+is however with ALMYEAR register and proper RTC alarm operation. When
+YEAREN bit is set for the configured alarm, RTC hardware triggers alarm
+only when ALMYEAR and RTCYEAR matches. This usually doesn't happen
+because of the random noise on the third BCD character.
+
+Fix this by simply skipping setting ALMYEAR register in alarm
+configuration. This workaround fixes broken alarm operation on Exynos
+built-in rtc device. My tests revealed that the issue happens on the
+following Exynos series: 3250, 4210, 4412, 5250 and 5410.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-s3c.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
+index a8992c227f611..4120a305954af 100644
+--- a/drivers/rtc/rtc-s3c.c
++++ b/drivers/rtc/rtc-s3c.c
+@@ -327,7 +327,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ struct rtc_time *tm = &alrm->time;
+ unsigned int alrm_en;
+ int ret;
+- int year = tm->tm_year - 100;
+
+ dev_dbg(dev, "s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n",
+ alrm->enabled,
+@@ -356,11 +355,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ writeb(bin2bcd(tm->tm_hour), info->base + S3C2410_ALMHOUR);
+ }
+
+- if (year < 100 && year >= 0) {
+- alrm_en |= S3C2410_RTCALM_YEAREN;
+- writeb(bin2bcd(year), info->base + S3C2410_ALMYEAR);
+- }
+-
+ if (tm->tm_mon < 12 && tm->tm_mon >= 0) {
+ alrm_en |= S3C2410_RTCALM_MONEN;
+ writeb(bin2bcd(tm->tm_mon + 1), info->base + S3C2410_ALMMON);
+--
+2.20.1
+
--- /dev/null
+From 8a20a0319c6b00a4d949594b0929f3879cb7d54a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 11:18:37 +0200
+Subject: sched/core: Avoid spurious lock dependencies
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit ff51ff84d82aea5a889b85f2b9fb3aa2b8691668 ]
+
+While seemingly harmless, __sched_fork() does hrtimer_init(), which,
+when DEBUG_OBJETS, can end up doing allocations.
+
+This then results in the following lock order:
+
+ rq->lock
+ zone->lock.rlock
+ batched_entropy_u64.lock
+
+Which in turn causes deadlocks when we do wakeups while holding that
+batched_entropy lock -- as the random code does.
+
+Solve this by moving __sched_fork() out from under rq->lock. This is
+safe because nothing there relies on rq->lock, as also evident from the
+other __sched_fork() callsite.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qian Cai <cai@lca.pw>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: akpm@linux-foundation.org
+Cc: bigeasy@linutronix.de
+Cc: cl@linux.com
+Cc: keescook@chromium.org
+Cc: penberg@kernel.org
+Cc: rientjes@google.com
+Cc: thgarnie@google.com
+Cc: tytso@mit.edu
+Cc: will@kernel.org
+Fixes: b7d5dc21072c ("random: add a spinlock_t to struct batched_entropy")
+Link: https://lkml.kernel.org/r/20191001091837.GK4536@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index bbf8b32fc69ec..97a27726ea217 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5242,10 +5242,11 @@ void init_idle(struct task_struct *idle, int cpu)
+ struct rq *rq = cpu_rq(cpu);
+ unsigned long flags;
+
++ __sched_fork(0, idle);
++
+ raw_spin_lock_irqsave(&idle->pi_lock, flags);
+ raw_spin_lock(&rq->lock);
+
+- __sched_fork(0, idle);
+ idle->state = TASK_RUNNING;
+ idle->se.exec_start = sched_clock();
+ idle->flags |= PF_IDLE;
+--
+2.20.1
+
--- /dev/null
+From 0c8d6332455e6a063b9fecb7b2116c536edc82b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 01:25:18 -0800
+Subject: scsi: qedi: Allocate IRQs based on msix_cnt
+
+From: Nilesh Javali <nilesh.javali@cavium.com>
+
+[ Upstream commit 1a291bce5eaf5374627d337157544aa6499ce34a ]
+
+The driver load on some systems failed with error,
+[0004:01:00.5]:[qedi_request_msix_irq:2524]:8: request_irq failed.
+
+Allocate the IRQs based on MSIX count obtained from qed module instead of
+number of queues.
+
+Signed-off-by: Nilesh Javali <nilesh.javali@cavium.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 24b945b555ba3..6e318a995dcc4 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1099,7 +1099,7 @@ static int qedi_request_msix_irq(struct qedi_ctx *qedi)
+ int i, rc, cpu;
+
+ cpu = cpumask_first(cpu_online_mask);
+- for (i = 0; i < MIN_NUM_CPUS_MSIX(qedi); i++) {
++ for (i = 0; i < qedi->int_info.msix_cnt; i++) {
+ rc = request_irq(qedi->int_info.msix[i].vector,
+ qedi_msix_handler, 0, "qedi",
+ &qedi->fp_array[i]);
+--
+2.20.1
+
--- /dev/null
+From 13fba4d9c2c91126df2be5309c4c15aeb28a0f85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 15:44:57 +0100
+Subject: scsi: zfcp: drop default switch case which might paper over missing
+ case
+
+From: Steffen Maier <maier@linux.ibm.com>
+
+[ Upstream commit 0c902936e55cff9335b27ed632fc45e7115ced75 ]
+
+This was introduced with v4.18 commit 8c3d20aada70 ("scsi: zfcp: fix
+missing REC trigger trace for all objects in ERP_FAILED") but would now
+suppress helpful -Wswitch compiler warnings when building with W=1 such as
+the following forced example:
+
+drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_handle_failed':
+drivers/s390/scsi/zfcp_erp.c:126:2: warning: enumeration value 'ZFCP_ERP_ACTION_REOPEN_PORT_FORCED' not handled in switch [-Wswitch]
+ switch (want) {
+ ^~~~~~
+
+But then again, only with W=1 we would notice unhandled enum cases.
+Without the default cases and a missed unhandled enum case, the code might
+perform unforeseen things we might not want...
+
+As of today, we never run through the removed default case, so removing it
+is no functional change. In the future, we never should run through a
+default case but introduce the necessary specific case(s) to handle new
+functionality.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/scsi/zfcp_erp.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index 64d70de98cdb6..8f90e4cea2545 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -179,9 +179,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter,
+ adapter, ZFCP_STATUS_COMMON_ERP_FAILED);
+ }
+ break;
+- default:
+- need = 0;
+- break;
+ }
+
+ return need;
+--
+2.20.1
+
--- /dev/null
+From 072baaa590934b993298e3ca984bed61ace6abf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:11:04 -0700
+Subject: serial: core: Allow processing sysrq at port unlock time
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit d6e1935819db0c91ce4a5af82466f3ab50d17346 ]
+
+Right now serial drivers process sysrq keys deep in their character
+receiving code. This means that they've already grabbed their
+port->lock spinlock. This can end up getting in the way if we've go
+to do serial stuff (especially kgdb) in response to the sysrq.
+
+Serial drivers have various hacks in them to handle this. Looking at
+'8250_port.c' you can see that the console_write() skips locking if
+we're in the sysrq handler. Looking at 'msm_serial.c' you can see
+that the port lock is dropped around uart_handle_sysrq_char().
+
+It turns out that these hacks aren't exactly perfect. If you have
+lockdep turned on and use something like the 8250_port hack you'll get
+a splat that looks like:
+
+ WARNING: possible circular locking dependency detected
+ [...] is trying to acquire lock:
+ ... (console_owner){-.-.}, at: console_unlock+0x2e0/0x5e4
+
+ but task is already holding lock:
+ ... (&port_lock_key){-.-.}, at: serial8250_handle_irq+0x30/0xe4
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #1 (&port_lock_key){-.-.}:
+ _raw_spin_lock_irqsave+0x58/0x70
+ serial8250_console_write+0xa8/0x250
+ univ8250_console_write+0x40/0x4c
+ console_unlock+0x528/0x5e4
+ register_console+0x2c4/0x3b0
+ uart_add_one_port+0x350/0x478
+ serial8250_register_8250_port+0x350/0x3a8
+ dw8250_probe+0x67c/0x754
+ platform_drv_probe+0x58/0xa4
+ really_probe+0x150/0x294
+ driver_probe_device+0xac/0xe8
+ __driver_attach+0x98/0xd0
+ bus_for_each_dev+0x84/0xc8
+ driver_attach+0x2c/0x34
+ bus_add_driver+0xf0/0x1ec
+ driver_register+0xb4/0x100
+ __platform_driver_register+0x60/0x6c
+ dw8250_platform_driver_init+0x20/0x28
+ ...
+
+ -> #0 (console_owner){-.-.}:
+ lock_acquire+0x1e8/0x214
+ console_unlock+0x35c/0x5e4
+ vprintk_emit+0x230/0x274
+ vprintk_default+0x7c/0x84
+ vprintk_func+0x190/0x1bc
+ printk+0x80/0xa0
+ __handle_sysrq+0x104/0x21c
+ handle_sysrq+0x30/0x3c
+ serial8250_read_char+0x15c/0x18c
+ serial8250_rx_chars+0x34/0x74
+ serial8250_handle_irq+0x9c/0xe4
+ dw8250_handle_irq+0x98/0xcc
+ serial8250_interrupt+0x50/0xe8
+ ...
+
+ other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&port_lock_key);
+ lock(console_owner);
+ lock(&port_lock_key);
+ lock(console_owner);
+
+ *** DEADLOCK ***
+
+The hack used in 'msm_serial.c' doesn't cause the above splats but it
+seems a bit ugly to unlock / lock our spinlock deep in our irq
+handler.
+
+It seems like we could defer processing the sysrq until the end of the
+interrupt handler right after we've unlocked the port. With this
+scheme if a whole batch of sysrq characters comes in one irq then we
+won't handle them all, but that seems like it should be a fine
+compromise.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/serial_core.h | 37 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
+index 868b60a79c0b8..b2a7b7c15451b 100644
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -166,6 +166,7 @@ struct uart_port {
+ struct console *cons; /* struct console, if any */
+ #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ)
+ unsigned long sysrq; /* sysrq timeout */
++ unsigned int sysrq_ch; /* char for sysrq */
+ #endif
+
+ /* flags must be updated while holding port mutex */
+@@ -474,8 +475,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
+ }
+ return 0;
+ }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
++{
++ if (port->sysrq) {
++ if (ch && time_before(jiffies, port->sysrq)) {
++ port->sysrq_ch = ch;
++ port->sysrq = 0;
++ return 1;
++ }
++ port->sysrq = 0;
++ }
++ return 0;
++}
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ int sysrq_ch;
++
++ sysrq_ch = port->sysrq_ch;
++ port->sysrq_ch = 0;
++
++ spin_unlock_irqrestore(&port->lock, irqflags);
++
++ if (sysrq_ch)
++ handle_sysrq(sysrq_ch);
++}
+ #else
+-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; })
++static inline int
++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ spin_unlock_irqrestore(&port->lock, irqflags);
++}
+ #endif
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 92599de87b6f003e179d561f143119b10ee0204a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:49:38 +0100
+Subject: serial: imx: fix error handling in console_setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 63fd4b94b948c14eeb27a3bbf50ea0f7f0593bad ]
+
+The ipg clock only needs to be unprepared in case preparing
+per clock fails. The ipg clock has already disabled at the point.
+
+Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/imx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 4e827e5a52a36..aae68230fb7b8 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1956,7 +1956,7 @@ imx_console_setup(struct console *co, char *options)
+
+ retval = clk_prepare(sport->clk_per);
+ if (retval)
+- clk_disable_unprepare(sport->clk_ipg);
++ clk_unprepare(sport->clk_ipg);
+
+ error_console:
+ return retval;
+--
+2.20.1
+
serial-pl011-fix-dma-flush_buffer.patch
serial-serial_core-perform-null-checks-for-break_ctl-ops.patch
serial-ifx6x60-add-missed-pm_runtime_disable.patch
+autofs-fix-a-leak-in-autofs_expire_indirect.patch
+rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch
+iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch
+exportfs_decode_fh-negative-pinned-may-become-positi.patch
+audit_get_nd-don-t-unlock-parent-too-early.patch
+nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch
+xfrm-release-device-reference-for-invalid-state.patch
+input-cyttsp4_core-fix-use-after-free-bug.patch
+sched-core-avoid-spurious-lock-dependencies.patch
+alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch
+rsxx-add-missed-destroy_workqueue-calls-in-remove.patch
+net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch
+i2c-core-fix-use-after-free-in-of_i2c_notify.patch
+serial-core-allow-processing-sysrq-at-port-unlock-ti.patch
+cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch
+iwlwifi-mvm-synchronize-tid-queue-removal.patch
+iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch
+dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch
+arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch
+net-mlx5-release-resource-on-error-flow.patch
+pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch
+clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch
+dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch
+extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch
+net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch
+rtc-s3c-rtc-avoid-using-broken-almyear-register.patch
+i40e-don-t-restart-nway-if-autoneg-not-supported.patch
+clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch
+clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch
+arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch
+dlm-fix-missing-idr_destroy-for-recover_idr.patch
+mips-sibyte-enable-zone_dma32-for-littlesur.patch
+net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch
+scsi-zfcp-drop-default-switch-case-which-might-paper.patch
+crypto-ecc-check-for-invalid-values-in-the-key-verif.patch
+crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch
+pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch
+staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch
+mm-vmstat.c-fix-numa-statistics-updates.patch
+clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch
+clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch
+regulator-fix-return-value-of-_set_load-stub.patch
+net-next-hinic-fix-a-bug-in-set-mac-address.patch
+iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch
+iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch
+mips-octeon-octeon-platform-fix-typing.patch
+net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch
+math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch
+rtc-max8997-fix-the-returned-value-in-case-of-error-.patch
+rtc-dt-binding-abx80x-fix-resistance-scale.patch
+arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch
+media-coda-fix-memory-corruption-in-case-more-than-3.patch
+media-pulse8-cec-return-0-when-invalidating-the-logi.patch
+media-cec-report-vendor-id-after-initialization.patch
+dmaengine-coh901318-fix-a-double-lock-bug.patch
+dmaengine-dw-dmac-implement-dma-protection-control-s.patch
+usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch
+usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch
+acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch
+f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch
+f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch
+arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch
+arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch
+f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch
+sparc-correct-ctx-saw_frame_pointer-logic.patch
+dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch
+altera-stapl-check-for-a-null-key-before-strcasecmp-.patch
+serial-imx-fix-error-handling-in-console_setup.patch
+i2c-imx-don-t-print-error-message-on-probe-defer.patch
+lockd-fix-decoding-of-test-results.patch
+asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch
+arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch
+arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch
+dlm-null-check-before-kmem_cache_destroy-is-not-need.patch
+arm-debug-enable-uart1-for-socfpga-cyclone5.patch
+nfsd-fix-a-warning-in-__cld_pipe_upcall.patch
+scsi-qedi-allocate-irqs-based-on-msix_cnt.patch
+asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch
+arm-omap1-2-fix-soc-name-printing.patch
+arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch
+arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch
+arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch
+arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch
+net-x25-fix-called-calling-length-calculation-in-x25.patch
+net-x25-fix-null_x25_address-handling.patch
+arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch
+arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch
+tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch
+tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch
+tcp-fix-snmp-tcp-timeout-under-estimation.patch
+modpost-skip-elf-local-symbols-during-section-mismat.patch
+kbuild-fix-single-target-build-for-external-module.patch
+mtd-fix-mtd_oobavail-incoherent-returned-value.patch
+arm-dts-pxa-clean-up-usb-controller-nodes.patch
+arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch
+clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch
+arm-dts-realview-fix-some-more-duplicate-regulator-n.patch
+dlm-fix-invalid-cluster-name-warning.patch
+net-mlx4_core-fix-return-codes-of-unsupported-operat.patch
+pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch
+powerpc-math-emu-update-macros-from-gcc.patch
+clk-renesas-r8a77995-correct-parent-clock-of-du.patch
+mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch
+nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch
+tty-don-t-block-on-io-when-ldisc-change-is-pending.patch
+media-stkwebcam-bugfix-for-wrong-return-values.patch
+firmware-qcom-scm-fix-compilation-error-when-disable.patch
+mlxsw-spectrum_router-relax-gre-decap-matching-check.patch
+ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch
+ib-hfi1-close-vnic-sdma_progress-sleep-window.patch
+mlx4-use-snprintf-instead-of-complicated-strcpy.patch
+usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch
+arm-dts-sunxi-fix-pmu-compatible-strings.patch
+media-vimc-fix-start-stream-when-link-is-disabled.patch
+net-aquantia-fix-rss-table-and-key-sizes.patch
--- /dev/null
+From 76a1d0c26657d948677b48e3fa57271beb45b92e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 14:52:18 -0800
+Subject: sparc: Correct ctx->saw_frame_pointer logic.
+
+From: David Miller <davem@davemloft.net>
+
+[ Upstream commit e2ac579a7a18bcd9e8cf14cf42eac0b8a2ba6c4b ]
+
+We need to initialize the frame pointer register not just if it is
+seen as a source operand, but also if it is seen as the destination
+operand of a store or an atomic instruction (which effectively is a
+source operand).
+
+This is exercised by test_verifier's "non-invalid fp arithmetic"
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/net/bpf_jit_comp_64.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
+index adfb4581bd809..dfb1a62abe932 100644
+--- a/arch/sparc/net/bpf_jit_comp_64.c
++++ b/arch/sparc/net/bpf_jit_comp_64.c
+@@ -1326,6 +1326,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ u32 opcode = 0, rs2;
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_2_used = true;
+ emit_loadimm(imm, tmp2, ctx);
+
+@@ -1364,6 +1367,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp = bpf2sparc[TMP_REG_1];
+ u32 opcode = 0, rs2;
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ switch (BPF_SIZE(code)) {
+ case BPF_W:
+ opcode = ST32;
+@@ -1396,6 +1402,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ const u8 tmp3 = bpf2sparc[TMP_REG_3];
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_1_used = true;
+ ctx->tmp_2_used = true;
+ ctx->tmp_3_used = true;
+@@ -1416,6 +1425,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ const u8 tmp3 = bpf2sparc[TMP_REG_3];
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_1_used = true;
+ ctx->tmp_2_used = true;
+ ctx->tmp_3_used = true;
+--
+2.20.1
+
--- /dev/null
+From cddc575f94091294b51e56123634ce94a7617ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Nov 2018 04:19:07 +0530
+Subject: Staging: iio: adt7316: Fix i2c data reading, set the data field
+
+From: Shreeya Patel <shreeya.patel23498@gmail.com>
+
+[ Upstream commit 688cd642ba0c393344c802647848da5f0d925d0e ]
+
+adt7316_i2c_read function nowhere sets the data field.
+It is necessary to have an appropriate value for it.
+Hence, assign the value stored in 'ret' variable to data field.
+
+This is an ancient bug, and as no one seems to have noticed,
+probably no sense in applying it to stable.
+
+Signed-off-by: Shreeya Patel <shreeya.patel23498@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/iio/addac/adt7316-i2c.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c
+index f66dd3ebbab1f..856bcfa60c6c4 100644
+--- a/drivers/staging/iio/addac/adt7316-i2c.c
++++ b/drivers/staging/iio/addac/adt7316-i2c.c
+@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data)
+ return ret;
+ }
+
++ *data = ret;
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 34f6afb5fca2b5cf21b37cc1b16bac8d08b0de2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 16:06:43 -0800
+Subject: tcp: fix off-by-one bug on aborting window-probing socket
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit 3976535af0cb9fe34a55f2ffb8d7e6b39a2f8188 ]
+
+Previously there is an off-by-one bug on determining when to abort
+a stalled window-probing socket. This patch fixes that so it is
+consistent with tcp_write_timeout().
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_timer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 592d6e9967a91..04e2c43a43a5a 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -358,7 +358,7 @@ static void tcp_probe_timer(struct sock *sk)
+ return;
+ }
+
+- if (icsk->icsk_probes_out > max_probes) {
++ if (icsk->icsk_probes_out >= max_probes) {
+ abort: tcp_write_err(sk);
+ } else {
+ /* Only send another probe if we didn't close things up. */
+--
+2.20.1
+
--- /dev/null
+From 07e39765cb3b9b215996bb31dfa50dd661b695d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 16:06:45 -0800
+Subject: tcp: fix SNMP TCP timeout under-estimation
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit e1561fe2dd69dc5dddd69bd73aa65355bdfb048b ]
+
+Previously the SNMP TCPTIMEOUTS counter has inconsistent accounting:
+1. It counts all SYN and SYN-ACK timeouts
+2. It counts timeouts in other states except recurring timeouts and
+ timeouts after fast recovery or disorder state.
+
+Such selective accounting makes analysis difficult and complicated. For
+example the monitoring system needs to collect many other SNMP counters
+to infer the total amount of timeout events. This patch makes TCPTIMEOUTS
+counter simply counts all the retransmit timeout (SYN or data or FIN).
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_timer.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 04e2c43a43a5a..65f66bd585e62 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -464,11 +464,12 @@ void tcp_retransmit_timer(struct sock *sk)
+ goto out_reset_timer;
+ }
+
++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
+ if (tcp_write_timeout(sk))
+ goto out;
+
+ if (icsk->icsk_retransmits == 0) {
+- int mib_idx;
++ int mib_idx = 0;
+
+ if (icsk->icsk_ca_state == TCP_CA_Recovery) {
+ if (tcp_is_sack(tp))
+@@ -483,10 +484,9 @@ void tcp_retransmit_timer(struct sock *sk)
+ mib_idx = LINUX_MIB_TCPSACKFAILURES;
+ else
+ mib_idx = LINUX_MIB_TCPRENOFAILURES;
+- } else {
+- mib_idx = LINUX_MIB_TCPTIMEOUTS;
+ }
+- __NET_INC_STATS(sock_net(sk), mib_idx);
++ if (mib_idx)
++ __NET_INC_STATS(sock_net(sk), mib_idx);
+ }
+
+ tcp_enter_loss(sk);
+--
+2.20.1
+
--- /dev/null
+From 70c9babedaf9ffe0277450688cc30a9ec76bb1f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 16:06:44 -0800
+Subject: tcp: fix SNMP under-estimation on failed retransmission
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit ec641b39457e17774313b66697a8a1dc070257bd ]
+
+Previously the SNMP counter LINUX_MIB_TCPRETRANSFAIL is not counting
+the TSO/GSO properly on failed retransmission. This patch fixes that.
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 5b808089eff89..6025cc509d974 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2932,7 +2932,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ if (likely(!err)) {
+ TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
+ } else if (err != -EBUSY) {
+- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
++ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs);
+ }
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From c761aae7426f70e4cdc4a33d4d0d16241016e529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Nov 2018 00:24:48 +0000
+Subject: tty: Don't block on IO when ldisc change is pending
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit c96cf923a98d1b094df9f0cf97a83e118817e31b ]
+
+There might be situations where tty_ldisc_lock() has blocked, but there
+is already IO on tty and it prevents line discipline changes.
+It might theoretically turn into dead-lock.
+
+Basically, provide more priority to pending tty_ldisc_lock() than to
+servicing reads/writes over tty.
+
+User-visible issue was reported by Mikulas where on pa-risc with
+Debian 5 reboot took either 80 seconds, 3 minutes or 3:25 after proper
+locking in tty_reopen().
+
+Cc: Jiri Slaby <jslaby@suse.com>
+Reported-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_hdlc.c | 4 ++--
+ drivers/tty/n_r3964.c | 2 +-
+ drivers/tty/n_tty.c | 8 ++++----
+ drivers/tty/tty_ldisc.c | 7 +++++++
+ include/linux/tty.h | 7 +++++++
+ 5 files changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index e83dea8d6633a..19c4aa800c810 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -614,7 +614,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
+ }
+
+ /* no data */
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ ret = -EAGAIN;
+ break;
+ }
+@@ -681,7 +681,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
+ if (tbuf)
+ break;
+
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ error = -EAGAIN;
+ break;
+ }
+diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c
+index 305b6490d4053..08ac04d089916 100644
+--- a/drivers/tty/n_r3964.c
++++ b/drivers/tty/n_r3964.c
+@@ -1080,7 +1080,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
+ pMsg = remove_msg(pInfo, pClient);
+ if (pMsg == NULL) {
+ /* no messages available. */
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ ret = -EAGAIN;
+ goto unlock;
+ }
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 904fc9c37fdea..8214b0326b3a1 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1704,7 +1704,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+
+ down_read(&tty->termios_rwsem);
+
+- while (1) {
++ do {
+ /*
+ * When PARMRK is set, each input char may take up to 3 chars
+ * in the read buf; reduce the buffer space avail by 3x
+@@ -1746,7 +1746,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+ fp += n;
+ count -= n;
+ rcvd += n;
+- }
++ } while (!test_bit(TTY_LDISC_CHANGING, &tty->flags));
+
+ tty->receive_room = room;
+
+@@ -2213,7 +2213,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ break;
+ if (!timeout)
+ break;
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ retval = -EAGAIN;
+ break;
+ }
+@@ -2367,7 +2367,7 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
+ }
+ if (!nr)
+ break;
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ retval = -EAGAIN;
+ break;
+ }
+diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
+index 01fcdc7ff0771..62dd2abb57fea 100644
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -348,6 +348,11 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ {
+ int ret;
+
++ /* Kindly asking blocked readers to release the read side */
++ set_bit(TTY_LDISC_CHANGING, &tty->flags);
++ wake_up_interruptible_all(&tty->read_wait);
++ wake_up_interruptible_all(&tty->write_wait);
++
+ ret = __tty_ldisc_lock(tty, timeout);
+ if (!ret)
+ return -EBUSY;
+@@ -358,6 +363,8 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ void tty_ldisc_unlock(struct tty_struct *tty)
+ {
+ clear_bit(TTY_LDISC_HALTED, &tty->flags);
++ /* Can be cleared here - ldisc_unlock will wake up writers firstly */
++ clear_bit(TTY_LDISC_CHANGING, &tty->flags);
+ __tty_ldisc_unlock(tty);
+ }
+
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 1dd587ba6d882..0cd621d8c7f05 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -365,6 +365,7 @@ struct tty_file_private {
+ #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */
+ #define TTY_HUPPED 18 /* Post driver->hangup() */
+ #define TTY_HUPPING 19 /* Hangup in progress */
++#define TTY_LDISC_CHANGING 20 /* Change pending - non-block IO */
+ #define TTY_LDISC_HALTED 22 /* Line discipline is halted */
+
+ /* Values for tty->flow_change */
+@@ -382,6 +383,12 @@ static inline void tty_set_flow_change(struct tty_struct *tty, int val)
+ smp_mb();
+ }
+
++static inline bool tty_io_nonblock(struct tty_struct *tty, struct file *file)
++{
++ return file->f_flags & O_NONBLOCK ||
++ test_bit(TTY_LDISC_CHANGING, &tty->flags);
++}
++
+ static inline bool tty_io_error(struct tty_struct *tty)
+ {
+ return test_bit(TTY_IO_ERROR, &tty->flags);
+--
+2.20.1
+
--- /dev/null
+From c6eeee9af3b160b43110caae00dc925e737db284 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 17:55:19 -0800
+Subject: usb: dwc3: debugfs: Properly print/set link state for HS
+
+From: Thinh Nguyen <thinh.nguyen@synopsys.com>
+
+[ Upstream commit 0d36dede457873404becd7c9cb9d0f2bcfd0dcd9 ]
+
+Highspeed device and below has different state names than superspeed and
+higher. Add proper checks and printouts of link states for highspeed and
+below.
+
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/debug.h | 29 +++++++++++++++++++++++++++++
+ drivers/usb/dwc3/debugfs.c | 19 +++++++++++++++++--
+ 2 files changed, 46 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
+index 5e9c070ec8747..1b4c2f8bb3daf 100644
+--- a/drivers/usb/dwc3/debug.h
++++ b/drivers/usb/dwc3/debug.h
+@@ -124,6 +124,35 @@ dwc3_gadget_link_string(enum dwc3_link_state link_state)
+ }
+ }
+
++/**
++ * dwc3_gadget_hs_link_string - returns highspeed and below link name
++ * @link_state: link state code
++ */
++static inline const char *
++dwc3_gadget_hs_link_string(enum dwc3_link_state link_state)
++{
++ switch (link_state) {
++ case DWC3_LINK_STATE_U0:
++ return "On";
++ case DWC3_LINK_STATE_U2:
++ return "Sleep";
++ case DWC3_LINK_STATE_U3:
++ return "Suspend";
++ case DWC3_LINK_STATE_SS_DIS:
++ return "Disconnected";
++ case DWC3_LINK_STATE_RX_DET:
++ return "Early Suspend";
++ case DWC3_LINK_STATE_RECOV:
++ return "Recovery";
++ case DWC3_LINK_STATE_RESET:
++ return "Reset";
++ case DWC3_LINK_STATE_RESUME:
++ return "Resume";
++ default:
++ return "UNKNOWN link state\n";
++ }
++}
++
+ /**
+ * dwc3_trb_type_string - returns TRB type as a string
+ * @type: the type of the TRB
+diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
+index 4e09be80e59f9..0d6a6a168a7ec 100644
+--- a/drivers/usb/dwc3/debugfs.c
++++ b/drivers/usb/dwc3/debugfs.c
+@@ -436,13 +436,17 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused)
+ unsigned long flags;
+ enum dwc3_link_state state;
+ u32 reg;
++ u8 speed;
+
+ spin_lock_irqsave(&dwc->lock, flags);
+ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ state = DWC3_DSTS_USBLNKST(reg);
+- spin_unlock_irqrestore(&dwc->lock, flags);
++ speed = reg & DWC3_DSTS_CONNECTSPD;
+
+- seq_printf(s, "%s\n", dwc3_gadget_link_string(state));
++ seq_printf(s, "%s\n", (speed >= DWC3_DSTS_SUPERSPEED) ?
++ dwc3_gadget_link_string(state) :
++ dwc3_gadget_hs_link_string(state));
++ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+ }
+@@ -460,6 +464,8 @@ static ssize_t dwc3_link_state_write(struct file *file,
+ unsigned long flags;
+ enum dwc3_link_state state = 0;
+ char buf[32];
++ u32 reg;
++ u8 speed;
+
+ if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+ return -EFAULT;
+@@ -480,6 +486,15 @@ static ssize_t dwc3_link_state_write(struct file *file,
+ return -EINVAL;
+
+ spin_lock_irqsave(&dwc->lock, flags);
++ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
++ speed = reg & DWC3_DSTS_CONNECTSPD;
++
++ if (speed < DWC3_DSTS_SUPERSPEED &&
++ state != DWC3_LINK_STATE_RECOV) {
++ spin_unlock_irqrestore(&dwc->lock, flags);
++ return -EINVAL;
++ }
++
+ dwc3_gadget_set_link_state(dwc, state);
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+--
+2.20.1
+
--- /dev/null
+From 32c4336c22651de8893c3314ab17a3ec27983b7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 12:40:29 -0800
+Subject: usb: dwc3: don't log probe deferrals; but do log other error codes
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 408d3ba006af57380fa48858b39f72fde6405031 ]
+
+It's not very useful to repeat a bunch of probe deferral errors. And
+it's also not very useful to log "failed" without telling the error
+code.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 48755c501201d..a497b878c3e2b 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1261,7 +1261,8 @@ static int dwc3_probe(struct platform_device *pdev)
+
+ ret = dwc3_core_init(dwc);
+ if (ret) {
+- dev_err(dev, "failed to initialize core\n");
++ if (ret != -EPROBE_DEFER)
++ dev_err(dev, "failed to initialize core: %d\n", ret);
+ goto err4;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0f5be1efe0504b85942435d620bc59758a413e44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 03:52:43 +0000
+Subject: usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit f770e3bc236ee954a3b4052bdf55739e26ee25db ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/usb/mtu3/mtu3_qmu.c: In function 'qmu_tx_zlp_error_handler':
+drivers/usb/mtu3/mtu3_qmu.c:385:22: warning:
+ variable 'req' set but not used [-Wunused-but-set-variable]
+
+It seems dbginfo original intention is print 'req' other than 'mreq'
+
+Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mtu3/mtu3_qmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c
+index 7d9ba8a52368f..c87947fb26940 100644
+--- a/drivers/usb/mtu3/mtu3_qmu.c
++++ b/drivers/usb/mtu3/mtu3_qmu.c
+@@ -372,7 +372,7 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum)
+ return;
+ }
+
+- dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, mreq);
++ dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, req);
+
+ mtu3_clrbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_DMAREQEN);
+
+--
+2.20.1
+
--- /dev/null
+From b4c88fd1852cd8730c78e3900205f47360bc2770 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 15:05:46 -0800
+Subject: xfrm: release device reference for invalid state
+
+From: Xiaodong Xu <stid.smth@gmail.com>
+
+[ Upstream commit 4944a4b1077f74d89073624bd286219d2fcbfce3 ]
+
+An ESP packet could be decrypted in async mode if the input handler for
+this packet returns -EINPROGRESS in xfrm_input(). At this moment the device
+reference in skb is held. Later xfrm_input() will be invoked again to
+resume the processing.
+If the transform state is still valid it would continue to release the
+device reference and there won't be a problem; however if the transform
+state is not valid when async resumption happens, the packet will be
+dropped while the device reference is still being held.
+When the device is deleted for some reason and the reference to this
+device is not properly released, the kernel will keep logging like:
+
+unregister_netdevice: waiting for ppp2 to become free. Usage count = 1
+
+The issue is observed when running IPsec traffic over a PPPoE device based
+on a bridge interface. By terminating the PPPoE connection on the server
+end for multiple times, the PPPoE device on the client side will eventually
+get stuck on the above warning message.
+
+This patch will check the async mode first and continue to release device
+reference in async resumption, before it is dropped due to invalid state.
+
+v2: Do not assign address family from outer_mode in the transform if the
+state is invalid
+
+v3: Release device reference in the error path instead of jumping to resume
+
+Fixes: 4ce3dbe397d7b ("xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)")
+Signed-off-by: Xiaodong Xu <stid.smth@gmail.com>
+Reported-by: Bo Chen <chenborfc@163.com>
+Tested-by: Bo Chen <chenborfc@163.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_input.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index fc0a9ce1be18f..311597401b821 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -245,6 +245,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ else
+ XFRM_INC_STATS(net,
+ LINUX_MIB_XFRMINSTATEINVALID);
++
++ if (encap_type == -1)
++ dev_put(skb->dev);
+ goto drop;
+ }
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
