--- /dev/null
+From b1ba90684179f3b25165da9b458d5e24bf73e34b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Nov 2018 23:07:14 +0300
+Subject: ACPI: fix acpi_find_child_device() invocation in
+ acpi_preset_companion()
+
+From: Alexey Dobriyan <adobriyan@gmail.com>
+
+[ Upstream commit f8c6d1402b89f22a3647705d63cbd171aa19a77e ]
+
+acpi_find_child_device() accepts boolean not pointer as last argument.
+
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+[ rjw: Subject ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/acpi.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index 59a416dfcaaa2..df1252e22dcfd 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -101,7 +101,7 @@ static inline bool has_acpi_companion(struct device *dev)
+ static inline void acpi_preset_companion(struct device *dev,
+ struct acpi_device *parent, u64 addr)
+ {
+- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL));
++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false));
+ }
+
+ static inline const char *acpi_dev_name(struct acpi_device *adev)
+--
+2.20.1
+
--- /dev/null
+From 7c2fb5c105e9e18e7f86c9577444970d7062524f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 01:17:14 +0800
+Subject: ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
+
+From: paulhsia <paulhsia@chromium.org>
+
+[ Upstream commit f5cdc9d4003a2f66ea57b3edd3e04acc2b1a4439 ]
+
+If the nullity check for `substream->runtime` is outside of the lock
+region, it is possible to have a null runtime in the critical section
+if snd_pcm_detach_substream is called right before the lock.
+
+Signed-off-by: paulhsia <paulhsia@chromium.org>
+Link: https://lore.kernel.org/r/20191112171715.128727-2-paulhsia@chromium.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/pcm_lib.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 4e6110d778bd2..ad52126d3d22e 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1797,11 +1797,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ struct snd_pcm_runtime *runtime;
+ unsigned long flags;
+
+- if (PCM_RUNTIME_CHECK(substream))
++ if (snd_BUG_ON(!substream))
+ return;
+- runtime = substream->runtime;
+
+ snd_pcm_stream_lock_irqsave(substream, flags);
++ if (PCM_RUNTIME_CHECK(substream))
++ goto _unlock;
++ runtime = substream->runtime;
++
+ if (!snd_pcm_running(substream) ||
+ snd_pcm_update_hw_ptr0(substream, 1) < 0)
+ goto _end;
+@@ -1812,6 +1815,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream)
+ #endif
+ _end:
+ kill_fasync(&runtime->fasync, SIGIO, POLL_IN);
++ _unlock:
+ snd_pcm_stream_unlock_irqrestore(substream, flags);
+ }
+ EXPORT_SYMBOL(snd_pcm_period_elapsed);
+--
+2.20.1
+
--- /dev/null
+From d5640e5a1f74a4c2178c5cb2b62aa3dff19eccc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Nov 2018 12:34:10 +0000
+Subject: altera-stapl: check for a null key before strcasecmp'ing it
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 9ccb645683ef46e3c52c12c088a368baa58447d4 ]
+
+Currently the null check on key is occurring after the strcasecmp on
+the key, hence there is a potential null pointer dereference on key.
+Fix this by checking if key is null first. Also replace the == 0
+check on strcasecmp with just the ! operator.
+
+Detected by CoverityScan, CID#1248787 ("Dereference before null check")
+
+Fixes: fa766c9be58b ("[media] Altera FPGA firmware download module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/altera-stapl/altera.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
+index ef83a9078646f..d2ed3b9728b7c 100644
+--- a/drivers/misc/altera-stapl/altera.c
++++ b/drivers/misc/altera-stapl/altera.c
+@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size,
+ key_ptr = &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i)])];
+- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) &&
+- (key != NULL)) {
++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) {
+ status = 0;
+
+ value_ptr = &p[note_strings +
+--
+2.20.1
+
--- /dev/null
+From 0ecee61df124810670bf289000532f74d3ab1f3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 16:12:12 +0300
+Subject: ARC: IOC: panic if kernel was started with previously enabled IOC
+
+From: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+
+[ Upstream commit 3624379d90ad2b65f9dbb30d7f7ce5498d2fe322 ]
+
+If IOC was already enabled (due to bootloader) it technically needs to
+be reconfigured with aperture base,size corresponding to Linux memory map
+which will certainly be different than uboot's. But disabling and
+reenabling IOC when DMA might be potentially active is tricky business.
+To avoid random memory issues later, just panic here and ask user to
+upgrade bootloader to one which doesn't enable IOC
+
+This was actually seen as issue on some of the HSDK board with a version
+of uboot which enabled IOC. There were random issues later with starting
+of X or peripherals etc.
+
+Also while I'm at it, replace hardcoded bits in ARC_REG_IO_COH_PARTIAL
+and ARC_REG_IO_COH_ENABLE registers by definitions.
+
+Inspired by: https://lkml.org/lkml/2018/1/19/557
+Signed-off-by: Eugeniy Paltsev <Eugeniy.Paltsev@synopsys.com>
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arc/include/asm/cache.h | 2 ++
+ arch/arc/mm/cache.c | 20 +++++++++++++++++---
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
+index db681cf4959c8..2ad77fb43639c 100644
+--- a/arch/arc/include/asm/cache.h
++++ b/arch/arc/include/asm/cache.h
+@@ -124,7 +124,9 @@ extern unsigned long perip_base, perip_end;
+
+ /* IO coherency related Auxiliary registers */
+ #define ARC_REG_IO_COH_ENABLE 0x500
++#define ARC_IO_COH_ENABLE_BIT BIT(0)
+ #define ARC_REG_IO_COH_PARTIAL 0x501
++#define ARC_IO_COH_PARTIAL_BIT BIT(0)
+ #define ARC_REG_IO_COH_AP0_BASE 0x508
+ #define ARC_REG_IO_COH_AP0_SIZE 0x509
+
+diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
+index f2701c13a66b2..cf9619d4efb4f 100644
+--- a/arch/arc/mm/cache.c
++++ b/arch/arc/mm/cache.c
+@@ -1144,6 +1144,20 @@ noinline void __init arc_ioc_setup(void)
+ {
+ unsigned int ioc_base, mem_sz;
+
++ /*
++ * If IOC was already enabled (due to bootloader) it technically needs to
++ * be reconfigured with aperture base,size corresponding to Linux memory map
++ * which will certainly be different than uboot's. But disabling and
++ * reenabling IOC when DMA might be potentially active is tricky business.
++ * To avoid random memory issues later, just panic here and ask user to
++ * upgrade bootloader to one which doesn't enable IOC
++ */
++ if (read_aux_reg(ARC_REG_IO_COH_ENABLE) & ARC_IO_COH_ENABLE_BIT)
++ panic("IOC already enabled, please upgrade bootloader!\n");
++
++ if (!ioc_enable)
++ return;
++
+ /*
+ * As for today we don't support both IOC and ZONE_HIGHMEM enabled
+ * simultaneously. This happens because as of today IOC aperture covers
+@@ -1187,8 +1201,8 @@ noinline void __init arc_ioc_setup(void)
+ panic("IOC Aperture start must be aligned to the size of the aperture");
+
+ write_aux_reg(ARC_REG_IO_COH_AP0_BASE, ioc_base >> 12);
+- write_aux_reg(ARC_REG_IO_COH_PARTIAL, 1);
+- write_aux_reg(ARC_REG_IO_COH_ENABLE, 1);
++ write_aux_reg(ARC_REG_IO_COH_PARTIAL, ARC_IO_COH_PARTIAL_BIT);
++ write_aux_reg(ARC_REG_IO_COH_ENABLE, ARC_IO_COH_ENABLE_BIT);
+
+ /* Re-enable L1 dcache */
+ __dc_enable();
+@@ -1265,7 +1279,7 @@ void __init arc_cache_init_master(void)
+ if (is_isa_arcv2() && l2_line_sz && !slc_enable)
+ arc_slc_disable();
+
+- if (is_isa_arcv2() && ioc_enable)
++ if (is_isa_arcv2() && ioc_exists)
+ arc_ioc_setup();
+
+ if (is_isa_arcv2() && l2_line_sz && slc_enable) {
+--
+2.20.1
+
--- /dev/null
+From 0b81379a1a1bfa43d6079af97f2fa14ee35433ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 10:12:30 +0100
+Subject: ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
+
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+
+[ Upstream commit 344eb5539abf3e0b6ce22568c03e86450073e097 ]
+
+getuser() and putuser() (and there underscored variants) use two
+strb[t]/ldrb[t] instructions when they are asked to get/put 16-bits.
+This means that the read/write is not atomic even when performed to a
+16-bit-aligned address.
+
+This leads to problems with vhost: vhost uses __getuser() to read the
+vring's 16-bit avail.index field, and if it happens to observe a partial
+update of the index, wrong descriptors will be used which will lead to a
+breakdown of the virtio communication. A similar problem exists for
+__putuser() which is used to write to the vring's used.index field.
+
+The reason these functions use strb[t]/ldrb[t] is because strht/ldrht
+instructions did not exist until ARMv6T2/ARMv7. So we should be easily
+able to fix this on ARMv7. Also, since all ARMv6 processors also don't
+actually use the unprivileged instructions anymore for uaccess (since
+CONFIG_CPU_USE_DOMAINS is not used) we can easily fix them too.
+
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess.h | 18 ++++++++++++++++++
+ arch/arm/lib/getuser.S | 11 +++++++++++
+ arch/arm/lib/putuser.S | 20 ++++++++++----------
+ 3 files changed, 39 insertions(+), 10 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
+index c136eef8f690b..6390a40f16e73 100644
+--- a/arch/arm/include/asm/uaccess.h
++++ b/arch/arm/include/asm/uaccess.h
+@@ -349,6 +349,13 @@ do { \
+ #define __get_user_asm_byte(x, addr, err) \
+ __get_user_asm(x, addr, err, ldrb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __get_user_asm_half(x, addr, err) \
++ __get_user_asm(x, addr, err, ldrh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __get_user_asm_half(x, __gu_addr, err) \
+ ({ \
+@@ -367,6 +374,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __get_user_asm_word(x, addr, err) \
+ __get_user_asm(x, addr, err, ldr)
+ #endif
+@@ -442,6 +451,13 @@ do { \
+ #define __put_user_asm_byte(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, strb)
+
++#if __LINUX_ARM_ARCH__ >= 6
++
++#define __put_user_asm_half(x, __pu_addr, err) \
++ __put_user_asm(x, __pu_addr, err, strh)
++
++#else
++
+ #ifndef __ARMEB__
+ #define __put_user_asm_half(x, __pu_addr, err) \
+ ({ \
+@@ -458,6 +474,8 @@ do { \
+ })
+ #endif
+
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ #define __put_user_asm_word(x, __pu_addr, err) \
+ __put_user_asm(x, __pu_addr, err, str)
+
+diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S
+index 746e7801dcdf7..b2e4bc3a635e2 100644
+--- a/arch/arm/lib/getuser.S
++++ b/arch/arm/lib/getuser.S
+@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1)
+
+ ENTRY(__get_user_2)
+ check_uaccess r0, 2, r1, r2, __get_user_bad
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(ldrh) r2, [r0]
++
++#else
++
+ #ifdef CONFIG_CPU_USE_DOMAINS
+ rb .req ip
+ 2: ldrbt r2, [r0], #1
+@@ -56,6 +62,9 @@ rb .req r0
+ #else
+ orr r2, rb, r2, lsl #8
+ #endif
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
++
+ mov r0, #0
+ ret lr
+ ENDPROC(__get_user_2)
+@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8)
+ .pushsection __ex_table, "a"
+ .long 1b, __get_user_bad
+ .long 2b, __get_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __get_user_bad
++#endif
+ .long 4b, __get_user_bad
+ .long 5b, __get_user_bad8
+ .long 6b, __get_user_bad8
+diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S
+index 38d660d3705f4..515eeaa9975c6 100644
+--- a/arch/arm/lib/putuser.S
++++ b/arch/arm/lib/putuser.S
+@@ -41,16 +41,13 @@ ENDPROC(__put_user_1)
+
+ ENTRY(__put_user_2)
+ check_uaccess r0, 2, r1, ip, __put_user_bad
+- mov ip, r2, lsr #8
+-#ifdef CONFIG_THUMB2_KERNEL
+-#ifndef __ARMEB__
+-2: TUSER(strb) r2, [r0]
+-3: TUSER(strb) ip, [r0, #1]
++#if __LINUX_ARM_ARCH__ >= 6
++
++2: TUSER(strh) r2, [r0]
++
+ #else
+-2: TUSER(strb) ip, [r0]
+-3: TUSER(strb) r2, [r0, #1]
+-#endif
+-#else /* !CONFIG_THUMB2_KERNEL */
++
++ mov ip, r2, lsr #8
+ #ifndef __ARMEB__
+ 2: TUSER(strb) r2, [r0], #1
+ 3: TUSER(strb) ip, [r0]
+@@ -58,7 +55,8 @@ ENTRY(__put_user_2)
+ 2: TUSER(strb) ip, [r0], #1
+ 3: TUSER(strb) r2, [r0]
+ #endif
+-#endif /* CONFIG_THUMB2_KERNEL */
++
++#endif /* __LINUX_ARM_ARCH__ >= 6 */
+ mov r0, #0
+ ret lr
+ ENDPROC(__put_user_2)
+@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad)
+ .pushsection __ex_table, "a"
+ .long 1b, __put_user_bad
+ .long 2b, __put_user_bad
++#if __LINUX_ARM_ARCH__ < 6
+ .long 3b, __put_user_bad
++#endif
+ .long 4b, __put_user_bad
+ .long 5b, __put_user_bad
+ .long 6b, __put_user_bad
+--
+2.20.1
+
--- /dev/null
+From a7ca2a7251adb6ab32123a08a9099f56344d3772 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Oct 2018 13:28:37 +0200
+Subject: ARM: debug: enable UART1 for socfpga Cyclone5
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Clément Péron <peron.clem@gmail.com>
+
+[ Upstream commit f6628486c8489e91c513b62608f89ccdb745600d ]
+
+Cyclone5 and Arria10 doesn't have the same memory map for UART1.
+
+Split the SOCFPGA_UART1 into 2 options to allow debugging on UART1 for Cyclone5.
+
+Signed-off-by: Clément Péron <peron.clem@gmail.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/Kconfig.debug | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug
+index f95a90dfc282a..bee0ba1d1cfb7 100644
+--- a/arch/arm/Kconfig.debug
++++ b/arch/arm/Kconfig.debug
+@@ -1079,14 +1079,21 @@ choice
+ Say Y here if you want kernel low-level debugging support
+ on SOCFPGA(Cyclone 5 and Arria 5) based platforms.
+
+- config DEBUG_SOCFPGA_UART1
++ config DEBUG_SOCFPGA_ARRIA10_UART1
+ depends on ARCH_SOCFPGA
+- bool "Use SOCFPGA UART1 for low-level debug"
++ bool "Use SOCFPGA Arria10 UART1 for low-level debug"
+ select DEBUG_UART_8250
+ help
+ Say Y here if you want kernel low-level debugging support
+ on SOCFPGA(Arria 10) based platforms.
+
++ config DEBUG_SOCFPGA_CYCLONE5_UART1
++ depends on ARCH_SOCFPGA
++ bool "Use SOCFPGA Cyclone 5 UART1 for low-level debug"
++ select DEBUG_UART_8250
++ help
++ Say Y here if you want kernel low-level debugging support
++ on SOCFPGA(Cyclone 5 and Arria 5) based platforms.
+
+ config DEBUG_SUN9I_UART0
+ bool "Kernel low-level debugging messages via sun9i UART0"
+@@ -1647,7 +1654,8 @@ config DEBUG_UART_PHYS
+ default 0xfe800000 if ARCH_IOP32X
+ default 0xff690000 if DEBUG_RK32_UART2
+ default 0xffc02000 if DEBUG_SOCFPGA_UART0
+- default 0xffc02100 if DEBUG_SOCFPGA_UART1
++ default 0xffc02100 if DEBUG_SOCFPGA_ARRIA10_UART1
++ default 0xffc03000 if DEBUG_SOCFPGA_CYCLONE5_UART1
+ default 0xffd82340 if ARCH_IOP13XX
+ default 0xffe40000 if DEBUG_RCAR_GEN1_SCIF0
+ default 0xffe42000 if DEBUG_RCAR_GEN1_SCIF2
+@@ -1754,7 +1762,8 @@ config DEBUG_UART_VIRT
+ default 0xfeb30c00 if DEBUG_KEYSTONE_UART0
+ default 0xfeb31000 if DEBUG_KEYSTONE_UART1
+ default 0xfec02000 if DEBUG_SOCFPGA_UART0
+- default 0xfec02100 if DEBUG_SOCFPGA_UART1
++ default 0xfec02100 if DEBUG_SOCFPGA_ARRIA10_UART1
++ default 0xfec03000 if DEBUG_SOCFPGA_CYCLONE5_UART1
+ default 0xfec12000 if (DEBUG_MVEBU_UART0 || DEBUG_MVEBU_UART0_ALTERNATE) && ARCH_MVEBU
+ default 0xfec12100 if DEBUG_MVEBU_UART1_ALTERNATE
+ default 0xfec10000 if DEBUG_SIRFATLAS7_UART0
+@@ -1803,9 +1812,9 @@ config DEBUG_UART_8250_WORD
+ depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250
+ depends on DEBUG_UART_8250_SHIFT >= 2
+ default y if DEBUG_PICOXCELL_UART || \
+- DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_UART1 || \
+- DEBUG_KEYSTONE_UART0 || DEBUG_KEYSTONE_UART1 || \
+- DEBUG_ALPINE_UART0 || \
++ DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_ARRIA10_UART1 || \
++ DEBUG_SOCFPGA_CYCLONE5_UART1 || DEBUG_KEYSTONE_UART0 || \
++ DEBUG_KEYSTONE_UART1 || DEBUG_ALPINE_UART0 || \
+ DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \
+ DEBUG_DAVINCI_DA8XX_UART2 || DEBUG_BCM_IPROC_UART3 || \
+ DEBUG_BCM_KONA_UART || DEBUG_RK32_UART2
+--
+2.20.1
+
--- /dev/null
+From 1d3e3ce4e748633c57e325fa020a41b171d2c32e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 15:54:46 +0100
+Subject: ARM: dts: am335x-pdu001: Fix polarity of card detection input
+
+From: Felix Brack <fb@ltec.ch>
+
+[ Upstream commit 5760367298a37c459ef0b1364463d70fd9a1f972 ]
+
+When a micro SD card is inserted in the PDU001 card cage, the card
+detection switch is opened and the corresponding GPIO input is driven
+by a pull-up. Hence change the active level of the card detection
+input from low to high.
+
+Signed-off-by: Felix Brack <fb@ltec.ch>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-pdu001.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/am335x-pdu001.dts b/arch/arm/boot/dts/am335x-pdu001.dts
+index 34fb63ef420f5..f56798efddff3 100644
+--- a/arch/arm/boot/dts/am335x-pdu001.dts
++++ b/arch/arm/boot/dts/am335x-pdu001.dts
+@@ -577,7 +577,7 @@
+ bus-width = <4>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc2_pins>;
+- cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>;
++ cd-gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>;
+ };
+
+ &sham {
+--
+2.20.1
+
--- /dev/null
+From 5b5a27e4a9744f945b209770822c46bbd31584b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Sep 2018 14:07:34 +0000
+Subject: ARM: dts: exynos: Fix LDO13 min values on Odroid XU3/XU4/HC1
+
+From: Anand Moon <linux.amoon@gmail.com>
+
+[ Upstream commit 8fe325fa9d065aa54db4914fdaccab2169fd67a8 ]
+
+From Odroid XU3/XU4/HC1 schematics the LDO13 regulator for SD2, can be
+set on 1.8V or 2.8V so the minimal value should be fixed to 1.8V. This
+is necessary to support UHS-I tuning (otherwise card won't be detected
+during boot).
+
+Signed-off-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+index 27214e6ebe4f4..d476ba0f07b6b 100644
+--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi
+@@ -224,7 +224,7 @@
+
+ ldo13_reg: LDO13 {
+ regulator-name = "vddq_mmc2";
+- regulator-min-microvolt = <2800000>;
++ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <2800000>;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 03d8fcefebe3fdee1a98c47e2afcb5a955038adf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 16:54:28 +0100
+Subject: ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 6035cbcceb069f87296b3cd0bc4736ad5618bf47 ]
+
+DWC2 hardware module integrated in Samsung SoCs requires some quirks to
+operate properly, so use Samsung SoC specific compatible to notify driver
+to apply respective fixes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/exynos3250.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi
+index 94efca78c42ff..5892a9f7622fa 100644
+--- a/arch/arm/boot/dts/exynos3250.dtsi
++++ b/arch/arm/boot/dts/exynos3250.dtsi
+@@ -360,7 +360,7 @@
+ };
+
+ hsotg: hsotg@12480000 {
+- compatible = "snps,dwc2";
++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2";
+ reg = <0x12480000 0x20000>;
+ interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&cmu CLK_USBOTG>;
+--
+2.20.1
+
--- /dev/null
+From 07721c8386791fe1c277ae5bf961996705d9abc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 18:31:56 +0100
+Subject: ARM: dts: imx6: RDU2: fix eGalax touchscreen node
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit 749a5068f2e2453a38777b1d5fc322d503cabf1d ]
+
+Use the correct compatible for the new protocol used by the firmware
+on the touch controller, the GPIO wakeup isn't used in that case.
+Also eGalax touch needs axis swapping, just as with the RMI4 touch.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+index 7fff3717cf7c0..315d0e7615f33 100644
+--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi
+@@ -609,13 +609,14 @@
+ };
+
+ touchscreen@2a {
+- compatible = "eeti,egalax_ts";
++ compatible = "eeti,exc3000";
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_ts>;
+ reg = <0x2a>;
+ interrupt-parent = <&gpio1>;
+ interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
+- wakeup-gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
++ touchscreen-inverted-x;
++ touchscreen-swapped-x-y;
+ status = "disabled";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 0288eaaebe8d10a6f2454441baee83d185fa1262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 18:53:06 +0100
+Subject: ARM: dts: mmp2: fix the gpio interrupt cell number
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 400583983f8a8e95ec02c9c9e2b50188753a87fb ]
+
+gpio-pxa uses two cell to encode the interrupt source: the pin number
+and the trigger type. Adjust the device node accordingly.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/mmp2.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi
+index 47e5b63339d18..e95deed6a7973 100644
+--- a/arch/arm/boot/dts/mmp2.dtsi
++++ b/arch/arm/boot/dts/mmp2.dtsi
+@@ -180,7 +180,7 @@
+ clocks = <&soc_clocks MMP2_CLK_GPIO>;
+ resets = <&soc_clocks MMP2_CLK_GPIO>;
+ interrupt-controller;
+- #interrupt-cells = <1>;
++ #interrupt-cells = <2>;
+ ranges;
+
+ gcb0: gpio@d4019000 {
+--
+2.20.1
+
--- /dev/null
+From c5755f73e6a917366b886e1fc0f9bec389ef238b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 14:54:51 +0100
+Subject: ARM: dts: pxa: clean up USB controller nodes
+
+From: Daniel Mack <daniel@zonque.org>
+
+[ Upstream commit c40ad24254f1dbd54f2df5f5f524130dc1862122 ]
+
+PXA25xx SoCs don't have a USB controller, so drop the node from the
+common pxa2xx.dtsi base file. Both pxa27x and pxa3xx have a dedicated
+node already anyway.
+
+While at it, unify the names for the nodes across all pxa platforms.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Reported-by: Sergey Yanovich <ynvich@gmail.com>
+Link: https://patchwork.kernel.org/patch/8375421/
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/pxa27x.dtsi | 2 +-
+ arch/arm/boot/dts/pxa2xx.dtsi | 7 -------
+ arch/arm/boot/dts/pxa3xx.dtsi | 2 +-
+ 3 files changed, 2 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi
+index 3228ad5fb725f..ccbecad9c5c7c 100644
+--- a/arch/arm/boot/dts/pxa27x.dtsi
++++ b/arch/arm/boot/dts/pxa27x.dtsi
+@@ -35,7 +35,7 @@
+ clocks = <&clks CLK_NONE>;
+ };
+
+- pxa27x_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi
+index a520b4c14ea9f..0a0e837dc79cb 100644
+--- a/arch/arm/boot/dts/pxa2xx.dtsi
++++ b/arch/arm/boot/dts/pxa2xx.dtsi
+@@ -117,13 +117,6 @@
+ status = "disabled";
+ };
+
+- usb0: ohci@4c000000 {
+- compatible = "marvell,pxa-ohci";
+- reg = <0x4c000000 0x10000>;
+- interrupts = <3>;
+- status = "disabled";
+- };
+-
+ mmc0: mmc@41100000 {
+ compatible = "marvell,pxa-mmc";
+ reg = <0x41100000 0x1000>;
+diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi
+index 3a8f0edc3af99..53009dbd36158 100644
+--- a/arch/arm/boot/dts/pxa3xx.dtsi
++++ b/arch/arm/boot/dts/pxa3xx.dtsi
+@@ -204,7 +204,7 @@
+ status = "disabled";
+ };
+
+- pxa3xx_ohci: usb@4c000000 {
++ usb0: usb@4c000000 {
+ compatible = "marvell,pxa-ohci";
+ reg = <0x4c000000 0x10000>;
+ interrupts = <3>;
+--
+2.20.1
+
--- /dev/null
+From 9a8fa051519256afc5de3573081f382a7df49f65 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Oct 2018 20:48:01 +0300
+Subject: ARM: dts: r8a779[01]: Disable unconnected LVDS encoders
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+[ Upstream commit 89862542fab10fed8a3c2f9c167622ef4287351d ]
+
+The LVDS0 encoder on Koelsh and Porter, and the LVDS1 encoder on Lager,
+are enabled in DT but have no device connected to their output. This
+result in spurious messages being printed to the kernel log such as
+
+rcar-du feb00000.display: no connector for encoder /soc/lvds@feb90000, skipping
+
+Fix it by disabling the encoders.
+
+Fixes: 15a1ff30d8f9 ("ARM: dts: r8a7790: Convert to new LVDS DT bindings")
+Fixes: e5c3f4707f39 ("ARM: dts: r8a7791: Convert to new LVDS DT bindings")
+Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/r8a7790-lager.dts | 2 --
+ arch/arm/boot/dts/r8a7791-koelsch.dts | 2 --
+ arch/arm/boot/dts/r8a7791-porter.dts | 2 --
+ 3 files changed, 6 deletions(-)
+
+diff --git a/arch/arm/boot/dts/r8a7790-lager.dts b/arch/arm/boot/dts/r8a7790-lager.dts
+index 50312e752e2fa..7b9508e83d46c 100644
+--- a/arch/arm/boot/dts/r8a7790-lager.dts
++++ b/arch/arm/boot/dts/r8a7790-lager.dts
+@@ -489,8 +489,6 @@
+ };
+
+ &lvds1 {
+- status = "okay";
+-
+ ports {
+ port@1 {
+ lvds_connector: endpoint {
+diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts
+index ce22db01fbbaa..e6580aa0cea35 100644
+--- a/arch/arm/boot/dts/r8a7791-koelsch.dts
++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts
+@@ -479,8 +479,6 @@
+ };
+
+ &lvds0 {
+- status = "okay";
+-
+ ports {
+ port@1 {
+ lvds_connector: endpoint {
+diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts
+index f02036e5de015..fefdf8238bbe9 100644
+--- a/arch/arm/boot/dts/r8a7791-porter.dts
++++ b/arch/arm/boot/dts/r8a7791-porter.dts
+@@ -482,8 +482,6 @@
+ };
+
+ &lvds0 {
+- status = "okay";
+-
+ ports {
+ port@1 {
+ lvds_connector: endpoint {
+--
+2.20.1
+
--- /dev/null
+From 174dea05964266f86be3e336c17052a476016f85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 13:12:48 -0600
+Subject: ARM: dts: realview: Fix some more duplicate regulator nodes
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit f3b2f758ec1e6cdb13c925647cbd8ad4938b78fb ]
+
+There's a bug in dtc in checking for duplicate node names when there's
+another section (e.g. "/ { };"). In this case, skeleton.dtsi provides
+another section. Upon removal of skeleton.dtsi, the dtb fails to build
+due to a duplicate node 'fixedregulator@0'. As both nodes were pretty
+much the same 3.3V fixed regulator, it hasn't really mattered. Fix this
+by renaming the nodes to something unique. In the process, drop the
+unit-address which shouldn't be present wtihout reg property.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-pb1176.dts | 4 ++--
+ arch/arm/boot/dts/arm-realview-pb11mp.dts | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts
+index f2a1d25eb6cf3..83e0fbc4a1a10 100644
+--- a/arch/arm/boot/dts/arm-realview-pb1176.dts
++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts
+@@ -45,7 +45,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -53,7 +53,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+index 7f9cbdf33a510..2f6aa24a0b67c 100644
+--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts
++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts
+@@ -145,7 +145,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -153,7 +153,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+--
+2.20.1
+
--- /dev/null
+From bca9c15c2e0930bc214c47cecf32389b5b3159ed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 19:05:47 -0600
+Subject: ARM: dts: realview-pbx: Fix duplicate regulator nodes
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 7f4b001b7f6e0480b5bdab9cd8ce1711e43e5cb5 ]
+
+There's a bug in dtc in checking for duplicate node names when there's
+another section (e.g. "/ { };"). In this case, skeleton.dtsi provides
+another section. Upon removal of skeleton.dtsi, the dtb fails to build
+due to a duplicate node 'fixedregulator@0'. As both nodes were pretty
+much the same 3.3V fixed regulator, it hasn't really mattered. Fix this
+by renaming the nodes to something unique. In the process, drop the
+unit-address which shouldn't be present wtihout reg property.
+
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/arm-realview-pbx.dtsi | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+index a5676697ff3b7..916a97734f84c 100644
+--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi
++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi
+@@ -44,7 +44,7 @@
+ };
+
+ /* The voltage to the MMC card is hardwired at 3.3V */
+- vmmc: fixedregulator@0 {
++ vmmc: regulator-vmmc {
+ compatible = "regulator-fixed";
+ regulator-name = "vmmc";
+ regulator-min-microvolt = <3300000>;
+@@ -52,7 +52,7 @@
+ regulator-boot-on;
+ };
+
+- veth: fixedregulator@0 {
++ veth: regulator-veth {
+ compatible = "regulator-fixed";
+ regulator-name = "veth";
+ regulator-min-microvolt = <3300000>;
+@@ -567,4 +567,3 @@
+ };
+ };
+ };
+-
+--
+2.20.1
+
--- /dev/null
+From 83bc10a3ab829e3f7fbbd53a400f51a67671aa4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 15:35:04 -0200
+Subject: ARM: dts: rockchip: Assign the proper GPIO clocks for rv1108
+
+From: Otavio Salvador <otavio@ossystems.com.br>
+
+[ Upstream commit efc2e0bd9594060915696a418564aefd0270b1d6 ]
+
+It is not correct to assign the 24MHz clock oscillator to the GPIO
+ports.
+
+Fix it by assigning the proper GPIO clocks instead.
+
+Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
+Tested-by: Fabio Berton <fabio.berton@ossystems.com.br>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rv1108.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi
+index 4090ad2619ffb..a9f053dfdc068 100644
+--- a/arch/arm/boot/dts/rv1108.dtsi
++++ b/arch/arm/boot/dts/rv1108.dtsi
+@@ -541,7 +541,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x20030000 0x100>;
+ interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO0_PMU>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -554,7 +554,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10310000 0x100>;
+ interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO1>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -567,7 +567,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10320000 0x100>;
+ interrupts = <GIC_SPI 42 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO2>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+@@ -580,7 +580,7 @@
+ compatible = "rockchip,gpio-bank";
+ reg = <0x10330000 0x100>;
+ interrupts = <GIC_SPI 43 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&xin24m>;
++ clocks = <&cru PCLK_GPIO3>;
+
+ gpio-controller;
+ #gpio-cells = <2>;
+--
+2.20.1
+
--- /dev/null
+From e2d409e7fa18f1a23c6deab1f9907a94de15e057 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 15:24:13 +0000
+Subject: ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name
+
+From: John Keeping <john@metanate.com>
+
+[ Upstream commit 03d9f8fa2bfdc791865624d3adc29070cf67814e ]
+
+There is no functional change from this, but it is confusing to find two
+copies of vcc_sys and no vcc_flash when looking in
+/sys/class/regulator/*/name.
+
+Signed-off-by: John Keeping <john@metanate.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+index 50325489c0ced..32e1ab3366629 100644
+--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi
++++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi
+@@ -25,7 +25,7 @@
+
+ vcc_flash: flash-regulator {
+ compatible = "regulator-fixed";
+- regulator-name = "vcc_sys";
++ regulator-name = "vcc_flash";
+ regulator-min-microvolt = <1800000>;
+ regulator-max-microvolt = <1800000>;
+ startup-delay-us = <150>;
+--
+2.20.1
+
--- /dev/null
+From 4d3a556e58db5a520cb4c6bc531b79b5a183dd21 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 15:35:03 -0200
+Subject: ARM: dts: rockchip: Fix the PMU interrupt number for rv1108
+
+From: Otavio Salvador <otavio@ossystems.com.br>
+
+[ Upstream commit c955b7aec510145129ca7aaea6ecbf6d748f5ebf ]
+
+According to the Rockchip vendor tree the PMU interrupt number is
+76, so fix it accordingly.
+
+Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
+Tested-by: Fabio Berton <fabio.berton@ossystems.com.br>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rv1108.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi
+index ed8f6ca52c5bc..4090ad2619ffb 100644
+--- a/arch/arm/boot/dts/rv1108.dtsi
++++ b/arch/arm/boot/dts/rv1108.dtsi
+@@ -66,7 +66,7 @@
+
+ arm-pmu {
+ compatible = "arm,cortex-a7-pmu";
+- interrupts = <GIC_SPI 67 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+ timer {
+--
+2.20.1
+
--- /dev/null
+From 9f028f82b34a124c242871f1c7b3d0356b114b68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 15:59:30 +0200
+Subject: ARM: dts: sun4i: Fix gpio-keys warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit c9b543404c5e1fd51a7ac375294519be5064bf80 ]
+
+Fix the 'unnecessary #address-cells/#size-cells without "ranges" or child
+"reg" property' DTC warning for the gpio-keys DT node on A10 boards.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts | 2 --
+ arch/arm/boot/dts/sun4i-a10-pcduino.dts | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts b/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts
+index 221acd10f6c84..2f0d966f39ad8 100644
+--- a/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts
++++ b/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts
+@@ -63,8 +63,6 @@
+ compatible = "gpio-keys-polled";
+ pinctrl-names = "default";
+ pinctrl-0 = <&key_pins_inet9f>;
+- #address-cells = <1>;
+- #size-cells = <0>;
+ poll-interval = <20>;
+
+ left-joystick-left {
+diff --git a/arch/arm/boot/dts/sun4i-a10-pcduino.dts b/arch/arm/boot/dts/sun4i-a10-pcduino.dts
+index b97a0f2f20b97..d82a604f3d9c7 100644
+--- a/arch/arm/boot/dts/sun4i-a10-pcduino.dts
++++ b/arch/arm/boot/dts/sun4i-a10-pcduino.dts
+@@ -76,8 +76,6 @@
+
+ gpio-keys {
+ compatible = "gpio-keys";
+- #address-cells = <1>;
+- #size-cells = <0>;
+
+ back {
+ label = "Key Back";
+--
+2.20.1
+
--- /dev/null
+From 75d1524c17c1b56ac5fae70f7107394f2a0588ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:00:22 +0200
+Subject: ARM: dts: sun4i: Fix HDMI output DTC warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 123b796d3fac60d69a3737d81901ab483c4efd6e ]
+
+Our HDMI output endpoint on the A10 DTSI has a warning under DTC: "graph
+node has single child node 'endpoint', #address-cells/#size-cells are not
+necessary". Fix this by removing those properties.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun4i-a10.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
+index 3d62a89507207..5d46bb0139fad 100644
+--- a/arch/arm/boot/dts/sun4i-a10.dtsi
++++ b/arch/arm/boot/dts/sun4i-a10.dtsi
+@@ -530,8 +530,6 @@
+ };
+
+ hdmi_out: port@1 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ reg = <1>;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From d889fdd6ba25df9c402874f38cbef715d8eba69c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:00:22 +0200
+Subject: ARM: dts: sun5i: a10s: Fix HDMI output DTC warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit ed5fc60b909427be6ca93d3e07a0a5f296d7000a ]
+
+Our HDMI output endpoint on the A10s DTSI has a warning under DTC: "graph
+node has single child node 'endpoint', #address-cells/#size-cells are not
+necessary". Fix this by removing those properties.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun5i-a10s.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
+index 316cb8b2945b1..a66d9f92f58f5 100644
+--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
++++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
+@@ -104,8 +104,6 @@
+ };
+
+ hdmi_out: port@1 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ reg = <1>;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From 269b2d8ea263d5261e5c0e2855b7f385a7f12d40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Sep 2018 16:00:22 +0200
+Subject: ARM: dts: sun7i: Fix HDMI output DTC warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 4d9a06979b1ae0c802440cb4433dfcd85fc7bdd3 ]
+
+Our HDMI output endpoint on the A10s DTSI has a warning under DTC: "graph
+node has single child node 'endpoint', #address-cells/#size-cells are not
+necessary". Fix this by removing those properties.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun7i-a20.dtsi | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
+index 9c52712af2411..73e789a133de1 100644
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -639,8 +639,6 @@
+ };
+
+ hdmi_out: port@1 {
+- #address-cells = <1>;
+- #size-cells = <0>;
+ reg = <1>;
+ };
+ };
+--
+2.20.1
+
--- /dev/null
+From ae7d9baa762700f965925bc4319099cb36d396a7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 09:51:04 +0100
+Subject: ARM: dts: sun8i: a23/a33: Fix OPP DTC warnings
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit a858f569b80a69076c521532a289097af905cf1e ]
+
+DTC will emit a warning on our OPPs nodes for the common DTSI between the
+A23 and A33 since those nodes use the frequency as unit addresses, but
+don't have a matching reg property.
+
+Fix this by moving the frequency to the node name instead.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3.dtsi | 6 +++---
+ arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
+index f0096074a4678..97de6ad133dc2 100644
+--- a/arch/arm/boot/dts/sun8i-h3.dtsi
++++ b/arch/arm/boot/dts/sun8i-h3.dtsi
+@@ -47,19 +47,19 @@
+ compatible = "operating-points-v2";
+ opp-shared;
+
+- opp@648000000 {
++ opp-648000000 {
+ opp-hz = /bits/ 64 <648000000>;
+ opp-microvolt = <1040000 1040000 1300000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+ };
+
+- opp@816000000 {
++ opp-816000000 {
+ opp-hz = /bits/ 64 <816000000>;
+ opp-microvolt = <1100000 1100000 1300000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+ };
+
+- opp@1008000000 {
++ opp-1008000000 {
+ opp-hz = /bits/ 64 <1008000000>;
+ opp-microvolt = <1200000 1200000 1300000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+diff --git a/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts b/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts
+index 0dbdb29a8fff9..ee7ce3752581b 100644
+--- a/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts
++++ b/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts
+@@ -103,13 +103,13 @@
+ };
+
+ &cpu0_opp_table {
+- opp@1104000000 {
++ opp-1104000000 {
+ opp-hz = /bits/ 64 <1104000000>;
+ opp-microvolt = <1320000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+ };
+
+- opp@1200000000 {
++ opp-1200000000 {
+ opp-hz = /bits/ 64 <1200000000>;
+ opp-microvolt = <1320000>;
+ clock-latency-ns = <244144>; /* 8 32k periods */
+--
+2.20.1
+
--- /dev/null
+From 83e9ee5b5a78469b8941c308e7316eb5f1ae75c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 22:58:20 +0800
+Subject: ARM: dts: sun8i: a23/a33: Fix up RTC device node
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit f6f4422532ad9ec9380a9936ed16b30922066a50 ]
+
+The RTC module on the A23 was claimed to be the same as on the A31, when
+in fact it is not. The A31 does not have an RTC external clock output,
+and its internal RC oscillator's average clock rate is not in the same
+range. The A33's RTC is the same as the A23.
+
+This patch fixes the compatible string and clock properties to conform
+to the updated bindings. The register range is also fixed.
+
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a23-a33.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+index c16ffcc4db7da..5616333c0e0e3 100644
+--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi
++++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi
+@@ -565,11 +565,11 @@
+ };
+
+ rtc: rtc@1f00000 {
+- compatible = "allwinner,sun6i-a31-rtc";
+- reg = <0x01f00000 0x54>;
++ compatible = "allwinner,sun8i-a23-rtc";
++ reg = <0x01f00000 0x400>;
+ interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+- clock-output-names = "osc32k";
++ clock-output-names = "osc32k", "osc32k-out";
+ clocks = <&ext_osc32k>;
+ #clock-cells = <1>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 00b32db0c6e54c7ae30ef60c097bbce7cb8b1119 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 10:24:30 +0100
+Subject: ARM: dts: sun8i: h3: Fix the system-control register range
+
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+
+[ Upstream commit 925c5afd78c40169c7e0e6adec52d5119ff43751 ]
+
+Unlike in previous generations, the system-control register range is not
+limited to a size of 0x30 on the H3. In particular, the EMAC clock
+configuration register (accessed through syscon) is at offset 0x30 in
+that range.
+
+Extend the register size to its full range (0x1000) as a result.
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi
+index 97de6ad133dc2..9233ba30a857c 100644
+--- a/arch/arm/boot/dts/sun8i-h3.dtsi
++++ b/arch/arm/boot/dts/sun8i-h3.dtsi
+@@ -122,7 +122,7 @@
+ soc {
+ system-control@1c00000 {
+ compatible = "allwinner,sun8i-h3-system-control";
+- reg = <0x01c00000 0x30>;
++ reg = <0x01c00000 0x1000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges;
+--
+2.20.1
+
--- /dev/null
+From a9ddf0136b5da57061b41a6d285773690bc2ada7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 10:58:01 +0100
+Subject: ARM: dts: sun8i: v3s: Change pinctrl nodes to avoid warning
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 438a44ce7e51ce571f942433c6c7cb87c4c0effd ]
+
+All our pinctrl nodes were using a node name convention with a unit-address
+to differentiate the different muxing options. However, since those nodes
+didn't have a reg property, they were generating warnings in DTC.
+
+In order to accomodate for this, convert the old nodes to the syntax we've
+been using for the new SoCs, including removing the letter suffix of the
+node labels to the bank of those pins to make things more readable.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts | 4 ++--
+ arch/arm/boot/dts/sun8i-v3s.dtsi | 10 +++++-----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
+index 387fc2aa546d6..333df90e8037c 100644
+--- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
++++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts
+@@ -78,7 +78,7 @@
+ };
+
+ &mmc0 {
+- pinctrl-0 = <&mmc0_pins_a>;
++ pinctrl-0 = <&mmc0_pins>;
+ pinctrl-names = "default";
+ broken-cd;
+ bus-width = <4>;
+@@ -87,7 +87,7 @@
+ };
+
+ &uart0 {
+- pinctrl-0 = <&uart0_pins_a>;
++ pinctrl-0 = <&uart0_pb_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+ };
+diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi
+index 443b083c6adc9..92fcb756a08a9 100644
+--- a/arch/arm/boot/dts/sun8i-v3s.dtsi
++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi
+@@ -292,17 +292,17 @@
+ interrupt-controller;
+ #interrupt-cells = <3>;
+
+- i2c0_pins: i2c0 {
++ i2c0_pins: i2c0-pins {
+ pins = "PB6", "PB7";
+ function = "i2c0";
+ };
+
+- uart0_pins_a: uart0@0 {
++ uart0_pb_pins: uart0-pb-pins {
+ pins = "PB8", "PB9";
+ function = "uart0";
+ };
+
+- mmc0_pins_a: mmc0@0 {
++ mmc0_pins: mmc0-pins {
+ pins = "PF0", "PF1", "PF2", "PF3",
+ "PF4", "PF5";
+ function = "mmc0";
+@@ -310,7 +310,7 @@
+ bias-pull-up;
+ };
+
+- mmc1_pins: mmc1 {
++ mmc1_pins: mmc1-pins {
+ pins = "PG0", "PG1", "PG2", "PG3",
+ "PG4", "PG5";
+ function = "mmc1";
+@@ -318,7 +318,7 @@
+ bias-pull-up;
+ };
+
+- spi0_pins: spi0 {
++ spi0_pins: spi0-pins {
+ pins = "PC0", "PC1", "PC2", "PC3";
+ function = "spi0";
+ };
+--
+2.20.1
+
--- /dev/null
+From 396de51f9449b7796005df0b1ee1ea3d422e6c07 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 13:11:42 -0600
+Subject: ARM: dts: sunxi: Fix PMU compatible strings
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 5719ac19fc32d892434939c1756c2f9a8322e6ef ]
+
+"arm,cortex-a15-pmu" is not a valid fallback compatible string for an
+Cortex-A7 PMU, so drop it.
+
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Cc: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun6i-a31.dtsi | 2 +-
+ arch/arm/boot/dts/sun7i-a20.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi
+index debc0bf22ea3b..76924fa42bbc3 100644
+--- a/arch/arm/boot/dts/sun6i-a31.dtsi
++++ b/arch/arm/boot/dts/sun6i-a31.dtsi
+@@ -201,7 +201,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
+diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
+index 73e789a133de1..355619dce7994 100644
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -183,7 +183,7 @@
+ };
+
+ pmu {
+- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu";
++ compatible = "arm,cortex-a7-pmu";
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 2c4cf4e6224271df635f048993491e45b815f084 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 21:46:41 +0200
+Subject: ARM: OMAP1/2: fix SoC name printing
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 04a92358b3964988c78dfe370a559ae550383886 ]
+
+Currently we get extra newlines on OMAP1/2 when the SoC name is printed:
+
+[ 0.000000] OMAP1510
+[ 0.000000] revision 2 handled as 15xx id: bc058c9b93111a16
+
+[ 0.000000] OMAP2420
+[ 0.000000]
+
+Fix by using pr_cont.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap1/id.c | 6 +++---
+ arch/arm/mach-omap2/id.c | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c
+index 52de382fc8047..7e49dfda3d2f4 100644
+--- a/arch/arm/mach-omap1/id.c
++++ b/arch/arm/mach-omap1/id.c
+@@ -200,10 +200,10 @@ void __init omap_check_revision(void)
+ printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type);
+ }
+
+- printk(KERN_INFO "OMAP%04x", omap_revision >> 16);
++ pr_info("OMAP%04x", omap_revision >> 16);
+ if ((omap_revision >> 8) & 0xff)
+- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff);
+- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n",
++ pr_cont("%x", (omap_revision >> 8) & 0xff);
++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n",
+ die_rev, omap_revision & 0xff, system_serial_low,
+ system_serial_high);
+ }
+diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
+index 68ba5f472f6ba..859c71c4e9324 100644
+--- a/arch/arm/mach-omap2/id.c
++++ b/arch/arm/mach-omap2/id.c
+@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void)
+
+ pr_info("%s", soc_name);
+ if ((omap_rev() >> 8) & 0x0f)
+- pr_info("%s", soc_rev);
+- pr_info("\n");
++ pr_cont("%s", soc_rev);
++ pr_cont("\n");
+ }
+
+ #define OMAP3_SHOW_FEATURE(feat) \
+--
+2.20.1
+
--- /dev/null
+From 4e3b4ee3bd4f6b5ef25c970c17cdce956aaba70d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 18:23:25 +0800
+Subject: arm64: dts: allwinner: a64: enable sound on Pinebook
+
+From: Vasily Khoruzhick <anarsoul@gmail.com>
+
+[ Upstream commit 6de8e717848f1b07b05f1b512dd6b8552677d958 ]
+
+The Pinebook has a headphone jack tied to the HP headphone output of
+the SoC, and internal speakers connected to the LINEOUT of the SoC,
+through a standalone amplifier.
+
+This commit enables I2S, digital and analog parts of audio codec on
+Pinebook, along with a device node for the external amplifier.
+
+Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
+[wens@csie.org: dropped headphone_amp; added headphone amp regulator supply;
+ fixed speaker_amp node name and sound-name-prefix name]
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Tested-by: Vasily Khoruzhick <anarsoul@gmail.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../dts/allwinner/sun50i-a64-pinebook.dts | 49 +++++++++++++++++++
+ 1 file changed, 49 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+index 897e60cbe38d1..b71ac80f6dc77 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts
+@@ -64,6 +64,32 @@
+ compatible = "mmc-pwrseq-simple";
+ reset-gpios = <&r_pio 0 2 GPIO_ACTIVE_LOW>; /* PL2 */
+ };
++
++ speaker_amp: audio-amplifier {
++ compatible = "simple-audio-amplifier";
++ /*
++ * TODO This is actually a fixed regulator controlled by
++ * the GPIO line on the PMIC. This should be corrected
++ * once GPIO support is added for this PMIC.
++ */
++ VCC-supply = <®_ldo_io0>;
++ enable-gpios = <&pio 7 7 GPIO_ACTIVE_HIGH>; /* PH7 */
++ sound-name-prefix = "Speaker Amp";
++ };
++
++};
++
++&codec {
++ status = "okay";
++};
++
++&codec_analog {
++ hpvcc-supply = <®_eldo1>;
++ status = "okay";
++};
++
++&dai {
++ status = "okay";
+ };
+
+ &ehci0 {
+@@ -268,6 +294,29 @@
+ vcc-hdmi-supply = <®_dldo1>;
+ };
+
++&sound {
++ status = "okay";
++ simple-audio-card,aux-devs = <&codec_analog>, <&speaker_amp>;
++ simple-audio-card,widgets = "Microphone", "Internal Microphone Left",
++ "Microphone", "Internal Microphone Right",
++ "Headphone", "Headphone Jack",
++ "Speaker", "Internal Speaker";
++ simple-audio-card,routing =
++ "Left DAC", "AIF1 Slot 0 Left",
++ "Right DAC", "AIF1 Slot 0 Right",
++ "Speaker Amp INL", "LINEOUT",
++ "Speaker Amp INR", "LINEOUT",
++ "Internal Speaker", "Speaker Amp OUTL",
++ "Internal Speaker", "Speaker Amp OUTR",
++ "Headphone Jack", "HP",
++ "AIF1 Slot 0 Left ADC", "Left ADC",
++ "AIF1 Slot 0 Right ADC", "Right ADC",
++ "Internal Microphone Left", "MBIAS",
++ "MIC1", "Internal Microphone Left",
++ "Internal Microphone Right", "HBIAS",
++ "MIC2", "Internal Microphone Right";
++};
++
+ &uart0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&uart0_pins_a>;
+--
+2.20.1
+
--- /dev/null
+From 9da49d0b489610801400fa2d55a4f43d1c9492d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 22:58:25 +0800
+Subject: arm64: dts: allwinner: a64: Fix up RTC device node and clock
+ references
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 44ff3cafcd7f413e7710a58ac40cfdc3a9380097 ]
+
+The RTC module on the A64 was claimed to be the same as on the A31, when
+in fact it is not. It is actually compatible to the H3's RTC. The A64's
+RTC has some extra crypto-related registers which the H3's does not, but
+the exact function of these is not clear.
+
+This patch fixes the compatible string and clock properties to conform
+to the updated bindings. The device node for the internal oscillator is
+removed, as it is internalized into the RTC device. Clock references to
+the IOSC and LOSC are also fixed.
+
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 22 ++++++-------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index d3daf90a8715c..f2e1b1c3c92a8 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -123,15 +123,7 @@
+ #clock-cells = <0>;
+ compatible = "fixed-clock";
+ clock-frequency = <32768>;
+- clock-output-names = "osc32k";
+- };
+-
+- iosc: internal-osc-clk {
+- #clock-cells = <0>;
+- compatible = "fixed-clock";
+- clock-frequency = <16000000>;
+- clock-accuracy = <300000000>;
+- clock-output-names = "iosc";
++ clock-output-names = "ext-osc32k";
+ };
+
+ psci {
+@@ -354,7 +346,7 @@
+ ccu: clock@1c20000 {
+ compatible = "allwinner,sun50i-a64-ccu";
+ reg = <0x01c20000 0x400>;
+- clocks = <&osc24M>, <&osc32k>;
++ clocks = <&osc24M>, <&rtc 0>;
+ clock-names = "hosc", "losc";
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+@@ -687,11 +679,12 @@
+ };
+
+ rtc: rtc@1f00000 {
+- compatible = "allwinner,sun6i-a31-rtc";
+- reg = <0x01f00000 0x54>;
++ compatible = "allwinner,sun50i-a64-rtc",
++ "allwinner,sun8i-h3-rtc";
++ reg = <0x01f00000 0x400>;
+ interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
+- clock-output-names = "rtc-osc32k", "rtc-osc32k-out";
++ clock-output-names = "osc32k", "osc32k-out", "iosc";
+ clocks = <&osc32k>;
+ #clock-cells = <1>;
+ };
+@@ -708,8 +701,7 @@
+ r_ccu: clock@1f01400 {
+ compatible = "allwinner,sun50i-a64-r-ccu";
+ reg = <0x01f01400 0x100>;
+- clocks = <&osc24M>, <&osc32k>, <&iosc>,
+- <&ccu 11>;
++ clocks = <&osc24M>, <&rtc 0>, <&rtc 2>, <&ccu 11>;
+ clock-names = "hosc", "losc", "iosc", "pll-periph";
+ #clock-cells = <1>;
+ #reset-cells = <1>;
+--
+2.20.1
+
--- /dev/null
+From 1c787ac81c0fcad4ed320780258ef8100e70c25d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:48 +0100
+Subject: arm64: dts: meson-gxbb-nanopi-k2: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit f0783f5edb52af14ecaae6c5ce4f38e0a358f5d8 ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: 12ada0513d7a ("ARM64: dts: meson-gxbb-nanopi-k2: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+index cbe99bd4e06d2..8cd50b75171de 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts
+@@ -191,7 +191,7 @@
+ pinctrl-names = "default";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX", "UART RX", "Power Control", "Power Key In",
+ "VCCK En", "CON1 Header Pin31",
+ "I2S Header Pin6", "IR In", "I2S Header Pin7",
+@@ -201,7 +201,7 @@
+ "";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk",
+ "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2",
+--
+2.20.1
+
--- /dev/null
+From 4b9ec2d3aea3a2f8b550258ed4d928dc6f4f4a4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:49 +0100
+Subject: arm64: dts: meson-gxbb-odroidc2: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 2165b006b65d609140dafafcb14cce5a4aaacbab ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: b03c7d6438bb ("ARM64: dts: meson-gxbb-odroidc2: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+index 54954b314a452..00f7be6d83f7c 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts
+@@ -187,7 +187,7 @@
+ pinctrl-names = "default";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX", "UART RX", "VCCK En", "TF 3V3/1V8 En",
+ "USB HUB nRESET", "USB OTG Power En",
+ "J7 Header Pin2", "IR In", "J7 Header Pin4",
+@@ -197,7 +197,7 @@
+ "";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk",
+ "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2",
+--
+2.20.1
+
--- /dev/null
+From af418ac4c5d8bfa3283dc86d4029410b798a48de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:50 +0100
+Subject: arm64: dts: meson-gxl-khadas-vim: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 5b78012636f537344bd551934387f5772c38ba80 ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: 60795933b709 ("ARM64: dts: meson-gxl-khadas-vim: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+index d32cf38463702..864ef0111b01a 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts
+@@ -112,7 +112,7 @@
+ linux,rc-map-name = "rc-geekbox";
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX",
+ "UART RX",
+ "Power Key In",
+@@ -127,7 +127,7 @@
+ "";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "", "", "", "", "", "", "",
+ "", "", "", "", "", "", "",
+--
+2.20.1
+
--- /dev/null
+From d9b56bce9c6df19a6301532b026a7e3f99598084 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 11:45:47 +0100
+Subject: arm64: dts: meson-gxl-libretech-cc: fix GPIO lines names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 11fa9774612decea87144d7f950a9c53a4fe3050 ]
+
+The gpio line names were set in the pinctrl node instead of the gpio node,
+at the time it was merged, it worked, but was obviously wrong.
+This patch moves the properties to the gpio nodes.
+
+Fixes: 47884c5c746e ("ARM64: dts: meson-gxl-libretech-cc: Add GPIO lines names")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index 90a56af967a7f..b4dfb9afdef86 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -163,7 +163,7 @@
+ };
+ };
+
+-&pinctrl_aobus {
++&gpio_ao {
+ gpio-line-names = "UART TX",
+ "UART RX",
+ "Blue LED",
+@@ -178,7 +178,7 @@
+ "7J1 Header Pin15";
+ };
+
+-&pinctrl_periphs {
++&gpio {
+ gpio-line-names = /* Bank GPIOZ */
+ "", "", "", "", "", "", "",
+ "", "", "", "", "", "", "",
+--
+2.20.1
+
--- /dev/null
+From 04760e45777a137706cbd4c30a98e70a1bbbff36 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 21:50:13 -0800
+Subject: arm64: dts: qcom: sdm845-mtp: Mark protected gcc clocks
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit d206e6b7ea3fdc8ec8f6be9a2ecfe58142b49e37 ]
+
+As of v4.20-rc1 probing the GCC driver on a SDM845 device with the
+standard security implementation causes an access violation and an
+immediate system restart. Use the protected-clocks property to mark the
+offending clocks protected for the MTP, in order to allow it to boot.
+
+Cc: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Acked-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/sdm845-mtp.dts | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+index 6921f8dc5ebbc..ea5bdda0681e6 100644
+--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
++++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts
+@@ -22,6 +22,12 @@
+ };
+ };
+
++&gcc {
++ protected-clocks = <GCC_QSPI_CORE_CLK>,
++ <GCC_QSPI_CORE_CLK_SRC>,
++ <GCC_QSPI_CNOC_PERIPH_AHB_CLK>;
++};
++
+ &i2c10 {
+ status = "okay";
+ clock-frequency = <400000>;
+--
+2.20.1
+
--- /dev/null
+From 12dfeba43c42a5d07e1295ce62b836e66abcc4a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 10:06:53 +0100
+Subject: arm64: dts: zynqmp: Fix node names which contain "_"
+
+From: Michal Simek <michal.simek@xilinx.com>
+
+[ Upstream commit d1d4445abffb2b17e841d37b555b6f1364b571c1 ]
+
+s/_/-/ for node names.
+
+It fixes warnings like this:
+... Warning (node_name_chars_strict): /cpu_opp_table:
+Character '_' not recommended in node name ...
+
+Issues reported by make dtbs W=12
+
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi | 4 ++--
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts | 4 ++--
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts | 10 +++++-----
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 2 +-
+ arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts | 2 +-
+ arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++--
+ 6 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi
+index 9c09baca7dd78..306ad2157c988 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi
+@@ -58,13 +58,13 @@
+ clock-accuracy = <100>;
+ };
+
+- dpdma_clk: dpdma_clk {
++ dpdma_clk: dpdma-clk {
+ compatible = "fixed-clock";
+ #clock-cells = <0x0>;
+ clock-frequency = <533000000>;
+ };
+
+- drm_clock: drm_clock {
++ drm_clock: drm-clock {
+ compatible = "fixed-clock";
+ #clock-cells = <0x0>;
+ clock-frequency = <262750000>;
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
+index 8954c8c6f5475..14062b4535dd7 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts
+@@ -82,7 +82,7 @@
+ linux,default-trigger = "bluetooth-power";
+ };
+
+- vbus_det { /* U5 USB5744 VBUS detection via MIO25 */
++ vbus-det { /* U5 USB5744 VBUS detection via MIO25 */
+ label = "vbus_det";
+ gpios = <&gpio 25 GPIO_ACTIVE_HIGH>;
+ default-state = "on";
+@@ -98,7 +98,7 @@
+ regulator-boot-on;
+ };
+
+- sdio_pwrseq: sdio_pwrseq {
++ sdio_pwrseq: sdio-pwrseq {
+ compatible = "mmc-pwrseq-simple";
+ reset-gpios = <&gpio 7 GPIO_ACTIVE_LOW>; /* WIFI_EN */
+ post-power-on-delay-ms = <10>;
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts
+index 25dd574853235..d3b8e1a9c0761 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts
+@@ -53,7 +53,7 @@
+
+ leds {
+ compatible = "gpio-leds";
+- heartbeat_led {
++ heartbeat-led {
+ label = "heartbeat";
+ gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+@@ -139,25 +139,25 @@
+ * 7, 10 - 17 - not connected
+ */
+
+- gtr_sel0 {
++ gtr-sel0 {
+ gpio-hog;
+ gpios = <0 0>;
+ output-low; /* PCIE = 0, DP = 1 */
+ line-name = "sel0";
+ };
+- gtr_sel1 {
++ gtr-sel1 {
+ gpio-hog;
+ gpios = <1 0>;
+ output-high; /* PCIE = 0, DP = 1 */
+ line-name = "sel1";
+ };
+- gtr_sel2 {
++ gtr-sel2 {
+ gpio-hog;
+ gpios = <2 0>;
+ output-high; /* PCIE = 0, USB0 = 1 */
+ line-name = "sel2";
+ };
+- gtr_sel3 {
++ gtr-sel3 {
+ gpio-hog;
+ gpios = <3 0>;
+ output-high; /* PCIE = 0, SATA = 1 */
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+index 259f21b0c0014..28dee4dad82c2 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts
+@@ -53,7 +53,7 @@
+
+ leds {
+ compatible = "gpio-leds";
+- heartbeat_led {
++ heartbeat-led {
+ label = "heartbeat";
+ gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts
+index a61b3cc6f4c95..47b5989035e4e 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts
++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts
+@@ -53,7 +53,7 @@
+
+ leds {
+ compatible = "gpio-leds";
+- heartbeat_led {
++ heartbeat-led {
+ label = "heartbeat";
+ gpios = <&gpio 23 GPIO_ACTIVE_HIGH>;
+ linux,default-trigger = "heartbeat";
+diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+index 29ce23422acf2..a516c0e01429a 100644
+--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
+@@ -71,7 +71,7 @@
+ };
+ };
+
+- cpu_opp_table: cpu_opp_table {
++ cpu_opp_table: cpu-opp-table {
+ compatible = "operating-points-v2";
+ opp-shared;
+ opp00 {
+@@ -124,7 +124,7 @@
+ <1 10 0xf08>;
+ };
+
+- amba_apu: amba_apu@0 {
++ amba_apu: amba-apu@0 {
+ compatible = "simple-bus";
+ #address-cells = <2>;
+ #size-cells = <1>;
+--
+2.20.1
+
--- /dev/null
+From f9887ec47ccd1955c8deb844a4f65f06b3719bf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 17:47:25 +0100
+Subject: arm64: tegra: Fix power key interrupt type on Jetson TX2
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 6f13f10b3bbfed3b29c812f0f65bef802ce05e3c ]
+
+In order for the correct interrupt type to be configured, the event
+action for the power key needs to be "asserted".
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+index bd5305a634b16..9fc577a1ec442 100644
+--- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
++++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts
+@@ -2,6 +2,7 @@
+ /dts-v1/;
+
+ #include <dt-bindings/input/linux-event-codes.h>
++#include <dt-bindings/input/gpio-keys.h>
+
+ #include "tegra186-p3310.dtsi"
+
+@@ -121,6 +122,7 @@
+ linux,input-type = <EV_KEY>;
+ linux,code = <KEY_POWER>;
+ debounce-interval = <10>;
++ wakeup-event-action = <EV_ACT_ASSERTED>;
+ wakeup-source;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 67fae614a24c3fb6c4fe54b6476950944af25beb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 06:33:16 +0000
+Subject: ASoC: au8540: use 64-bit arithmetic instead of 32-bit
+
+From: Young_X <YangX92@hotmail.com>
+
+[ Upstream commit cd7fdc45bc69a62b4e22c6e875f1f1aea566256d ]
+
+Add suffix ULL to constant 256 in order to give the compiler complete
+information about the proper arithmetic to use.
+
+Notice that such constant is used in a context that expects an
+expression of type u64 (64 bits, unsigned) and the following
+expression is currently being evaluated using 32-bit arithmetic:
+
+ 256 * fs * 2 * mclk_src_scaling[i].param
+
+Signed-off-by: Young_X <YangX92@hotmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/nau8540.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c
+index e3c8cd17daf2d..4dd1a609756be 100644
+--- a/sound/soc/codecs/nau8540.c
++++ b/sound/soc/codecs/nau8540.c
+@@ -585,7 +585,7 @@ static int nau8540_calc_fll_param(unsigned int fll_in,
+ fvco_max = 0;
+ fvco_sel = ARRAY_SIZE(mclk_src_scaling);
+ for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) {
+- fvco = 256 * fs * 2 * mclk_src_scaling[i].param;
++ fvco = 256ULL * fs * 2 * mclk_src_scaling[i].param;
+ if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX &&
+ fvco_max < fvco) {
+ fvco_max = fvco;
+--
+2.20.1
+
--- /dev/null
+From 2eb3c559a62ea62963da0d36a1fbea7494ac17cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 19:19:51 +0100
+Subject: ASoC: max9867: Fix power management
+
+From: Ladislav Michl <ladis@linux-mips.org>
+
+[ Upstream commit 29f58ff06795a923407d011d4721eaf3e8d39acc ]
+
+Implement set_bias_level to drive shutdown bit, so device is
+put to sleep when unused.
+
+Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/max9867.c | 72 ++++++++++++++++++++++++--------------
+ sound/soc/codecs/max9867.h | 2 +-
+ 2 files changed, 46 insertions(+), 28 deletions(-)
+
+diff --git a/sound/soc/codecs/max9867.c b/sound/soc/codecs/max9867.c
+index 4ea3287162ad2..e51143df4702a 100644
+--- a/sound/soc/codecs/max9867.c
++++ b/sound/soc/codecs/max9867.c
+@@ -248,17 +248,6 @@ static int max9867_dai_hw_params(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
+-static int max9867_prepare(struct snd_pcm_substream *substream,
+- struct snd_soc_dai *dai)
+-{
+- struct snd_soc_component *component = dai->component;
+- struct max9867_priv *max9867 = snd_soc_component_get_drvdata(component);
+-
+- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
+- MAX9867_SHTDOWN_MASK, MAX9867_SHTDOWN_MASK);
+- return 0;
+-}
+-
+ static int max9867_mute(struct snd_soc_dai *dai, int mute)
+ {
+ struct snd_soc_component *component = dai->component;
+@@ -361,7 +350,6 @@ static int max9867_dai_set_fmt(struct snd_soc_dai *codec_dai,
+ static const struct snd_soc_dai_ops max9867_dai_ops = {
+ .set_fmt = max9867_dai_set_fmt,
+ .set_sysclk = max9867_set_dai_sysclk,
+- .prepare = max9867_prepare,
+ .digital_mute = max9867_mute,
+ .hw_params = max9867_dai_hw_params,
+ };
+@@ -392,27 +380,59 @@ static struct snd_soc_dai_driver max9867_dai[] = {
+ }
+ };
+
+-#ifdef CONFIG_PM_SLEEP
+-static int max9867_suspend(struct device *dev)
++#ifdef CONFIG_PM
++static int max9867_suspend(struct snd_soc_component *component)
+ {
+- struct max9867_priv *max9867 = dev_get_drvdata(dev);
++ snd_soc_component_force_bias_level(component, SND_SOC_BIAS_OFF);
+
+- /* Drop down to power saving mode when system is suspended */
+- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
+- MAX9867_SHTDOWN_MASK, ~MAX9867_SHTDOWN_MASK);
+ return 0;
+ }
+
+-static int max9867_resume(struct device *dev)
++static int max9867_resume(struct snd_soc_component *component)
+ {
+- struct max9867_priv *max9867 = dev_get_drvdata(dev);
++ snd_soc_component_force_bias_level(component, SND_SOC_BIAS_STANDBY);
+
+- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
+- MAX9867_SHTDOWN_MASK, MAX9867_SHTDOWN_MASK);
+ return 0;
+ }
++#else
++#define max9867_suspend NULL
++#define max9867_resume NULL
+ #endif
+
++static int max9867_set_bias_level(struct snd_soc_component *component,
++ enum snd_soc_bias_level level)
++{
++ int err;
++ struct max9867_priv *max9867 = snd_soc_component_get_drvdata(component);
++
++ switch (level) {
++ case SND_SOC_BIAS_STANDBY:
++ if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF) {
++ err = regcache_sync(max9867->regmap);
++ if (err)
++ return err;
++
++ err = regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
++ MAX9867_SHTDOWN, MAX9867_SHTDOWN);
++ if (err)
++ return err;
++ }
++ break;
++ case SND_SOC_BIAS_OFF:
++ err = regmap_update_bits(max9867->regmap, MAX9867_PWRMAN,
++ MAX9867_SHTDOWN, 0);
++ if (err)
++ return err;
++
++ regcache_mark_dirty(max9867->regmap);
++ break;
++ default:
++ break;
++ }
++
++ return 0;
++}
++
+ static const struct snd_soc_component_driver max9867_component = {
+ .controls = max9867_snd_controls,
+ .num_controls = ARRAY_SIZE(max9867_snd_controls),
+@@ -420,6 +440,9 @@ static const struct snd_soc_component_driver max9867_component = {
+ .num_dapm_routes = ARRAY_SIZE(max9867_audio_map),
+ .dapm_widgets = max9867_dapm_widgets,
+ .num_dapm_widgets = ARRAY_SIZE(max9867_dapm_widgets),
++ .suspend = max9867_suspend,
++ .resume = max9867_resume,
++ .set_bias_level = max9867_set_bias_level,
+ .idle_bias_on = 1,
+ .use_pmdown_time = 1,
+ .endianness = 1,
+@@ -518,15 +541,10 @@ static const struct of_device_id max9867_of_match[] = {
+ };
+ MODULE_DEVICE_TABLE(of, max9867_of_match);
+
+-static const struct dev_pm_ops max9867_pm_ops = {
+- SET_SYSTEM_SLEEP_PM_OPS(max9867_suspend, max9867_resume)
+-};
+-
+ static struct i2c_driver max9867_i2c_driver = {
+ .driver = {
+ .name = "max9867",
+ .of_match_table = of_match_ptr(max9867_of_match),
+- .pm = &max9867_pm_ops,
+ },
+ .probe = max9867_i2c_probe,
+ .id_table = max9867_i2c_id,
+diff --git a/sound/soc/codecs/max9867.h b/sound/soc/codecs/max9867.h
+index 55cd9976ff47d..d9170850c96ea 100644
+--- a/sound/soc/codecs/max9867.h
++++ b/sound/soc/codecs/max9867.h
+@@ -67,7 +67,7 @@
+ #define MAX9867_MICCONFIG 0x15
+ #define MAX9867_MODECONFIG 0x16
+ #define MAX9867_PWRMAN 0x17
+-#define MAX9867_SHTDOWN_MASK (1<<7)
++#define MAX9867_SHTDOWN 0x80
+ #define MAX9867_REVISION 0xff
+
+ #define MAX9867_CACHEREGNUM 10
+--
+2.20.1
+
--- /dev/null
+From 8de9a18f8121c327f46182e247f4ae04354c2eaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 07:35:34 +0000
+Subject: ASoC: rsnd: tidyup registering method for rsnd_kctrl_new()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 9c698e8481a15237a5b1db5f8391dd66d59e42a4 ]
+
+Current rsnd dvc.c is using flags to avoid duplicating register for
+MIXer case. OTOH, commit e894efef9ac7 ("ASoC: core: add support to card
+rebind") allows to rebind sound card without rebinding all drivers.
+
+Because of above patch and dvc.c flags, it can't re-register kctrl if
+only sound card was rebinded, because dvc is keeping old flags.
+(Of course it will be no problem if rsnd driver also be rebinded,
+but it is not purpose of above patch).
+
+This patch checks current card registered kctrl when registering.
+In MIXer case, it can avoid duplicate register if card already has same
+kctrl. In rebind case, it can re-register kctrl because card registered
+kctl had been removed when unbinding.
+
+This patch is updated version of commit b918f1bc7f1ce ("ASoC: rsnd: DVC
+kctrl sets once")
+
+Reported-by: Nguyen Viet Dung <dung.nguyen.aj@renesas.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Nguyen Viet Dung <dung.nguyen.aj@renesas.com>
+Cc: Hiroyuki Yokoyama <hiroyuki.yokoyama.vx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sh/rcar/core.c | 12 ++++++++++++
+ sound/soc/sh/rcar/dvc.c | 8 --------
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index 15a31820df169..99cd52b9ff228 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -1344,6 +1344,18 @@ int rsnd_kctrl_new(struct rsnd_mod *mod,
+ };
+ int ret;
+
++ /*
++ * 1) Avoid duplicate register (ex. MIXer case)
++ * 2) re-register if card was rebinded
++ */
++ list_for_each_entry(kctrl, &card->controls, list) {
++ struct rsnd_kctrl_cfg *c = kctrl->private_data;
++
++ if (strcmp(kctrl->id.name, name) == 0 &&
++ c->mod == mod)
++ return 0;
++ }
++
+ if (size > RSND_MAX_CHANNELS)
+ return -EINVAL;
+
+diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c
+index 2b16e0ce6bc53..024ece46bf685 100644
+--- a/sound/soc/sh/rcar/dvc.c
++++ b/sound/soc/sh/rcar/dvc.c
+@@ -40,11 +40,8 @@ struct rsnd_dvc {
+ struct rsnd_kctrl_cfg_s ren; /* Ramp Enable */
+ struct rsnd_kctrl_cfg_s rup; /* Ramp Rate Up */
+ struct rsnd_kctrl_cfg_s rdown; /* Ramp Rate Down */
+- u32 flags;
+ };
+
+-#define KCTRL_INITIALIZED (1 << 0)
+-
+ #define rsnd_dvc_get(priv, id) ((struct rsnd_dvc *)(priv->dvc) + id)
+ #define rsnd_dvc_nr(priv) ((priv)->dvc_nr)
+
+@@ -227,9 +224,6 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
+ int channels = rsnd_rdai_channels_get(rdai);
+ int ret;
+
+- if (rsnd_flags_has(dvc, KCTRL_INITIALIZED))
+- return 0;
+-
+ /* Volume */
+ ret = rsnd_kctrl_new_m(mod, io, rtd,
+ is_play ?
+@@ -285,8 +279,6 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod,
+ if (ret < 0)
+ return ret;
+
+- rsnd_flags_set(dvc, KCTRL_INITIALIZED);
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 90f6029f9c6f4abdc2cfe9ac1dad5195de3c8810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 09:54:48 -0500
+Subject: audit: Embed key into chunk
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 8d20d6e9301d7b3777d66d47dd5b89acd645cd39 ]
+
+Currently chunk hash key (which is in fact pointer to the inode) is
+derived as chunk->mark.conn->obj. It is tricky to make this dereference
+reliable for hash table lookups only under RCU as mark can get detached
+from the connector and connector gets freed independently of the
+running lookup. Thus there is a possible use after free / NULL ptr
+dereference issue:
+
+CPU1 CPU2
+ untag_chunk()
+ ...
+audit_tree_lookup()
+ list_for_each_entry_rcu(p, list, hash) {
+ list_del_rcu(&chunk->hash);
+ fsnotify_destroy_mark(entry);
+ fsnotify_put_mark(entry)
+ chunk_to_key(p)
+ if (!chunk->mark.connector)
+ ...
+ hlist_del_init_rcu(&mark->obj_list);
+ if (hlist_empty(&conn->list)) {
+ inode = fsnotify_detach_connector_from_object(conn);
+ mark->connector = NULL;
+ ...
+ frees connector from workqueue
+ chunk->mark.connector->obj
+
+This race is probably impossible to hit in practice as the race window
+on CPU1 is very narrow and CPU2 has a lot of code to execute. Still it's
+better to have this fixed. Since the inode the chunk is attached to is
+constant during chunk's lifetime it is easy to cache the key in the
+chunk itself and thus avoid these issues.
+
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/audit_tree.c | 27 ++++++++-------------------
+ 1 file changed, 8 insertions(+), 19 deletions(-)
+
+diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
+index ea43181cde4a2..04f59dfd3e71f 100644
+--- a/kernel/audit_tree.c
++++ b/kernel/audit_tree.c
+@@ -24,6 +24,7 @@ struct audit_tree {
+
+ struct audit_chunk {
+ struct list_head hash;
++ unsigned long key;
+ struct fsnotify_mark mark;
+ struct list_head trees; /* with root here */
+ int dead;
+@@ -172,21 +173,6 @@ static unsigned long inode_to_key(const struct inode *inode)
+ return (unsigned long)&inode->i_fsnotify_marks;
+ }
+
+-/*
+- * Function to return search key in our hash from chunk. Key 0 is special and
+- * should never be present in the hash.
+- */
+-static unsigned long chunk_to_key(struct audit_chunk *chunk)
+-{
+- /*
+- * We have a reference to the mark so it should be attached to a
+- * connector.
+- */
+- if (WARN_ON_ONCE(!chunk->mark.connector))
+- return 0;
+- return (unsigned long)chunk->mark.connector->obj;
+-}
+-
+ static inline struct list_head *chunk_hash(unsigned long key)
+ {
+ unsigned long n = key / L1_CACHE_BYTES;
+@@ -196,12 +182,12 @@ static inline struct list_head *chunk_hash(unsigned long key)
+ /* hash_lock & entry->lock is held by caller */
+ static void insert_hash(struct audit_chunk *chunk)
+ {
+- unsigned long key = chunk_to_key(chunk);
+ struct list_head *list;
+
+ if (!(chunk->mark.flags & FSNOTIFY_MARK_FLAG_ATTACHED))
+ return;
+- list = chunk_hash(key);
++ WARN_ON_ONCE(!chunk->key);
++ list = chunk_hash(chunk->key);
+ list_add_rcu(&chunk->hash, list);
+ }
+
+@@ -213,7 +199,7 @@ struct audit_chunk *audit_tree_lookup(const struct inode *inode)
+ struct audit_chunk *p;
+
+ list_for_each_entry_rcu(p, list, hash) {
+- if (chunk_to_key(p) == key) {
++ if (p->key == key) {
+ atomic_long_inc(&p->refs);
+ return p;
+ }
+@@ -297,6 +283,7 @@ static void untag_chunk(struct node *p)
+
+ chunk->dead = 1;
+ spin_lock(&hash_lock);
++ new->key = chunk->key;
+ list_replace_init(&chunk->trees, &new->trees);
+ if (owner->root == chunk) {
+ list_del_init(&owner->same_root);
+@@ -378,6 +365,7 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree)
+ tree->root = chunk;
+ list_add(&tree->same_root, &chunk->trees);
+ }
++ chunk->key = inode_to_key(inode);
+ insert_hash(chunk);
+ spin_unlock(&hash_lock);
+ spin_unlock(&entry->lock);
+@@ -462,6 +450,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
+ fsnotify_put_mark(old_entry);
+ return 0;
+ }
++ chunk->key = old->key;
+ list_replace_init(&old->trees, &chunk->trees);
+ for (n = 0, p = chunk->owners; n < old->count; n++, p++) {
+ struct audit_tree *s = old->owners[n].owner;
+@@ -661,7 +650,7 @@ void audit_trim_trees(void)
+ /* this could be NULL if the watch is dying else where... */
+ node->index |= 1U<<31;
+ if (iterate_mounts(compare_root,
+- (void *)chunk_to_key(chunk),
++ (void *)(chunk->key),
+ root_mnt))
+ node->index &= ~(1U<<31);
+ }
+--
+2.20.1
+
--- /dev/null
+From 169a4fdff86052f9d75be28dbe2b1b8ae56bca52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 13:11:41 -0400
+Subject: audit_get_nd(): don't unlock parent too early
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 69924b89687a2923e88cc42144aea27868913d0e ]
+
+if the child has been negative and just went positive
+under us, we want coherent d_is_positive() and ->d_inode.
+Don't unlock the parent until we'd done that work...
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/audit_watch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index 787c7afdf8294..4f7262eba73d8 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -366,12 +366,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent)
+ struct dentry *d = kern_path_locked(watch->path, parent);
+ if (IS_ERR(d))
+ return PTR_ERR(d);
+- inode_unlock(d_backing_inode(parent->dentry));
+ if (d_is_positive(d)) {
+ /* update watch filter fields */
+ watch->dev = d->d_sb->s_dev;
+ watch->ino = d_backing_inode(d)->i_ino;
+ }
++ inode_unlock(d_backing_inode(parent->dentry));
+ dput(d);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 96a2be4902dea67c66ece5e01d3d6fed4582c844 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 00:03:11 -0400
+Subject: autofs: fix a leak in autofs_expire_indirect()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 03ad0d703df75c43f78bd72e16124b5b94a95188 ]
+
+if the second call of should_expire() in there ends up
+grabbing and returning a new reference to dentry, we need
+to drop it before continuing.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/autofs/expire.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c
+index 28d9c2b1b3bb3..70e9afe589fbf 100644
+--- a/fs/autofs/expire.c
++++ b/fs/autofs/expire.c
+@@ -501,9 +501,10 @@ static struct dentry *autofs_expire_indirect(struct super_block *sb,
+ */
+ how &= ~AUTOFS_EXP_LEAVES;
+ found = should_expire(expired, mnt, timeout, how);
+- if (!found || found != expired)
+- /* Something has changed, continue */
++ if (found != expired) { // something has changed, continue
++ dput(found);
+ goto next;
++ }
+
+ if (expired != dentry)
+ dput(dentry);
+--
+2.20.1
+
--- /dev/null
+From b768ee87c27bcc6de62befc5c8caea67ddcae0b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 14:05:39 +0100
+Subject: bpf, arm64: fix getting subprog addr from aux for calls
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 8c11ea5ce13da0252fc92f91e90b0cb0c8fe5619 ]
+
+The arm64 JIT has the same issue as ppc64 JIT in that the relative BPF
+to BPF call offset can be too far away from core kernel in that relative
+encoding into imm is not sufficient and could potentially be truncated,
+see also fd045f6cd98e ("arm64: add support for module PLTs") which adds
+spill-over space for module_alloc() and therefore bpf_jit_binary_alloc().
+Therefore, use the recently added bpf_jit_get_func_addr() helper for
+properly fetching the address through prog->aux->func[off]->bpf_func
+instead. This also has the benefit to optimize normal helper calls since
+their address can use the optimized emission. Tested on Cavium ThunderX
+CN8890.
+
+Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/net/bpf_jit_comp.c | 26 +++++++++++++++++---------
+ 1 file changed, 17 insertions(+), 9 deletions(-)
+
+diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
+index 7f0258ed1f5fe..722b7cdb5892b 100644
+--- a/arch/arm64/net/bpf_jit_comp.c
++++ b/arch/arm64/net/bpf_jit_comp.c
+@@ -351,7 +351,8 @@ static void build_epilogue(struct jit_ctx *ctx)
+ * >0 - successfully JITed a 16-byte eBPF instruction.
+ * <0 - failed to JIT.
+ */
+-static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
++static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx,
++ bool extra_pass)
+ {
+ const u8 code = insn->code;
+ const u8 dst = bpf2a64[insn->dst_reg];
+@@ -625,12 +626,19 @@ emit_cond_jmp:
+ case BPF_JMP | BPF_CALL:
+ {
+ const u8 r0 = bpf2a64[BPF_REG_0];
+- const u64 func = (u64)__bpf_call_base + imm;
++ bool func_addr_fixed;
++ u64 func_addr;
++ int ret;
+
+- if (ctx->prog->is_func)
+- emit_addr_mov_i64(tmp, func, ctx);
++ ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass,
++ &func_addr, &func_addr_fixed);
++ if (ret < 0)
++ return ret;
++ if (func_addr_fixed)
++ /* We can use optimized emission here. */
++ emit_a64_mov_i64(tmp, func_addr, ctx);
+ else
+- emit_a64_mov_i64(tmp, func, ctx);
++ emit_addr_mov_i64(tmp, func_addr, ctx);
+ emit(A64_BLR(tmp), ctx);
+ emit(A64_MOV(1, r0, A64_R(0)), ctx);
+ break;
+@@ -762,7 +770,7 @@ emit_cond_jmp:
+ return 0;
+ }
+
+-static int build_body(struct jit_ctx *ctx)
++static int build_body(struct jit_ctx *ctx, bool extra_pass)
+ {
+ const struct bpf_prog *prog = ctx->prog;
+ int i;
+@@ -771,7 +779,7 @@ static int build_body(struct jit_ctx *ctx)
+ const struct bpf_insn *insn = &prog->insnsi[i];
+ int ret;
+
+- ret = build_insn(insn, ctx);
++ ret = build_insn(insn, ctx, extra_pass);
+ if (ret > 0) {
+ i++;
+ if (ctx->image == NULL)
+@@ -867,7 +875,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ /* 1. Initial fake pass to compute ctx->idx. */
+
+ /* Fake pass to fill in ctx->offset. */
+- if (build_body(&ctx)) {
++ if (build_body(&ctx, extra_pass)) {
+ prog = orig_prog;
+ goto out_off;
+ }
+@@ -897,7 +905,7 @@ skip_init_ctx:
+
+ build_prologue(&ctx, was_classic);
+
+- if (build_body(&ctx)) {
++ if (build_body(&ctx, extra_pass)) {
+ bpf_jit_binary_free(header);
+ prog = orig_prog;
+ goto out_off;
+--
+2.20.1
+
--- /dev/null
+From ac654f6e35d5412da06475900e37a5f9da505115 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 13:23:28 -0800
+Subject: bpf: btf: check name validity for various types
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit eb04bbb608e683f8fd3ef7f716e2fa32dd90861f ]
+
+This patch added name checking for the following types:
+ . BTF_KIND_PTR, BTF_KIND_ARRAY, BTF_KIND_VOLATILE,
+ BTF_KIND_CONST, BTF_KIND_RESTRICT:
+ the name must be null
+ . BTF_KIND_STRUCT, BTF_KIND_UNION: the struct/member name
+ is either null or a valid identifier
+ . BTF_KIND_ENUM: the enum type name is either null or a valid
+ identifier; the enumerator name must be a valid identifier.
+ . BTF_KIND_FWD: the name must be a valid identifier
+ . BTF_KIND_TYPEDEF: the name must be a valid identifier
+
+For those places a valid name is required, the name must be
+a valid C identifier. This can be relaxed later if we found
+use cases for a different (non-C) frontend.
+
+Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 57 insertions(+)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index f0f9109f59bac..3e2413345e718 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -1168,6 +1168,22 @@ static int btf_ref_type_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* typedef type must have a valid name, and other ref types,
++ * volatile, const, restrict, should have a null name.
++ */
++ if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPEDEF) {
++ if (!t->name_off ||
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++ } else {
++ if (t->name_off) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ return 0;
+@@ -1325,6 +1341,13 @@ static s32 btf_fwd_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* fwd type must have a valid name */
++ if (!t->name_off ||
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ return 0;
+@@ -1381,6 +1404,12 @@ static s32 btf_array_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* array type should not have a name */
++ if (t->name_off) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ if (btf_type_vlen(t)) {
+ btf_verifier_log_type(env, t, "vlen != 0");
+ return -EINVAL;
+@@ -1557,6 +1586,13 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* struct type either no name or a valid one */
++ if (t->name_off &&
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ last_offset = 0;
+@@ -1568,6 +1604,12 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* struct member either no name or a valid one */
++ if (member->name_off &&
++ !btf_name_valid_identifier(btf, member->name_off)) {
++ btf_verifier_log_member(env, t, member, "Invalid name");
++ return -EINVAL;
++ }
+ /* A member cannot be in type void */
+ if (!member->type || !BTF_TYPE_ID_VALID(member->type)) {
+ btf_verifier_log_member(env, t, member,
+@@ -1755,6 +1797,13 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* enum type either no name or a valid one */
++ if (t->name_off &&
++ !btf_name_valid_identifier(env->btf, t->name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
+ btf_verifier_log_type(env, t, NULL);
+
+ for (i = 0; i < nr_enums; i++) {
+@@ -1764,6 +1813,14 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env,
+ return -EINVAL;
+ }
+
++ /* enum member must have a valid name */
++ if (!enums[i].name_off ||
++ !btf_name_valid_identifier(btf, enums[i].name_off)) {
++ btf_verifier_log_type(env, t, "Invalid name");
++ return -EINVAL;
++ }
++
++
+ btf_verifier_log(env, "\t%s val=%d\n",
+ btf_name_by_offset(btf, enums[i].name_off),
+ enums[i].val);
+--
+2.20.1
+
--- /dev/null
+From f581dafb0e98a809f56c811bdc3281e1f0cbc50c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 13:23:27 -0800
+Subject: bpf: btf: implement btf_name_valid_identifier()
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit cdbb096adddb3f42584cecb5ec2e07c26815b71f ]
+
+Function btf_name_valid_identifier() have been implemented in
+bpf-next commit 2667a2626f4d ("bpf: btf: Add BTF_KIND_FUNC and
+BTF_KIND_FUNC_PROTO"). Backport this function so later patch
+can use it.
+
+Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/btf.c | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index cfa27b7d1168c..f0f9109f59bac 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -5,6 +5,7 @@
+ #include <uapi/linux/types.h>
+ #include <linux/seq_file.h>
+ #include <linux/compiler.h>
++#include <linux/ctype.h>
+ #include <linux/errno.h>
+ #include <linux/slab.h>
+ #include <linux/anon_inodes.h>
+@@ -426,6 +427,30 @@ static bool btf_name_offset_valid(const struct btf *btf, u32 offset)
+ offset < btf->hdr.str_len;
+ }
+
++/* Only C-style identifier is permitted. This can be relaxed if
++ * necessary.
++ */
++static bool btf_name_valid_identifier(const struct btf *btf, u32 offset)
++{
++ /* offset must be valid */
++ const char *src = &btf->strings[offset];
++ const char *src_limit;
++
++ if (!isalpha(*src) && *src != '_')
++ return false;
++
++ /* set a limit on identifier length */
++ src_limit = src + KSYM_NAME_LEN;
++ src++;
++ while (*src && src < src_limit) {
++ if (!isalnum(*src) && *src != '_')
++ return false;
++ src++;
++ }
++
++ return !*src;
++}
++
+ static const char *btf_name_by_offset(const struct btf *btf, u32 offset)
+ {
+ if (!offset)
+--
+2.20.1
+
--- /dev/null
+From 042e1380a706d016779220e50dcf937079a4d7c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 14:46:52 -0800
+Subject: bus: ti-sysc: Fix getting optional clocks in clock_roles
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7b4f8ac2f1acdff3c0cce23d8c3b86434a6e768a ]
+
+We can have holes in clock_roles with interface clock missing for
+example. Currently getting an optional clock will fail if there are
+only a functional clock and an optional clock.
+
+Fixes: 09dfe5810762 ("bus: ti-sysc: Add handling for clkctrl opt clocks")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bus/ti-sysc.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
+index 5b31131d0cba2..b6f63e7620214 100644
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -217,8 +217,13 @@ static int sysc_get_clocks(struct sysc *ddata)
+ if (!ddata->clocks)
+ return -ENOMEM;
+
+- for (i = 0; i < ddata->nr_clocks; i++) {
+- error = sysc_get_one_clock(ddata, ddata->clock_roles[i]);
++ for (i = 0; i < SYSC_MAX_CLOCKS; i++) {
++ const char *name = ddata->clock_roles[i];
++
++ if (!name)
++ continue;
++
++ error = sysc_get_one_clock(ddata, name);
+ if (error && error != -ENOENT)
+ return error;
+ }
+--
+2.20.1
+
--- /dev/null
+From eb7e6c52b64822fe0a8681544ee167ccfe0dcf0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 18:32:29 +0800
+Subject: can: xilinx: fix return type of ndo_start_xmit function
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 81de0cd60fd492575b24d97667f38b8b833fb058 ]
+
+The method ndo_start_xmit() is defined as returning an 'netdev_tx_t',
+which is a typedef for an enum type, so make sure the implementation in
+this driver has returns 'netdev_tx_t' value, and change the function
+return type to netdev_tx_t.
+
+Found by coccinelle.
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/xilinx_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
+index 3df23487487f7..b01c6da4dd814 100644
+--- a/drivers/net/can/xilinx_can.c
++++ b/drivers/net/can/xilinx_can.c
+@@ -612,7 +612,7 @@ static int xcan_start_xmit_mailbox(struct sk_buff *skb, struct net_device *ndev)
+ *
+ * Return: NETDEV_TX_OK on success and NETDEV_TX_BUSY when the tx queue is full
+ */
+-static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
++static netdev_tx_t xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ {
+ struct xcan_priv *priv = netdev_priv(ndev);
+ int ret;
+--
+2.20.1
+
--- /dev/null
+From 0e6de807e239ddeca65152571347fef67537fcd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 00:36:33 -0800
+Subject: clk: mediatek: Drop more __init markings for driver probe
+
+From: Stephen Boyd <sboyd@kernel.org>
+
+[ Upstream commit 553604c041b8c18cd6a8e1d785a77f3e4be61cdb ]
+
+This function is called from driver probe, which isn't the same as
+__init code because driver probe can happen later. Drop the __init
+marking here to fix this potential problem.
+
+Cc: Sean Wang <sean.wang@mediatek.com>
+Cc: Ryder Lee <ryder.lee@mediatek.com>
+Cc: Rob Herring <robh@kernel.org>
+Cc: Wenzhen Yu <wenzhen.yu@mediatek.com>
+Cc: Weiyi Lu <weiyi.lu@mediatek.com>
+Fixes: 2fc0a509e4ee ("clk: mediatek: add clock support for MT7622 SoC")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mediatek/clk-mt7622.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c
+index 92f7e32770c6a..a8aecef1ba89a 100644
+--- a/drivers/clk/mediatek/clk-mt7622.c
++++ b/drivers/clk/mediatek/clk-mt7622.c
+@@ -513,7 +513,7 @@ static const struct mtk_gate peri_clks[] = {
+ GATE_PERI1(CLK_PERI_IRTX_PD, "peri_irtx_pd", "irtx_sel", 2),
+ };
+
+-static struct mtk_composite infra_muxes[] __initdata = {
++static struct mtk_composite infra_muxes[] = {
+ MUX(CLK_INFRA_MUX1_SEL, "infra_mux1_sel", infra_mux1_parents,
+ 0x000, 2, 2),
+ };
+@@ -652,7 +652,7 @@ static int mtk_topckgen_init(struct platform_device *pdev)
+ return of_clk_add_provider(node, of_clk_src_onecell_get, clk_data);
+ }
+
+-static int __init mtk_infrasys_init(struct platform_device *pdev)
++static int mtk_infrasys_init(struct platform_device *pdev)
+ {
+ struct device_node *node = pdev->dev.of_node;
+ struct clk_onecell_data *clk_data;
+--
+2.20.1
+
--- /dev/null
+From 76a256bf18a2a841a9205a6f08be4e9bb0fb0a4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 12:19:22 +0100
+Subject: clk: meson: Fix GXL HDMI PLL fractional bits width
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 21310c39ec01e82ef3ef9bf8ac385b53ccdc158c ]
+
+The GXL Documentation specifies 12 bits for the Fractional bit field,
+bit the last bits have a different purpose that we cannot handle right
+now, so update the bitwidth to have correct fractional calculations.
+
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+[narmstrong: added comment on GXL HHI_HDMI_PLL_CNTL register shift]
+Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lkml.kernel.org/r/20181121111922.1277-1-narmstrong@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index d94b65061b9f1..b039909e03cf8 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -295,6 +295,12 @@ static struct clk_regmap gxl_hdmi_pll = {
+ .shift = 9,
+ .width = 5,
+ },
++ /*
++ * On gxl, there is a register shift due to
++ * HHI_HDMI_PLL_CNTL1 which does not exist on gxbb,
++ * so we use the HHI_HDMI_PLL_CNTL2 define from GXBB
++ * instead which is defined at the same offset.
++ */
+ .frac = {
+ /*
+ * On gxl, there is a register shift due to
+@@ -304,7 +310,7 @@ static struct clk_regmap gxl_hdmi_pll = {
+ */
+ .reg_off = HHI_HDMI_PLL_CNTL + 4,
+ .shift = 0,
+- .width = 12,
++ .width = 10,
+ },
+ .od = {
+ .reg_off = HHI_HDMI_PLL_CNTL + 8,
+--
+2.20.1
+
--- /dev/null
+From 06c777e73f6344d25e3d7907a0ee80f877c3e088 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 22:42:18 +0100
+Subject: clk: meson: meson8b: fix the offset of vid_pll_dco's N value
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 376d8c45bd6ac79f02ecf9ca1606dc5d1b271bc0 ]
+
+Unlike the other PLLs on Meson8b the N value "vid_pll_dco" (a better
+name would be hdmi_pll_dco or - as the datasheet calls it - HPLL) is
+located at HHI_VID_PLL_CNTL[14:10] instead of [13:9].
+This results in an incorrect calculation of the rate of this PLL because
+the value seen by the kernel is double the actual N (divider) value.
+Update the offset of the N value to fix the calculation of the PLL rate.
+
+Fixes: 28b9fcd016126e ("clk: meson8b: Add support for Meson8b clocks")
+Reported-by: Jianxin Pan <jianxin.pan@amlogic.com>
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Link: https://lkml.kernel.org/r/20181202214220.7715-2-martin.blumenstingl@googlemail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/meson8b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c
+index 9d79ff857d83e..e90af556ff90f 100644
+--- a/drivers/clk/meson/meson8b.c
++++ b/drivers/clk/meson/meson8b.c
+@@ -144,7 +144,7 @@ static struct clk_regmap meson8b_vid_pll = {
+ },
+ .n = {
+ .reg_off = HHI_VID_PLL_CNTL,
+- .shift = 9,
++ .shift = 10,
+ .width = 5,
+ },
+ .od = {
+--
+2.20.1
+
--- /dev/null
+From 381bcfff7d5794e5b9cc1bc2123c769abc6e4b04 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 09:13:43 -0700
+Subject: clk: qcom: Fix MSM8998 resets
+
+From: Jeffrey Hugo <jhugo@codeaurora.org>
+
+[ Upstream commit 4f89f7b59a6ea17e81cff212c18a0b580ff5ff27 ]
+
+The offsets for the defined BCR reset registers does not match the hardware
+documentation. Update the values to match the hardware documentation.
+
+Fixes: b5f5f525c547 (clk: qcom: Add MSM8998 Global Clock Control (GCC) driver)
+Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8998.c | 38 +++++++++++++++++-----------------
+ 1 file changed, 19 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index cd937ce6aaaf6..5fd6662a1beac 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -2743,25 +2743,25 @@ static struct gdsc *gcc_msm8998_gdscs[] = {
+ };
+
+ static const struct qcom_reset_map gcc_msm8998_resets[] = {
+- [GCC_BLSP1_QUP1_BCR] = { 0x102400 },
+- [GCC_BLSP1_QUP2_BCR] = { 0x110592 },
+- [GCC_BLSP1_QUP3_BCR] = { 0x118784 },
+- [GCC_BLSP1_QUP4_BCR] = { 0x126976 },
+- [GCC_BLSP1_QUP5_BCR] = { 0x135168 },
+- [GCC_BLSP1_QUP6_BCR] = { 0x143360 },
+- [GCC_BLSP2_QUP1_BCR] = { 0x155648 },
+- [GCC_BLSP2_QUP2_BCR] = { 0x163840 },
+- [GCC_BLSP2_QUP3_BCR] = { 0x172032 },
+- [GCC_BLSP2_QUP4_BCR] = { 0x180224 },
+- [GCC_BLSP2_QUP5_BCR] = { 0x188416 },
+- [GCC_BLSP2_QUP6_BCR] = { 0x196608 },
+- [GCC_PCIE_0_BCR] = { 0x438272 },
+- [GCC_PDM_BCR] = { 0x208896 },
+- [GCC_SDCC2_BCR] = { 0x81920 },
+- [GCC_SDCC4_BCR] = { 0x90112 },
+- [GCC_TSIF_BCR] = { 0x221184 },
+- [GCC_UFS_BCR] = { 0x479232 },
+- [GCC_USB_30_BCR] = { 0x61440 },
++ [GCC_BLSP1_QUP1_BCR] = { 0x19000 },
++ [GCC_BLSP1_QUP2_BCR] = { 0x1b000 },
++ [GCC_BLSP1_QUP3_BCR] = { 0x1d000 },
++ [GCC_BLSP1_QUP4_BCR] = { 0x1f000 },
++ [GCC_BLSP1_QUP5_BCR] = { 0x21000 },
++ [GCC_BLSP1_QUP6_BCR] = { 0x23000 },
++ [GCC_BLSP2_QUP1_BCR] = { 0x26000 },
++ [GCC_BLSP2_QUP2_BCR] = { 0x28000 },
++ [GCC_BLSP2_QUP3_BCR] = { 0x2a000 },
++ [GCC_BLSP2_QUP4_BCR] = { 0x2c000 },
++ [GCC_BLSP2_QUP5_BCR] = { 0x2e000 },
++ [GCC_BLSP2_QUP6_BCR] = { 0x30000 },
++ [GCC_PCIE_0_BCR] = { 0x6b000 },
++ [GCC_PDM_BCR] = { 0x33000 },
++ [GCC_SDCC2_BCR] = { 0x14000 },
++ [GCC_SDCC4_BCR] = { 0x16000 },
++ [GCC_TSIF_BCR] = { 0x36000 },
++ [GCC_UFS_BCR] = { 0x75000 },
++ [GCC_USB_30_BCR] = { 0xf000 },
+ };
+
+ static const struct regmap_config gcc_msm8998_regmap_config = {
+--
+2.20.1
+
--- /dev/null
+From 5ebfdc8b653e454ec1da801676ea70fb5f338fd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 10:33:29 -0800
+Subject: clk: qcom: gcc-msm8998: Disable halt check of UFS clocks
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+[ Upstream commit 2abf856202fd3e4883e4c518acaa9a023b0dbe54 ]
+
+Drop the halt check of the UFS symbol clocks, in accordance with other
+platforms. This makes clk_disable_unused() happy and makes it possible
+to turn the clocks on again without an error.
+
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8998.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c
+index 5fd6662a1beac..4e23973b6cd16 100644
+--- a/drivers/clk/qcom/gcc-msm8998.c
++++ b/drivers/clk/qcom/gcc-msm8998.c
+@@ -2402,7 +2402,7 @@ static struct clk_branch gcc_ufs_phy_aux_clk = {
+
+ static struct clk_branch gcc_ufs_rx_symbol_0_clk = {
+ .halt_reg = 0x75014,
+- .halt_check = BRANCH_HALT,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x75014,
+ .enable_mask = BIT(0),
+@@ -2415,7 +2415,7 @@ static struct clk_branch gcc_ufs_rx_symbol_0_clk = {
+
+ static struct clk_branch gcc_ufs_rx_symbol_1_clk = {
+ .halt_reg = 0x7605c,
+- .halt_check = BRANCH_HALT,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x7605c,
+ .enable_mask = BIT(0),
+@@ -2428,7 +2428,7 @@ static struct clk_branch gcc_ufs_rx_symbol_1_clk = {
+
+ static struct clk_branch gcc_ufs_tx_symbol_0_clk = {
+ .halt_reg = 0x75010,
+- .halt_check = BRANCH_HALT,
++ .halt_check = BRANCH_HALT_SKIP,
+ .clkr = {
+ .enable_reg = 0x75010,
+ .enable_mask = BIT(0),
+--
+2.20.1
+
--- /dev/null
+From d5cca48e90dc16d96106089cd573e9cd4cac426e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 16:48:34 +0900
+Subject: clk: renesas: r8a77990: Correct parent clock of DU
+
+From: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+
+[ Upstream commit 7cf3a216a2b3a672cad3e498c186c9333bdff90a ]
+
+According to the R-Car Gen3 Hardware Manual Rev 1.00, the parent clock
+of the DU module clocks on R-Car E3 is S1D1.
+
+Signed-off-by: Takeshi Kihara <takeshi.kihara.df@renesas.com>
+Fixes: 3570a2af473789c5 ("clk: renesas: cpg-mssr: Add support for R-Car E3")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a77990-cpg-mssr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/r8a77990-cpg-mssr.c b/drivers/clk/renesas/r8a77990-cpg-mssr.c
+index 9e14f1486fbb9..81569767025cc 100644
+--- a/drivers/clk/renesas/r8a77990-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a77990-cpg-mssr.c
+@@ -175,8 +175,8 @@ static const struct mssr_mod_clk r8a77990_mod_clks[] __initconst = {
+ DEF_MOD("ehci0", 703, R8A77990_CLK_S3D4),
+ DEF_MOD("hsusb", 704, R8A77990_CLK_S3D4),
+ DEF_MOD("csi40", 716, R8A77990_CLK_CSI0),
+- DEF_MOD("du1", 723, R8A77990_CLK_S2D1),
+- DEF_MOD("du0", 724, R8A77990_CLK_S2D1),
++ DEF_MOD("du1", 723, R8A77990_CLK_S1D1),
++ DEF_MOD("du0", 724, R8A77990_CLK_S1D1),
+ DEF_MOD("lvds", 727, R8A77990_CLK_S2D1),
+
+ DEF_MOD("vin5", 806, R8A77990_CLK_S1D2),
+--
+2.20.1
+
--- /dev/null
+From 607ed23b59d6f5579549788090473a4ac6c35bbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 11:06:37 +0100
+Subject: clk: renesas: r8a77995: Correct parent clock of DU
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 515b2915ee08060ad4f6a3b3de38c5c2c5258e8b ]
+
+According to the R-Car Gen3 Hardware Manual Rev 1.00, the parent clock
+of the DU module clocks on R-Car D3 is S1D1.
+
+Fixes: d71e851d82c6cfe5 ("clk: renesas: cpg-mssr: Add R8A77995 support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Tested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/r8a77995-cpg-mssr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+index ea4cafbe6e851..9e16931e6f28a 100644
+--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c
++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c
+@@ -141,8 +141,8 @@ static const struct mssr_mod_clk r8a77995_mod_clks[] __initconst = {
+ DEF_MOD("vspbs", 627, R8A77995_CLK_S0D1),
+ DEF_MOD("ehci0", 703, R8A77995_CLK_S3D2),
+ DEF_MOD("hsusb", 704, R8A77995_CLK_S3D2),
+- DEF_MOD("du1", 723, R8A77995_CLK_S2D1),
+- DEF_MOD("du0", 724, R8A77995_CLK_S2D1),
++ DEF_MOD("du1", 723, R8A77995_CLK_S1D1),
++ DEF_MOD("du0", 724, R8A77995_CLK_S1D1),
+ DEF_MOD("lvds", 727, R8A77995_CLK_S2D1),
+ DEF_MOD("vin7", 804, R8A77995_CLK_S1D2),
+ DEF_MOD("vin6", 805, R8A77995_CLK_S1D2),
+--
+2.20.1
+
--- /dev/null
+From 5596ab3465df34d171ca9c5002d5f471a42d6a1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 01:15:38 +0100
+Subject: clk: renesas: rcar-gen3: Set state when registering SD clocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit ecda0a09fa9933bcd67e33c952f778f0872392ed ]
+
+The driver tries to figure out which state a SD clock is in when the
+clock is registered, instead of setting a known state. This can be
+problematic for two reasons.
+
+1. If the clock driver can't figure out the state of the clock,
+ registration of the clock fails, and setting of a known state by a
+ clock user is not possible.
+
+2. The state of the clock depends on if and how the bootloader
+ configured it. The driver only checks that the rate is known, not if
+ the clock is stopped or not for example.
+
+Fix this by setting a known state and making sure the clock is stopped.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/renesas/rcar-gen3-cpg.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/clk/renesas/rcar-gen3-cpg.c b/drivers/clk/renesas/rcar-gen3-cpg.c
+index 628b63b85d3f0..9ace7d39cd1b5 100644
+--- a/drivers/clk/renesas/rcar-gen3-cpg.c
++++ b/drivers/clk/renesas/rcar-gen3-cpg.c
+@@ -361,7 +361,7 @@ static struct clk * __init cpg_sd_clk_register(const struct cpg_core_clk *core,
+ struct sd_clock *clock;
+ struct clk *clk;
+ unsigned int i;
+- u32 sd_fc;
++ u32 val;
+
+ clock = kzalloc(sizeof(*clock), GFP_KERNEL);
+ if (!clock)
+@@ -378,17 +378,9 @@ static struct clk * __init cpg_sd_clk_register(const struct cpg_core_clk *core,
+ clock->div_table = cpg_sd_div_table;
+ clock->div_num = ARRAY_SIZE(cpg_sd_div_table);
+
+- sd_fc = readl(clock->csn.reg) & CPG_SD_FC_MASK;
+- for (i = 0; i < clock->div_num; i++)
+- if (sd_fc == (clock->div_table[i].val & CPG_SD_FC_MASK))
+- break;
+-
+- if (WARN_ON(i >= clock->div_num)) {
+- kfree(clock);
+- return ERR_PTR(-EINVAL);
+- }
+-
+- clock->cur_div_idx = i;
++ val = readl(clock->csn.reg) & ~CPG_SD_FC_MASK;
++ val |= CPG_SD_STP_MASK | (clock->div_table[0].val & CPG_SD_FC_MASK);
++ writel(val, clock->csn.reg);
+
+ clock->div_max = clock->div_table[0].div;
+ clock->div_min = clock->div_max;
+--
+2.20.1
+
--- /dev/null
+From 733c8f30526d84cba6ce80d53393af5f120a86b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Nov 2018 13:16:12 +0900
+Subject: clk: rockchip: fix I2S1 clock gate register for rk3328
+
+From: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+
+[ Upstream commit 5c73ac2f8b70834a603eb2d92eb0bb464634420b ]
+
+This patch fixes definition of I2S1 clock gate register for rk3328.
+Current setting is not related I2S clocks.
+ - bit6 of CRU_CLKGATE_CON0 means clk_ddrmon_en
+ - bit6 of CRU_CLKGATE_CON1 means clk_i2s1_en
+
+Signed-off-by: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3328.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index ecbae8acd05b8..f2f13b603ae9b 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -392,7 +392,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ RK3328_CLKGATE_CON(1), 5, GFLAGS,
+ &rk3328_i2s1_fracmux),
+ GATE(SCLK_I2S1, "clk_i2s1", "i2s1_pre", CLK_SET_RATE_PARENT,
+- RK3328_CLKGATE_CON(0), 6, GFLAGS),
++ RK3328_CLKGATE_CON(1), 6, GFLAGS),
+ COMPOSITE_NODIV(SCLK_I2S1_OUT, "i2s1_out", mux_i2s1out_p, 0,
+ RK3328_CLKSEL_CON(8), 12, 1, MFLAGS,
+ RK3328_CLKGATE_CON(1), 7, GFLAGS),
+--
+2.20.1
+
--- /dev/null
+From df96eb57f8f5fb08a15b1d892c00b19ae741c42e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Nov 2018 13:18:02 +0900
+Subject: clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328
+
+From: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+
+[ Upstream commit df7b1f2e0a4ae0fceff261e29cde63dafcf2360f ]
+
+This patch fixes mistakes in HCLK_I2S1_8CH for running I2S1
+successfully.
+
+Signed-off-by: Katsuhiro Suzuki <katsuhiro@katsuster.net>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/dt-bindings/clock/rk3328-cru.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/dt-bindings/clock/rk3328-cru.h b/include/dt-bindings/clock/rk3328-cru.h
+index a82a0109faffe..9d5f799469eee 100644
+--- a/include/dt-bindings/clock/rk3328-cru.h
++++ b/include/dt-bindings/clock/rk3328-cru.h
+@@ -178,7 +178,7 @@
+ #define HCLK_TSP 309
+ #define HCLK_GMAC 310
+ #define HCLK_I2S0_8CH 311
+-#define HCLK_I2S1_8CH 313
++#define HCLK_I2S1_8CH 312
+ #define HCLK_I2S2_2CH 313
+ #define HCLK_SPDIF_8CH 314
+ #define HCLK_VOP 315
+--
+2.20.1
+
--- /dev/null
+From 046cd73a9fa5d4044ad783254e783eeedd95717c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 12:17:30 +0100
+Subject: clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+[ Upstream commit ac8cb53829a6ba119082e067f5bc8fab3611ce6a ]
+
+Similar to commit a9f0c0e56371 ("clk: rockchip: fix rk3188 sclk_smc
+gate data") there is one other gate clock in the rk3188 clock driver
+with a similar wrong ordering, the sclk_mac_lbtest. So fix it as well.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3188.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 9a6ad5a4cdf06..2ca7e2be2f09e 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -362,8 +362,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ RK2928_CLKGATE_CON(2), 5, GFLAGS),
+ MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT,
+ RK2928_CLKSEL_CON(21), 4, 1, MFLAGS),
+- GATE(0, "sclk_mac_lbtest", "sclk_macref",
+- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS),
++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0,
++ RK2928_CLKGATE_CON(2), 12, GFLAGS),
+
+ COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0,
+ RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS,
+--
+2.20.1
+
--- /dev/null
+From 96bbeb6a0742e05e253806f1909300bb20ce1487 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 15:45:49 +0000
+Subject: clk: rockchip: fix rk3188 sclk_smc gate data
+
+From: Finley Xiao <finley.xiao@rock-chips.com>
+
+[ Upstream commit a9f0c0e563717b9f63b3bb1c4a7c2df436a206d9 ]
+
+Fix sclk_smc gate data.
+Change variable order, flags come before the register address.
+
+Signed-off-by: Finley Xiao <finley.xiao@rock-chips.com>
+Signed-off-by: Johan Jonker <jbx9999@hotmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/rockchip/clk-rk3188.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c
+index 69fb3afc970fb..9a6ad5a4cdf06 100644
+--- a/drivers/clk/rockchip/clk-rk3188.c
++++ b/drivers/clk/rockchip/clk-rk3188.c
+@@ -391,8 +391,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
+ * Clock-Architecture Diagram 4
+ */
+
+- GATE(SCLK_SMC, "sclk_smc", "hclk_peri",
+- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS),
++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0,
++ RK2928_CLKGATE_CON(2), 4, GFLAGS),
+
+ COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0,
+ RK2928_CLKSEL_CON(25), 0, 7, DFLAGS,
+--
+2.20.1
+
--- /dev/null
+From 3132945faa1c1de17f670e480b5d90ab44ffd1b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 16:46:08 +0530
+Subject: clk: sunxi-ng: a64: Fix gate bit of DSI DPHY
+
+From: Jagan Teki <jagan@amarulasolutions.com>
+
+[ Upstream commit ee678706e46d0d185c27cc214ad97828e0643159 ]
+
+DSI DPHY gate bit on MIPI DSI clock register is bit 15
+not bit 30.
+
+Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+index 2a60981799216..dec4a130390a3 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c
+@@ -582,7 +582,7 @@ static const char * const dsi_dphy_parents[] = { "pll-video0", "pll-periph0" };
+ static const u8 dsi_dphy_table[] = { 0, 2, };
+ static SUNXI_CCU_M_WITH_MUX_TABLE_GATE(dsi_dphy_clk, "dsi-dphy",
+ dsi_dphy_parents, dsi_dphy_table,
+- 0x168, 0, 4, 8, 2, BIT(31), CLK_SET_RATE_PARENT);
++ 0x168, 0, 4, 8, 2, BIT(15), CLK_SET_RATE_PARENT);
+
+ static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu",
+ 0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT);
+--
+2.20.1
+
--- /dev/null
+From b4f4962363771ab23aa2719cc49d23346c1aaeff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 13:33:28 +0800
+Subject: clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 7bb7d29cffdd24bf419516d14b6768591e74069e ]
+
+The third parent of CSI_MCLK is PLL_PERIPH1, not PLL_PERIPH0.
+Fix it.
+
+Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks")
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+index 77ed0b0ba6819..61e3ba12773ea 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c
+@@ -475,7 +475,7 @@ static const char * const csi_sclk_parents[] = { "pll-periph0", "pll-periph1" };
+ static SUNXI_CCU_M_WITH_MUX_GATE(csi_sclk_clk, "csi-sclk", csi_sclk_parents,
+ 0x134, 16, 4, 24, 3, BIT(31), 0);
+
+-static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph0" };
++static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph1" };
+ static SUNXI_CCU_M_WITH_MUX_GATE(csi_mclk_clk, "csi-mclk", csi_mclk_parents,
+ 0x134, 0, 5, 8, 3, BIT(15), 0);
+
+--
+2.20.1
+
--- /dev/null
+From 6649c0ebfbf9a63c365aa122d484f87e9d80e7b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:58:58 +0530
+Subject: crypto: bcm - fix normal/non key hash algorithm failure
+
+From: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+
+[ Upstream commit 4f0129d13e69bad0363fd75553fb22897b32c379 ]
+
+Remove setkey() callback handler for normal/non key
+hash algorithms and keep it for AES-CBC/CMAC which needs key.
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/bcm/cipher.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index cd464637b0cb6..49c0097fa4749 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -4634,12 +4634,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg)
+ hash->halg.statesize = sizeof(struct spu_hash_export_s);
+
+ if (driver_alg->auth_info.mode != HASH_MODE_HMAC) {
+- hash->setkey = ahash_setkey;
+ hash->init = ahash_init;
+ hash->update = ahash_update;
+ hash->final = ahash_final;
+ hash->finup = ahash_finup;
+ hash->digest = ahash_digest;
++ if ((driver_alg->auth_info.alg == HASH_ALG_AES) &&
++ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) ||
++ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) {
++ hash->setkey = ahash_setkey;
++ }
+ } else {
+ hash->setkey = ahash_hmac_setkey;
+ hash->init = ahash_hmac_init;
+--
+2.20.1
+
--- /dev/null
+From 1b145cefa4b2b965a2a31449d19b9043874858fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 5 Nov 2018 11:36:18 +0300
+Subject: crypto: ecc - check for invalid values in the key verification test
+
+From: Vitaly Chikunov <vt@altlinux.org>
+
+[ Upstream commit 2eb4942b6609d35a4e835644a33203b0aef7443d ]
+
+Currently used scalar multiplication algorithm (Matthieu Rivain, 2011)
+have invalid values for scalar == 1, n-1, and for regularized version
+n-2, which was previously not checked. Verify that they are not used as
+private keys.
+
+Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/ecc.c | 42 ++++++++++++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+diff --git a/crypto/ecc.c b/crypto/ecc.c
+index adcce310f6462..ed1237115066b 100644
+--- a/crypto/ecc.c
++++ b/crypto/ecc.c
+@@ -912,30 +912,43 @@ static inline void ecc_swap_digits(const u64 *in, u64 *out,
+ out[i] = __swab64(in[ndigits - 1 - i]);
+ }
+
+-int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
+- const u64 *private_key, unsigned int private_key_len)
++static int __ecc_is_key_valid(const struct ecc_curve *curve,
++ const u64 *private_key, unsigned int ndigits)
+ {
+- int nbytes;
+- const struct ecc_curve *curve = ecc_get_curve(curve_id);
++ u64 one[ECC_MAX_DIGITS] = { 1, };
++ u64 res[ECC_MAX_DIGITS];
+
+ if (!private_key)
+ return -EINVAL;
+
+- nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
+-
+- if (private_key_len != nbytes)
++ if (curve->g.ndigits != ndigits)
+ return -EINVAL;
+
+- if (vli_is_zero(private_key, ndigits))
++ /* Make sure the private key is in the range [2, n-3]. */
++ if (vli_cmp(one, private_key, ndigits) != -1)
+ return -EINVAL;
+-
+- /* Make sure the private key is in the range [1, n-1]. */
+- if (vli_cmp(curve->n, private_key, ndigits) != 1)
++ vli_sub(res, curve->n, one, ndigits);
++ vli_sub(res, res, one, ndigits);
++ if (vli_cmp(res, private_key, ndigits) != 1)
+ return -EINVAL;
+
+ return 0;
+ }
+
++int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits,
++ const u64 *private_key, unsigned int private_key_len)
++{
++ int nbytes;
++ const struct ecc_curve *curve = ecc_get_curve(curve_id);
++
++ nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT;
++
++ if (private_key_len != nbytes)
++ return -EINVAL;
++
++ return __ecc_is_key_valid(curve, private_key, ndigits);
++}
++
+ /*
+ * ECC private keys are generated using the method of extra random bits,
+ * equivalent to that described in FIPS 186-4, Appendix B.4.1.
+@@ -979,11 +992,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey)
+ if (err)
+ return err;
+
+- if (vli_is_zero(priv, ndigits))
+- return -EINVAL;
+-
+- /* Make sure the private key is in the range [1, n-1]. */
+- if (vli_cmp(curve->n, priv, ndigits) != 1)
++ /* Make sure the private key is in the valid range. */
++ if (__ecc_is_key_valid(curve, priv, ndigits))
+ return -EINVAL;
+
+ ecc_swap_digits(priv, privkey, ndigits);
+--
+2.20.1
+
--- /dev/null
+From a13fde0627e7be9f8138c5fbb02a6a6c3f1428e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 14:52:01 +0530
+Subject: cxgb4vf: fix memleak in mac_hlist initialization
+
+From: Arjun Vynipadath <arjun@chelsio.com>
+
+[ Upstream commit 24357e06ba511ad874d664d39475dbb01c1ca450 ]
+
+mac_hlist was initialized during adapter_up, which will be called
+every time a vf device is first brought up, or every time when device
+is brought up again after bringing all devices down. This means our
+state of previous list is lost, causing a memleak if entries are
+present in the list. To fix that, move list init to the condition
+that performs initial one time adapter setup.
+
+Signed-off-by: Arjun Vynipadath <arjun@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+index ff84791a0ff85..972dc7bd721d9 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+@@ -722,6 +722,10 @@ static int adapter_up(struct adapter *adapter)
+
+ if (adapter->flags & USING_MSIX)
+ name_msix_vecs(adapter);
++
++ /* Initialize hash mac addr list*/
++ INIT_LIST_HEAD(&adapter->mac_hlist);
++
+ adapter->flags |= FULL_INIT_DONE;
+ }
+
+@@ -747,8 +751,6 @@ static int adapter_up(struct adapter *adapter)
+ enable_rx(adapter);
+ t4vf_sge_start(adapter);
+
+- /* Initialize hash mac addr list*/
+- INIT_LIST_HEAD(&adapter->mac_hlist);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 14a69eac44bdc4ac73486bfd338ddaef070675dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 15:27:37 -0600
+Subject: dlm: fix invalid cluster name warning
+
+From: David Teigland <teigland@redhat.com>
+
+[ Upstream commit 3595c559326d0b660bb088a88e22e0ca630a0e35 ]
+
+The warning added in commit 3b0e761ba83
+ "dlm: print log message when cluster name is not set"
+
+did not account for the fact that lockspaces created
+from userland do not supply a cluster name, so bogus
+warnings are printed every time a userland lockspace
+is created.
+
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/user.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/dlm/user.c b/fs/dlm/user.c
+index 13f29409600bb..3c84c62dadb7b 100644
+--- a/fs/dlm/user.c
++++ b/fs/dlm/user.c
+@@ -25,6 +25,7 @@
+ #include "lvb_table.h"
+ #include "user.h"
+ #include "ast.h"
++#include "config.h"
+
+ static const char name_prefix[] = "dlm";
+ static const struct file_operations device_fops;
+@@ -404,7 +405,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
+- error = dlm_new_lockspace(params->name, NULL, params->flags,
++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags,
+ DLM_USER_LVB_LEN, NULL, NULL, NULL,
+ &lockspace);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From 59f35205c4d99ca66d4081ccef89ae3657d711c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 11:17:40 -0600
+Subject: dlm: fix missing idr_destroy for recover_idr
+
+From: David Teigland <teigland@redhat.com>
+
+[ Upstream commit 8fc6ed9a3508a0435b9270c313600799d210d319 ]
+
+Which would leak memory for the idr internals.
+
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/lockspace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c
+index 6a1529e478f3d..f1261fa0af8a1 100644
+--- a/fs/dlm/lockspace.c
++++ b/fs/dlm/lockspace.c
+@@ -807,6 +807,7 @@ static int release_lockspace(struct dlm_ls *ls, int force)
+
+ dlm_delete_debug_file(ls);
+
++ idr_destroy(&ls->ls_recover_idr);
+ kfree(ls->ls_recover_buf);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 7a7ed137f75b2abed46da7502b7fe3bd42f97b82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 20:39:50 +0300
+Subject: dlm: fix possible call to kfree() for non-initialized pointer
+
+From: Denis V. Lunev <den@openvz.org>
+
+[ Upstream commit 58a923adf4d9aca8bf7205985c9c8fc531c65d72 ]
+
+Technically dlm_config_nodes() could return error and keep nodes
+uninitialized. After that on the fail path of we'll call kfree()
+for that uninitialized value.
+
+The patch is simple - we should just initialize nodes with NULL.
+
+Signed-off-by: Denis V. Lunev <den@openvz.org>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/member.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/dlm/member.c b/fs/dlm/member.c
+index cad6d85911a80..0bc43b35d2c53 100644
+--- a/fs/dlm/member.c
++++ b/fs/dlm/member.c
+@@ -671,7 +671,7 @@ int dlm_ls_stop(struct dlm_ls *ls)
+ int dlm_ls_start(struct dlm_ls *ls)
+ {
+ struct dlm_recover *rv, *rv_old;
+- struct dlm_config_node *nodes;
++ struct dlm_config_node *nodes = NULL;
+ int error, count;
+
+ rv = kzalloc(sizeof(*rv), GFP_NOFS);
+--
+2.20.1
+
--- /dev/null
+From 77197ec432b1e9be579d388b98afbc8e8f17c93b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 15:25:00 +0800
+Subject: dlm: NULL check before kmem_cache_destroy is not needed
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit f31a89692830061bceba8469607e4e4b0f900159 ]
+
+kmem_cache_destroy(NULL) is safe, so removes NULL check before
+freeing the mem. This patch also fix ifnullfree.cocci warnings.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Signed-off-by: David Teigland <teigland@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/dlm/memory.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c
+index 7cd24bccd4fe5..37be29f21d04d 100644
+--- a/fs/dlm/memory.c
++++ b/fs/dlm/memory.c
+@@ -38,10 +38,8 @@ int __init dlm_memory_init(void)
+
+ void dlm_memory_exit(void)
+ {
+- if (lkb_cache)
+- kmem_cache_destroy(lkb_cache);
+- if (rsb_cache)
+- kmem_cache_destroy(rsb_cache);
++ kmem_cache_destroy(lkb_cache);
++ kmem_cache_destroy(rsb_cache);
+ }
+
+ char *dlm_allocate_lvb(struct dlm_ls *ls)
+@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb)
+ struct dlm_user_args *ua;
+ ua = lkb->lkb_ua;
+ if (ua) {
+- if (ua->lksb.sb_lvbptr)
+- kfree(ua->lksb.sb_lvbptr);
++ kfree(ua->lksb.sb_lvbptr);
+ kfree(ua);
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 3a06b4d99de7aa91c23bce9b9383319e8e205849 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Aug 2018 23:29:21 +0200
+Subject: dma-mapping: fix return type of dma_set_max_seg_size()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+[ Upstream commit c9d76d0655c06b8c1f944e46c4fd9e9cf4b331c0 ]
+
+The function dma_set_max_seg_size() can return either 0 on success or
+-EIO on error. Change its return type from unsigned int to int to
+capture this.
+
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/dma-mapping.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
+index 1db6a6b46d0d3..669cde2fa8723 100644
+--- a/include/linux/dma-mapping.h
++++ b/include/linux/dma-mapping.h
+@@ -674,8 +674,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev)
+ return SZ_64K;
+ }
+
+-static inline unsigned int dma_set_max_seg_size(struct device *dev,
+- unsigned int size)
++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size)
+ {
+ if (dev->dma_parms) {
+ dev->dma_parms->max_segment_size = size;
+--
+2.20.1
+
--- /dev/null
+From c1dd1672bdddee27257b5085aa438a8f2cdaab4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 11:33:48 +0800
+Subject: dmaengine: coh901318: Fix a double-lock bug
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 627469e4445b9b12e0229b3bdf8564d5ce384dd7 ]
+
+The function coh901318_alloc_chan_resources() calls spin_lock_irqsave()
+before calling coh901318_config().
+But coh901318_config() calls spin_lock_irqsave() again in its
+definition, which may cause a double-lock bug.
+
+Because coh901318_config() is only called by
+coh901318_alloc_chan_resources(), the bug fix is to remove the
+calls to spin-lock and -unlock functions in coh901318_config().
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/coh901318.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
+index da74fd74636b4..502e9af85f303 100644
+--- a/drivers/dma/coh901318.c
++++ b/drivers/dma/coh901318.c
+@@ -1802,8 +1802,6 @@ static int coh901318_config(struct coh901318_chan *cohc,
+ int channel = cohc->id;
+ void __iomem *virtbase = cohc->base->virtbase;
+
+- spin_lock_irqsave(&cohc->lock, flags);
+-
+ if (param)
+ p = param;
+ else
+@@ -1823,8 +1821,6 @@ static int coh901318_config(struct coh901318_chan *cohc,
+ coh901318_set_conf(cohc, p->config);
+ coh901318_set_ctrl(cohc, p->ctrl_lli_last);
+
+- spin_unlock_irqrestore(&cohc->lock, flags);
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From cc3689b43ba3fadc9c7eb6cc7ccfcc7cfb3c2ab3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Nov 2018 17:17:21 +0100
+Subject: dmaengine: dw-dmac: implement dma protection control setting
+
+From: Christian Lamparter <chunkeey@gmail.com>
+
+[ Upstream commit 7b0c03ecc42fb223baf015877fee9d517c2c8af1 ]
+
+This patch adds a new device-tree property that allows to
+specify the dma protection control bits for the all of the
+DMA controller's channel uniformly.
+
+Setting the "correct" bits can have a huge impact on the
+PPC460EX and APM82181 that use this DMA engine in combination
+with a DesignWare' SATA-II core (sata_dwc_460ex driver).
+
+In the OpenWrt Forum, the user takimata reported that:
+|It seems your patch unleashed the full power of the SATA port.
+|Where I was previously hitting a really hard limit at around
+|82 MB/s for reading and 27 MB/s for writing, I am now getting this:
+|
+|root@OpenWrt:/mnt# time dd if=/dev/zero of=tempfile bs=1M count=1024
+|1024+0 records in
+|1024+0 records out
+|real 0m 13.65s
+|user 0m 0.01s
+|sys 0m 11.89s
+|
+|root@OpenWrt:/mnt# time dd if=tempfile of=/dev/null bs=1M count=1024
+|1024+0 records in
+|1024+0 records out
+|real 0m 8.41s
+|user 0m 0.01s
+|sys 0m 4.70s
+|
+|This means: 121 MB/s reading and 75 MB/s writing!
+|
+|The drive is a WD Green WD10EARX taken from an older MBL Single.
+|I repeated the test a few times with even larger files to rule out
+|any caching, I'm still seeing the same great performance. OpenWrt is
+|now completely on par with the original MBL firmware's performance.
+
+Another user And.short reported:
+|I can report that your fix worked! Boots up fine with two
+|drives even with more partitions, and no more reboot on
+|concurrent disk access!
+
+A closer look into the sata_dwc_460ex code revealed that
+the driver did initally set the correct protection control
+bits. However, this feature was lost when the sata_dwc_460ex
+driver was converted to the generic DMA driver framework.
+
+BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/55
+BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/50
+Fixes: 8b3444852a2b ("sata_dwc_460ex: move to generic DMA driver")
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw/core.c | 2 ++
+ drivers/dma/dw/platform.c | 6 ++++++
+ drivers/dma/dw/regs.h | 4 ++++
+ include/linux/platform_data/dma-dw.h | 6 ++++++
+ 4 files changed, 18 insertions(+)
+
+diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
+index 0f389e008ce64..055d83b6cb68a 100644
+--- a/drivers/dma/dw/core.c
++++ b/drivers/dma/dw/core.c
+@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(struct dw_dma_chan *dwc)
+
+ static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc)
+ {
++ struct dw_dma *dw = to_dw_dma(dwc->chan.device);
+ u32 cfghi = DWC_CFGH_FIFO_MODE;
+ u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority);
+ bool hs_polarity = dwc->dws.hs_polarity;
+
+ cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id);
+ cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id);
++ cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl);
+
+ /* Set polarity of handshake interface */
+ cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0;
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index f62dd0944908d..c299ff181bb68 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *pdev)
+ pdata->multi_block[tmp] = 1;
+ }
+
++ if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) {
++ if (tmp > CHAN_PROTCTL_MASK)
++ return NULL;
++ pdata->protctl = tmp;
++ }
++
+ return pdata;
+ }
+ #else
+diff --git a/drivers/dma/dw/regs.h b/drivers/dma/dw/regs.h
+index 09e7dfdbb7907..646c9c960c071 100644
+--- a/drivers/dma/dw/regs.h
++++ b/drivers/dma/dw/regs.h
+@@ -200,6 +200,10 @@ enum dw_dma_msize {
+ #define DWC_CFGH_FCMODE (1 << 0)
+ #define DWC_CFGH_FIFO_MODE (1 << 1)
+ #define DWC_CFGH_PROTCTL(x) ((x) << 2)
++#define DWC_CFGH_PROTCTL_DATA (0 << 2) /* data access - always set */
++#define DWC_CFGH_PROTCTL_PRIV (1 << 2) /* privileged -> AHB HPROT[1] */
++#define DWC_CFGH_PROTCTL_BUFFER (2 << 2) /* bufferable -> AHB HPROT[2] */
++#define DWC_CFGH_PROTCTL_CACHE (4 << 2) /* cacheable -> AHB HPROT[3] */
+ #define DWC_CFGH_DS_UPD_EN (1 << 5)
+ #define DWC_CFGH_SS_UPD_EN (1 << 6)
+ #define DWC_CFGH_SRC_PER(x) ((x) << 7)
+diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h
+index 896cb71a382cb..1a1d58ebffbf1 100644
+--- a/include/linux/platform_data/dma-dw.h
++++ b/include/linux/platform_data/dma-dw.h
+@@ -49,6 +49,7 @@ struct dw_dma_slave {
+ * @data_width: Maximum data width supported by hardware per AHB master
+ * (in bytes, power of 2)
+ * @multi_block: Multi block transfers supported by hardware per channel.
++ * @protctl: Protection control signals setting per channel.
+ */
+ struct dw_dma_platform_data {
+ unsigned int nr_channels;
+@@ -65,6 +66,11 @@ struct dw_dma_platform_data {
+ unsigned char nr_masters;
+ unsigned char data_width[DW_DMA_MAX_NR_MASTERS];
+ unsigned char multi_block[DW_DMA_MAX_NR_CHANNELS];
++#define CHAN_PROTCTL_PRIVILEGED BIT(0)
++#define CHAN_PROTCTL_BUFFERABLE BIT(1)
++#define CHAN_PROTCTL_CACHEABLE BIT(2)
++#define CHAN_PROTCTL_MASK GENMASK(2, 0)
++ unsigned char protctl;
+ };
+
+ #endif /* _PLATFORM_DATA_DMA_DW_H */
+--
+2.20.1
+
--- /dev/null
+From 782417e1346195bed4e9ac3d73eef1d4e99e7ce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Sep 2018 11:18:00 -0600
+Subject: dmaengine: xilinx_dma: Fix 64-bit simple CDMA transfer
+
+From: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+
+[ Upstream commit 0e03aca2659ef7a85eaff1a1ca9b0b498002ede8 ]
+
+In AXI CDMA simple mode also pass MSB bits of source and destination
+address to xilinx_write function. This fixes simple CDMA operation
+mode using 64-bit addressing.
+
+Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Signed-off-by: Michal Simek <michal.simek@xilinx.com>
+Reviewed-by: Appana Durga Kedareswara Rao <appana.durga.rao@xilinx.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/xilinx/xilinx_dma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 8aec137b4fcaa..0ef4388bbeaa9 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -1248,8 +1248,10 @@ static void xilinx_cdma_start_transfer(struct xilinx_dma_chan *chan)
+
+ hw = &segment->hw;
+
+- xilinx_write(chan, XILINX_CDMA_REG_SRCADDR, hw->src_addr);
+- xilinx_write(chan, XILINX_CDMA_REG_DSTADDR, hw->dest_addr);
++ xilinx_write(chan, XILINX_CDMA_REG_SRCADDR,
++ xilinx_prep_dma_addr_t(hw->src_addr));
++ xilinx_write(chan, XILINX_CDMA_REG_DSTADDR,
++ xilinx_prep_dma_addr_t(hw->dest_addr));
+
+ /* Start the transfer */
+ dma_ctrl_write(chan, XILINX_DMA_REG_BTT,
+--
+2.20.1
+
--- /dev/null
+From 589376748a4d3ae6aa9f7670679cfd869e7af1be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 17:46:54 +0100
+Subject: drivers: soc: Allow building the amlogic drivers without ARCH_MESON
+
+From: Maxime Jourdan <mjourdan@baylibre.com>
+
+[ Upstream commit 41bb5769b7f4b7a85e4b92c37429228279b4f569 ]
+
+The current condition makes it difficult to compile the amlogic/
+drivers with COMPILE_TEST, or without ARCH_MESON in general.
+
+Fixes kbuild errors with patch series that depend on drivers in that
+directory, for instance the meson video decoder.
+
+Signed-off-by: Maxime Jourdan <mjourdan@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile
+index 113e884697fd8..f0d46b16e08c4 100644
+--- a/drivers/soc/Makefile
++++ b/drivers/soc/Makefile
+@@ -13,7 +13,7 @@ obj-$(CONFIG_ARCH_GEMINI) += gemini/
+ obj-$(CONFIG_ARCH_MXC) += imx/
+ obj-$(CONFIG_SOC_XWAY) += lantiq/
+ obj-y += mediatek/
+-obj-$(CONFIG_ARCH_MESON) += amlogic/
++obj-y += amlogic/
+ obj-y += qcom/
+ obj-y += renesas/
+ obj-$(CONFIG_ARCH_ROCKCHIP) += rockchip/
+--
+2.20.1
+
--- /dev/null
+From 98b9fd88d80c45f8eea374b0ee2361971e4d1bd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 13:27:25 +0000
+Subject: drm/sun4i: tcon: Set min division of TCON0_DCLK to 1.
+
+From: Yunhao Tian <t123yh@outlook.com>
+
+[ Upstream commit 0b8e7bbde5e7e2c419567e1ee29587dae3b78ee3 ]
+
+The datasheet of V3s (and various other chips) wrote
+that TCON0_DCLK_DIV can be >= 1 if only dclk is used,
+and must >= 6 if dclk1 or dclk2 is used. As currently
+neither dclk1 nor dclk2 is used (no writes to these
+bits), let's set minimal division to 1.
+
+If this minimal division is 6, some common dot clock
+frequencies can't be produced (e.g. 30MHz will not be
+possible and will fallback to 25MHz), which is
+obviously not an expected behaviour.
+
+Signed-off-by: Yunhao Tian <t123yh@outlook.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://lore.kernel.org/linux-arm-kernel/MN2PR08MB57905AD8A00C08DA219377C989760@MN2PR08MB5790.namprd08.prod.outlook.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+index 8c31c9ab06f8b..fda1ae12069a7 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
+@@ -423,7 +423,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon,
+
+ WARN_ON(!tcon->quirks->has_channel_0);
+
+- tcon->dclk_min_div = 6;
++ tcon->dclk_min_div = 1;
+ tcon->dclk_max_div = 127;
+ sun4i_tcon0_mode_set_common(tcon, mode);
+
+--
+2.20.1
+
--- /dev/null
+From a510389e195193f60c1d9b073d78052bbef41d2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 22:08:29 -0500
+Subject: exportfs_decode_fh(): negative pinned may become positive without the
+ parent locked
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit a2ece088882666e1dc7113744ac912eb161e3f87 ]
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exportfs/expfs.c | 31 +++++++++++++++++++------------
+ 1 file changed, 19 insertions(+), 12 deletions(-)
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 63707abcbeb3e..808cae6d5f50f 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -517,26 +517,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid,
+ * inode is actually connected to the parent.
+ */
+ err = exportfs_get_name(mnt, target_dir, nbuf, result);
+- if (!err) {
+- inode_lock(target_dir->d_inode);
+- nresult = lookup_one_len(nbuf, target_dir,
+- strlen(nbuf));
+- inode_unlock(target_dir->d_inode);
+- if (!IS_ERR(nresult)) {
+- if (nresult->d_inode) {
+- dput(result);
+- result = nresult;
+- } else
+- dput(nresult);
+- }
++ if (err) {
++ dput(target_dir);
++ goto err_result;
+ }
+
++ inode_lock(target_dir->d_inode);
++ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf));
++ if (!IS_ERR(nresult)) {
++ if (unlikely(nresult->d_inode != result->d_inode)) {
++ dput(nresult);
++ nresult = ERR_PTR(-ESTALE);
++ }
++ }
++ inode_unlock(target_dir->d_inode);
+ /*
+ * At this point we are done with the parent, but it's pinned
+ * by the child dentry anyway.
+ */
+ dput(target_dir);
+
++ if (IS_ERR(nresult)) {
++ err = PTR_ERR(nresult);
++ goto err_result;
++ }
++ dput(result);
++ result = nresult;
++
+ /*
+ * And finally make sure the dentry is actually acceptable
+ * to NFSD.
+--
+2.20.1
+
--- /dev/null
+From 89e3aa22e55a039976265fdb9e8845b765afb16f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 16:38:47 +0100
+Subject: extcon: max8997: Fix lack of path setting in USB device mode
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit a2dc50914744eea9f83a70a5db0486be625e5dc0 ]
+
+MAX8997 driver disables automatic path selection from MicroUSB connector
+and manually sets path to either UART or USB lines. However the code for
+setting USB path worked only for USB host mode (when ID pin is set
+to ground). When standard USB cable (USB device mode) is connected, path
+registers are not touched. This means that once the non-USB accessory is
+connected to MAX8997-operated micro USB port, the path is no longer set
+to USB and USB device mode doesn't work. This patch fixes it by setting
+USB path both for USB and USB host modes.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/extcon/extcon-max8997.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
+index 9f30f4929b729..7a767b66dd865 100644
+--- a/drivers/extcon/extcon-max8997.c
++++ b/drivers/extcon/extcon-max8997.c
+@@ -321,12 +321,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info,
+ {
+ int ret = 0;
+
+- if (usb_type == MAX8997_USB_HOST) {
+- ret = max8997_muic_set_path(info, info->path_usb, attached);
+- if (ret < 0) {
+- dev_err(info->dev, "failed to update muic register\n");
+- return ret;
+- }
++ ret = max8997_muic_set_path(info, info->path_usb, attached);
++ if (ret < 0) {
++ dev_err(info->dev, "failed to update muic register\n");
++ return ret;
+ }
+
+ switch (usb_type) {
+--
+2.20.1
+
--- /dev/null
+From 987acab3c98a586726179b98ef9f1e66910b24ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 20:37:55 +0800
+Subject: f2fs: change segment to section in f2fs_ioc_gc_range
+
+From: Yunlong Song <yunlong.song@huawei.com>
+
+[ Upstream commit 67b0e42b768c9ddc3fd5ca1aee3db815cfaa635c ]
+
+f2fs_ioc_gc_range skips blocks_per_seg each time, however, f2fs_gc moves
+blocks of section each time, so fix it from segment to section.
+
+Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 187bf7e260c99..5eef2a8b29ab6 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -2143,7 +2143,7 @@ do_more:
+ }
+
+ ret = f2fs_gc(sbi, range.sync, true, GET_SEGNO(sbi, range.start));
+- range.start += sbi->blocks_per_seg;
++ range.start += BLKS_PER_SEC(sbi);
+ if (range.start <= end)
+ goto do_more;
+ out:
+--
+2.20.1
+
--- /dev/null
+From 48b739d5c23405cbb138f2cc5389956eb0838344 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Oct 2018 16:08:30 +0800
+Subject: f2fs: fix count of seg_freed to make sec_freed correct
+
+From: Yunlong Song <yunlong.song@huawei.com>
+
+[ Upstream commit d6c66cd19ef322fe0d51ba09ce1b7f386acab04a ]
+
+When sbi->segs_per_sec > 1, and if some segno has 0 valid blocks before
+gc starts, do_garbage_collect will skip counting seg_freed++, and this
+will cause seg_freed < sbi->segs_per_sec and finally skip sec_freed++.
+
+Signed-off-by: Yunlong Song <yunlong.song@huawei.com>
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 8c4cb1eee10a6..3d98e909201d9 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -1081,9 +1081,9 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+ GET_SUM_BLOCK(sbi, segno));
+ f2fs_put_page(sum_page, 0);
+
+- if (get_valid_blocks(sbi, segno, false) == 0 ||
+- !PageUptodate(sum_page) ||
+- unlikely(f2fs_cp_error(sbi)))
++ if (get_valid_blocks(sbi, segno, false) == 0)
++ goto freed;
++ if (!PageUptodate(sum_page) || unlikely(f2fs_cp_error(sbi)))
+ goto next;
+
+ sum = page_address(sum_page);
+@@ -1110,6 +1110,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
+
+ stat_inc_seg_count(sbi, type, gc_type);
+
++freed:
+ if (gc_type == FG_GC &&
+ get_valid_blocks(sbi, segno, false) == 0)
+ seg_freed++;
+--
+2.20.1
+
--- /dev/null
+From bf9572054aee63a43b202f9d8892737cde2f425f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Oct 2018 17:24:10 +0800
+Subject: f2fs: fix to account preflush command for noflush_merge mode
+
+From: Chao Yu <yuchao0@huawei.com>
+
+[ Upstream commit a8075dc484cf10ebdb07bee2b17322fb0a846309 ]
+
+Previously, we only account preflush command for flush_merge mode,
+so for noflush_merge mode, we can not know in-flight preflush
+command count, fix it.
+
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/segment.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index a807a8d5e38f0..0e3e590a250f7 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -637,7 +637,9 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi, nid_t ino)
+ return 0;
+
+ if (!test_opt(sbi, FLUSH_MERGE)) {
++ atomic_inc(&fcc->issing_flush);
+ ret = submit_flush_wait(sbi, ino);
++ atomic_dec(&fcc->issing_flush);
+ atomic_inc(&fcc->issued_flush);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 64a62bdeee2f5da52d5d84adb4c876c7d3dad32d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 13:31:41 +0530
+Subject: f2fs: fix to allow node segment for GC by ioctl path
+
+From: Sahitya Tummala <stummala@codeaurora.org>
+
+[ Upstream commit 08ac9a3870f6babb2b1fff46118536ca8a71ef19 ]
+
+Allow node type segments also to be GC'd via f2fs ioctl
+F2FS_IOC_GARBAGE_COLLECT_RANGE.
+
+Signed-off-by: Sahitya Tummala <stummala@codeaurora.org>
+Reviewed-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/f2fs/gc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
+index 3d98e909201d9..700c39ec99f5a 100644
+--- a/fs/f2fs/gc.c
++++ b/fs/f2fs/gc.c
+@@ -318,8 +318,7 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi,
+ p.min_cost = get_max_cost(sbi, &p);
+
+ if (*result != NULL_SEGNO) {
+- if (IS_DATASEG(get_seg_entry(sbi, *result)->type) &&
+- get_valid_blocks(sbi, *result, false) &&
++ if (get_valid_blocks(sbi, *result, false) &&
+ !sec_usage_check(sbi, GET_SEC_FROM_SEG(sbi, *result)))
+ p.min_segno = *result;
+ goto out;
+--
+2.20.1
+
--- /dev/null
+From 979a9a7af95cefaf2514cce8965aed5b46f9010e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 21:32:25 -0500
+Subject: firmware: qcom: scm: fix compilation error when disabled
+
+From: Jonathan Marek <jonathan@marek.ca>
+
+[ Upstream commit 16ad9501b1f2edebe24f8cf3c09da0695871986b ]
+
+This fixes the case when CONFIG_QCOM_SCM is not enabled, and linux/errno.h
+has not been included previously.
+
+Signed-off-by: Jonathan Marek <jonathan@marek.ca>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/qcom_scm.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/linux/qcom_scm.h b/include/linux/qcom_scm.h
+index 5d65521260b3d..116b81ac442ad 100644
+--- a/include/linux/qcom_scm.h
++++ b/include/linux/qcom_scm.h
+@@ -65,6 +65,9 @@ extern int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare);
+ extern int qcom_scm_io_readl(phys_addr_t addr, unsigned int *val);
+ extern int qcom_scm_io_writel(phys_addr_t addr, unsigned int val);
+ #else
++
++#include <linux/errno.h>
++
+ static inline
+ int qcom_scm_set_cold_boot_addr(void *entry, const cpumask_t *cpus)
+ {
+--
+2.20.1
+
--- /dev/null
+From 2c2bdf60542ce65bc8879fe313e576c30d52a92d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 14:39:07 +0000
+Subject: firmware: raspberrypi: Fix firmware calls with large buffers
+
+From: James Hughes <james.hughes@raspberrypi.org>
+
+[ Upstream commit 91c6ada69f396e663acb2b713e8acb8a9463557d ]
+
+Commit a1547e0bca51 ("firmware: raspberrypi: Remove VLA usage")
+moved away from VLA's to a fixed maximum size for mailbox data.
+However, some mailbox calls use larger data buffers
+than the maximum allowed in that change. This fix therefor
+moves from using fixed buffers to kmalloc to ensure all sizes
+are catered for.
+
+There is some documentation, which is somewhat out of date,
+on the mailbox calls here :
+https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface
+
+Fixes: a1547e0bca51 ("firmware: raspberrypi: Remove VLA usage")
+
+Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
+Reviewed-by: Eric Anholt <eric@anholt.net>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/raspberrypi.c | 35 +++++++++++++++++-----------------
+ 1 file changed, 18 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
+index a200a21746119..44eb99807e337 100644
+--- a/drivers/firmware/raspberrypi.c
++++ b/drivers/firmware/raspberrypi.c
+@@ -14,6 +14,7 @@
+ #include <linux/module.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
++#include <linux/slab.h>
+ #include <soc/bcm2835/raspberrypi-firmware.h>
+
+ #define MBOX_MSG(chan, data28) (((data28) & ~0xf) | ((chan) & 0xf))
+@@ -21,8 +22,6 @@
+ #define MBOX_DATA28(msg) ((msg) & ~0xf)
+ #define MBOX_CHAN_PROPERTY 8
+
+-#define MAX_RPI_FW_PROP_BUF_SIZE 32
+-
+ static struct platform_device *rpi_hwmon;
+
+ struct rpi_firmware {
+@@ -144,28 +143,30 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_list);
+ int rpi_firmware_property(struct rpi_firmware *fw,
+ u32 tag, void *tag_data, size_t buf_size)
+ {
+- /* Single tags are very small (generally 8 bytes), so the
+- * stack should be safe.
+- */
+- u8 data[sizeof(struct rpi_firmware_property_tag_header) +
+- MAX_RPI_FW_PROP_BUF_SIZE];
+- struct rpi_firmware_property_tag_header *header =
+- (struct rpi_firmware_property_tag_header *)data;
++ struct rpi_firmware_property_tag_header *header;
+ int ret;
+
+- if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
+- return -EINVAL;
++ /* Some mailboxes can use over 1k bytes. Rather than checking
++ * size and using stack or kmalloc depending on requirements,
++ * just use kmalloc. Mailboxes don't get called enough to worry
++ * too much about the time taken in the allocation.
++ */
++ void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
+
++ if (!data)
++ return -ENOMEM;
++
++ header = data;
+ header->tag = tag;
+ header->buf_size = buf_size;
+ header->req_resp_size = 0;
+- memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
+- tag_data, buf_size);
++ memcpy(data + sizeof(*header), tag_data, buf_size);
++
++ ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
++
++ memcpy(tag_data, data + sizeof(*header), buf_size);
+
+- ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
+- memcpy(tag_data,
+- data + sizeof(struct rpi_firmware_property_tag_header),
+- buf_size);
++ kfree(data);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1843ae54ce037708d78ed76c152d9644a0cd228c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 14:51:23 +0100
+Subject: gpio: OF: Parse MMC-specific CD and WP properties
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 81c85ec15a1946f2e347ec0bf66936121eb97ce7 ]
+
+When retrieveing CD (card detect) and WP (write protect)
+GPIO handles from the device tree, make sure to assign
+them active low by default unless the "cd-inverted" or
+"wp-inverted" properties are set. These properties mean
+that respective signal is active HIGH since the SDHCI
+specification stipulates that this kind of signals
+should be treated as active LOW.
+
+If the twocell GPIO flag is also specified as active
+low, well that's nice and we will silently ignore the
+tautological specification.
+
+If however the GPIO line is specified as active low
+in the GPIO flasg cell and "cd-inverted" or "wp-inverted"
+is also specified, the latter takes precedence and we
+print a warning.
+
+The current effect on the MMC slot-gpio core are as
+follows:
+
+For CD GPIOs: no effect. The current code in
+mmc/core/host.c calls mmc_gpiod_request_cd() with
+the "override_active_level" argument set to true,
+which means that whatever the GPIO descriptor
+thinks about active low/high will be ignored, the
+core will use the MMC_CAP2_CD_ACTIVE_HIGH to keep
+track of this and reads the raw value from the
+GPIO descriptor, totally bypassing gpiolibs inversion
+semantics. I plan to clean this up at a later point
+passing the handling of inversion semantics over
+to gpiolib, so this patch prepares the ground for
+that.
+
+Fow WP GPIOs: this is probably fixing a bug, because
+the code in mmc/core/host.c calls mmc_gpiod_request_ro()
+with the "override_active_level" argument set to false,
+which means it will respect the inversion semantics of
+the gpiolib and ignore the MMC_CAP2_RO_ACTIVE_HIGH
+flag for everyone using this through device tree.
+However the code in host.c confusingly goes to great
+lengths setting up the MMC_CAP2_RO_ACTIVE_HIGH flag
+from the GPIO descriptor and by reading the "wp-inverted"
+property of the node. As far as I can tell this is all
+in vain and the inversion is broken: device trees that
+use "wp-inverted" do not work as intended, instead the
+only way to actually get inversion on a line is by
+setting the second cell flag to GPIO_ACTIVE_HIGH (which
+will be the default) or GPIO_ACTIVE_LOW if they want
+the proper MMC semantics. Presumably all device trees do
+this right but we need to parse and handle this properly.
+
+Cc: linux-mmc@vger.kernel.org
+Cc: linux-gpio@vger.kernel.org
+Cc: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-of.c | 39 +++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 39 insertions(+)
+
+diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
+index e0f149bdf98ff..1147ad968fd75 100644
+--- a/drivers/gpio/gpiolib-of.c
++++ b/drivers/gpio/gpiolib-of.c
+@@ -60,6 +60,45 @@ static struct gpio_desc *of_xlate_and_get_gpiod_flags(struct gpio_chip *chip,
+ static void of_gpio_flags_quirks(struct device_node *np,
+ enum of_gpio_flags *flags)
+ {
++ /*
++ * Handle MMC "cd-inverted" and "wp-inverted" semantics.
++ */
++ if (IS_ENABLED(CONFIG_MMC)) {
++ if (of_property_read_bool(np, "cd-gpios")) {
++ if (of_property_read_bool(np, "cd-inverted")) {
++ if (*flags & OF_GPIO_ACTIVE_LOW) {
++ /* "cd-inverted" takes precedence */
++ *flags &= ~OF_GPIO_ACTIVE_LOW;
++ pr_warn("%s GPIO handle specifies CD active low - ignored\n",
++ of_node_full_name(np));
++ }
++ } else {
++ /*
++ * Active low is the default according to the
++ * SDHCI specification. If the GPIO handle
++ * specifies the same thing - good.
++ */
++ *flags |= OF_GPIO_ACTIVE_LOW;
++ }
++ }
++ if (of_property_read_bool(np, "wp-gpios")) {
++ if (of_property_read_bool(np, "wp-inverted")) {
++ /* "wp-inverted" takes precedence */
++ if (*flags & OF_GPIO_ACTIVE_LOW) {
++ *flags &= ~OF_GPIO_ACTIVE_LOW;
++ pr_warn("%s GPIO handle specifies WP active low - ignored\n",
++ of_node_full_name(np));
++ }
++ } else {
++ /*
++ * Active low is the default according to the
++ * SDHCI specification. If the GPIO handle
++ * specifies the same thing - good.
++ */
++ *flags |= OF_GPIO_ACTIVE_LOW;
++ }
++ }
++ }
+ /*
+ * Some GPIO fixed regulator quirks.
+ * Note that active low is the default.
+--
+2.20.1
+
--- /dev/null
+From ef6b7be356d3e1019234b784092f689612b24c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 11:31:30 +0100
+Subject: gpu: host1x: Fix syncpoint ID field size on Tegra186
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 2fc777ba8422e4a38cae61537ad6a26435a86fb8 ]
+
+The number of syncpoints on Tegra186 is 576 and therefore no longer fits
+into 8 bits. Increase the size of the syncpoint ID field to 10 in order
+to accomodate all syncpoints.
+
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/host1x/hw/hw_host1x06_uclass.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
+index 4457486c72b05..e599e15bf999a 100644
+--- a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
++++ b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h
+@@ -59,7 +59,7 @@ static inline u32 host1x_uclass_incr_syncpt_r(void)
+ host1x_uclass_incr_syncpt_r()
+ static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v)
+ {
+- return (v & 0xff) << 8;
++ return (v & 0xff) << 10;
+ }
+ #define HOST1X_UCLASS_INCR_SYNCPT_COND_F(v) \
+ host1x_uclass_incr_syncpt_cond_f(v)
+--
+2.20.1
+
--- /dev/null
+From b0eb1bc5525b941322bf837570e93480ababc63c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 16:36:48 +0800
+Subject: i2c: core: fix use after free in of_i2c_notify
+
+From: Wen Yang <wenyang@linux.alibaba.com>
+
+[ Upstream commit a4c2fec16f5e6a5fee4865e6e0e91e2bc2d10f37 ]
+
+We can't use "adap->dev" after it has been freed.
+
+Fixes: 5bf4fa7daea6 ("i2c: break out OF support into separate file")
+Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/i2c-core-of.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c
+index 0f01cdba9d2c6..14d4884996968 100644
+--- a/drivers/i2c/i2c-core-of.c
++++ b/drivers/i2c/i2c-core-of.c
+@@ -253,14 +253,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action,
+ }
+
+ client = of_i2c_register_device(adap, rd->dn);
+- put_device(&adap->dev);
+-
+ if (IS_ERR(client)) {
+ dev_err(&adap->dev, "failed to create client for '%pOF'\n",
+ rd->dn);
++ put_device(&adap->dev);
+ of_node_clear_flag(rd->dn, OF_POPULATED);
+ return notifier_from_errno(PTR_ERR(client));
+ }
++ put_device(&adap->dev);
+ break;
+ case OF_RECONFIG_CHANGE_REMOVE:
+ /* already depopulated? */
+--
+2.20.1
+
--- /dev/null
+From 0d564bd5b5dda9946de6186cbb8b4b68b84fd394 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:29:13 +0100
+Subject: i2c: imx: don't print error message on probe defer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit fece4978510e43f09c8cd386fee15210e8c68493 ]
+
+Probe deferral is a normal operating condition in the probe function,
+so don't spam the log with an error in this case.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-imx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index 7bd409eaf0acd..d4b72e4ffd71f 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -1090,7 +1090,8 @@ static int i2c_imx_probe(struct platform_device *pdev)
+ /* Get I2C clock */
+ i2c_imx->clk = devm_clk_get(&pdev->dev, NULL);
+ if (IS_ERR(i2c_imx->clk)) {
+- dev_err(&pdev->dev, "can't get I2C clock\n");
++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER)
++ dev_err(&pdev->dev, "can't get I2C clock\n");
+ return PTR_ERR(i2c_imx->clk);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 34bed3c53a5ed774b9a39f3be44312e8cc3a9570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 14:33:28 -0700
+Subject: i40e: don't restart nway if autoneg not supported
+
+From: Mitch Williams <mitch.a.williams@intel.com>
+
+[ Upstream commit 7c3758f7839377ab67529cc50264a640636c47af ]
+
+On link types that do not support autoneg, we cannot attempt to restart
+nway negotiation. This results in a dead link that requires a power
+cycle to remedy.
+
+Fix this by saving off the autoneg state and checking this value before
+we try to restart nway.
+
+Signed-off-by: Mitch Williams <mitch.a.williams@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+index 5ff6caa83948c..a6b0f605a7d8b 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -1136,6 +1136,7 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ i40e_status status;
+ u8 aq_failures;
+ int err = 0;
++ u32 is_an;
+
+ /* Changing the port's flow control is not supported if this isn't the
+ * port's controlling PF
+@@ -1148,15 +1149,14 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ if (vsi != pf->vsi[pf->lan_vsi])
+ return -EOPNOTSUPP;
+
+- if (pause->autoneg != ((hw_link_info->an_info & I40E_AQ_AN_COMPLETED) ?
+- AUTONEG_ENABLE : AUTONEG_DISABLE)) {
++ is_an = hw_link_info->an_info & I40E_AQ_AN_COMPLETED;
++ if (pause->autoneg != is_an) {
+ netdev_info(netdev, "To change autoneg please use: ethtool -s <dev> autoneg <on|off>\n");
+ return -EOPNOTSUPP;
+ }
+
+ /* If we have link and don't have autoneg */
+- if (!test_bit(__I40E_DOWN, pf->state) &&
+- !(hw_link_info->an_info & I40E_AQ_AN_COMPLETED)) {
++ if (!test_bit(__I40E_DOWN, pf->state) && !is_an) {
+ /* Send message that it might not necessarily work*/
+ netdev_info(netdev, "Autoneg did not complete so changing settings may not result in an actual change.\n");
+ }
+@@ -1207,7 +1207,7 @@ static int i40e_set_pauseparam(struct net_device *netdev,
+ err = -EAGAIN;
+ }
+
+- if (!test_bit(__I40E_DOWN, pf->state)) {
++ if (!test_bit(__I40E_DOWN, pf->state) && is_an) {
+ /* Give it a little more time to try to come back */
+ msleep(75);
+ if (!test_bit(__I40E_DOWN, pf->state))
+--
+2.20.1
+
--- /dev/null
+From 778b1cdf9b8f483d85ede2b5635f5c628cf1b424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:32:48 -0800
+Subject: IB/hfi1: Close VNIC sdma_progress sleep window
+
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+
+[ Upstream commit 18912c4524385dd6532c682cb9d4f6aa39ba8d47 ]
+
+The call to sdma_progress() is called outside the wait lock.
+
+In this case, there is a race condition where sdma_progress() can return
+false and the sdma_engine can idle. If that happens, there will be no
+more sdma interrupts to cause the wakeup and the vnic_sdma xmit will hang.
+
+Fix by moving the lock to enclose the sdma_progress() call.
+
+Also, delete the tx_retry. The need for this was removed by:
+commit bcad29137a97 ("IB/hfi1: Serve the most starved iowait entry first")
+
+Fixes: 64551ede6cd1 ("IB/hfi1: VNIC SDMA support")
+Reviewed-by: Gary Leshner <Gary.S.Leshner@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/vnic_sdma.c | 15 +++++----------
+ 1 file changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+index c3c96c5869ed4..718dcdef946ee 100644
+--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c
++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c
+@@ -57,7 +57,6 @@
+
+ #define HFI1_VNIC_TXREQ_NAME_LEN 32
+ #define HFI1_VNIC_SDMA_DESC_WTRMRK 64
+-#define HFI1_VNIC_SDMA_RETRY_COUNT 1
+
+ /*
+ * struct vnic_txreq - VNIC transmit descriptor
+@@ -67,7 +66,6 @@
+ * @pad: pad buffer
+ * @plen: pad length
+ * @pbc_val: pbc value
+- * @retry_count: tx retry count
+ */
+ struct vnic_txreq {
+ struct sdma_txreq txreq;
+@@ -77,8 +75,6 @@ struct vnic_txreq {
+ unsigned char pad[HFI1_VNIC_MAX_PAD];
+ u16 plen;
+ __le64 pbc_val;
+-
+- u32 retry_count;
+ };
+
+ static void vnic_sdma_complete(struct sdma_txreq *txreq,
+@@ -196,7 +192,6 @@ int hfi1_vnic_send_dma(struct hfi1_devdata *dd, u8 q_idx,
+ ret = build_vnic_tx_desc(sde, tx, pbc);
+ if (unlikely(ret))
+ goto free_desc;
+- tx->retry_count = 0;
+
+ ret = sdma_send_txreq(sde, &vnic_sdma->wait, &tx->txreq,
+ vnic_sdma->pkts_sent);
+@@ -238,14 +233,14 @@ static int hfi1_vnic_sdma_sleep(struct sdma_engine *sde,
+ struct hfi1_vnic_sdma *vnic_sdma =
+ container_of(wait, struct hfi1_vnic_sdma, wait);
+ struct hfi1_ibdev *dev = &vnic_sdma->dd->verbs_dev;
+- struct vnic_txreq *tx = container_of(txreq, struct vnic_txreq, txreq);
+
+- if (sdma_progress(sde, seq, txreq))
+- if (tx->retry_count++ < HFI1_VNIC_SDMA_RETRY_COUNT)
+- return -EAGAIN;
++ write_seqlock(&dev->iowait_lock);
++ if (sdma_progress(sde, seq, txreq)) {
++ write_sequnlock(&dev->iowait_lock);
++ return -EAGAIN;
++ }
+
+ vnic_sdma->state = HFI1_VNIC_SDMA_Q_DEFERRED;
+- write_seqlock(&dev->iowait_lock);
+ if (list_empty(&vnic_sdma->wait.list))
+ iowait_queue(pkts_sent, wait, &sde->dmawait);
+ write_sequnlock(&dev->iowait_lock);
+--
+2.20.1
+
--- /dev/null
+From 6b9e4890f574cd01c2ba51df90018d9b5eff5c5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 10:19:04 -0800
+Subject: IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state
+
+From: Kaike Wan <kaike.wan@intel.com>
+
+[ Upstream commit c1a797c0818e0122c7ec8422edd971cfec9b15ea ]
+
+When it is requested to change its physical state back to Offline while in
+the process to go up, DC8051 will set the ERROR field in the
+DC8051_DBG_ERR_INFO_SET_BY_8051 register. This ERROR field will remain
+until the next time when DC8051 transitions from Offline to Polling.
+Subsequently, when the host requests DC8051 to change its physical state
+to Polling again, it may receive a DC8051 interrupt with the stale ERROR
+field still in DC8051_DBG_ERR_INFO_SET_BY_8051. If the host link state has
+been changed to Polling, this stale ERROR will force the host to
+transition to Offline state, resulting in a vicious cycle of Polling
+->Offline->Polling->Offline. On the other hand, if the host link state is
+still Offline when the stale ERROR is received, the stale ERROR will be
+ignored, and the link will come up correctly. This patch implements the
+correct behavior by changing host link state to Polling only after DC8051
+changes its physical state to Polling.
+
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Krzysztof Goreczny <krzysztof.goreczny@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 47 ++++++++++++++++++++++++++++++-
+ 1 file changed, 46 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 6aa5a8a242ffd..6b89353611333 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -1074,6 +1074,8 @@ static void log_state_transition(struct hfi1_pportdata *ppd, u32 state);
+ static void log_physical_state(struct hfi1_pportdata *ppd, u32 state);
+ static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state,
+ int msecs);
++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd,
++ int msecs);
+ static void read_planned_down_reason_code(struct hfi1_devdata *dd, u8 *pdrrc);
+ static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr);
+ static void handle_temp_err(struct hfi1_devdata *dd);
+@@ -10769,13 +10771,15 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+ break;
+
+ ppd->port_error_action = 0;
+- ppd->host_link_state = HLS_DN_POLL;
+
+ if (quick_linkup) {
+ /* quick linkup does not go into polling */
+ ret = do_quick_linkup(dd);
+ } else {
+ ret1 = set_physical_link_state(dd, PLS_POLLING);
++ if (!ret1)
++ ret1 = wait_phys_link_out_of_offline(ppd,
++ 3000);
+ if (ret1 != HCMD_SUCCESS) {
+ dd_dev_err(dd,
+ "Failed to transition to Polling link state, return 0x%x\n",
+@@ -10783,6 +10787,14 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+ ret = -EINVAL;
+ }
+ }
++
++ /*
++ * Change the host link state after requesting DC8051 to
++ * change its physical state so that we can ignore any
++ * interrupt with stale LNI(XX) error, which will not be
++ * cleared until DC8051 transitions to Polling state.
++ */
++ ppd->host_link_state = HLS_DN_POLL;
+ ppd->offline_disabled_reason =
+ HFI1_ODR_MASK(OPA_LINKDOWN_REASON_NONE);
+ /*
+@@ -12914,6 +12926,39 @@ static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd,
+ return read_state;
+ }
+
++/*
++ * wait_phys_link_out_of_offline - wait for any out of offline state
++ * @ppd: port device
++ * @msecs: the number of milliseconds to wait
++ *
++ * Wait up to msecs milliseconds for any out of offline physical link
++ * state change to occur.
++ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT.
++ */
++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd,
++ int msecs)
++{
++ u32 read_state;
++ unsigned long timeout;
++
++ timeout = jiffies + msecs_to_jiffies(msecs);
++ while (1) {
++ read_state = read_physical_state(ppd->dd);
++ if ((read_state & 0xF0) != PLS_OFFLINE)
++ break;
++ if (time_after(jiffies, timeout)) {
++ dd_dev_err(ppd->dd,
++ "timeout waiting for phy link out of offline. Read state 0x%x, %dms\n",
++ read_state, msecs);
++ return -ETIMEDOUT;
++ }
++ usleep_range(1950, 2050); /* sleep 2ms-ish */
++ }
++
++ log_state_transition(ppd, read_state);
++ return read_state;
++}
++
+ #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \
+ (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK)
+
+--
+2.20.1
+
--- /dev/null
+From e1ab1d5933b4a46f3288956e5fc4ff52cedaa089 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 10:41:05 -0700
+Subject: ice: Fix NVM mask defines
+
+From: Lev Faerman <lev.faerman@intel.com>
+
+[ Upstream commit 6263e811f4d4418660c20b36a08063c6d2c3fb9d ]
+
+Fixes bad masks that would break compilation when evaluated.
+
+Signed-off-by: Lev Faerman <lev.faerman@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+index a0614f472658a..328d293bc3ff5 100644
+--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h
+@@ -1056,10 +1056,10 @@ struct ice_aqc_nvm {
+ #define ICE_AQC_NVM_LAST_CMD BIT(0)
+ #define ICE_AQC_NVM_PCIR_REQ BIT(0) /* Used by NVM Update reply */
+ #define ICE_AQC_NVM_PRESERVATION_S 1
+-#define ICE_AQC_NVM_PRESERVATION_M (3 << CSR_AQ_NVM_PRESERVATION_S)
+-#define ICE_AQC_NVM_NO_PRESERVATION (0 << CSR_AQ_NVM_PRESERVATION_S)
++#define ICE_AQC_NVM_PRESERVATION_M (3 << ICE_AQC_NVM_PRESERVATION_S)
++#define ICE_AQC_NVM_NO_PRESERVATION (0 << ICE_AQC_NVM_PRESERVATION_S)
+ #define ICE_AQC_NVM_PRESERVE_ALL BIT(1)
+-#define ICE_AQC_NVM_PRESERVE_SELECTED (3 << CSR_AQ_NVM_PRESERVATION_S)
++#define ICE_AQC_NVM_PRESERVE_SELECTED (3 << ICE_AQC_NVM_PRESERVATION_S)
+ #define ICE_AQC_NVM_FLASH_ONLY BIT(7)
+ __le16 module_typeid;
+ __le16 length;
+--
+2.20.1
+
--- /dev/null
+From e4315dd574208beb060276b468b8d051aaad9e9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 10:19:35 -0800
+Subject: ice: Fix possible NULL pointer de-reference
+
+From: Bruce Allan <bruce.w.allan@intel.com>
+
+[ Upstream commit f25dad19ba70f7cc135da78ec013325042cd8c52 ]
+
+A recent update to smatch is causing it to report the error "we previously
+assumed 'm_entry->vsi_list_info' could be null". Fix that.
+
+Signed-off-by: Bruce Allan <bruce.w.allan@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_switch.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c
+index 4012adbab0112..1bfc59dff51f7 100644
+--- a/drivers/net/ethernet/intel/ice/ice_switch.c
++++ b/drivers/net/ethernet/intel/ice/ice_switch.c
+@@ -1023,6 +1023,9 @@ ice_handle_vsi_list_mgmt(struct ice_hw *hw,
+ u16 vsi_id = new_fltr->fwd_id.vsi_id;
+ enum ice_adminq_opc opcode;
+
++ if (!m_entry->vsi_list_info)
++ return ICE_ERR_CFG;
++
+ /* A rule already exists with the new VSI being added */
+ if (test_bit(vsi_id, m_entry->vsi_list_info->vsi_map))
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From c60312845ba53addbb9b143309f3138d83707b53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 11:44:43 -0700
+Subject: ice: Fix return value from NAPI poll
+
+From: Dave Ertman <david.m.ertman@intel.com>
+
+[ Upstream commit e0c9fd9b77a7334032ec407d9e14d7c3cac1ac4f ]
+
+ice_napi_poll is hard-coded to return zero when it's done. It should
+instead return the work done (if any work was done). The only time it
+should return zero is if an interrupt or poll is handled and no work
+is performed. So change the return value to be the minimum of work
+done or budget-1.
+
+Signed-off-by: Dave Ertman <david.m.ertman@intel.com>
+Signed-off-by: Anirudh Venkataramanan <anirudh.venkataramanan@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_txrx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
+index 0c95c8f83432c..1d84fedf1f649 100644
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@ -1106,7 +1106,8 @@ int ice_napi_poll(struct napi_struct *napi, int budget)
+ napi_complete_done(napi, work_done);
+ if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags))
+ ice_irq_dynamic_ena(&vsi->back->hw, vsi, q_vector);
+- return 0;
++
++ return min(work_done, budget - 1);
+ }
+
+ /* helper function for building cmd/type/offset */
+--
+2.20.1
+
--- /dev/null
+From c0ff4235181661dffc9f29937b637bb30b72f350 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Nov 2019 17:04:54 -0800
+Subject: Input: cyttsp4_core - fix use after free bug
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 79aae6acbef16f720a7949f8fc6ac69816c79d62 ]
+
+The device md->input is used after it is released. Setting the device
+data to NULL is unnecessary as the device is never used again. Instead,
+md->input should be assigned NULL to avoid accessing the freed memory
+accidently. Besides, checking md->si against NULL is superfluous as it
+points to a variable address, which cannot be NULL.
+
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Link: https://lore.kernel.org/r/1572936379-6423-1-git-send-email-bianpan2016@163.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/cyttsp4_core.c | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
+index 727c3232517cd..c84ee739a8d50 100644
+--- a/drivers/input/touchscreen/cyttsp4_core.c
++++ b/drivers/input/touchscreen/cyttsp4_core.c
+@@ -2000,11 +2000,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ /* get sysinfo */
+ md->si = &cd->sysinfo;
+- if (!md->si) {
+- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n",
+- __func__, md->si);
+- goto error_get_sysinfo;
+- }
+
+ rc = cyttsp4_setup_input_device(cd);
+ if (rc)
+@@ -2014,8 +2009,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd)
+
+ error_init_input:
+ input_free_device(md->input);
+-error_get_sysinfo:
+- input_set_drvdata(md->input, NULL);
+ error_alloc_failed:
+ dev_err(dev, "%s failed.\n", __func__);
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From d074dfabfcde1eda4ac093d6fecb29ca3f138b82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 13:31:11 -0800
+Subject: iomap: dio data corruption and spurious errors when pipes fill
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 4721a6010990971440b4ffefbdf014976b8eda2f ]
+
+When doing direct IO to a pipe for do_splice_direct(), then pipe is
+trivial to fill up and overflow as it can only hold 16 pages. At
+this point bio_iov_iter_get_pages() then returns -EFAULT, and we
+abort the IO submission process. Unfortunately, iomap_dio_rw()
+propagates the error back up the stack.
+
+The error is converted from the EFAULT to EAGAIN in
+generic_file_splice_read() to tell the splice layers that the pipe
+is full. do_splice_direct() completely fails to handle EAGAIN errors
+(it aborts on error) and returns EAGAIN to the caller.
+
+copy_file_write() then completely fails to handle EAGAIN as well,
+and so returns EAGAIN to userspace, having failed to copy the data
+it was asked to.
+
+Avoid this whole steaming pile of fail by having iomap_dio_rw()
+silently swallow EFAULT errors and so do short reads.
+
+To make matters worse, iomap_dio_actor() has a stale data exposure
+bug bio_iov_iter_get_pages() fails - it does not zero the tail block
+that it may have been left uncovered by partial IO. Fix the error
+handling case to drop to the sub-block zeroing rather than
+immmediately returning the -EFAULT error.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/fs/iomap.c b/fs/iomap.c
+index d3d227682f7d4..0ff0f8ca3b197 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -1603,7 +1603,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+ struct bio *bio;
+ bool need_zeroout = false;
+ bool use_fua = false;
+- int nr_pages, ret;
++ int nr_pages, ret = 0;
+ size_t copied = 0;
+
+ if ((pos | length | align) & ((1 << blkbits) - 1))
+@@ -1668,8 +1668,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+
+ ret = bio_iov_iter_get_pages(bio, &iter);
+ if (unlikely(ret)) {
++ /*
++ * We have to stop part way through an IO. We must fall
++ * through to the sub-block tail zeroing here, otherwise
++ * this short IO may expose stale data in the tail of
++ * the block we haven't written data to.
++ */
+ bio_put(bio);
+- return copied ? copied : ret;
++ goto zero_tail;
+ }
+
+ n = bio->bi_iter.bi_size;
+@@ -1706,6 +1712,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+ * the block tail in the latter case, we can expose stale data via mmap
+ * reads of the EOF block.
+ */
++zero_tail:
+ if (need_zeroout ||
+ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
+ /* zero out from the end of the write to the end of the block */
+@@ -1713,7 +1720,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+ if (pad)
+ iomap_dio_zero(dio, iomap, pos, fs_block_size - pad);
+ }
+- return copied;
++ return copied ? copied : ret;
+ }
+
+ static loff_t
+@@ -1888,6 +1895,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
+ wait_for_completion = true;
+ ret = 0;
+ }
++
++ /*
++ * Splicing to pipes can fail on a full pipe. We have to
++ * swallow this to make it look like a short IO
++ * otherwise the higher splice layers will completely
++ * mishandle the error and stop moving data.
++ */
++ if (ret == -EFAULT)
++ ret = 0;
+ break;
+ }
+ pos += ret;
+--
+2.20.1
+
--- /dev/null
+From 75262e256b6dad96a91eed932c8217f85321e040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 13:31:10 -0800
+Subject: iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 0929d8580071c6a1cec1a7916a8f674c243ceee1 ]
+
+When we write into an unwritten extent via direct IO, we dirty
+metadata on IO completion to convert the unwritten extent to
+written. However, when we do the FUA optimisation checks, the inode
+may be clean and so we issue a FUA write into the unwritten extent.
+This means we then bypass the generic_write_sync() call after
+unwritten extent conversion has ben done and we don't force the
+modified metadata to stable storage.
+
+This violates O_DSYNC semantics. The window of exposure is a single
+IO, as the next DIO write will see the inode has dirty metadata and
+hence will not use the FUA optimisation. Calling
+generic_write_sync() after completion of the second IO will also
+sync the first write and it's metadata.
+
+Fix this by avoiding the FUA optimisation when writing to unwritten
+extents.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/fs/iomap.c b/fs/iomap.c
+index fac45206418a2..914c07c9e0d6f 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -1619,12 +1619,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+
+ if (iomap->flags & IOMAP_F_NEW) {
+ need_zeroout = true;
+- } else {
++ } else if (iomap->type == IOMAP_MAPPED) {
+ /*
+- * Use a FUA write if we need datasync semantics, this
+- * is a pure data IO that doesn't require any metadata
+- * updates and the underlying device supports FUA. This
+- * allows us to avoid cache flushes on IO completion.
++ * Use a FUA write if we need datasync semantics, this is a pure
++ * data IO that doesn't require any metadata updates (including
++ * after IO completion such as unwritten extent conversion) and
++ * the underlying device supports FUA. This allows us to avoid
++ * cache flushes on IO completion.
+ */
+ if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) &&
+ (dio->flags & IOMAP_DIO_WRITE_FUA) &&
+--
+2.20.1
+
--- /dev/null
+From 4d77a37a2584030f9a3ac8c6268cf10377c236ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 08:06:37 -0800
+Subject: iomap: readpages doesn't zero page tail beyond EOF
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 8c110d43c6bca4b24dd13272a9d4e0ba6f2ec957 ]
+
+When we read the EOF page of the file via readpages, we need
+to zero the region beyond EOF that we either do not read or
+should not contain data so that mmap does not expose stale data to
+user applications.
+
+However, iomap_adjust_read_range() fails to detect EOF correctly,
+and so fsx on 1k block size filesystems fails very quickly with
+mapreads exposing data beyond EOF. There are two problems here.
+
+Firstly, when calculating the end block of the EOF byte, we have
+to round the size by one to avoid a block aligned EOF from reporting
+a block too large. i.e. a size of 1024 bytes is 1 block, which in
+index terms is block 0. Therefore we have to calculate the end block
+from (isize - 1), not isize.
+
+The second bug is determining if the current page spans EOF, and so
+whether we need split it into two half, one for the IO, and the
+other for zeroing. Unfortunately, the code that checks whether
+we should split the block doesn't actually check if we span EOF, it
+just checks if the read spans the /offset in the page/ that EOF
+sits on. So it splits every read into two if EOF is not page
+aligned, regardless of whether we are reading the EOF block or not.
+
+Hence we need to restrict the "does the read span EOF" check to
+just the page that spans EOF, not every page we read.
+
+This patch results in correct EOF detection through readpages:
+
+xfs_vm_readpages: dev 259:0 ino 0x43 nr_pages 24
+xfs_iomap_found: dev 259:0 ino 0x43 size 0x66c00 offset 0x4f000 count 98304 type hole startoff 0x13c startblock 1368 blockcount 0x4
+iomap_readpage_actor: orig pos 323584 pos 323584, length 4096, poff 0 plen 4096, isize 420864
+xfs_iomap_found: dev 259:0 ino 0x43 size 0x66c00 offset 0x50000 count 94208 type hole startoff 0x140 startblock 1497 blockcount 0x5c
+iomap_readpage_actor: orig pos 327680 pos 327680, length 94208, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 331776 pos 331776, length 90112, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 335872 pos 335872, length 86016, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 339968 pos 339968, length 81920, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 344064 pos 344064, length 77824, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 348160 pos 348160, length 73728, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 352256 pos 352256, length 69632, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 356352 pos 356352, length 65536, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 360448 pos 360448, length 61440, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 364544 pos 364544, length 57344, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 368640 pos 368640, length 53248, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 372736 pos 372736, length 49152, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 376832 pos 376832, length 45056, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 380928 pos 380928, length 40960, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 385024 pos 385024, length 36864, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 389120 pos 389120, length 32768, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 393216 pos 393216, length 28672, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 397312 pos 397312, length 24576, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 401408 pos 401408, length 20480, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 405504 pos 405504, length 16384, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 409600 pos 409600, length 12288, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 413696 pos 413696, length 8192, poff 0 plen 4096, isize 420864
+iomap_readpage_actor: orig pos 417792 pos 417792, length 4096, poff 0 plen 3072, isize 420864
+iomap_readpage_actor: orig pos 420864 pos 420864, length 1024, poff 3072 plen 1024, isize 420864
+
+As you can see, it now does full page reads until the last one which
+is split correctly at the block aligned EOF, reading 3072 bytes and
+zeroing the last 1024 bytes. The original version of the patch got
+this right, but it got another case wrong.
+
+The EOF detection crossing really needs to the the original length
+as plen, while it starts at the end of the block, will be shortened
+as up-to-date blocks are found on the page. This means "orig_pos +
+plen" no longer points to the end of the page, and so will not
+correctly detect EOF crossing. Hence we have to use the length
+passed in to detect this partial page case:
+
+xfs_filemap_fault: dev 259:1 ino 0x43 write_fault 0
+xfs_vm_readpage: dev 259:1 ino 0x43 nr_pages 1
+xfs_iomap_found: dev 259:1 ino 0x43 size 0x2cc00 offset 0x2c000 count 4096 type hole startoff 0xb0 startblock 282 blockcount 0x4
+iomap_readpage_actor: orig pos 180224 pos 181248, length 4096, poff 1024 plen 2048, isize 183296
+xfs_iomap_found: dev 259:1 ino 0x43 size 0x2cc00 offset 0x2cc00 count 1024 type hole startoff 0xb3 startblock 285 blockcount 0x1
+iomap_readpage_actor: orig pos 183296 pos 183296, length 1024, poff 3072 plen 1024, isize 183296
+
+Heere we see a trace where the first block on the EOF page is up to
+date, hence poff = 1024 bytes. The offset into the page of EOF is
+3072, so the range we want to read is 1024 - 3071, and the range we
+want to zero is 3072 - 4095. You can see this is split correctly
+now.
+
+This fixes the stale data beyond EOF problem that fsx quickly
+uncovers on 1k block size filesystems.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/iomap.c b/fs/iomap.c
+index 0ff0f8ca3b197..caa45f73967cf 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -150,13 +150,14 @@ static void
+ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
+ loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp)
+ {
++ loff_t orig_pos = *pos;
++ loff_t isize = i_size_read(inode);
+ unsigned block_bits = inode->i_blkbits;
+ unsigned block_size = (1 << block_bits);
+ unsigned poff = offset_in_page(*pos);
+ unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length);
+ unsigned first = poff >> block_bits;
+ unsigned last = (poff + plen - 1) >> block_bits;
+- unsigned end = offset_in_page(i_size_read(inode)) >> block_bits;
+
+ /*
+ * If the block size is smaller than the page size we need to check the
+@@ -191,8 +192,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop,
+ * handle both halves separately so that we properly zero data in the
+ * page cache for blocks that are entirely outside of i_size.
+ */
+- if (first <= end && last > end)
+- plen -= (last - end) * block_size;
++ if (orig_pos <= isize && orig_pos + length > isize) {
++ unsigned end = offset_in_page(isize - 1) >> block_bits;
++
++ if (first <= end && last > end)
++ plen -= (last - end) * block_size;
++ }
+
+ *offp = poff;
+ *lenp = plen;
+--
+2.20.1
+
--- /dev/null
+From e2651b022de57f56c1a9fe714a5758538e15cd8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 13:31:10 -0800
+Subject: iomap: sub-block dio needs to zeroout beyond EOF
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit b450672fb66b4a991a5b55ee24209ac7ae7690ce ]
+
+If we are doing sub-block dio that extends EOF, we need to zero
+the unused tail of the block to initialise the data in it it. If we
+do not zero the tail of the block, then an immediate mmap read of
+the EOF block will expose stale data beyond EOF to userspace. Found
+with fsx running sub-block DIO sizes vs MAPREAD/MAPWRITE operations.
+
+Fix this by detecting if the end of the DIO write is beyond EOF
+and zeroing the tail if necessary.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/iomap.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/iomap.c b/fs/iomap.c
+index 914c07c9e0d6f..d3d227682f7d4 100644
+--- a/fs/iomap.c
++++ b/fs/iomap.c
+@@ -1700,7 +1700,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length,
+ dio->submit.cookie = submit_bio(bio);
+ } while (nr_pages);
+
+- if (need_zeroout) {
++ /*
++ * We need to zeroout the tail of a sub-block write if the extent type
++ * requires zeroing or the write extends beyond EOF. If we don't zero
++ * the block tail in the latter case, we can expose stale data via mmap
++ * reads of the EOF block.
++ */
++ if (need_zeroout ||
++ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) {
+ /* zero out from the end of the write to the end of the block */
+ pad = pos & (fs_block_size - 1);
+ if (pad)
+--
+2.20.1
+
--- /dev/null
+From a1c2f59fc4126363aada985e9a8116f705687083 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 16:43:57 +0100
+Subject: iommu/amd: Fix line-break in error log reporting
+
+From: Joerg Roedel <jroedel@suse.de>
+
+[ Upstream commit 1a21ee1aabf7ff9484f2eb122476d80c7f60a620 ]
+
+With the switch to dev_err for reporting errors from the
+iommu log there was an unwanted newline introduced. The
+reason was that the reporting was done in multiple dev_err()
+calls, and dev_err adds a newline after every call.
+
+Fix it by printing the log messages with only one dev_err()
+call.
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index fe18804a50083..9991386fb7000 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -549,7 +549,7 @@ static void amd_iommu_report_page_fault(u16 devid, u16 domain_id,
+ dev_data = get_dev_data(&pdev->dev);
+
+ if (dev_data && __ratelimit(&dev_data->rs)) {
+- dev_err(&pdev->dev, "AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x%04x address=0x%016llx flags=0x%04x]\n",
++ dev_err(&pdev->dev, "Event logged [IO_PAGE_FAULT domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+ domain_id, address, flags);
+ } else if (printk_ratelimit()) {
+ pr_err("AMD-Vi: Event logged [IO_PAGE_FAULT device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+@@ -589,43 +589,41 @@ retry:
+ if (type == EVENT_TYPE_IO_FAULT) {
+ amd_iommu_report_page_fault(devid, pasid, address, flags);
+ return;
+- } else {
+- dev_err(dev, "AMD-Vi: Event logged [");
+ }
+
+ switch (type) {
+ case EVENT_TYPE_ILL_DEV:
+- dev_err(dev, "ILLEGAL_DEV_TABLE_ENTRY device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [ILLEGAL_DEV_TABLE_ENTRY device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ dump_dte_entry(devid);
+ break;
+ case EVENT_TYPE_DEV_TAB_ERR:
+- dev_err(dev, "DEV_TAB_HARDWARE_ERROR device=%02x:%02x.%x "
++ dev_err(dev, "Event logged [DEV_TAB_HARDWARE_ERROR device=%02x:%02x.%x "
+ "address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ address, flags);
+ break;
+ case EVENT_TYPE_PAGE_TAB_ERR:
+- dev_err(dev, "PAGE_TAB_HARDWARE_ERROR device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [PAGE_TAB_HARDWARE_ERROR device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ break;
+ case EVENT_TYPE_ILL_CMD:
+- dev_err(dev, "ILLEGAL_COMMAND_ERROR address=0x%016llx]\n", address);
++ dev_err(dev, "Event logged [ILLEGAL_COMMAND_ERROR address=0x%016llx]\n", address);
+ dump_command(address);
+ break;
+ case EVENT_TYPE_CMD_HARD_ERR:
+- dev_err(dev, "COMMAND_HARDWARE_ERROR address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [COMMAND_HARDWARE_ERROR address=0x%016llx flags=0x%04x]\n",
+ address, flags);
+ break;
+ case EVENT_TYPE_IOTLB_INV_TO:
+- dev_err(dev, "IOTLB_INV_TIMEOUT device=%02x:%02x.%x address=0x%016llx]\n",
++ dev_err(dev, "Event logged [IOTLB_INV_TIMEOUT device=%02x:%02x.%x address=0x%016llx]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ address);
+ break;
+ case EVENT_TYPE_INV_DEV_REQ:
+- dev_err(dev, "INVALID_DEVICE_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [INVALID_DEVICE_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ break;
+@@ -633,12 +631,12 @@ retry:
+ pasid = ((event[0] >> 16) & 0xFFFF)
+ | ((event[1] << 6) & 0xF0000);
+ tag = event[1] & 0x03FF;
+- dev_err(dev, "INVALID_PPR_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
++ dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n",
+ PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid),
+ pasid, address, flags);
+ break;
+ default:
+- dev_err(dev, "UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n",
++ dev_err(dev, "Event logged [UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n",
+ event[0], event[1], event[2], event[3]);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 837296519595c616f1050f5b4ae8d95c626d29b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Nov 2018 05:27:39 -0800
+Subject: iw_cxgb4: only reconnect with MPAv1 if the peer aborts
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit 9828ca654b52848e7eb7dcc9b0994ff130dd4546 ]
+
+Only retry connection setup with MPAv1 if the peer actually aborted the
+connection upon receiving the MPAv2 start message. This avoids retrying
+with MPAv1 in the case where the connection was aborted due to retransmit
+timeouts.
+
+Fixes: d2fe99e86bb2 ("RDMA/cxgb4: Add support for MPAv2 Enhanced RDMA Negotiation")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index a5ff1f0f2073e..4dcc92d116097 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2798,7 +2798,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb)
+ break;
+ case MPA_REQ_SENT:
+ (void)stop_ep_timer(ep);
+- if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1))
++ if (status != CPL_ERR_CONN_RESET || mpa_rev == 1 ||
++ (mpa_rev == 2 && ep->tried_with_mpa_v1))
+ connect_reply_upcall(ep, -ECONNRESET);
+ else {
+ /*
+--
+2.20.1
+
--- /dev/null
+From da435c30b1d5d0a6c5ce2c17d9521d2fb98faf56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Aug 2018 14:45:42 +0300
+Subject: iwlwifi: fix cfg structs for 22000 with different RF modules
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit b1bbc1a636505ebdd6336ff781e417123226d4f7 ]
+
+We have to choose different configuration and different firmwares
+depending on the external RF module that is installed. Since the
+external module is not represented in the PCI IDs, we need to change
+the configuration at runtime, after checking the RF ID of the module
+installed. We have a bit of a mess in the code that does this,
+because it applies cfg's according to the RF ID only, ignoring the
+integrated module that is in use.
+
+Fix that for some devices by adding correct configurations for them
+and not ignoring the integrated module's type when making the
+decision.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/cfg/22000.c | 1 -
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 +-
+ .../net/wireless/intel/iwlwifi/pcie/trans.c | 22 +++++++++++++++++--
+ 3 files changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index a0de61aa0feff..d7335fabd9294 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -321,7 +321,6 @@ MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 0982bd99b1c3c..844a1009484f6 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -888,7 +888,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ac_cfg_jf)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0000, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0010, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40c0, 0x0090, iwl22560_2ax_cfg_su_cdb)},
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index f89d43bc7d4bd..4f5571123f70a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -3415,8 +3415,26 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ #if IS_ENABLED(CONFIG_IWLMVM)
+ trans->hw_rf_id = iwl_read32(trans, CSR_HW_RF_ID);
+
+- if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+- CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
++ if (cfg == &iwl22000_2ax_cfg_hr) {
++ if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
++ trans->cfg = &iwl22000_2ax_cfg_hr;
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
++ trans->cfg = &iwl22000_2ax_cfg_jf;
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HRCDB)) {
++ IWL_ERR(trans, "RF ID HRCDB is not supported\n");
++ ret = -EINVAL;
++ goto out_no_pci;
++ } else {
++ IWL_ERR(trans, "Unrecognized RF ID 0x%08x\n",
++ CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id));
++ ret = -EINVAL;
++ goto out_no_pci;
++ }
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
+ u32 hw_status;
+
+ hw_status = iwl_read_prph(trans, UMAG_GEN_HW_STATUS);
+--
+2.20.1
+
--- /dev/null
+From 582dae32d99bd7528d108777d530a103c9fc5c58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jul 2018 21:57:50 +0300
+Subject: iwlwifi: mvm: Send non offchannel traffic via AP sta
+
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+
+[ Upstream commit dc1aca22f8f38b7e2ad7b118db87404d11e68771 ]
+
+TDLS discovery response frame is a unicast direct frame to the peer.
+Since we don't have a STA for this peer, this frame goes through
+iwl_tx_skb_non_sta(). As the result aux_sta and some completely
+arbitrary queue would be selected for this frame, resulting in a queue
+hang. Fix that by sending such frames through AP sta instead.
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 0f357e8c4f940..476c44db0e64b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -820,6 +820,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
+ !ieee80211_is_bufferable_mmpdu(hdr->frame_control))
+ sta = NULL;
+
++ /* If there is no sta, and it's not offchannel - send through AP */
++ if (info->control.vif->type == NL80211_IFTYPE_STATION &&
++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) {
++ struct iwl_mvm_vif *mvmvif =
++ iwl_mvm_vif_from_mac80211(info->control.vif);
++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id);
++
++ if (ap_sta_id < IWL_MVM_STATION_COUNT) {
++ /* mac80211 holds rcu read lock */
++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]);
++ if (IS_ERR_OR_NULL(sta))
++ goto drop;
++ }
++ }
++
+ if (sta) {
+ if (iwl_mvm_defer_tx(mvm, sta, skb))
+ return;
+--
+2.20.1
+
--- /dev/null
+From 7a950f581199d2bb37d0c2f8dd7bfbb9f96e2480 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 23:12:33 +0200
+Subject: iwlwifi: mvm: synchronize TID queue removal
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 06bc6f6ed4ae0246a5e52094d1be90906a1361c7 ]
+
+When we mark a TID as no longer having a queue, there's no
+guarantee the TX path isn't using this txq_id right now,
+having accessed it just before we reset the value. To fix
+this, add synchronize_net() when we change the TIDs from
+having a queue to not having one, so that we can then be
+sure that the TX path is no longer accessing that queue.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 04ea516bddcc0..e850aa504b608 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -440,6 +440,16 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue)
+
+ rcu_read_unlock();
+
++ /*
++ * The TX path may have been using this TXQ_ID from the tid_data,
++ * so make sure it's no longer running so that we can safely reuse
++ * this TXQ later. We've set all the TIDs to IWL_MVM_INVALID_QUEUE
++ * above, but nothing guarantees we've stopped using them. Thus,
++ * without this, we could get to iwl_mvm_disable_txq() and remove
++ * the queue while still sending frames to it.
++ */
++ synchronize_net();
++
+ return disable_agg_tids;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4f823097e96bfa0948363fdd70c15a79705c3757 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 13:51:47 +0200
+Subject: iwlwifi: pcie: don't consider IV len in A-MSDU
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+[ Upstream commit cb1a4badf59275eb7221dcec621e8154917eabd1 ]
+
+From gen2 PN is totally offloaded to hardware (also the space for the
+IV isn't part of the skb). As you can see in mvm/mac80211.c:3545, the
+MAC for cipher types CCMP/GCMP doesn't set
+IEEE80211_KEY_FLAG_PUT_IV_SPACE for gen2 NICs.
+
+This causes all the AMSDU data to be corrupted with cipher enabled.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 20 +++++++------------
+ 1 file changed, 7 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+index 316e2ba0c34d7..7b1dff92b7094 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c
+@@ -242,27 +242,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ struct ieee80211_hdr *hdr = (void *)skb->data;
+ unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room;
+ unsigned int mss = skb_shinfo(skb)->gso_size;
+- u16 length, iv_len, amsdu_pad;
++ u16 length, amsdu_pad;
+ u8 *start_hdr;
+ struct iwl_tso_hdr_page *hdr_page;
+ struct page **page_ptr;
+ struct tso_t tso;
+
+- /* if the packet is protected, then it must be CCMP or GCMP */
+- iv_len = ieee80211_has_protected(hdr->frame_control) ?
+- IEEE80211_CCMP_HDR_LEN : 0;
+-
+ trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd),
+ &dev_cmd->hdr, start_len, 0);
+
+ ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb);
+ snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb);
+- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len;
++ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len;
+ amsdu_pad = 0;
+
+ /* total amount of header we may need for this A-MSDU */
+ hdr_room = DIV_ROUND_UP(total_len, mss) *
+- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len;
++ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr));
+
+ /* Our device supports 9 segments at most, it will fit in 1 page */
+ hdr_page = get_page_hdr(trans, hdr_room);
+@@ -273,14 +269,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ start_hdr = hdr_page->pos;
+ page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs);
+ *page_ptr = hdr_page->page;
+- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len);
+- hdr_page->pos += iv_len;
+
+ /*
+- * Pull the ieee80211 header + IV to be able to use TSO core,
++ * Pull the ieee80211 header to be able to use TSO core,
+ * we will restore it for the tx_status flow.
+ */
+- skb_pull(skb, hdr_len + iv_len);
++ skb_pull(skb, hdr_len);
+
+ /*
+ * Remove the length of all the headers that we don't actually
+@@ -355,8 +349,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans,
+ }
+ }
+
+- /* re -add the WiFi header and IV */
+- skb_push(skb, hdr_len + iv_len);
++ /* re -add the WiFi header */
++ skb_push(skb, hdr_len);
+
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From d312a77c216dca6a3742b7e65e1524ec4fc04845 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 15:31:36 +0300
+Subject: iwlwifi: trans: Clear persistence bit when starting the FW
+
+From: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+
+[ Upstream commit 8954e1eb2270fa2effffd031b4839253952c76f2 ]
+
+In D3 suspend flow in 9260 gen2 HW, the NIC receives two PERST signals.
+The first PERST is expected and indicates the device on coming resume flow.
+The second PERST causes FW restart FW restart.
+In order to avoid this issue, the FW set the persistence bit on.
+Once this bit is set, the FW ignores reset attempts.
+The problem is when the FW gets assert during D3 and then the persistence
+bit is set and causes the FW to ignore reset.
+To handle this issue, the FW opens the preg bit which allows access
+to the persistence bit, so that the driver clear the persistence bit
+and reset the NIC.
+
+The flow is as follows:
+the driver checks if the persistence bit is set.
+If the bit is set, the driver checks if he can clear the bit.
+If the driver can not clear the bit then there is no point to continue
+configuring the NIC since it will fail.
+
+The fix was added is in start HW flow instead of the resume flow since in
+general, if the persistence bit is set, the driver can not start the FW.
+So it is good to check it when we start configuring the NIC.
+
+The driver does not need to close the preg bit since the FW close it
+during the start flow.
+
+Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 7 +++++++
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 12 ++++++++++++
+ 2 files changed, 19 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+index 421a869633a32..2e512f6e9ebcd 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h
+@@ -8,6 +8,7 @@
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -35,6 +36,7 @@
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 Intel Deutschland GmbH
++ * Copyright (C) 2018 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -399,6 +401,7 @@ enum aux_misc_master1_en {
+ #define AUX_MISC_MASTER1_SMPHR_STATUS 0xA20800
+ #define RSA_ENABLE 0xA24B08
+ #define PREG_AUX_BUS_WPROT_0 0xA04CC0
++#define PREG_PRPH_WPROT_0 0xA04CE0
+ #define SB_CPU_1_STATUS 0xA01E30
+ #define SB_CPU_2_STATUS 0xA01E34
+ #define UMAG_SB_CPU_1_STATUS 0xA038C0
+@@ -425,4 +428,8 @@ enum {
+ #define UREG_CHICK (0xA05C00)
+ #define UREG_CHICK_MSI_ENABLE BIT(24)
+ #define UREG_CHICK_MSIX_ENABLE BIT(25)
++
++#define HPM_DEBUG 0xA03440
++#define PERSISTENCE_BIT BIT(12)
++#define PREG_WFPM_ACCESS BIT(12)
+ #endif /* __iwl_prph_h__ */
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 954f932e9c88e..f89d43bc7d4bd 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -1747,6 +1747,7 @@ static int iwl_pcie_init_msix_handler(struct pci_dev *pdev,
+ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+ {
+ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++ u32 hpm;
+ int err;
+
+ lockdep_assert_held(&trans_pcie->mutex);
+@@ -1757,6 +1758,17 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power)
+ return err;
+ }
+
++ hpm = iwl_trans_read_prph(trans, HPM_DEBUG);
++ if (hpm != 0xa5a5a5a0 && (hpm & PERSISTENCE_BIT)) {
++ if (iwl_trans_read_prph(trans, PREG_PRPH_WPROT_0) &
++ PREG_WFPM_ACCESS) {
++ IWL_ERR(trans,
++ "Error, can not clear persistence bit\n");
++ return -EPERM;
++ }
++ iwl_trans_write_prph(trans, HPM_DEBUG, hpm & ~PERSISTENCE_BIT);
++ }
++
+ iwl_trans_pcie_sw_reset(trans);
+
+ err = iwl_pcie_apm_init(trans);
+--
+2.20.1
+
--- /dev/null
+From 03a6d5c3189f489b6f54e857544cbf81b9b22a92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 19:11:50 -0600
+Subject: kbuild: disable dtc simple_bus_reg warnings by default
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit 70523a3ce5ff928faa43bb2cad554dc63438e3e7 ]
+
+The updated version of dtc has a bug fix for simple_bus_reg warnings
+and lots of warnings are generated now. So disable this warning by
+default.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.lib | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index 61e596650ed31..a232741e3fd3b 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -252,6 +252,7 @@ DTC_FLAGS += -Wno-unit_address_vs_reg \
+ -Wno-alias_paths \
+ -Wno-graph_child_address \
+ -Wno-graph_port \
++ -Wno-simple_bus_reg \
+ -Wno-unique_unit_address \
+ -Wno-pci_device_reg
+ endif
+--
+2.20.1
+
--- /dev/null
+From fb5901019cef9ed5a76ddeaf83eccff8b2bd5c28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 09:08:21 -0600
+Subject: kbuild: Enable dtc graph_port warning by default
+
+From: Rob Herring <robh@kernel.org>
+
+[ Upstream commit a2237fec1e0645d1e99e108f2658c26cb5a66c74 ]
+
+All the 'graph_port' warnings have been fixed or have pending fixes, so
+we can enable it by default now.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/Makefile.lib | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index a232741e3fd3b..18f44bba3c8c2 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -251,7 +251,6 @@ DTC_FLAGS += -Wno-unit_address_vs_reg \
+ -Wno-avoid_unnecessary_addr_size \
+ -Wno-alias_paths \
+ -Wno-graph_child_address \
+- -Wno-graph_port \
+ -Wno-simple_bus_reg \
+ -Wno-unique_unit_address \
+ -Wno-pci_device_reg
+--
+2.20.1
+
--- /dev/null
+From 48cdf320b608b507f2f2309f747e4719c6817f4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 08:11:54 +0900
+Subject: kbuild: fix single target build for external module
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit e07db28eea38ed4e332b3a89f3995c86b713cb5b ]
+
+Building a single target in an external module fails due to missing
+.tmp_versions directory.
+
+For example,
+
+ $ make -C /lib/modules/$(uname -r)/build M=$PWD foo.o
+
+will fail in the following way:
+
+ CC [M] /home/masahiro/foo/foo.o
+/bin/sh: 1: cannot create /home/masahiro/foo/.tmp_versions/foo.mod: Directory nonexistent
+
+This is because $(cmd_crmodverdir) is executed only before building
+/, %/, %.ko single targets of external modules. Create .tmp_versions
+in the 'prepare' target.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index f9ebb74e8e43f..471acfc74998b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1507,9 +1507,6 @@ else # KBUILD_EXTMOD
+
+ # We are always building modules
+ KBUILD_MODULES := 1
+-PHONY += crmodverdir
+-crmodverdir:
+- $(cmd_crmodverdir)
+
+ PHONY += $(objtree)/Module.symvers
+ $(objtree)/Module.symvers:
+@@ -1521,7 +1518,7 @@ $(objtree)/Module.symvers:
+
+ module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD))
+ PHONY += $(module-dirs) modules
+-$(module-dirs): crmodverdir $(objtree)/Module.symvers
++$(module-dirs): prepare $(objtree)/Module.symvers
+ $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
+
+ modules: $(module-dirs)
+@@ -1562,7 +1559,8 @@ help:
+
+ # Dummies...
+ PHONY += prepare scripts
+-prepare: ;
++prepare:
++ $(cmd_crmodverdir)
+ scripts: ;
+ endif # KBUILD_EXTMOD
+
+@@ -1689,17 +1687,14 @@ endif
+
+ # Modules
+ /: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ # Make sure the latest headers are built for Documentation
+ Documentation/ samples/: headers_install
+ %/: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir)
+ %.ko: prepare scripts FORCE
+- $(cmd_crmodverdir)
+ $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
+ $(build)=$(build-dir) $(@:.ko=.o)
+ $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
+--
+2.20.1
+
--- /dev/null
+From 54decfa1a6966d8c4ba55e77a7a40831aa91552f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 11:36:52 -0500
+Subject: lockd: fix decoding of TEST results
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit b8db159239b3f51e2b909859935cc25cb3ff3eed ]
+
+We fail to advance the read pointer when reading the stat.oh field that
+identifies the lock-holder in a TEST result.
+
+This turns out not to matter if the server is knfsd, which always
+returns a zero-length field. But other servers (Ganesha is an example)
+may not do this. The result is bad values in fcntl F_GETLK results.
+
+Fix this.
+
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/lockd/clnt4xdr.c | 22 ++++++----------------
+ fs/lockd/clntxdr.c | 22 ++++++----------------
+ 2 files changed, 12 insertions(+), 32 deletions(-)
+
+diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
+index 00d5ef5f99f73..214a2fa1f1e39 100644
+--- a/fs/lockd/clnt4xdr.c
++++ b/fs/lockd/clnt4xdr.c
+@@ -128,24 +128,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
+index 2c6176387143c..747b9c8c940ac 100644
+--- a/fs/lockd/clntxdr.c
++++ b/fs/lockd/clntxdr.c
+@@ -125,24 +125,14 @@ static void encode_netobj(struct xdr_stream *xdr,
+ static int decode_netobj(struct xdr_stream *xdr,
+ struct xdr_netobj *obj)
+ {
+- u32 length;
+- __be32 *p;
++ ssize_t ret;
+
+- p = xdr_inline_decode(xdr, 4);
+- if (unlikely(p == NULL))
+- goto out_overflow;
+- length = be32_to_cpup(p++);
+- if (unlikely(length > XDR_MAX_NETOBJ))
+- goto out_size;
+- obj->len = length;
+- obj->data = (u8 *)p;
++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data,
++ XDR_MAX_NETOBJ);
++ if (unlikely(ret < 0))
++ return -EIO;
++ obj->len = ret;
+ return 0;
+-out_size:
+- dprintk("NFS: returned netobj was too long: %u\n", length);
+- return -EIO;
+-out_overflow:
+- print_overflow_msg(__func__, xdr);
+- return -EIO;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From ba5bb5d8dfa22352df5a210cf456433dad47a9bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 11:14:38 +0800
+Subject: math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
+
+From: Vincent Chen <vincentc@andestech.com>
+
+[ Upstream commit 83312f1b7ae205dca647bf52bbe2d51303cdedfb ]
+
+_FP_ROUND_ZERO is defined as 0 and used as a statemente in macro
+_FP_ROUND. This generates "error: statement with no effect
+[-Werror=unused-value]" from gcc. Defining _FP_ROUND_ZERO as (void)0 to
+fix it.
+
+This modification is quoted from glibc 'commit <In libc/:>
+(8ed1e7d5894000c155acbd06f)'
+
+Signed-off-by: Vincent Chen <vincentc@andestech.com>
+Acked-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/math-emu/soft-fp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h
+index 3f284bc031809..5650c16283830 100644
+--- a/include/math-emu/soft-fp.h
++++ b/include/math-emu/soft-fp.h
+@@ -138,7 +138,7 @@ do { \
+ _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \
+ } while (0)
+
+-#define _FP_ROUND_ZERO(wc, X) 0
++#define _FP_ROUND_ZERO(wc, X) (void)0
+
+ #define _FP_ROUND_PINF(wc, X) \
+ do { \
+--
+2.20.1
+
--- /dev/null
+From 254d9965a6de082559f5038b9bd0b1016ced58dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Oct 2018 03:44:20 -0400
+Subject: media: cec: report Vendor ID after initialization
+
+From: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+
+[ Upstream commit 7f02ac77c768ba2bcdd0ce719c1fca0870ffe2fb ]
+
+The CEC specification requires that the Vendor ID (if any) is reported
+after a logical address was claimed.
+
+This was never done, so add support for this.
+
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/cec/cec-adap.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c
+index 4a15d53f659ec..dd6f3e6ce0062 100644
+--- a/drivers/media/cec/cec-adap.c
++++ b/drivers/media/cec/cec-adap.c
+@@ -1437,6 +1437,13 @@ configured:
+ las->log_addr[i],
+ cec_phys_addr_exp(adap->phys_addr));
+ cec_transmit_msg_fh(adap, &msg, NULL, false);
++
++ /* Report Vendor ID */
++ if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) {
++ cec_msg_device_vendor_id(&msg,
++ adap->log_addrs.vendor_id);
++ cec_transmit_msg_fh(adap, &msg, NULL, false);
++ }
+ }
+ adap->kthread_config = NULL;
+ complete(&adap->config_completion);
+--
+2.20.1
+
--- /dev/null
+From e0c9ade66069781e702e804c78f4930e5225527c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 05:40:54 -0500
+Subject: media: coda: fix memory corruption in case more than 32 instances are
+ opened
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+[ Upstream commit 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f ]
+
+The ffz() return value is undefined if the instance mask does not
+contain any zeros. If it returned 32, the following set_bit would
+corrupt the debugfs_root pointer.
+Switch to IDA for context index allocation. This also removes the
+artificial 32 instance limit for all except CodaDx6.
+
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/coda/coda-common.c | 26 +++++++++--------------
+ drivers/media/platform/coda/coda.h | 3 ++-
+ 2 files changed, 12 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 4b0220f40b425..fccc771d23a51 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -17,6 +17,7 @@
+ #include <linux/firmware.h>
+ #include <linux/gcd.h>
+ #include <linux/genalloc.h>
++#include <linux/idr.h>
+ #include <linux/interrupt.h>
+ #include <linux/io.h>
+ #include <linux/irq.h>
+@@ -2101,17 +2102,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq,
+ return coda_queue_init(priv, dst_vq);
+ }
+
+-static int coda_next_free_instance(struct coda_dev *dev)
+-{
+- int idx = ffz(dev->instance_mask);
+-
+- if ((idx < 0) ||
+- (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES))
+- return -EBUSY;
+-
+- return idx;
+-}
+-
+ /*
+ * File operations
+ */
+@@ -2120,7 +2110,8 @@ static int coda_open(struct file *file)
+ {
+ struct video_device *vdev = video_devdata(file);
+ struct coda_dev *dev = video_get_drvdata(vdev);
+- struct coda_ctx *ctx = NULL;
++ struct coda_ctx *ctx;
++ unsigned int max = ~0;
+ char *name;
+ int ret;
+ int idx;
+@@ -2129,12 +2120,13 @@ static int coda_open(struct file *file)
+ if (!ctx)
+ return -ENOMEM;
+
+- idx = coda_next_free_instance(dev);
++ if (dev->devtype->product == CODA_DX6)
++ max = CODADX6_MAX_INSTANCES - 1;
++ idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL);
+ if (idx < 0) {
+ ret = idx;
+ goto err_coda_max;
+ }
+- set_bit(idx, &dev->instance_mask);
+
+ name = kasprintf(GFP_KERNEL, "context%d", idx);
+ if (!name) {
+@@ -2243,8 +2235,8 @@ err_clk_per:
+ err_pm_get:
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
+ err_coda_name_init:
++ ida_free(&dev->ida, ctx->idx);
+ err_coda_max:
+ kfree(ctx);
+ return ret;
+@@ -2286,7 +2278,7 @@ static int coda_release(struct file *file)
+ pm_runtime_put_sync(&dev->plat_dev->dev);
+ v4l2_fh_del(&ctx->fh);
+ v4l2_fh_exit(&ctx->fh);
+- clear_bit(ctx->idx, &dev->instance_mask);
++ ida_free(&dev->ida, ctx->idx);
+ if (ctx->ops->release)
+ ctx->ops->release(ctx);
+ debugfs_remove_recursive(ctx->debugfs_entry);
+@@ -2747,6 +2739,7 @@ static int coda_probe(struct platform_device *pdev)
+
+ mutex_init(&dev->dev_mutex);
+ mutex_init(&dev->coda_mutex);
++ ida_init(&dev->ida);
+
+ dev->debugfs_root = debugfs_create_dir("coda", NULL);
+ if (!dev->debugfs_root)
+@@ -2834,6 +2827,7 @@ static int coda_remove(struct platform_device *pdev)
+ coda_free_aux_buf(dev, &dev->tempbuf);
+ coda_free_aux_buf(dev, &dev->workbuf);
+ debugfs_remove_recursive(dev->debugfs_root);
++ ida_destroy(&dev->ida);
+ return 0;
+ }
+
+diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h
+index 2469ca1dc5985..8df02c32781ee 100644
+--- a/drivers/media/platform/coda/coda.h
++++ b/drivers/media/platform/coda/coda.h
+@@ -16,6 +16,7 @@
+ #define __CODA_H__
+
+ #include <linux/debugfs.h>
++#include <linux/idr.h>
+ #include <linux/irqreturn.h>
+ #include <linux/mutex.h>
+ #include <linux/kfifo.h>
+@@ -95,7 +96,7 @@ struct coda_dev {
+ struct workqueue_struct *workqueue;
+ struct v4l2_m2m_dev *m2m_dev;
+ struct list_head instances;
+- unsigned long instance_mask;
++ struct ida ida;
+ struct dentry *debugfs_root;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From db0afc33c9b1bb7c314be6bd40ce1d9bc78b008c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 07:44:48 -0500
+Subject: media: cxd2880-spi: fix probe when dvb_attach fails
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+[ Upstream commit 458ffce1cb46e46e3cec48b625ed142250475708 ]
+
+When dvb_attach fails, probe returns 0, and remove crashes afterwards.
+This patch sets the return value to -ENODEV when attach fails.
+
+Fixes: bd24fcddf6b8 ("media: cxd2880-spi: Add support for CXD2880 SPI interface")
+
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Acked-by: Yasunari Takiguchi <Yasunari.Takiguchi@sony.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/spi/cxd2880-spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c
+index 11ce5101e19f6..c43730977f53c 100644
+--- a/drivers/media/spi/cxd2880-spi.c
++++ b/drivers/media/spi/cxd2880-spi.c
+@@ -536,6 +536,7 @@ cxd2880_spi_probe(struct spi_device *spi)
+
+ if (!dvb_attach(cxd2880_attach, &dvb_spi->dvb_fe, &config)) {
+ pr_err("cxd2880_attach failed\n");
++ ret = -ENODEV;
+ goto fail_attach;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2c93d98b701120f8a122b5309786b0306630915b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 08:25:53 -0500
+Subject: media: pulse8-cec: return 0 when invalidating the logical address
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+[ Upstream commit 2e84eb9affac43eeaf834992888b72426a8cd442 ]
+
+Return 0 when invalidating the logical address. The cec core produces
+a warning for drivers that do this.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Torbjorn Jansson <torbjorn.jansson@mbox200.swipnet.se>
+Signed-off-by: Hans Verkuil <hansverk@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/pulse8-cec/pulse8-cec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+index 350635826aaed..6e3bdd71e273b 100644
+--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c
++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c
+@@ -585,7 +585,7 @@ unlock:
+ else
+ pulse8->config_pending = true;
+ mutex_unlock(&pulse8->config_lock);
+- return err;
++ return log_addr == CEC_LOG_ADDR_INVALID ? 0 : err;
+ }
+
+ static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts,
+--
+2.20.1
+
--- /dev/null
+From 51ba2ed58d315da6dcd27de3338685de4340e798 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 23 Nov 2018 11:14:54 -0500
+Subject: media: stkwebcam: Bugfix for wrong return values
+
+From: Andreas Pape <ap@ca-pape.de>
+
+[ Upstream commit 3c28b91380dd1183347d32d87d820818031ebecf ]
+
+usb_control_msg returns in case of a successfully sent message the number
+of sent bytes as a positive number. Don't use this value as a return value
+for stk_camera_read_reg, as a non-zero return value is used as an error
+condition in some cases when stk_camera_read_reg is called.
+
+Signed-off-by: Andreas Pape <ap@ca-pape.de>
+Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/stkwebcam/stk-webcam.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c
+index 6e3f234e790b8..e33fa78ef98dd 100644
+--- a/drivers/media/usb/stkwebcam/stk-webcam.c
++++ b/drivers/media/usb/stkwebcam/stk-webcam.c
+@@ -164,7 +164,11 @@ int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value)
+ *value = *buf;
+
+ kfree(buf);
+- return ret;
++
++ if (ret < 0)
++ return ret;
++ else
++ return 0;
+ }
+
+ static int stk_start_stream(struct stk_camera *dev)
+--
+2.20.1
+
--- /dev/null
+From 3c3b428c05b46ebfcac9b0e2a6bba0f74ad1e85b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 9 Nov 2018 09:26:10 -0500
+Subject: media: uvcvideo: Abstract streaming object lifetime
+
+From: Kieran Bingham <kieran.bingham@ideasonboard.com>
+
+[ Upstream commit ece41454c6a5ed8f301ef1c37710ab222e577823 ]
+
+The streaming object is a key part of handling the UVC device. Although
+not critical, we are currently missing a call to destroy the mutex on
+clean up paths, and we are due to extend the objects complexity in the
+near future.
+
+Facilitate easy management of a stream object by creating a pair of
+functions to handle creating and destroying the allocation. The new
+uvc_stream_delete() function also performs the missing mutex_destroy()
+operation.
+
+Previously a failed streaming object allocation would cause
+uvc_parse_streaming() to return -EINVAL, which is inappropriate. If the
+constructor failes, we will instead return -ENOMEM.
+
+While we're here, fix the trivial spelling error in the function banner
+of uvc_delete().
+
+Signed-off-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/usb/uvc/uvc_driver.c | 54 +++++++++++++++++++++---------
+ 1 file changed, 38 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index cf4feff2a48c1..063e229ead5ef 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -390,6 +390,39 @@ static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id)
+ return NULL;
+ }
+
++/* ------------------------------------------------------------------------
++ * Streaming Object Management
++ */
++
++static void uvc_stream_delete(struct uvc_streaming *stream)
++{
++ mutex_destroy(&stream->mutex);
++
++ usb_put_intf(stream->intf);
++
++ kfree(stream->format);
++ kfree(stream->header.bmaControls);
++ kfree(stream);
++}
++
++static struct uvc_streaming *uvc_stream_new(struct uvc_device *dev,
++ struct usb_interface *intf)
++{
++ struct uvc_streaming *stream;
++
++ stream = kzalloc(sizeof(*stream), GFP_KERNEL);
++ if (stream == NULL)
++ return NULL;
++
++ mutex_init(&stream->mutex);
++
++ stream->dev = dev;
++ stream->intf = usb_get_intf(intf);
++ stream->intfnum = intf->cur_altsetting->desc.bInterfaceNumber;
++
++ return stream;
++}
++
+ /* ------------------------------------------------------------------------
+ * Descriptors parsing
+ */
+@@ -682,17 +715,12 @@ static int uvc_parse_streaming(struct uvc_device *dev,
+ return -EINVAL;
+ }
+
+- streaming = kzalloc(sizeof(*streaming), GFP_KERNEL);
++ streaming = uvc_stream_new(dev, intf);
+ if (streaming == NULL) {
+ usb_driver_release_interface(&uvc_driver.driver, intf);
+- return -EINVAL;
++ return -ENOMEM;
+ }
+
+- mutex_init(&streaming->mutex);
+- streaming->dev = dev;
+- streaming->intf = usb_get_intf(intf);
+- streaming->intfnum = intf->cur_altsetting->desc.bInterfaceNumber;
+-
+ /* The Pico iMage webcam has its class-specific interface descriptors
+ * after the endpoint descriptors.
+ */
+@@ -899,10 +927,7 @@ static int uvc_parse_streaming(struct uvc_device *dev,
+
+ error:
+ usb_driver_release_interface(&uvc_driver.driver, intf);
+- usb_put_intf(intf);
+- kfree(streaming->format);
+- kfree(streaming->header.bmaControls);
+- kfree(streaming);
++ uvc_stream_delete(streaming);
+ return ret;
+ }
+
+@@ -1818,7 +1843,7 @@ static int uvc_scan_device(struct uvc_device *dev)
+ * is released.
+ *
+ * As this function is called after or during disconnect(), all URBs have
+- * already been canceled by the USB core. There is no need to kill the
++ * already been cancelled by the USB core. There is no need to kill the
+ * interrupt URB manually.
+ */
+ static void uvc_delete(struct kref *kref)
+@@ -1856,10 +1881,7 @@ static void uvc_delete(struct kref *kref)
+ streaming = list_entry(p, struct uvc_streaming, list);
+ usb_driver_release_interface(&uvc_driver.driver,
+ streaming->intf);
+- usb_put_intf(streaming->intf);
+- kfree(streaming->format);
+- kfree(streaming->header.bmaControls);
+- kfree(streaming);
++ uvc_stream_delete(streaming);
+ }
+
+ kfree(dev);
+--
+2.20.1
+
--- /dev/null
+From caeb333c3dfdc742fb47ca3952a084c348f02af9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 12:56:41 -0500
+Subject: media: vimc: fix start stream when link is disabled
+
+From: Helen Fornazier <helen.koike@collabora.com>
+
+[ Upstream commit e159b6074c82fe31b79aad672e02fa204dbbc6d8 ]
+
+If link is disabled, media_entity_remote_pad returns NULL, causing a
+NULL pointer deference.
+Ignore links that are not enabled instead.
+
+Signed-off-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vimc/vimc-common.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c
+index 204aa6f554e4d..fa8435ac2b1ae 100644
+--- a/drivers/media/platform/vimc/vimc-common.c
++++ b/drivers/media/platform/vimc/vimc-common.c
+@@ -241,6 +241,8 @@ int vimc_pipeline_s_stream(struct media_entity *ent, int enable)
+
+ /* Start the stream in the subdevice direct connected */
+ pad = media_entity_remote_pad(&ent->pads[i]);
++ if (!pad)
++ continue;
+
+ if (!is_media_entity_v4l2_subdev(pad->entity))
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From f331be075b208837582870c47152815dcc4ea970 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 22:12:17 +0200
+Subject: MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible
+ definition
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 1c6121c39677175bd372076020948e184bad4b6b ]
+
+cn58xx is compatible with cn50xx, so use the latter.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+[paul.burton@mips.com: s/cn52xx/cn50xx/ in commit message.]
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c | 2 +-
+ arch/mips/include/asm/octeon/cvmx-pko.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+index 8241fc6aa17d8..3839feba68f20 100644
+--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c
+@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id)
+ } else {
+ union cvmx_pko_mem_debug8 debug8;
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- return debug8.cn58xx.doorbell;
++ return debug8.cn50xx.doorbell;
+ }
+ case CVMX_CMD_QUEUE_ZIP:
+ case CVMX_CMD_QUEUE_DFA:
+diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h
+index 5f47f76ed510a..20eb9c46a75ab 100644
+--- a/arch/mips/include/asm/octeon/cvmx-pko.h
++++ b/arch/mips/include/asm/octeon/cvmx-pko.h
+@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear,
+ pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num);
+ cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64);
+ debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8);
+- status->doorbell = debug8.cn58xx.doorbell;
++ status->doorbell = debug8.cn50xx.doorbell;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ed18f1542e47b316c12995ff0262acaf53bd049b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Nov 2018 00:37:29 +0200
+Subject: MIPS: OCTEON: octeon-platform: fix typing
+
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+
+[ Upstream commit 2cf1c8933dd93088cfb5f8f58b3bb9bbdf1781b9 ]
+
+Use correct type for fdt_property nameoff field.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/21204/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@linux-mips.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/cavium-octeon/octeon-platform.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
+index 807cadaf554e2..5ba181e87d2c1 100644
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -501,7 +501,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr)
+ if (phy_addr >= 256 && alt_phy > 0) {
+ const struct fdt_property *phy_prop;
+ struct fdt_property *alt_prop;
+- u32 phy_handle_name;
++ fdt32_t phy_handle_name;
+
+ /* Use the alt phy node instead.*/
+ phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL);
+--
+2.20.1
+
--- /dev/null
+From bb7fbd856b1afad9ea39917217cfda5e5a5ec50b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 22:42:37 +0000
+Subject: MIPS: SiByte: Enable ZONE_DMA32 for LittleSur
+
+From: Maciej W. Rozycki <macro@linux-mips.org>
+
+[ Upstream commit 756d6d836dbfb04a5a486bc2ec89397aa4533737 ]
+
+The LittleSur board is marked for high memory support and therefore
+clearly must provide a way to have enough memory installed for some to
+be present outside the low 4GiB physical address range. With the memory
+map of the BCM1250 SOC it has been built around it means over 1GiB of
+actual DRAM, as only the first 1GiB is mapped in the low 4GiB physical
+address range[1].
+
+Complement commit cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need
+DMA32.") then and also enable ZONE_DMA32 for LittleSur.
+
+References:
+
+[1] "BCM1250/BCM1125/BCM1125H User Manual", Revision 1250_1125-UM100-R,
+ Broadcom Corporation, 21 Oct 2002, Section 3: "System Overview",
+ "Memory Map", pp. 34-38
+
+Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Patchwork: https://patchwork.linux-mips.org/patch/21107/
+Fixes: cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need DMA32.")
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index 201caf226b47b..a830a9701e501 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -806,6 +806,7 @@ config SIBYTE_LITTLESUR
+ select SYS_SUPPORTS_BIG_ENDIAN
+ select SYS_SUPPORTS_HIGHMEM
+ select SYS_SUPPORTS_LITTLE_ENDIAN
++ select ZONE_DMA32 if 64BIT
+
+ config SIBYTE_SENTOSA
+ bool "Sibyte BCM91250E-Sentosa"
+--
+2.20.1
+
--- /dev/null
+From 6aee17cde111c6c4606b4bc5d68d1e90ff175a40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 21:18:07 -0500
+Subject: mlx4: Use snprintf instead of complicated strcpy
+
+From: Qian Cai <cai@gmx.us>
+
+[ Upstream commit 0fbc9b8b4ea3f688a5da141a64f97aa33ad02ae9 ]
+
+This fixes a compilation warning in sysfs.c
+
+drivers/infiniband/hw/mlx4/sysfs.c:360:2: warning: 'strncpy' output may be
+truncated copying 8 bytes from a string of length 31
+[-Wstringop-truncation]
+
+By eliminating the temporary stack buffer.
+
+Signed-off-by: Qian Cai <cai@gmx.us>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx4/sysfs.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
+index e219093d27645..d2da28d613f2c 100644
+--- a/drivers/infiniband/hw/mlx4/sysfs.c
++++ b/drivers/infiniband/hw/mlx4/sysfs.c
+@@ -353,16 +353,12 @@ err:
+
+ static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max)
+ {
+- char base_name[9];
+-
+- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */
+- strlcpy(name, pci_name(dev->dev->persist->pdev), max);
+- strncpy(base_name, name, 8); /*till xxxx:yy:*/
+- base_name[8] = '\0';
+- /* with no ARI only 3 last bits are used so when the fn is higher than 8
++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n
++ * with no ARI only 3 last bits are used so when the fn is higher than 8
+ * need to add it to the dev num, so count in the last number will be
+ * modulo 8 */
+- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8));
++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev),
++ i / 8, i % 8);
+ }
+
+ struct mlx4_port {
+--
+2.20.1
+
--- /dev/null
+From fa203629a01f6791b9b45cc4cac780237e19f56f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 17:44:52 +0000
+Subject: mlxsw: spectrum_router: Relax GRE decap matching check
+
+From: Nir Dotan <nird@mellanox.com>
+
+[ Upstream commit da93d2913fdf43d5cde3c5a53ac9cc29684d5c7c ]
+
+GRE decap offload is configured when local routes prefix correspond to the
+local address of one of the offloaded GRE tunnels. The matching check was
+found to be too strict, such that for a flat GRE configuration, in which
+the overlay and underlay traffic share the same non-default VRF, decap flow
+was not offloaded.
+
+Relax the check for decap flow offloading. A match occurs if the local
+address of the tunnel matches the local route address while both share the
+same VRF table.
+
+Fixes: 4607f6d26950 ("mlxsw: spectrum_router: Support IPv4 underlay decap")
+Signed-off-by: Nir Dotan <nird@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 3f54b3ca38bad..44b6c2ac5961d 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -1215,15 +1215,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp,
+ {
+ u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN;
+ enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt;
+- struct net_device *ipip_ul_dev;
+
+ if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto)
+ return false;
+
+- ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev);
+ return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip,
+- ul_tb_id, ipip_entry) &&
+- (!ipip_ul_dev || ipip_ul_dev == ul_dev);
++ ul_tb_id, ipip_entry);
+ }
+
+ /* Given decap parameters, find the corresponding IPIP entry. */
+--
+2.20.1
+
--- /dev/null
+From 25617f4173b2022deab3b14f9aef2405b8e167fd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 15:08:32 -0800
+Subject: mm/vmstat.c: fix NUMA statistics updates
+
+From: Janne Huttunen <janne.huttunen@nokia.com>
+
+[ Upstream commit 13c9aaf7fa01cc7600c61981609feadeef3354ec ]
+
+Scan through the whole array to see if an update is needed. While we're
+at it, use sizeof() to be safe against any possible type changes in the
+future.
+
+The bug here is that we wouldn't sync per-cpu counters into global ones
+if there was an update of numa_stats for higher cpus. Highly
+theoretical one though because it is much more probable that zone_stats
+are updated so we would refresh anyway. So I wouldn't bother to mark
+this for stable, yet something nice to fix.
+
+[mhocko@suse.com: changelog enhancement]
+Link: http://lkml.kernel.org/r/1541601517-17282-1-git-send-email-janne.huttunen@nokia.com
+Fixes: 1d90ca897cb0 ("mm: update NUMA counter threshold size")
+Signed-off-by: Janne Huttunen <janne.huttunen@nokia.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ mm/vmstat.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index a2b2ea786c9b2..ce81b0a7d0186 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1826,12 +1826,13 @@ static bool need_update(int cpu)
+
+ /*
+ * The fast way of checking if there are any vmstat diffs.
+- * This works because the diffs are byte sized items.
+ */
+- if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS))
++ if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS *
++ sizeof(p->vm_stat_diff[0])))
+ return true;
+ #ifdef CONFIG_NUMA
+- if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS))
++ if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS *
++ sizeof(p->vm_numa_stat_diff[0])))
+ return true;
+ #endif
+ }
+--
+2.20.1
+
--- /dev/null
+From 30283e56a0762e780c81384e4ba58d8cb40aacd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 13:14:13 -0800
+Subject: modpost: skip ELF local symbols during section mismatch check
+
+From: Paul Walmsley <paul.walmsley@sifive.com>
+
+[ Upstream commit a4d26f1a0958bb1c2b60c6f1e67c6f5d43e2647b ]
+
+During development of a serial console driver with a gcc 8.2.0
+toolchain for RISC-V, the following modpost warning appeared:
+
+----
+WARNING: vmlinux.o(.data+0x19b10): Section mismatch in reference from the variable .LANCHOR1 to the function .init.text:sifive_serial_console_setup()
+The variable .LANCHOR1 references
+the function __init sifive_serial_console_setup()
+If the reference is valid then annotate the
+variable with __init* or __refdata (see linux/init.h) or name the variable:
+*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console
+----
+
+".LANCHOR1" is an ELF local symbol, automatically created by gcc's section
+anchor generation code:
+
+https://gcc.gnu.org/onlinedocs/gccint/Anchored-Addresses.html
+
+https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/varasm.c;h=cd9591a45617464946dcf9a126dde277d9de9804;hb=9fb89fa845c1b2e0a18d85ada0b077c84508ab78#l7473
+
+This was verified by compiling the kernel with -fno-section-anchors
+and observing that the ".LANCHOR1" ELF local symbol disappeared, and
+modpost no longer warned about the section mismatch. The serial
+driver code idiom triggering the warning is standard Linux serial
+driver practice that has a specific whitelist inclusion in modpost.c.
+
+I'm neither a modpost nor an ELF expert, but naively, it doesn't seem
+useful for modpost to report section mismatch warnings caused by ELF
+local symbols by default. Local symbols have compiler-generated
+names, and thus bypass modpost's whitelisting algorithm, which relies
+on the presence of a non-autogenerated symbol name. This increases
+the likelihood that false positive warnings will be generated (as in
+the above case).
+
+Thus, disable section mismatch reporting on ELF local symbols. The
+rationale here is similar to that of commit 2e3a10a1551d ("ARM: avoid
+ARM binutils leaking ELF local symbols") and of similar code already
+present in modpost.c:
+
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/mod/modpost.c?h=v4.19-rc4&id=7876320f88802b22d4e2daf7eb027dd14175a0f8#n1256
+
+This third version of the patch implements a suggestion from Masahiro
+Yamada <yamada.masahiro@socionext.com> to restructure the code as an
+additional pattern matching step inside secref_whitelist(), and
+further improves the patch description.
+
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Paul Walmsley <paul@pwsan.com>
+Acked-by: Sam Ravnborg <sam@ravnborg.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/mod/modpost.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 858cbe56b1006..91a80036c05d5 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -1163,6 +1163,14 @@ static const struct sectioncheck *section_mismatch(
+ * fromsec = text section
+ * refsymname = *.constprop.*
+ *
++ * Pattern 6:
++ * Hide section mismatch warnings for ELF local symbols. The goal
++ * is to eliminate false positive modpost warnings caused by
++ * compiler-generated ELF local symbol names such as ".LANCHOR1".
++ * Autogenerated symbol names bypass modpost's "Pattern 2"
++ * whitelisting, which relies on pattern-matching against symbol
++ * names to work. (One situation where gcc can autogenerate ELF
++ * local symbols is when "-fsection-anchors" is used.)
+ **/
+ static int secref_whitelist(const struct sectioncheck *mismatch,
+ const char *fromsec, const char *fromsym,
+@@ -1201,6 +1209,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
+ match(fromsym, optim_symbols))
+ return 0;
+
++ /* Check for pattern 6 */
++ if (strstarts(fromsym, ".L"))
++ return 0;
++
+ return 1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 54135ca9301899b493dda2d7fa6bb3d909742b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Nov 2018 21:18:30 +0100
+Subject: mtd: fix mtd_oobavail() incoherent returned value
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+[ Upstream commit 4348433d8c0234f44adb6e12112e69343f50f0c5 ]
+
+mtd_oobavail() returns either mtd->oovabail or mtd->oobsize. Both
+values are unsigned 32-bit entities, so there is no reason to pretend
+returning a signed one.
+
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mtd/mtd.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
+index cd0be91bdefa5..035d641e8847c 100644
+--- a/include/linux/mtd/mtd.h
++++ b/include/linux/mtd/mtd.h
+@@ -386,7 +386,7 @@ static inline struct device_node *mtd_get_of_node(struct mtd_info *mtd)
+ return dev_of_node(&mtd->dev);
+ }
+
+-static inline int mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops)
++static inline u32 mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops)
+ {
+ return ops->mode == MTD_OPS_AUTO_OOB ? mtd->oobavail : mtd->oobsize;
+ }
+--
+2.20.1
+
--- /dev/null
+From b76436d49caa9567fc602a5992ef10592b944896 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 19:28:05 +0800
+Subject: nds32: Fix the items of hwcap_str ordering issue.
+
+From: Nylon Chen <nylon7@andestech.com>
+
+[ Upstream commit a5234068e6dc18ae5300d678fbf3e129d9b93f78 ]
+
+The hwcap_str should be set in a correct order according to HWCAP_xx.
+We also add the missing "fpu_dp" to it.
+
+Signed-off-by: Nylon Chen <nylon7@andestech.com>
+Acked-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Greentime Hu <greentime@andestech.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nds32/kernel/setup.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/nds32/kernel/setup.c b/arch/nds32/kernel/setup.c
+index 63a1a5ef5219f..87683583f2064 100644
+--- a/arch/nds32/kernel/setup.c
++++ b/arch/nds32/kernel/setup.c
+@@ -71,8 +71,9 @@ static const char *hwcap_str[] = {
+ "div",
+ "mac",
+ "l2c",
+- "dx_regs",
++ "fpu_dp",
+ "v2",
++ "dx_regs",
+ NULL,
+ };
+
+--
+2.20.1
+
--- /dev/null
+From d3e909b4a52fcb2c0f0f72816d6744b3d5c5dfa9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 14:00:11 +0000
+Subject: net: aquantia: fix RSS table and key sizes
+
+From: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+
+[ Upstream commit 474fb1150d40780e71f0b569aeac4f375df3af3d ]
+
+Set RSS indirection table and RSS hash key sizes to their real size.
+
+Signed-off-by: Dmitry Bogdanov <dmitry.bogdanov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_cfg.h | 4 ++--
+ drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+index 91eb8910b1c99..90a0e1d0d6221 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h
+@@ -42,8 +42,8 @@
+ #define AQ_CFG_IS_LRO_DEF 1U
+
+ /* RSS */
+-#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 128U
+-#define AQ_CFG_RSS_HASHKEY_SIZE 320U
++#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 64U
++#define AQ_CFG_RSS_HASHKEY_SIZE 40U
+
+ #define AQ_CFG_IS_RSS_DEF 1U
+ #define AQ_CFG_NUM_RSS_QUEUES_DEF AQ_CFG_VECS_DEF
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index 4f34808f1e064..8cc34b0bedc3a 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -44,7 +44,7 @@ static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues)
+ struct aq_rss_parameters *rss_params = &cfg->aq_rss;
+ int i = 0;
+
+- static u8 rss_key[40] = {
++ static u8 rss_key[AQ_CFG_RSS_HASHKEY_SIZE] = {
+ 0x1e, 0xad, 0x71, 0x87, 0x65, 0xfc, 0x26, 0x7d,
+ 0x0d, 0x45, 0x67, 0x74, 0xcd, 0x06, 0x1a, 0x18,
+ 0xb6, 0xc1, 0xf0, 0xc7, 0xbb, 0x18, 0xbe, 0xf8,
+--
+2.20.1
+
--- /dev/null
+From b44677c021512b1099e86711a590a39b9379a340 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 18:51:01 +0100
+Subject: net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing
+ MII_PHYSID2
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+[ Upstream commit ddc49acb659a2d8bfc5fdb0de0ef197712c11d75 ]
+
+We already have a workaround for a couple of switches whose internal
+PHYs only have the Marvel OUI, but no model number. We detect such
+PHYs and give them the 6390 ID as the model number. However the
+mv88e6161 has two SERDES interfaces in the same address range as its
+internal PHYs. These suffer from the same problem, the Marvell OUI,
+but no model number. As a result, these SERDES interfaces were getting
+the same PHY ID as the mv88e6390, even though they are not PHYs, and
+the Marvell PHY driver was trying to drive them.
+
+Add a special case to stop this from happen.
+
+Reported-by: Chris Healy <Chris.Healy@zii.aero>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 411ae9961bf4f..43b00e8bcdcd7 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -2645,11 +2645,22 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
+ mutex_unlock(&chip->reg_lock);
+
+ if (reg == MII_PHYSID2) {
+- /* Some internal PHYS don't have a model number. Use
+- * the mv88e6390 family model number instead.
+- */
+- if (!(val & 0x3f0))
+- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4;
++ /* Some internal PHYs don't have a model number. */
++ if (chip->info->family != MV88E6XXX_FAMILY_6165)
++ /* Then there is the 6165 family. It gets is
++ * PHYs correct. But it can also have two
++ * SERDES interfaces in the PHY address
++ * space. And these don't have a model
++ * number. But they are not PHYs, so we don't
++ * want to give them something a PHY driver
++ * will recognise.
++ *
++ * Use the mv88e6390 family model number
++ * instead, for anything which really could be
++ * a PHY,
++ */
++ if (!(val & 0x3f0))
++ val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4;
+ }
+
+ return err ? err : val;
+--
+2.20.1
+
--- /dev/null
+From 70096703cf6f7a387611ed89955e0bb19651d8b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 23:43:24 +0800
+Subject: net: ep93xx_eth: fix mismatch of request_mem_region in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 3df70afe8d33f4977d0e0891bdcfb639320b5257 ]
+
+The driver calls release_resource in remove to match request_mem_region
+in probe, which is incorrect.
+Fix it by using the right one, release_mem_region.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/cirrus/ep93xx_eth.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+index 13dfdfca49fc7..edc1d19c9c02e 100644
+--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+@@ -767,6 +767,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ {
+ struct net_device *dev;
+ struct ep93xx_priv *ep;
++ struct resource *mem;
+
+ dev = platform_get_drvdata(pdev);
+ if (dev == NULL)
+@@ -782,8 +783,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev)
+ iounmap(ep->base_addr);
+
+ if (ep->res != NULL) {
+- release_resource(ep->res);
+- kfree(ep->res);
++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ release_mem_region(mem->start, resource_size(mem));
+ }
+
+ free_netdev(dev);
+--
+2.20.1
+
--- /dev/null
+From a0c73b88bc967cceafdbef90fc5ba05c9cd7df4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 16:00:20 +0200
+Subject: net: ethernet: ti: cpts: correct debug for expired txq skb
+
+From: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+
+[ Upstream commit d0e14c4d9bcef0d4aa1057d2959adaa6f18d4a17 ]
+
+The msgtype and seqid that is smth that belongs to event for
+comparison but not for staled txq skb.
+
+Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ti/cpts.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
+index 4f644ac314fe8..d7543811dfae2 100644
+--- a/drivers/net/ethernet/ti/cpts.c
++++ b/drivers/net/ethernet/ti/cpts.c
+@@ -119,9 +119,7 @@ static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event)
+
+ if (time_after(jiffies, skb_cb->tmo)) {
+ /* timeout any expired skbs over 1s */
+- dev_dbg(cpts->dev,
+- "expiring tx timestamp mtype %u seqid %04x\n",
+- mtype, seqid);
++ dev_dbg(cpts->dev, "expiring tx timestamp from txq\n");
+ __skb_unlink(skb, &cpts->txq);
+ dev_consume_skb_any(skb);
+ }
+--
+2.20.1
+
--- /dev/null
+From 44333da9e6051b94b50be2fceec165a165754761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 21:52:33 +0800
+Subject: net/ipv6: re-do dad when interface has IFF_NOARP flag change
+
+From: Hangbin Liu <liuhangbin@gmail.com>
+
+[ Upstream commit 896585d48e8e9ba44cd1754fbce8537feffcc1a5 ]
+
+When we add a new IPv6 address, we should also join corresponding solicited-node
+multicast address, unless the interface has IFF_NOARP flag, as function
+addrconf_join_solict() did. But if we remove IFF_NOARP flag later, we do
+not do dad and add the mcast address. So we will drop corresponding neighbour
+discovery message that came from other nodes.
+
+A typical example is after creating a ipvlan with mode l3, setting up an ipv6
+address and changing the mode to l2. Then we will not be able to ping this
+address as the interface doesn't join related solicited-node mcast address.
+
+Fix it by re-doing dad when interface changed IFF_NOARP flag. Then we will add
+corresponding mcast group and check if there is a duplicate address on the
+network.
+
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index d2968a79abea8..ef309a26aba0f 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -179,7 +179,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp);
+ static void addrconf_dad_work(struct work_struct *w);
+ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
+ bool send_na);
+-static void addrconf_dad_run(struct inet6_dev *idev);
++static void addrconf_dad_run(struct inet6_dev *idev, bool restart);
+ static void addrconf_rs_timer(struct timer_list *t);
+ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
+ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
+@@ -3424,6 +3424,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ void *ptr)
+ {
+ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct netdev_notifier_change_info *change_info;
+ struct netdev_notifier_changeupper_info *info;
+ struct inet6_dev *idev = __in6_dev_get(dev);
+ struct net *net = dev_net(dev);
+@@ -3498,7 +3499,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ break;
+ }
+
+- if (idev) {
++ if (!IS_ERR_OR_NULL(idev)) {
+ if (idev->if_flags & IF_READY) {
+ /* device is already configured -
+ * but resend MLD reports, we might
+@@ -3506,6 +3507,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+ * multicast snooping switches
+ */
+ ipv6_mc_up(idev);
++ change_info = ptr;
++ if (change_info->flags_changed & IFF_NOARP)
++ addrconf_dad_run(idev, true);
+ rt6_sync_up(dev, RTNH_F_LINKDOWN);
+ break;
+ }
+@@ -3540,7 +3544,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
+
+ if (!IS_ERR_OR_NULL(idev)) {
+ if (run_pending)
+- addrconf_dad_run(idev);
++ addrconf_dad_run(idev, false);
+
+ /* Device has an address by now */
+ rt6_sync_up(dev, RTNH_F_DEAD);
+@@ -4158,16 +4162,19 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id,
+ addrconf_verify_rtnl();
+ }
+
+-static void addrconf_dad_run(struct inet6_dev *idev)
++static void addrconf_dad_run(struct inet6_dev *idev, bool restart)
+ {
+ struct inet6_ifaddr *ifp;
+
+ read_lock_bh(&idev->lock);
+ list_for_each_entry(ifp, &idev->addr_list, if_list) {
+ spin_lock(&ifp->lock);
+- if (ifp->flags & IFA_F_TENTATIVE &&
+- ifp->state == INET6_IFADDR_STATE_DAD)
++ if ((ifp->flags & IFA_F_TENTATIVE &&
++ ifp->state == INET6_IFADDR_STATE_DAD) || restart) {
++ if (restart)
++ ifp->state = INET6_IFADDR_STATE_PREDAD;
+ addrconf_dad_kick(ifp);
++ }
+ spin_unlock(&ifp->lock);
+ }
+ read_unlock_bh(&idev->lock);
+--
+2.20.1
+
--- /dev/null
+From f80d0d1e49065d1d58cb775d381bf8cd14a3b5bb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 2 Dec 2018 17:40:25 +0200
+Subject: net/mlx4_core: Fix return codes of unsupported operations
+
+From: Erez Alfasi <ereza@mellanox.com>
+
+[ Upstream commit 95aac2cdafd8c8298c9b2589c52f44db0d824e0e ]
+
+Functions __set_port_type and mlx4_check_port_params returned
+-EINVAL while the proper return code is -EOPNOTSUPP as a
+result of an unsupported operation. All drivers should generate
+this and all users should check for it when detecting an
+unsupported functionality.
+
+Signed-off-by: Erez Alfasi <ereza@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/main.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 6a046030e8734..4afe56a6eedfb 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -313,7 +313,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev,
+ for (i = 0; i < dev->caps.num_ports - 1; i++) {
+ if (port_type[i] != port_type[i + 1]) {
+ mlx4_err(dev, "Only same port types supported on this HCA, aborting\n");
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+ }
+ }
+@@ -322,7 +322,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev,
+ if (!(port_type[i] & dev->caps.supported_type[i+1])) {
+ mlx4_err(dev, "Requested port type for port %d is not supported on this HCA\n",
+ i + 1);
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+ }
+ return 0;
+@@ -1188,8 +1188,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ mlx4_err(mdev,
+ "Requested port type for port %d is not supported on this HCA\n",
+ info->port);
+- err = -EINVAL;
+- goto err_sup;
++ return -EOPNOTSUPP;
+ }
+
+ mlx4_stop_sense(mdev);
+@@ -1211,7 +1210,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ for (i = 1; i <= mdev->caps.num_ports; i++) {
+ if (mdev->caps.possible_type[i] == MLX4_PORT_TYPE_AUTO) {
+ mdev->caps.possible_type[i] = mdev->caps.port_type[i];
+- err = -EINVAL;
++ err = -EOPNOTSUPP;
+ }
+ }
+ }
+@@ -1237,7 +1236,7 @@ static int __set_port_type(struct mlx4_port_info *info,
+ out:
+ mlx4_start_sense(mdev);
+ mutex_unlock(&priv->port_mutex);
+-err_sup:
++
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From be5993a8d4205f69fc92d69c87ff0634920603eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 21:10:08 +0200
+Subject: net/mlx5: Release resource on error flow
+
+From: Moni Shoua <monis@mellanox.com>
+
+[ Upstream commit 698114968a22f6c0c9f42e983ba033cc36bb7217 ]
+
+Fix reference counting leakage when the event handler aborts due to an
+unsupported event for the resource type.
+
+Fixes: a14c2d4beee5 ("net/mlx5_core: Warn on unsupported events of QP/RQ/SQ")
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/qp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+index 4ca07bfb6b14f..f33707ce8b6b0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+@@ -132,7 +132,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
+ if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) {
+ mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n",
+ event_type, rsn);
+- return;
++ goto out;
+ }
+
+ switch (common->res) {
+@@ -150,7 +150,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type)
+ default:
+ mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn);
+ }
+-
++out:
+ mlx5_core_put_rsc(common);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3b7c963591bf8518cd975e726cf63445b00aa4f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 05:47:34 +0000
+Subject: net-next/hinic: fix a bug in rx data flow
+
+From: Xue Chaojing <xuechaojing@huawei.com>
+
+[ Upstream commit b1a200484143a727ce293e0f200a543cc7584152 ]
+
+In rx_alloc_pkts(), there is a loop call of tasklet, which causes
+100% cpu utilization, even no packets are being received. This patch
+fixes this bug.
+
+Signed-off-by: Xue Chaojing <xuechaojing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/huawei/hinic/hinic_rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_rx.c b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+index 4c0f7eda1166c..06b24a92ed7d4 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_rx.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_rx.c
+@@ -207,9 +207,9 @@ skb_out:
+ wmb(); /* write all the wqes before update PI */
+
+ hinic_rq_update(rxq->rq, prod_idx);
++ tasklet_schedule(&rxq->rx_task);
+ }
+
+- tasklet_schedule(&rxq->rx_task);
+ return i;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a8815fd856a8a48f27c457fda90b59599ee25424 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 05:47:33 +0000
+Subject: net-next/hinic:fix a bug in set mac address
+
+From: Xue Chaojing <xuechaojing@huawei.com>
+
+[ Upstream commit 9ea72dc9430306b77c73a8a21beb51437cde1d6d ]
+
+In add_mac_addr(), if the MAC address is a muliticast address,
+it will not be set, which causes the network card fail to receive
+the multicast packet. This patch fixes this bug.
+
+Signed-off-by: Xue Chaojing <xuechaojing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/huawei/hinic/hinic_main.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+index 4a8f82938ed5b..2352046971a4e 100644
+--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c
++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c
+@@ -600,9 +600,6 @@ static int add_mac_addr(struct net_device *netdev, const u8 *addr)
+ u16 vid = 0;
+ int err;
+
+- if (!is_valid_ether_addr(addr))
+- return -EADDRNOTAVAIL;
+-
+ netif_info(nic_dev, drv, netdev, "set mac addr = %02x %02x %02x %02x %02x %02x\n",
+ addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
+
+@@ -726,6 +723,7 @@ static void set_rx_mode(struct work_struct *work)
+ {
+ struct hinic_rx_mode_work *rx_mode_work = work_to_rx_mode_work(work);
+ struct hinic_dev *nic_dev = rx_mode_work_to_nic_dev(rx_mode_work);
++ struct netdev_hw_addr *ha;
+
+ netif_info(nic_dev, drv, nic_dev->netdev, "set rx mode work\n");
+
+@@ -733,6 +731,9 @@ static void set_rx_mode(struct work_struct *work)
+
+ __dev_uc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr);
+ __dev_mc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr);
++
++ netdev_for_each_mc_addr(ha, nic_dev->netdev)
++ add_mac_addr(nic_dev->netdev, ha->addr);
+ }
+
+ static void hinic_set_rx_mode(struct net_device *netdev)
+--
+2.20.1
+
--- /dev/null
+From 3e60467009d0a59ce23722e8c4957717701e93d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Nov 2018 15:03:02 +0000
+Subject: net: qualcomm: rmnet: move null check on dev before dereferecing it
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 3c18aa1464f9232d6abac8d7b4540f61b0658d62 ]
+
+Currently dev is dereferenced by the call dev_net(dev) before dev is null
+checked. Fix this by null checking dev before the potential null
+pointer dereference.
+
+Detected by CoverityScan, CID#1462955 ("Dereference before null check")
+
+Fixes: 23790ef12082 ("net: qualcomm: rmnet: Allow to configure flags for existing devices")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+index f66d1255e36a2..4c476fac78358 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+@@ -301,10 +301,13 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct rmnet_port *port;
+ u16 mux_id;
+
++ if (!dev)
++ return -ENODEV;
++
+ real_dev = __dev_get_by_index(dev_net(dev),
+ nla_get_u32(tb[IFLA_LINK]));
+
+- if (!real_dev || !dev || !rmnet_is_real_dev_registered(real_dev))
++ if (!real_dev || !rmnet_is_real_dev_registered(real_dev))
+ return -ENODEV;
+
+ port = rmnet_get_port_rtnl(real_dev);
+--
+2.20.1
+
--- /dev/null
+From da611f3622279fb3286da8580cff535402034661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Nov 2018 16:46:43 +0100
+Subject: net/smc: use after free fix in smc_wr_tx_put_slot()
+
+From: Ursula Braun <ursula.braun@linux.ibm.com>
+
+[ Upstream commit e438bae43c1e08e688c09c410407b59fc1c173b4 ]
+
+In smc_wr_tx_put_slot() field pend->idx is used after being
+cleared. That means always idx 0 is cleared in the wr_tx_mask.
+This results in a broken administration of available WR send
+payload buffers.
+
+Signed-off-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/smc/smc_wr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c
+index 3c458d2798557..c2694750a6a8a 100644
+--- a/net/smc/smc_wr.c
++++ b/net/smc/smc_wr.c
+@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link,
+
+ pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv);
+ if (pend->idx < link->wr_tx_cnt) {
++ u32 idx = pend->idx;
++
+ /* clear the full struct smc_wr_tx_pend including .priv */
+ memset(&link->wr_tx_pends[pend->idx], 0,
+ sizeof(link->wr_tx_pends[pend->idx]));
+ memset(&link->wr_tx_bufs[pend->idx], 0,
+ sizeof(link->wr_tx_bufs[pend->idx]));
+- test_and_clear_bit(pend->idx, link->wr_tx_mask);
++ test_and_clear_bit(idx, link->wr_tx_mask);
+ return 1;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2b613fc891d56bc0a6bbf74c247d6be27f980f20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 09:50:27 +0100
+Subject: net/x25: fix called/calling length calculation in
+ x25_parse_address_block
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit d449ba3d581ed29f751a59792fdc775572c66904 ]
+
+The length of the called and calling address was not calculated
+correctly (BCD encoding).
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index f7f53f9ae7efb..3150648206b68 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb,
+ }
+
+ len = *skb->data;
+- needed = 1 + (len >> 4) + (len & 0x0f);
++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2;
+
+ if (!pskb_may_pull(skb, needed)) {
+ /* packet is too short to hold the addresses it claims
+--
+2.20.1
+
--- /dev/null
+From e6f6253ad16bcbc002cf526e4155daf7abc1a040 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 09:50:28 +0100
+Subject: net/x25: fix null_x25_address handling
+
+From: Martin Schiller <ms@dev.tdt.de>
+
+[ Upstream commit 06137619f061f498c2924f6543fa45b7d39f0501 ]
+
+o x25_find_listener(): the compare for the null_x25_address was wrong.
+ We have to check the x25_addr of the listener socket instead of the
+ x25_addr of the incomming call.
+
+ o x25_bind(): it was not possible to bind a socket to null_x25_address
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/x25/af_x25.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 3150648206b68..20a511398389d 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr,
+ sk_for_each(s, &x25_list)
+ if ((!strcmp(addr->x25_addr,
+ x25_sk(s)->source_addr.x25_addr) ||
+- !strcmp(addr->x25_addr,
++ !strcmp(x25_sk(s)->source_addr.x25_addr,
+ null_x25_address.x25_addr)) &&
+ s->sk_state == TCP_LISTEN) {
+ /*
+@@ -685,11 +685,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ goto out;
+ }
+
+- len = strlen(addr->sx25_addr.x25_addr);
+- for (i = 0; i < len; i++) {
+- if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+- rc = -EINVAL;
+- goto out;
++ /* check for the null_x25_address */
++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
++
++ len = strlen(addr->sx25_addr.x25_addr);
++ for (i = 0; i < len; i++) {
++ if (!isdigit(addr->sx25_addr.x25_addr[i])) {
++ rc = -EINVAL;
++ goto out;
++ }
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 81e4fbfe4939b66c52a3e0d0106e5c1893449ef0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 4 Nov 2018 12:07:14 +0100
+Subject: netfilter: nf_tables: don't use position attribute on rule
+ replacement
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 447750f281abef547be44fdcfe3bc4447b3115a8 ]
+
+Its possible to set both HANDLE and POSITION when replacing a rule.
+In this case, the rule at POSITION gets replaced using the
+userspace-provided handle. Rule handles are supposed to be generated
+by the kernel only.
+
+Duplicate handles should be harmless, however better disable this "feature"
+by only checking for the POSITION attribute on insert operations.
+
+Fixes: 5e94846686d0 ("netfilter: nf_tables: add insert operation")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index ec0f8b5bde0aa..0e1b1f7f4745e 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -2610,17 +2610,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,
+
+ if (chain->use == UINT_MAX)
+ return -EOVERFLOW;
+- }
+-
+- if (nla[NFTA_RULE_POSITION]) {
+- if (!(nlh->nlmsg_flags & NLM_F_CREATE))
+- return -EOPNOTSUPP;
+
+- pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
+- old_rule = __nft_rule_lookup(chain, pos_handle);
+- if (IS_ERR(old_rule)) {
+- NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
+- return PTR_ERR(old_rule);
++ if (nla[NFTA_RULE_POSITION]) {
++ pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION]));
++ old_rule = __nft_rule_lookup(chain, pos_handle);
++ if (IS_ERR(old_rule)) {
++ NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]);
++ return PTR_ERR(old_rule);
++ }
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ec0b0897e5c549daada6eb2ddb55d5db3b8441e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 10 Nov 2019 17:19:15 +0100
+Subject: NFC: nxp-nci: Fix NULL pointer dereference after I2C communication
+ error
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit a71a29f50de1ef97ab55c151a1598eb12dde379d ]
+
+I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci
+result in a NULL pointer dereference at the moment:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ Oops: 0002 [#1] PREEMPT SMP NOPTI
+ CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1
+ RIP: 0010:skb_queue_tail+0x25/0x50
+ Call Trace:
+ nci_recv_frame+0x36/0x90 [nci]
+ nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c]
+ ? preempt_count_add+0x68/0xa0
+ ? irq_forced_thread_fn+0x80/0x80
+ irq_thread_fn+0x20/0x60
+ irq_thread+0xee/0x180
+ ? wake_threads_waitq+0x30/0x30
+ kthread+0xfb/0x130
+ ? irq_thread_check_affinity+0xd0/0xd0
+ ? kthread_park+0x90/0x90
+ ret_from_fork+0x1f/0x40
+
+Afterward the kernel must be rebooted to work properly again.
+
+This happens because it attempts to call nci_recv_frame() with skb == NULL.
+However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any
+NULL checks for skb, causing the NULL pointer dereference.
+
+Change the code to call only nxp_nci_fw_recv_frame() in case of an error.
+Make sure to log it so it is obvious that a communication error occurred.
+The error above then becomes:
+
+ nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
+ nci: __nci_request: wait_for_completion_interruptible_timeout failed 0
+ nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121
+
+Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/nxp-nci/i2c.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c
+index ba695e392c3b7..0df745cad601a 100644
+--- a/drivers/nfc/nxp-nci/i2c.c
++++ b/drivers/nfc/nxp-nci/i2c.c
+@@ -236,8 +236,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id)
+
+ if (r == -EREMOTEIO) {
+ phy->hard_fault = r;
+- skb = NULL;
+- } else if (r < 0) {
++ if (info->mode == NXP_NCI_MODE_FW)
++ nxp_nci_fw_recv_frame(phy->ndev, NULL);
++ }
++ if (r < 0) {
+ nfc_err(&client->dev, "Read failed with error %d\n", r);
+ goto exit_irq_handled;
+ }
+--
+2.20.1
+
--- /dev/null
+From 83fde08274c0927d0e1544fb723a7fd446e9acf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Nov 2018 13:35:08 -0500
+Subject: nfsd: fix a warning in __cld_pipe_upcall()
+
+From: Scott Mayhew <smayhew@redhat.com>
+
+[ Upstream commit b493fd31c0b89d9453917e977002de58bebc3802 ]
+
+__cld_pipe_upcall() emits a "do not call blocking ops when
+!TASK_RUNNING" warning due to the dput() call in rpc_queue_upcall().
+Fix it by using a completion instead of hand coding the wait.
+
+Signed-off-by: Scott Mayhew <smayhew@redhat.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4recover.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
+index 9c247fa1e9594..5188f9f70c78c 100644
+--- a/fs/nfsd/nfs4recover.c
++++ b/fs/nfsd/nfs4recover.c
+@@ -662,7 +662,7 @@ struct cld_net {
+ struct cld_upcall {
+ struct list_head cu_list;
+ struct cld_net *cu_net;
+- struct task_struct *cu_task;
++ struct completion cu_done;
+ struct cld_msg cu_msg;
+ };
+
+@@ -671,23 +671,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg)
+ {
+ int ret;
+ struct rpc_pipe_msg msg;
++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg);
+
+ memset(&msg, 0, sizeof(msg));
+ msg.data = cmsg;
+ msg.len = sizeof(*cmsg);
+
+- /*
+- * Set task state before we queue the upcall. That prevents
+- * wake_up_process in the downcall from racing with schedule.
+- */
+- set_current_state(TASK_UNINTERRUPTIBLE);
+ ret = rpc_queue_upcall(pipe, &msg);
+ if (ret < 0) {
+- set_current_state(TASK_RUNNING);
+ goto out;
+ }
+
+- schedule();
++ wait_for_completion(&cup->cu_done);
+
+ if (msg.errno < 0)
+ ret = msg.errno;
+@@ -754,7 +749,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
+ if (copy_from_user(&cup->cu_msg, src, mlen) != 0)
+ return -EFAULT;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ return mlen;
+ }
+
+@@ -769,7 +764,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
+ if (msg->errno >= 0)
+ return;
+
+- wake_up_process(cup->cu_task);
++ complete(&cup->cu_done);
+ }
+
+ static const struct rpc_pipe_ops cld_upcall_ops = {
+@@ -900,7 +895,7 @@ restart_search:
+ goto restart_search;
+ }
+ }
+- new->cu_task = current;
++ init_completion(&new->cu_done);
+ new->cu_msg.cm_vers = CLD_UPCALL_VERSION;
+ put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid);
+ new->cu_net = cn;
+--
+2.20.1
+
--- /dev/null
+From 5223dbb0e6e3b58b23f76bec75cf3372a450e835 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Nov 2018 16:04:25 +0800
+Subject: nfsd: Return EPERM, not EACCES, in some SETATTR cases
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 255fbca65137e25b12bced18ec9a014dc77ecda0 ]
+
+As the man(2) page for utime/utimes states, EPERM is returned when the
+second parameter of utime or utimes is not NULL, the caller's effective UID
+does not match the owner of the file, and the caller is not privileged.
+
+However, in a NFS directory mounted from knfsd, it will return EACCES
+(from nfsd_setattr-> fh_verify->nfsd_permission). This patch fixes
+that.
+
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/vfs.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index b53e76391e525..4fe8db3149506 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -396,10 +396,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap,
+ bool get_write_count;
+ bool size_change = (iap->ia_valid & ATTR_SIZE);
+
+- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE))
++ if (iap->ia_valid & ATTR_SIZE) {
+ accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE;
+- if (iap->ia_valid & ATTR_SIZE)
+ ftype = S_IFREG;
++ }
++
++ /*
++ * If utimes(2) and friends are called with times not NULL, we should
++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission
++ * will return EACCESS, when the caller's effective UID does not match
++ * the owner of the file, and the caller is not privileged. In this
++ * situation, we should return EPERM(notify_change will return this).
++ */
++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) {
++ accmode |= NFSD_MAY_OWNER_OVERRIDE;
++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET)))
++ accmode |= NFSD_MAY_WRITE;
++ }
+
+ /* Callers that do fh_verify should do the fh_want_write: */
+ get_write_count = !fhp->fh_dentry;
+--
+2.20.1
+
--- /dev/null
+From c1b471a8b55d1a079d1ca9960dbb90b1ba158748 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 16:39:47 -0700
+Subject: nvme: Free ctrl device name on init failure
+
+From: Keith Busch <keith.busch@intel.com>
+
+[ Upstream commit d6a2b9535d1e52bea269c138614c4801469d10e1 ]
+
+Free the kobject name that was allocated for the controller device on
+failure rather than its parent.
+
+Fixes: d22524a4782a9 ("nvme: switch controller refcounting to use struct device")
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index c4ff4f079448e..b2d9bd564960a 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3652,7 +3652,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+
+ return 0;
+ out_free_name:
+- kfree_const(dev->kobj.name);
++ kfree_const(ctrl->device->kobj.name);
+ out_release_instance:
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ out:
+--
+2.20.1
+
--- /dev/null
+From 624244767be86fcdcc74984b64aa64123d37be85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 09:57:02 +0200
+Subject: perf/core: Consistently fail fork on allocation failures
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+[ Upstream commit 697d877849d4b34ab58d7078d6930bad0ef6fc66 ]
+
+Commit:
+
+ 313ccb9615948 ("perf: Allocate context task_ctx_data for child event")
+
+makes the inherit path skip over the current event in case of task_ctx_data
+allocation failure. This, however, is inconsistent with allocation failures
+in perf_event_alloc(), which would abort the fork.
+
+Correct this by returning an error code on task_ctx_data allocation
+failure and failing the fork in that case.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Link: https://lkml.kernel.org/r/20191105075702.60319-1-alexander.shishkin@linux.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 625ba462e5bbd..460d5fd3ec4e4 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -11377,7 +11377,7 @@ inherit_event(struct perf_event *parent_event,
+ GFP_KERNEL);
+ if (!child_ctx->task_ctx_data) {
+ free_event(child_event);
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f7cc8ed4df0f7ba6d4bb9e12c230849d4e531ed9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Nov 2018 20:34:11 -0500
+Subject: pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit 7ed07855773814337b9814f1c3e866df52ebce68 ]
+
+When attempting to setup up a gpio hog, device probing will repeatedly
+fail with -EPROBE_DEFERED errors. It is caused by a circular dependency
+between the gpio and pinctrl frameworks. If the gpio-ranges property is
+present in device tree, then the gpio framework will handle the gpio pin
+registration and eliminate the circular dependency.
+
+See Christian Lamparter's commit a86caa9ba5d7 ("pinctrl: msm: fix
+gpio-hog related boot issues") for a detailed commit message that
+explains the issue in much more detail. The code comment in this commit
+came from Christian's commit.
+
+I did not test this change against any hardware supported by this
+particular driver, however I was able to validate this same fix works
+for pinctrl-spmi-gpio.c using a LG Nexus 5 (hammerhead) phone.
+
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+index 0e153bae322ee..6bed433e54205 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c
+@@ -762,12 +762,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = gpiochip_add_pin_range(&pctrl->chip,
+- dev_name(pctrl->dev),
+- 0, 0, pctrl->chip.ngpio);
+- if (ret) {
+- dev_err(pctrl->dev, "failed to add pin range\n");
+- goto unregister_gpiochip;
++ /*
++ * For DeviceTree-supported systems, the gpio core checks the
++ * pinctrl's device node for the "gpio-ranges" property.
++ * If it is present, it takes care of adding the pin ranges
++ * for the driver. In this case the driver can skip ahead.
++ *
++ * In order to remain compatible with older, existing DeviceTree
++ * files which don't set the "gpio-ranges" property or systems that
++ * utilize ACPI the driver has to call gpiochip_add_pin_range().
++ */
++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) {
++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev),
++ 0, 0, pctrl->chip.ngpio);
++ if (ret) {
++ dev_err(pctrl->dev, "failed to add pin range\n");
++ goto unregister_gpiochip;
++ }
+ }
+
+ platform_set_drvdata(pdev, pctrl);
+--
+2.20.1
+
--- /dev/null
+From 2baff95354561ef666795650ddb5668b83c8be3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 17:07:25 +0100
+Subject: pinctrl: sh-pfc: r8a7792: Fix VIN versioned groups
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 11c8f8df85e77329d5a3cacc08682722cb80b95b ]
+
+Versioned VIN groups can appear on different sets of pins. Using the
+VIN_DATA_PIN_GROUP macro now supports proper naming of said groups
+through an optional 'version' argument.
+
+Use the 'version' argument for said macro to fix naming of versioned
+groups for the R-Car V2H R8A7792 SoC.
+
+Fixes: 7dd74bb1f058 ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+index cc3597f66605a..b3814ca009b02 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+@@ -1747,10 +1747,10 @@ static const struct sh_pfc_pin_group pinmux_groups[] = {
+ VIN_DATA_PIN_GROUP(vin1_data, 12),
+ VIN_DATA_PIN_GROUP(vin1_data, 10),
+ VIN_DATA_PIN_GROUP(vin1_data, 8),
+- VIN_DATA_PIN_GROUP(vin1_data_b, 24),
+- VIN_DATA_PIN_GROUP(vin1_data_b, 20),
++ VIN_DATA_PIN_GROUP(vin1_data, 24, _b),
++ VIN_DATA_PIN_GROUP(vin1_data, 20, _b),
+ SH_PFC_PIN_GROUP(vin1_data18_b),
+- VIN_DATA_PIN_GROUP(vin1_data_b, 16),
++ VIN_DATA_PIN_GROUP(vin1_data, 16, _b),
+ SH_PFC_PIN_GROUP(vin1_sync),
+ SH_PFC_PIN_GROUP(vin1_field),
+ SH_PFC_PIN_GROUP(vin1_clkenb),
+--
+2.20.1
+
--- /dev/null
+From 7050fc57818e96eab2e6a7f0d456e2c53542616c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 17:07:26 +0100
+Subject: pinctrl: sh-pfc: r8a7795: Fix VIN versioned groups
+
+From: Jacopo Mondi <jacopo+renesas@jmondi.org>
+
+[ Upstream commit 184844ccda4138402846bf4b42c28ac5f16a458a ]
+
+Versioned VIN groups can appear on different sets of pins. Using the
+VIN_DATA_PIN_GROUP macro now supports proper naming of said groups
+through an optional 'version' argument.
+
+Use the 'version' argument for said macro to fix naming of versioned
+groups for the R-Car H3 R8A7795 SoC.
+
+Fixes: 9942a5b52990 ("pinctrl: sh-pfc: r8a7795: Deduplicate VIN4 pin definitions")
+Signed-off-by: Jacopo Mondi <jacopo+renesas@jmondi.org>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7795.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
+index 4f55b1562ad48..2893e3b05ff38 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
+@@ -4477,20 +4477,20 @@ static const struct sh_pfc_pin_group pinmux_groups[] = {
+ SH_PFC_PIN_GROUP(usb2),
+ SH_PFC_PIN_GROUP(usb2_ch3),
+ SH_PFC_PIN_GROUP(usb30),
+- VIN_DATA_PIN_GROUP(vin4_data_a, 8),
+- VIN_DATA_PIN_GROUP(vin4_data_a, 10),
+- VIN_DATA_PIN_GROUP(vin4_data_a, 12),
+- VIN_DATA_PIN_GROUP(vin4_data_a, 16),
++ VIN_DATA_PIN_GROUP(vin4_data, 8, _a),
++ VIN_DATA_PIN_GROUP(vin4_data, 10, _a),
++ VIN_DATA_PIN_GROUP(vin4_data, 12, _a),
++ VIN_DATA_PIN_GROUP(vin4_data, 16, _a),
+ SH_PFC_PIN_GROUP(vin4_data18_a),
+- VIN_DATA_PIN_GROUP(vin4_data_a, 20),
+- VIN_DATA_PIN_GROUP(vin4_data_a, 24),
+- VIN_DATA_PIN_GROUP(vin4_data_b, 8),
+- VIN_DATA_PIN_GROUP(vin4_data_b, 10),
+- VIN_DATA_PIN_GROUP(vin4_data_b, 12),
+- VIN_DATA_PIN_GROUP(vin4_data_b, 16),
++ VIN_DATA_PIN_GROUP(vin4_data, 20, _a),
++ VIN_DATA_PIN_GROUP(vin4_data, 24, _a),
++ VIN_DATA_PIN_GROUP(vin4_data, 8, _b),
++ VIN_DATA_PIN_GROUP(vin4_data, 10, _b),
++ VIN_DATA_PIN_GROUP(vin4_data, 12, _b),
++ VIN_DATA_PIN_GROUP(vin4_data, 16, _b),
+ SH_PFC_PIN_GROUP(vin4_data18_b),
+- VIN_DATA_PIN_GROUP(vin4_data_b, 20),
+- VIN_DATA_PIN_GROUP(vin4_data_b, 24),
++ VIN_DATA_PIN_GROUP(vin4_data, 20, _b),
++ VIN_DATA_PIN_GROUP(vin4_data, 24, _b),
+ SH_PFC_PIN_GROUP(vin4_sync),
+ SH_PFC_PIN_GROUP(vin4_field),
+ SH_PFC_PIN_GROUP(vin4_clkenb),
+--
+2.20.1
+
--- /dev/null
+From a26bd962f82086c0ae58fa13fbff0aece22cf9db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 09:37:46 +1030
+Subject: powerpc/math-emu: Update macros from GCC
+
+From: Joel Stanley <joel@jms.id.au>
+
+[ Upstream commit b682c8692442711684befe413cf93cf01c5324ea ]
+
+The add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros originate
+from GCC's longlong.h which in turn was copied from GMP's longlong.h a
+few decades ago.
+
+This was found when compiling with clang:
+
+ arch/powerpc/math-emu/fnmsub.c:46:2: error: invalid use of a cast in a
+ inline asm context requiring an l-value: remove the cast or build with
+ -fheinous-gnu-extensions
+ FP_ADD_D(R, T, B);
+ ^~~~~~~~~~~~~~~~~
+ ...
+
+ ./arch/powerpc/include/asm/sfp-machine.h:283:27: note: expanded from
+ macro 'sub_ddmmss'
+ : "=r" ((USItype)(sh)), \
+ ~~~~~~~~~~^~~
+
+Segher points out: this was fixed in GCC over 16 years ago
+( https://gcc.gnu.org/r56600 ), and in GMP (where it comes from)
+presumably before that.
+
+Update the add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros to
+the latest GCC version in order to git rid of the invalid casts. These
+were taken as-is from GCC's longlong in order to make future syncs
+obvious. Other parts of sfp-machine.h were left as-is as the file
+contains more features than present in longlong.h.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/260
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/sfp-machine.h | 92 ++++++++------------------
+ 1 file changed, 29 insertions(+), 63 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h
+index d89beaba26ff9..8b957aabb826d 100644
+--- a/arch/powerpc/include/asm/sfp-machine.h
++++ b/arch/powerpc/include/asm/sfp-machine.h
+@@ -213,30 +213,18 @@
+ * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow
+ * (i.e. carry out) is not stored anywhere, and is lost.
+ */
+-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\
+ else \
+- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "%r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "%r" ((USItype)(al)), \
+- "rI" ((USItype)(bl))); \
++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \
++ : "=r" (sh), "=&r" (sl) \
++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \
+ } while (0)
+
+ /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to
+@@ -248,44 +236,24 @@
+ * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere,
+ * and is lost.
+ */
+-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \
+ do { \
+ if (__builtin_constant_p (ah) && (ah) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\
+ else if (__builtin_constant_p (bh) && (bh) == 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
+- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \
+- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \
++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \
++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\
+ else \
+- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
+- : "=r" ((USItype)(sh)), \
+- "=&r" ((USItype)(sl)) \
+- : "r" ((USItype)(ah)), \
+- "r" ((USItype)(bh)), \
+- "rI" ((USItype)(al)), \
+- "r" ((USItype)(bl))); \
++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \
++ : "=r" (sh), "=&r" (sl) \
++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \
+ } while (0)
+
+ /* asm fragments for mul and div */
+@@ -294,13 +262,10 @@
+ * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype
+ * word product in HIGH_PROD and LOW_PROD.
+ */
+-#define umul_ppmm(ph, pl, m0, m1) \
++#define umul_ppmm(ph, pl, m0, m1) \
+ do { \
+ USItype __m0 = (m0), __m1 = (m1); \
+- __asm__ ("mulhwu %0,%1,%2" \
+- : "=r" ((USItype)(ph)) \
+- : "%r" (__m0), \
+- "r" (__m1)); \
++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \
+ (pl) = __m0 * __m1; \
+ } while (0)
+
+@@ -312,9 +277,10 @@
+ * significant bit of DENOMINATOR must be 1, then the pre-processor symbol
+ * UDIV_NEEDS_NORMALIZATION is defined to 1.
+ */
+-#define udiv_qrnnd(q, r, n1, n0, d) \
++#define udiv_qrnnd(q, r, n1, n0, d) \
+ do { \
+- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \
++ UWtype __d1, __d0, __q1, __q0; \
++ UWtype __r1, __r0, __m; \
+ __d1 = __ll_highpart (d); \
+ __d0 = __ll_lowpart (d); \
+ \
+@@ -325,7 +291,7 @@
+ if (__r1 < __m) \
+ { \
+ __q1--, __r1 += (d); \
+- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \
++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\
+ if (__r1 < __m) \
+ __q1--, __r1 += (d); \
+ } \
+--
+2.20.1
+
--- /dev/null
+From 6ac30cfb01d0369e035d566346c3cca218f930c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Dec 2018 16:39:01 -0800
+Subject: pstore/ram: Avoid NULL deref in ftrace merging failure path
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit 8665569e97dd52920713b95675409648986b5b0d ]
+
+Given corruption in the ftrace records, it might be possible to allocate
+tmp_prz without assigning prz to it, but still marking it as needing to
+be freed, which would cause at least a NULL dereference.
+
+smatch warnings:
+fs/pstore/ram.c:340 ramoops_pstore_read() error: we previously assumed 'prz' could be null (see line 255)
+
+https://lists.01.org/pipermail/kbuild-all/2018-December/055528.html
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: 2fbea82bbb89 ("pstore: Merge per-CPU ftrace records into one")
+Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/pstore/ram.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c
+index 015d74ee31a03..631ae057ab537 100644
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -301,6 +301,7 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record)
+ GFP_KERNEL);
+ if (!tmp_prz)
+ return -ENOMEM;
++ prz = tmp_prz;
+ free_prz = true;
+
+ while (cxt->ftrace_read_cnt < cxt->max_ftrace_cnt) {
+@@ -323,7 +324,6 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record)
+ goto out;
+ }
+ record->id = 0;
+- prz = tmp_prz;
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 805ebe084f35af9ea4689d9700653509fec0cc78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 20:21:26 +0900
+Subject: ravb: Clean up duplex handling
+
+From: Magnus Damm <damm+renesas@opensource.se>
+
+[ Upstream commit 08b43857804dd0eca48f5c5a84885cf0079586e0 ]
+
+Since only full-duplex operation is supported by the
+hardware, remove duplex handling code and keep the
+register setting of ECMR.DM fixed at 1.
+
+This updates the driver implementation to follow the
+data sheet text "This bit should always be set to 1."
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Signed-off-by: Magnus Damm <damm+renesas@opensource.se>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/ravb.h | 1 -
+ drivers/net/ethernet/renesas/ravb_main.c | 19 +------------------
+ 2 files changed, 1 insertion(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h
+index 9b6bf557a2f5f..e04af9546e526 100644
+--- a/drivers/net/ethernet/renesas/ravb.h
++++ b/drivers/net/ethernet/renesas/ravb.h
+@@ -1029,7 +1029,6 @@ struct ravb_private {
+ phy_interface_t phy_interface;
+ int msg_enable;
+ int speed;
+- int duplex;
+ int emac_irq;
+ enum ravb_chip_id chip_id;
+ int rx_irqs[NUM_RX_QUEUE];
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index 5462d2e8a1b71..faaf74073a120 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -82,13 +82,6 @@ static int ravb_config(struct net_device *ndev)
+ return error;
+ }
+
+-static void ravb_set_duplex(struct net_device *ndev)
+-{
+- struct ravb_private *priv = netdev_priv(ndev);
+-
+- ravb_modify(ndev, ECMR, ECMR_DM, priv->duplex ? ECMR_DM : 0);
+-}
+-
+ static void ravb_set_rate(struct net_device *ndev)
+ {
+ struct ravb_private *priv = netdev_priv(ndev);
+@@ -398,13 +391,11 @@ error:
+ /* E-MAC init function */
+ static void ravb_emac_init(struct net_device *ndev)
+ {
+- struct ravb_private *priv = netdev_priv(ndev);
+-
+ /* Receive frame limit set register */
+ ravb_write(ndev, ndev->mtu + ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN, RFLR);
+
+ /* EMAC Mode: PAUSE prohibition; Duplex; RX Checksum; TX; RX */
+- ravb_write(ndev, ECMR_ZPF | (priv->duplex ? ECMR_DM : 0) |
++ ravb_write(ndev, ECMR_ZPF | ECMR_DM |
+ (ndev->features & NETIF_F_RXCSUM ? ECMR_RCSC : 0) |
+ ECMR_TE | ECMR_RE, ECMR);
+
+@@ -992,12 +983,6 @@ static void ravb_adjust_link(struct net_device *ndev)
+ ravb_rcv_snd_disable(ndev);
+
+ if (phydev->link) {
+- if (phydev->duplex != priv->duplex) {
+- new_state = true;
+- priv->duplex = phydev->duplex;
+- ravb_set_duplex(ndev);
+- }
+-
+ if (phydev->speed != priv->speed) {
+ new_state = true;
+ priv->speed = phydev->speed;
+@@ -1012,7 +997,6 @@ static void ravb_adjust_link(struct net_device *ndev)
+ new_state = true;
+ priv->link = 0;
+ priv->speed = 0;
+- priv->duplex = -1;
+ }
+
+ /* Enable TX and RX right over here, if E-MAC change is ignored */
+@@ -1042,7 +1026,6 @@ static int ravb_phy_init(struct net_device *ndev)
+
+ priv->link = 0;
+ priv->speed = 0;
+- priv->duplex = -1;
+
+ /* Try connecting to PHY */
+ pn = of_parse_phandle(np, "phy-handle", 0);
+--
+2.20.1
+
--- /dev/null
+From 590d3903af950955d0e5f2c689aa729706eccae9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 10:33:29 +0800
+Subject: RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN
+
+From: Sirong Wang <wangsirong@huawei.com>
+
+[ Upstream commit 531eb45b3da4267fc2a64233ba256c8ffb02edd2 ]
+
+Size of pointer to buf field of struct hns_roce_hem_chunk should be
+considered when calculating HNS_ROCE_HEM_CHUNK_LEN, or sg table size will
+be larger than expected when allocating hem.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Link: https://lore.kernel.org/r/1572575610-52530-2-git-send-email-liweihang@hisilicon.com
+Signed-off-by: Sirong Wang <wangsirong@huawei.com>
+Signed-off-by: Weihang Li <liweihang@hisilicon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h
+index e8850d59e7804..a94444db3045a 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_hem.h
++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h
+@@ -54,7 +54,7 @@ enum {
+
+ #define HNS_ROCE_HEM_CHUNK_LEN \
+ ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \
+- (sizeof(struct scatterlist)))
++ (sizeof(struct scatterlist) + sizeof(void *)))
+
+ #define check_whether_bt_num_3(type, hop_num) \
+ (type < HEM_TYPE_MTT && hop_num == 2)
+--
+2.20.1
+
--- /dev/null
+From b87df424fe697fe9508215d306c6f9efa867a877 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Nov 2018 19:19:30 -0800
+Subject: regulator: Fix return value of _set_load() stub
+
+From: Mark Brown <broonie@kernel.org>
+
+[ Upstream commit f1abf67217de91f5cd3c757ae857632ca565099a ]
+
+The stub implementation of _set_load() returns a mode value which is
+within the bounds of valid return codes for success (the documentation
+just says that failures are negative error codes) but not sensible or
+what the actual implementation does. Fix it to just return 0.
+
+Reported-by: Cheng-Yi Chiang <cychiang@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/regulator/consumer.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h
+index 25602afd48447..f3f76051e8b00 100644
+--- a/include/linux/regulator/consumer.h
++++ b/include/linux/regulator/consumer.h
+@@ -508,7 +508,7 @@ static inline int regulator_get_error_flags(struct regulator *regulator,
+
+ static inline int regulator_set_load(struct regulator *regulator, int load_uA)
+ {
+- return REGULATOR_MODE_NORMAL;
++ return 0;
+ }
+
+ static inline int regulator_allow_bypass(struct regulator *regulator,
+--
+2.20.1
+
--- /dev/null
+From 7338bc41c75074e1c920c8745b7cbbfabe23a175 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 14:38:47 +0800
+Subject: rsxx: add missed destroy_workqueue calls in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit dcb77e4b274b8f13ac6482dfb09160cd2fae9a40 ]
+
+The driver misses calling destroy_workqueue in remove like what is done
+when probe fails.
+Add the missed calls to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/rsxx/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
+index f2c631ce793cc..14056dc450642 100644
+--- a/drivers/block/rsxx/core.c
++++ b/drivers/block/rsxx/core.c
+@@ -1014,8 +1014,10 @@ static void rsxx_pci_remove(struct pci_dev *dev)
+
+ cancel_work_sync(&card->event_work);
+
++ destroy_workqueue(card->event_wq);
+ rsxx_destroy_dev(card);
+ rsxx_dma_destroy(card);
++ destroy_workqueue(card->creg_ctrl.creg_wq);
+
+ spin_lock_irqsave(&card->irq_lock, flags);
+ rsxx_disable_ier_and_isr(card, CR_INTR_ALL);
+--
+2.20.1
+
--- /dev/null
+From 88b5aa110934d3c3de5ba46c332340877e481df2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 14:34:02 +0200
+Subject: rtc: dt-binding: abx80x: fix resistance scale
+
+From: Baruch Siach <baruch@tkos.co.il>
+
+[ Upstream commit 73852e56827f5cb5db9d6e8dd8191fc2f2e8f424 ]
+
+The abracon,tc-resistor property value is in kOhm.
+
+Signed-off-by: Baruch Siach <baruch@tkos.co.il>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/rtc/abracon,abx80x.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+index be789685a1c24..18b892d010d87 100644
+--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt
+@@ -27,4 +27,4 @@ and valid to enable charging:
+
+ - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V)
+ - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output
+- resistor, the other values are in ohm.
++ resistor, the other values are in kOhm.
+--
+2.20.1
+
--- /dev/null
+From e472e0102a0c99c8d0ab913ba510e8555877fc03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 00:36:45 +0100
+Subject: rtc: max77686: Fix the returned value in case of error in
+ 'max77686_rtc_read_time()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit b28cc6cec3d814f5184cbebb2d1f987e769f534a ]
+
+In case of error, we return 0.
+This is spurious and not consistent with the other functions of the driver.
+Commit e115a2bf1426 has modified more than what is said in the commit
+message. Reverse part of it znd return an error when needed, as it was
+previously.
+
+Fixes: e115a2bf1426 ("rtc: max77686: stop validating rtc_time in .read_time")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-max77686.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c
+index 8a60900d6b8b5..4aff349ae301a 100644
+--- a/drivers/rtc/rtc-max77686.c
++++ b/drivers/rtc/rtc-max77686.c
+@@ -360,7 +360,7 @@ static int max77686_rtc_read_time(struct device *dev, struct rtc_time *tm)
+
+ out:
+ mutex_unlock(&info->lock);
+- return 0;
++ return ret;
+ }
+
+ static int max77686_rtc_set_time(struct device *dev, struct rtc_time *tm)
+--
+2.20.1
+
--- /dev/null
+From 3df728b67577c64428086cfad1cb2a220ccd6ee2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:19:51 +0100
+Subject: rtc: max8997: Fix the returned value in case of error in
+ 'max8997_rtc_read_alarm()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 41ef3878203cd9218d92eaa07df4b85a2cb128fb ]
+
+In case of error, we return 0.
+This is spurious and not consistent with the other functions of the driver.
+Propagate the error code instead.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-max8997.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c
+index 08c661a332ec0..20e50d9fdf882 100644
+--- a/drivers/rtc/rtc-max8997.c
++++ b/drivers/rtc/rtc-max8997.c
+@@ -215,7 +215,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+
+ out:
+ mutex_unlock(&info->lock);
+- return 0;
++ return ret;
+ }
+
+ static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info)
+--
+2.20.1
+
--- /dev/null
+From 9c356c063bd3ce2a0ef124c8610393f99061fd78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 12:32:50 +0100
+Subject: rtc: s3c-rtc: Avoid using broken ALMYEAR register
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 50c8aec4212a966817e868056efc9bfbb73337c0 ]
+
+(RTC,ALM)YEAR registers of Exynos built-in RTC device contains 3 BCD
+characters. s3c-rtc driver uses only 2 lower of them and supports years
+from 2000..2099 range. The third BCD value is typically set to 0, but it
+looks that handling of it is broken in the hardware. It sometimes
+defaults to a random (even non-BCD) value. This is not an issue
+for handling RTCYEAR register, because bcd2bin() properly handles only
+8bit values (2 BCD characters, the third one is skipped). The problem
+is however with ALMYEAR register and proper RTC alarm operation. When
+YEAREN bit is set for the configured alarm, RTC hardware triggers alarm
+only when ALMYEAR and RTCYEAR matches. This usually doesn't happen
+because of the random noise on the third BCD character.
+
+Fix this by simply skipping setting ALMYEAR register in alarm
+configuration. This workaround fixes broken alarm operation on Exynos
+built-in rtc device. My tests revealed that the issue happens on the
+following Exynos series: 3250, 4210, 4412, 5250 and 5410.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-s3c.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
+index 75c8c5033e087..58e03ac3578b7 100644
+--- a/drivers/rtc/rtc-s3c.c
++++ b/drivers/rtc/rtc-s3c.c
+@@ -327,7 +327,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ struct rtc_time *tm = &alrm->time;
+ unsigned int alrm_en;
+ int ret;
+- int year = tm->tm_year - 100;
+
+ dev_dbg(dev, "s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n",
+ alrm->enabled,
+@@ -356,11 +355,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
+ writeb(bin2bcd(tm->tm_hour), info->base + S3C2410_ALMHOUR);
+ }
+
+- if (year < 100 && year >= 0) {
+- alrm_en |= S3C2410_RTCALM_YEAREN;
+- writeb(bin2bcd(year), info->base + S3C2410_ALMYEAR);
+- }
+-
+ if (tm->tm_mon < 12 && tm->tm_mon >= 0) {
+ alrm_en |= S3C2410_RTCALM_MONEN;
+ writeb(bin2bcd(tm->tm_mon + 1), info->base + S3C2410_ALMMON);
+--
+2.20.1
+
--- /dev/null
+From fc510a84b1bb280373fcb00a22d683f70b136ce7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 11:18:37 +0200
+Subject: sched/core: Avoid spurious lock dependencies
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+[ Upstream commit ff51ff84d82aea5a889b85f2b9fb3aa2b8691668 ]
+
+While seemingly harmless, __sched_fork() does hrtimer_init(), which,
+when DEBUG_OBJETS, can end up doing allocations.
+
+This then results in the following lock order:
+
+ rq->lock
+ zone->lock.rlock
+ batched_entropy_u64.lock
+
+Which in turn causes deadlocks when we do wakeups while holding that
+batched_entropy lock -- as the random code does.
+
+Solve this by moving __sched_fork() out from under rq->lock. This is
+safe because nothing there relies on rq->lock, as also evident from the
+other __sched_fork() callsite.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qian Cai <cai@lca.pw>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: akpm@linux-foundation.org
+Cc: bigeasy@linutronix.de
+Cc: cl@linux.com
+Cc: keescook@chromium.org
+Cc: penberg@kernel.org
+Cc: rientjes@google.com
+Cc: thgarnie@google.com
+Cc: tytso@mit.edu
+Cc: will@kernel.org
+Fixes: b7d5dc21072c ("random: add a spinlock_t to struct batched_entropy")
+Link: https://lkml.kernel.org/r/20191001091837.GK4536@hirez.programming.kicks-ass.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 78ecdfae25b69..2befd2c4ce9e6 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5413,10 +5413,11 @@ void init_idle(struct task_struct *idle, int cpu)
+ struct rq *rq = cpu_rq(cpu);
+ unsigned long flags;
+
++ __sched_fork(0, idle);
++
+ raw_spin_lock_irqsave(&idle->pi_lock, flags);
+ raw_spin_lock(&rq->lock);
+
+- __sched_fork(0, idle);
+ idle->state = TASK_RUNNING;
+ idle->se.exec_start = sched_clock();
+ idle->flags |= PF_IDLE;
+--
+2.20.1
+
--- /dev/null
+From 858d07cc26891658bb0c2c3aeee3ca4f84012655 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Nov 2018 01:25:18 -0800
+Subject: scsi: qedi: Allocate IRQs based on msix_cnt
+
+From: Nilesh Javali <nilesh.javali@cavium.com>
+
+[ Upstream commit 1a291bce5eaf5374627d337157544aa6499ce34a ]
+
+The driver load on some systems failed with error,
+[0004:01:00.5]:[qedi_request_msix_irq:2524]:8: request_irq failed.
+
+Allocate the IRQs based on MSIX count obtained from qed module instead of
+number of queues.
+
+Signed-off-by: Nilesh Javali <nilesh.javali@cavium.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qedi/qedi_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
+index 763c7628356b1..a81ea8f6c2087 100644
+--- a/drivers/scsi/qedi/qedi_main.c
++++ b/drivers/scsi/qedi/qedi_main.c
+@@ -1304,7 +1304,7 @@ static int qedi_request_msix_irq(struct qedi_ctx *qedi)
+ int i, rc, cpu;
+
+ cpu = cpumask_first(cpu_online_mask);
+- for (i = 0; i < MIN_NUM_CPUS_MSIX(qedi); i++) {
++ for (i = 0; i < qedi->int_info.msix_cnt; i++) {
+ rc = request_irq(qedi->int_info.msix[i].vector,
+ qedi_msix_handler, 0, "qedi",
+ &qedi->fp_array[i]);
+--
+2.20.1
+
--- /dev/null
+From 953d0584fbf43b0a7ac3bdcf1aa1f953f35a7580 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 15:44:57 +0100
+Subject: scsi: zfcp: drop default switch case which might paper over missing
+ case
+
+From: Steffen Maier <maier@linux.ibm.com>
+
+[ Upstream commit 0c902936e55cff9335b27ed632fc45e7115ced75 ]
+
+This was introduced with v4.18 commit 8c3d20aada70 ("scsi: zfcp: fix
+missing REC trigger trace for all objects in ERP_FAILED") but would now
+suppress helpful -Wswitch compiler warnings when building with W=1 such as
+the following forced example:
+
+drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_handle_failed':
+drivers/s390/scsi/zfcp_erp.c:126:2: warning: enumeration value 'ZFCP_ERP_ACTION_REOPEN_PORT_FORCED' not handled in switch [-Wswitch]
+ switch (want) {
+ ^~~~~~
+
+But then again, only with W=1 we would notice unhandled enum cases.
+Without the default cases and a missed unhandled enum case, the code might
+perform unforeseen things we might not want...
+
+As of today, we never run through the removed default case, so removing it
+is no functional change. In the future, we never should run through a
+default case but introduce the necessary specific case(s) to handle new
+functionality.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/scsi/zfcp_erp.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index 332701db7379d..f602b42b8343d 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -172,9 +172,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter,
+ adapter, ZFCP_STATUS_COMMON_ERP_FAILED);
+ }
+ break;
+- default:
+- need = 0;
+- break;
+ }
+
+ return need;
+--
+2.20.1
+
--- /dev/null
+From e46aefc4c2513dd774f9b4a01245955008b98f79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 15:44:47 +0100
+Subject: scsi: zfcp: update kernel message for invalid FCP_CMND length, it's
+ not the CDB
+
+From: Steffen Maier <maier@linux.ibm.com>
+
+[ Upstream commit 724e144387f4d7e7668d3da913d0efc44a9b4664 ]
+
+The CDB is just a part inside of FCP_CMND, see zfcp_fc_scsi_to_fcp().
+While at it, fix the device driver reaction: adapter not LUN shutdown.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/scsi/zfcp_fsf.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
+index df888506e363e..91aa4bfcf8d61 100644
+--- a/drivers/s390/scsi/zfcp_fsf.c
++++ b/drivers/s390/scsi/zfcp_fsf.c
+@@ -2104,11 +2104,8 @@ static void zfcp_fsf_fcp_handler_common(struct zfcp_fsf_req *req,
+ break;
+ case FSF_CMND_LENGTH_NOT_VALID:
+ dev_err(&req->adapter->ccw_device->dev,
+- "Incorrect CDB length %d, LUN 0x%016Lx on "
+- "port 0x%016Lx closed\n",
+- req->qtcb->bottom.io.fcp_cmnd_length,
+- (unsigned long long)zfcp_scsi_dev_lun(sdev),
+- (unsigned long long)zfcp_sdev->port->wwpn);
++ "Incorrect FCP_CMND length %d, FCP device closed\n",
++ req->qtcb->bottom.io.fcp_cmnd_length);
+ zfcp_erp_adapter_shutdown(req->adapter, 0, "fssfch4");
+ req->status |= ZFCP_STATUS_FSFREQ_ERROR;
+ break;
+--
+2.20.1
+
--- /dev/null
+From f271f948726c1ac968bf60dcb8a853d9c9c248e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 18 Nov 2018 15:07:38 +0800
+Subject: sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 02968ccf0125d39b08ecef5946300a8a873c0942 ]
+
+Now sctp increases sk_wmem_alloc by 1 when doing set_owner_w for the
+skb allocked in sctp_packet_transmit and decreases by 1 when freeing
+this skb.
+
+But when this skb goes through networking stack, some subcomponents
+might change skb->truesize and add the same amount on sk_wmem_alloc.
+However sctp doesn't know the amount to decrease by, it would cause
+a leak on sk->sk_wmem_alloc and the sock can never be freed.
+
+Xiumei found this issue when it hit esp_output_head() by using sctp
+over ipsec, where skb->truesize is added and so is sk->sk_wmem_alloc.
+
+Since sctp has used sk_wmem_queued to count for writable space since
+Commit cd305c74b0f8 ("sctp: use sk_wmem_queued to check for writable
+space"), it's ok to fix it by counting sk_wmem_alloc by skb truesize
+in sctp_packet_transmit.
+
+Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
+Reported-by: Xiumei Mu <xmu@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/output.c | 21 +--------------------
+ 1 file changed, 1 insertion(+), 20 deletions(-)
+
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index 08601223b0bfa..b0e74a3e77ec5 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -399,25 +399,6 @@ finish:
+ return retval;
+ }
+
+-static void sctp_packet_release_owner(struct sk_buff *skb)
+-{
+- sk_free(skb->sk);
+-}
+-
+-static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk)
+-{
+- skb_orphan(skb);
+- skb->sk = sk;
+- skb->destructor = sctp_packet_release_owner;
+-
+- /*
+- * The data chunks have already been accounted for in sctp_sendmsg(),
+- * therefore only reserve a single byte to keep socket around until
+- * the packet has been transmitted.
+- */
+- refcount_inc(&sk->sk_wmem_alloc);
+-}
+-
+ static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
+ {
+ if (SCTP_OUTPUT_CB(head)->last == head)
+@@ -604,7 +585,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp)
+ if (!head)
+ goto out;
+ skb_reserve(head, packet->overhead + MAX_HEADER);
+- sctp_packet_set_owner_w(head, sk);
++ skb_set_owner_w(head, sk);
+
+ /* set sctp header */
+ sh = skb_push(head, sizeof(struct sctphdr));
+--
+2.20.1
+
--- /dev/null
+From 5d34fd65d95fc06b482699626e94e3b30105ed2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Dec 2018 20:27:41 +0100
+Subject: sctp: frag_point sanity check
+
+From: Jakub Audykowicz <jakub.audykowicz@gmail.com>
+
+[ Upstream commit afd0a8006e98b1890908f81746c94ca5dae29d7c ]
+
+If for some reason an association's fragmentation point is zero,
+sctp_datamsg_from_user will try to endlessly try to divide a message
+into zero-sized chunks. This eventually causes kernel panic due to
+running out of memory.
+
+Although this situation is quite unlikely, it has occurred before as
+reported. I propose to add this simple last-ditch sanity check due to
+the severity of the potential consequences.
+
+Signed-off-by: Jakub Audykowicz <jakub.audykowicz@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/sctp/sctp.h | 5 +++++
+ net/sctp/chunk.c | 6 ++++++
+ net/sctp/socket.c | 3 +--
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index ab9242e51d9e0..2abbc15824af9 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -620,4 +620,9 @@ static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+ return false;
+ }
+
++static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize)
++{
++ return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize);
++}
++
+ #endif /* __net_sctp_h__ */
+diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
+index ce8087846f059..d2048de86e7c2 100644
+--- a/net/sctp/chunk.c
++++ b/net/sctp/chunk.c
+@@ -191,6 +191,12 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
+ * the packet
+ */
+ max_data = asoc->frag_point;
++ if (unlikely(!max_data)) {
++ max_data = sctp_min_frag_point(sctp_sk(asoc->base.sk),
++ sctp_datachk_len(&asoc->stream));
++ pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)",
++ __func__, asoc, max_data);
++ }
+
+ /* If the the peer requested that we authenticate DATA chunks
+ * we need to account for bundling of the AUTH chunks along with
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index e7a11cd7633f5..95f9068b85497 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3328,8 +3328,7 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
+ __u16 datasize = asoc ? sctp_datachk_len(&asoc->stream) :
+ sizeof(struct sctp_data_chunk);
+
+- min_len = sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT,
+- datasize);
++ min_len = sctp_min_frag_point(sp, datasize);
+ max_len = SCTP_MAX_CHUNK_LEN - datasize;
+
+ if (val < min_len || val > max_len)
+--
+2.20.1
+
--- /dev/null
+From c5f244ffecdd04de93817f993878702c7c3dac68 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 14:52:44 +0800
+Subject: sctp: increase sk_wmem_alloc when head->truesize is increased
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 0d32f17717e65e76cbdb248374dd162acdfe2fff ]
+
+I changed to count sk_wmem_alloc by skb truesize instead of 1 to
+fix the sk_wmem_alloc leak caused by later truesize's change in
+xfrm in Commit 02968ccf0125 ("sctp: count sk_wmem_alloc by skb
+truesize in sctp_packet_transmit").
+
+But I should have also increased sk_wmem_alloc when head->truesize
+is increased in sctp_packet_gso_append() as xfrm does. Otherwise,
+sctp gso packet will cause sk_wmem_alloc underflow.
+
+Fixes: 02968ccf0125 ("sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sctp/output.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index b0e74a3e77ec5..025f48e14a91f 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -410,6 +410,7 @@ static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb)
+ head->truesize += skb->truesize;
+ head->data_len += skb->len;
+ head->len += skb->len;
++ refcount_add(skb->truesize, &head->sk->sk_wmem_alloc);
+
+ __skb_header_release(skb);
+ }
+--
+2.20.1
+
--- /dev/null
+From ec3cf93d7bd74695ced5c4359edb37b2c5191137 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Nov 2019 13:51:15 +0100
+Subject: selftests: kvm: fix build with glibc >= 2.30
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vitaly Kuznetsov <vkuznets@redhat.com>
+
+[ Upstream commit e37f9f139f62deddff90c7298ae3a85026a71067 ]
+
+Glibc-2.30 gained gettid() wrapper, selftests fail to compile:
+
+lib/assert.c:58:14: error: static declaration of ‘gettid’ follows non-static declaration
+ 58 | static pid_t gettid(void)
+ | ^~~~~~
+In file included from /usr/include/unistd.h:1170,
+ from include/test_util.h:18,
+ from lib/assert.c:10:
+/usr/include/bits/unistd_ext.h:34:16: note: previous declaration of ‘gettid’ was here
+ 34 | extern __pid_t gettid (void) __THROW;
+ | ^~~~~~
+
+Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/lib/assert.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/kvm/lib/assert.c b/tools/testing/selftests/kvm/lib/assert.c
+index cd01144d27c8d..d306677065699 100644
+--- a/tools/testing/selftests/kvm/lib/assert.c
++++ b/tools/testing/selftests/kvm/lib/assert.c
+@@ -56,7 +56,7 @@ static void test_dump_stack(void)
+ #pragma GCC diagnostic pop
+ }
+
+-static pid_t gettid(void)
++static pid_t _gettid(void)
+ {
+ return syscall(SYS_gettid);
+ }
+@@ -73,7 +73,7 @@ test_assert(bool exp, const char *exp_str,
+ fprintf(stderr, "==== Test Assertion Failure ====\n"
+ " %s:%u: %s\n"
+ " pid=%d tid=%d - %s\n",
+- file, line, exp_str, getpid(), gettid(),
++ file, line, exp_str, getpid(), _gettid(),
+ strerror(errno));
+ test_dump_stack();
+ if (fmt) {
+--
+2.20.1
+
--- /dev/null
+From 52657ebbbb6aaf7b047df6c2be5e888a41e98561 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 11:38:20 -0300
+Subject: selftests/powerpc: Allocate base registers
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 5249497a7bb6334fcc128588d6a7e1e21786515a ]
+
+Some ptrace selftests are passing input operands using a constraint that
+can allocate any register for the operand, and using these registers on
+load/store operations.
+
+If the register allocated by the compiler happens to be zero (r0), it might
+cause an invalid memory address access, since load and store operations
+consider the content of 0x0 address if the base register is r0, instead of
+the content of the r0 register. For example:
+
+ r1 := 0xdeadbeef
+ r0 := 0xdeadbeef
+
+ ld r2, 0(1) /* will load into r2 the content of r1 address */
+ ld r2, 0(0) /* will load into r2 the content of 0x0 */
+
+In order to avoid this possible problem, the inline assembly constraint
+should be aware that these registers will be used as a base register, thus,
+r0 should not be allocated.
+
+Other than that, this patch removes inline assembly operands that are not
+used by the tests.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c | 2 +-
+ tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c | 4 ++--
+ tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c | 2 +-
+ tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c | 3 +--
+ tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c | 2 +-
+ tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c | 2 +-
+ tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c | 3 +--
+ 7 files changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c
+index 0b4ebcc2f485a..ca29fafeed5d9 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c
+@@ -31,7 +31,7 @@ void gpr(void)
+ ASM_LOAD_GPR_IMMED(gpr_1)
+ ASM_LOAD_FPR_SINGLE_PRECISION(flt_1)
+ :
+- : [gpr_1]"i"(GPR_1), [flt_1] "r" (&a)
++ : [gpr_1]"i"(GPR_1), [flt_1] "b" (&a)
+ : "memory", "r6", "r7", "r8", "r9", "r10",
+ "r11", "r12", "r13", "r14", "r15", "r16", "r17",
+ "r18", "r19", "r20", "r21", "r22", "r23", "r24",
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c
+index 59206b96e98a5..a08a91594dbe5 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c
+@@ -59,8 +59,8 @@ trans:
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+ : [gpr_1]"i"(GPR_1), [gpr_2]"i"(GPR_2),
+- [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "r" (&a),
+- [flt_2] "r" (&b), [cptr1] "r" (&cptr[1])
++ [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "b" (&a),
++ [flt_2] "b" (&b), [cptr1] "b" (&cptr[1])
+ : "memory", "r7", "r8", "r9", "r10",
+ "r11", "r12", "r13", "r14", "r15", "r16",
+ "r17", "r18", "r19", "r20", "r21", "r22",
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c
+index b3c061dc95122..f471747462312 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c
+@@ -72,7 +72,7 @@ trans:
+ "3: ;"
+
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+- : [val] "r" (cptr[1]), [sprn_dscr]"i"(SPRN_DSCR),
++ : [sprn_dscr]"i"(SPRN_DSCR),
+ [sprn_tar]"i"(SPRN_TAR), [sprn_ppr]"i"(SPRN_PPR),
+ [sprn_texasr]"i"(SPRN_TEXASR), [tar_1]"i"(TAR_1),
+ [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), [dscr_2]"i"(DSCR_2),
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c
+index 277dade1b382f..18a685bf6a097 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c
+@@ -77,8 +77,7 @@ trans:
+
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+- : [fp_load] "r" (fp_load), [fp_load_ckpt] "r" (fp_load_ckpt),
+- [sprn_texasr] "i" (SPRN_TEXASR)
++ : [sprn_texasr] "i" (SPRN_TEXASR)
+ : "memory", "r0", "r1", "r3", "r4",
+ "r7", "r8", "r9", "r10", "r11"
+ );
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c
+index 51427a2465f69..ba04999254e38 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c
+@@ -74,7 +74,7 @@ trans:
+
+ "3: ;"
+ : [tfhar] "=r" (tfhar), [res] "=r" (result),
+- [texasr] "=r" (texasr), [cptr1] "=r" (cptr1)
++ [texasr] "=r" (texasr), [cptr1] "=b" (cptr1)
+ : [sprn_texasr] "i" (SPRN_TEXASR)
+ : "memory", "r0", "r8", "r31"
+ );
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c
+index 48b462f750230..f70023b25e6e8 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c
+@@ -65,7 +65,7 @@ trans:
+ : [sprn_dscr]"i"(SPRN_DSCR), [sprn_tar]"i"(SPRN_TAR),
+ [sprn_ppr]"i"(SPRN_PPR), [sprn_texasr]"i"(SPRN_TEXASR),
+ [tar_1]"i"(TAR_1), [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2),
+- [dscr_2]"i"(DSCR_2), [cptr1] "r" (&cptr[1])
++ [dscr_2]"i"(DSCR_2), [cptr1] "b" (&cptr[1])
+ : "memory", "r0", "r1", "r3", "r4", "r5", "r6"
+ );
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c
+index 17c23cabac3ea..dfba800589776 100644
+--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c
++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c
+@@ -65,8 +65,7 @@ trans:
+
+ "3: ;"
+ : [res] "=r" (result), [texasr] "=r" (texasr)
+- : [fp_load] "r" (fp_load), [fp_load_ckpt] "r" (fp_load_ckpt),
+- [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "r" (&cptr[1])
++ : [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "b" (&cptr[1])
+ : "memory", "r0", "r1", "r3", "r4",
+ "r7", "r8", "r9", "r10", "r11"
+ );
+--
+2.20.1
+
--- /dev/null
+From dd32e68571dfaa92186742a63345d5ba5a0d4995 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 11:38:22 -0300
+Subject: selftests/powerpc: Skip test instead of failing
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit eafcd8e3fbad4f426a40ed2b6a8c697c3a4ef36a ]
+
+Current core-pkey selftest fails if the test runs without privileges to
+write into the core pattern file (/proc/sys/kernel/core_pattern). This
+causes the test to fail and give the impression that the subsystem being
+tested is broken, when, in fact, the test is being executed without the
+proper privileges. This is the current error:
+
+ test: core_pkey
+ tags: git_version:v4.19-3-g9e3363be9bce-dirty
+ Error writing to core_pattern file: Permission denied
+ failure: core_pkey
+
+This patch simply skips this test if it runs without the proper privileges,
+avoiding this undesired failure.
+
+CC: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+CC: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/powerpc/ptrace/core-pkey.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/tools/testing/selftests/powerpc/ptrace/core-pkey.c b/tools/testing/selftests/powerpc/ptrace/core-pkey.c
+index e23e2e199eb4e..d5c64fee032dc 100644
+--- a/tools/testing/selftests/powerpc/ptrace/core-pkey.c
++++ b/tools/testing/selftests/powerpc/ptrace/core-pkey.c
+@@ -352,10 +352,7 @@ static int write_core_pattern(const char *core_pattern)
+ FILE *f;
+
+ f = fopen(core_pattern_file, "w");
+- if (!f) {
+- perror("Error writing to core_pattern file");
+- return TEST_FAIL;
+- }
++ SKIP_IF_MSG(!f, "Try with root privileges");
+
+ ret = fwrite(core_pattern, 1, len, f);
+ fclose(f);
+--
+2.20.1
+
--- /dev/null
+From baca376ffcb144b35b956c8181fade7351564c90 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Oct 2018 15:11:04 -0700
+Subject: serial: core: Allow processing sysrq at port unlock time
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit d6e1935819db0c91ce4a5af82466f3ab50d17346 ]
+
+Right now serial drivers process sysrq keys deep in their character
+receiving code. This means that they've already grabbed their
+port->lock spinlock. This can end up getting in the way if we've go
+to do serial stuff (especially kgdb) in response to the sysrq.
+
+Serial drivers have various hacks in them to handle this. Looking at
+'8250_port.c' you can see that the console_write() skips locking if
+we're in the sysrq handler. Looking at 'msm_serial.c' you can see
+that the port lock is dropped around uart_handle_sysrq_char().
+
+It turns out that these hacks aren't exactly perfect. If you have
+lockdep turned on and use something like the 8250_port hack you'll get
+a splat that looks like:
+
+ WARNING: possible circular locking dependency detected
+ [...] is trying to acquire lock:
+ ... (console_owner){-.-.}, at: console_unlock+0x2e0/0x5e4
+
+ but task is already holding lock:
+ ... (&port_lock_key){-.-.}, at: serial8250_handle_irq+0x30/0xe4
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #1 (&port_lock_key){-.-.}:
+ _raw_spin_lock_irqsave+0x58/0x70
+ serial8250_console_write+0xa8/0x250
+ univ8250_console_write+0x40/0x4c
+ console_unlock+0x528/0x5e4
+ register_console+0x2c4/0x3b0
+ uart_add_one_port+0x350/0x478
+ serial8250_register_8250_port+0x350/0x3a8
+ dw8250_probe+0x67c/0x754
+ platform_drv_probe+0x58/0xa4
+ really_probe+0x150/0x294
+ driver_probe_device+0xac/0xe8
+ __driver_attach+0x98/0xd0
+ bus_for_each_dev+0x84/0xc8
+ driver_attach+0x2c/0x34
+ bus_add_driver+0xf0/0x1ec
+ driver_register+0xb4/0x100
+ __platform_driver_register+0x60/0x6c
+ dw8250_platform_driver_init+0x20/0x28
+ ...
+
+ -> #0 (console_owner){-.-.}:
+ lock_acquire+0x1e8/0x214
+ console_unlock+0x35c/0x5e4
+ vprintk_emit+0x230/0x274
+ vprintk_default+0x7c/0x84
+ vprintk_func+0x190/0x1bc
+ printk+0x80/0xa0
+ __handle_sysrq+0x104/0x21c
+ handle_sysrq+0x30/0x3c
+ serial8250_read_char+0x15c/0x18c
+ serial8250_rx_chars+0x34/0x74
+ serial8250_handle_irq+0x9c/0xe4
+ dw8250_handle_irq+0x98/0xcc
+ serial8250_interrupt+0x50/0xe8
+ ...
+
+ other info that might help us debug this:
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&port_lock_key);
+ lock(console_owner);
+ lock(&port_lock_key);
+ lock(console_owner);
+
+ *** DEADLOCK ***
+
+The hack used in 'msm_serial.c' doesn't cause the above splats but it
+seems a bit ugly to unlock / lock our spinlock deep in our irq
+handler.
+
+It seems like we could defer processing the sysrq until the end of the
+interrupt handler right after we've unlocked the port. With this
+scheme if a whole batch of sysrq characters comes in one irq then we
+won't handle them all, but that seems like it should be a fine
+compromise.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/serial_core.h | 37 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
+index 406edae44ca30..3460b15a26078 100644
+--- a/include/linux/serial_core.h
++++ b/include/linux/serial_core.h
+@@ -173,6 +173,7 @@ struct uart_port {
+ struct console *cons; /* struct console, if any */
+ #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ)
+ unsigned long sysrq; /* sysrq timeout */
++ unsigned int sysrq_ch; /* char for sysrq */
+ #endif
+
+ /* flags must be updated while holding port mutex */
+@@ -482,8 +483,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch)
+ }
+ return 0;
+ }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch)
++{
++ if (port->sysrq) {
++ if (ch && time_before(jiffies, port->sysrq)) {
++ port->sysrq_ch = ch;
++ port->sysrq = 0;
++ return 1;
++ }
++ port->sysrq = 0;
++ }
++ return 0;
++}
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ int sysrq_ch;
++
++ sysrq_ch = port->sysrq_ch;
++ port->sysrq_ch = 0;
++
++ spin_unlock_irqrestore(&port->lock, irqflags);
++
++ if (sysrq_ch)
++ handle_sysrq(sysrq_ch);
++}
+ #else
+-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; })
++static inline int
++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline int
++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; }
++static inline void
++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags)
++{
++ spin_unlock_irqrestore(&port->lock, irqflags);
++}
+ #endif
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 0fba9f7c984d27ee072a591a7b92312157337127 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 14 Nov 2018 18:49:38 +0100
+Subject: serial: imx: fix error handling in console_setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit 63fd4b94b948c14eeb27a3bbf50ea0f7f0593bad ]
+
+The ipg clock only needs to be unprepared in case preparing
+per clock fails. The ipg clock has already disabled at the point.
+
+Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/imx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 105de92b0b3bf..989ca7d662f3f 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2071,7 +2071,7 @@ imx_uart_console_setup(struct console *co, char *options)
+
+ retval = clk_prepare(sport->clk_per);
+ if (retval)
+- clk_disable_unprepare(sport->clk_ipg);
++ clk_unprepare(sport->clk_ipg);
+
+ error_console:
+ return retval;
+--
+2.20.1
+
serial-pl011-fix-dma-flush_buffer.patch
serial-serial_core-perform-null-checks-for-break_ctl-ops.patch
serial-ifx6x60-add-missed-pm_runtime_disable.patch
+autofs-fix-a-leak-in-autofs_expire_indirect.patch
+rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch
+iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch
+exportfs_decode_fh-negative-pinned-may-become-positi.patch
+audit_get_nd-don-t-unlock-parent-too-early.patch
+nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch
+xfrm-release-device-reference-for-invalid-state.patch
+input-cyttsp4_core-fix-use-after-free-bug.patch
+sched-core-avoid-spurious-lock-dependencies.patch
+perf-core-consistently-fail-fork-on-allocation-failu.patch
+alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch
+drm-sun4i-tcon-set-min-division-of-tcon0_dclk-to-1.patch
+selftests-kvm-fix-build-with-glibc-2.30.patch
+rsxx-add-missed-destroy_workqueue-calls-in-remove.patch
+net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch
+i2c-core-fix-use-after-free-in-of_i2c_notify.patch
+serial-core-allow-processing-sysrq-at-port-unlock-ti.patch
+cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch
+iwlwifi-mvm-synchronize-tid-queue-removal.patch
+iwlwifi-trans-clear-persistence-bit-when-starting-th.patch
+iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch
+dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch
+arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch
+audit-embed-key-into-chunk.patch
+netfilter-nf_tables-don-t-use-position-attribute-on-.patch
+arc-ioc-panic-if-kernel-was-started-with-previously-.patch
+net-mlx5-release-resource-on-error-flow.patch
+pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch
+pinctrl-sh-pfc-r8a7795-fix-vin-versioned-groups.patch
+clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch
+ice-fix-nvm-mask-defines.patch
+dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch
+arm-dts-exynos-fix-ldo13-min-values-on-odroid-xu3-xu.patch
+extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch
+net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch
+rtc-s3c-rtc-avoid-using-broken-almyear-register.patch
+rtc-max77686-fix-the-returned-value-in-case-of-error.patch
+i40e-don-t-restart-nway-if-autoneg-not-supported.patch
+virtchnl-fix-off-by-one-error.patch
+clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch
+clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch
+arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch
+dlm-fix-missing-idr_destroy-for-recover_idr.patch
+mips-sibyte-enable-zone_dma32-for-littlesur.patch
+net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch
+scsi-zfcp-update-kernel-message-for-invalid-fcp_cmnd.patch
+scsi-zfcp-drop-default-switch-case-which-might-paper.patch
+drivers-soc-allow-building-the-amlogic-drivers-witho.patch
+bus-ti-sysc-fix-getting-optional-clocks-in-clock_rol.patch
+arm-dts-imx6-rdu2-fix-egalax-touchscreen-node.patch
+crypto-ecc-check-for-invalid-values-in-the-key-verif.patch
+crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch
+arm64-dts-zynqmp-fix-node-names-which-contain-_.patch
+pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch
+staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch
+firmware-raspberrypi-fix-firmware-calls-with-large-b.patch
+mm-vmstat.c-fix-numa-statistics-updates.patch
+clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch
+clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch
+sctp-count-sk_wmem_alloc-by-skb-truesize-in-sctp_pac.patch
+regulator-fix-return-value-of-_set_load-stub.patch
+usb-serial-f81534-fix-reading-old-new-ic-config.patch
+xfs-extent-shifting-doesn-t-fully-invalidate-page-ca.patch
+net-next-hinic-fix-a-bug-in-set-mac-address.patch
+net-next-hinic-fix-a-bug-in-rx-data-flow.patch
+ice-fix-return-value-from-napi-poll.patch
+ice-fix-possible-null-pointer-de-reference.patch
+iomap-fua-is-wrong-for-dio-o_dsync-writes-into-unwri.patch
+iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch
+iomap-dio-data-corruption-and-spurious-errors-when-p.patch
+iomap-readpages-doesn-t-zero-page-tail-beyond-eof.patch
+iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch
+mips-octeon-octeon-platform-fix-typing.patch
+net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch
+math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch
+nds32-fix-the-items-of-hwcap_str-ordering-issue.patch
+rtc-max8997-fix-the-returned-value-in-case-of-error-.patch
+rtc-dt-binding-abx80x-fix-resistance-scale.patch
+arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch
+media-coda-fix-memory-corruption-in-case-more-than-3.patch
+media-pulse8-cec-return-0-when-invalidating-the-logi.patch
+media-cec-report-vendor-id-after-initialization.patch
+iwlwifi-fix-cfg-structs-for-22000-with-different-rf-.patch
+arm64-dts-allwinner-a64-enable-sound-on-pinebook.patch
+ravb-clean-up-duplex-handling.patch
+net-ipv6-re-do-dad-when-interface-has-iff_noarp-flag.patch
+dmaengine-coh901318-fix-a-double-lock-bug.patch
+dmaengine-dw-dmac-implement-dma-protection-control-s.patch
+net-qualcomm-rmnet-move-null-check-on-dev-before-der.patch
+selftests-powerpc-allocate-base-registers.patch
+selftests-powerpc-skip-test-instead-of-failing.patch
+usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch
+usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch
+acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch
+f2fs-fix-to-account-preflush-command-for-noflush_mer.patch
+f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch
+f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch
+arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch
+arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch
+f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch
+bpf-arm64-fix-getting-subprog-addr-from-aux-for-call.patch
+sparc-fix-jit-fused-branch-convergance.patch
+sparc-correct-ctx-saw_frame_pointer-logic.patch
+nvme-free-ctrl-device-name-on-init-failure.patch
+dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch
+slimbus-ngd-fix-build-error-on-x86.patch
+altera-stapl-check-for-a-null-key-before-strcasecmp-.patch
+serial-imx-fix-error-handling-in-console_setup.patch
+i2c-imx-don-t-print-error-message-on-probe-defer.patch
+clk-meson-fix-gxl-hdmi-pll-fractional-bits-width.patch
+gpu-host1x-fix-syncpoint-id-field-size-on-tegra186.patch
+lockd-fix-decoding-of-test-results.patch
+sctp-increase-sk_wmem_alloc-when-head-truesize-is-in.patch
+arm64-dts-qcom-sdm845-mtp-mark-protected-gcc-clocks.patch
+iommu-amd-fix-line-break-in-error-log-reporting.patch
+asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch
+arm-dts-sun4i-fix-gpio-keys-warning.patch
+arm-dts-sun4i-fix-hdmi-output-dtc-warning.patch
+arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch
+arm-dts-r8a779-01-disable-unconnected-lvds-encoders.patch
+arm-dts-sun7i-fix-hdmi-output-dtc-warning.patch
+arm-dts-sun8i-a23-a33-fix-opp-dtc-warnings.patch
+arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch
+dlm-null-check-before-kmem_cache_destroy-is-not-need.patch
+arm-debug-enable-uart1-for-socfpga-cyclone5.patch
+can-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch
+nfsd-fix-a-warning-in-__cld_pipe_upcall.patch
+bpf-btf-implement-btf_name_valid_identifier.patch
+bpf-btf-check-name-validity-for-various-types.patch
+tools-bpftool-fix-a-bitfield-pretty-print-issue.patch
+scsi-qedi-allocate-irqs-based-on-msix_cnt.patch
+asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch
+gpio-of-parse-mmc-specific-cd-and-wp-properties.patch
+arm-omap1-2-fix-soc-name-printing.patch
+arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch
+arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch
+arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch
+arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch
+net-x25-fix-called-calling-length-calculation-in-x25.patch
+net-x25-fix-null_x25_address-handling.patch
+tools-bpf-make-libbpf-_gnu_source-friendly.patch
+clk-mediatek-drop-more-__init-markings-for-driver-pr.patch
+soc-renesas-r8a77970-sysc-correct-names-of-a2dp-a2cn.patch
+soc-renesas-r8a77980-sysc-correct-names-of-a2dp-01-p.patch
+soc-renesas-r8a77980-sysc-correct-a3vip-012-power-do.patch
+kbuild-disable-dtc-simple_bus_reg-warnings-by-defaul.patch
+kbuild-enable-dtc-graph_port-warning-by-default.patch
+tcp-make-tcp_space-aware-of-socket-backlog.patch
+arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch
+arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch
+tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch
+tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch
+tcp-fix-snmp-tcp-timeout-under-estimation.patch
+modpost-skip-elf-local-symbols-during-section-mismat.patch
+kbuild-fix-single-target-build-for-external-module.patch
+mtd-fix-mtd_oobavail-incoherent-returned-value.patch
+arm-dts-pxa-clean-up-usb-controller-nodes.patch
+clk-meson-meson8b-fix-the-offset-of-vid_pll_dco-s-n-.patch
+arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch
+clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch
+clk-qcom-fix-msm8998-resets.patch
+media-cxd2880-spi-fix-probe-when-dvb_attach-fails.patch
+arm-dts-realview-fix-some-more-duplicate-regulator-n.patch
+dlm-fix-invalid-cluster-name-warning.patch
+net-mlx4_core-fix-return-codes-of-unsupported-operat.patch
+pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch
+powerpc-math-emu-update-macros-from-gcc.patch
+clk-renesas-r8a77990-correct-parent-clock-of-du.patch
+clk-renesas-r8a77995-correct-parent-clock-of-du.patch
+mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch
+nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch
+media-uvcvideo-abstract-streaming-object-lifetime.patch
+tty-serial-qcom_geni_serial-fix-softlock.patch
+arm-dts-sun8i-h3-fix-the-system-control-register-ran.patch
+tty-don-t-block-on-io-when-ldisc-change-is-pending.patch
+media-stkwebcam-bugfix-for-wrong-return-values.patch
+firmware-qcom-scm-fix-compilation-error-when-disable.patch
+clk-qcom-gcc-msm8998-disable-halt-check-of-ufs-clock.patch
+sctp-frag_point-sanity-check.patch
+soc-renesas-r8a77990-sysc-fix-initialization-order-o.patch
+mlxsw-spectrum_router-relax-gre-decap-matching-check.patch
+arm-dts-sun8i-a23-a33-fix-up-rtc-device-node.patch
+arm64-dts-allwinner-a64-fix-up-rtc-device-node-and-c.patch
+ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch
+ib-hfi1-close-vnic-sdma_progress-sleep-window.patch
+mlx4-use-snprintf-instead-of-complicated-strcpy.patch
+usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch
+clk-renesas-rcar-gen3-set-state-when-registering-sd-.patch
+asoc-max9867-fix-power-management.patch
+arm-dts-sunxi-fix-pmu-compatible-strings.patch
+arm-dts-am335x-pdu001-fix-polarity-of-card-detection.patch
+media-vimc-fix-start-stream-when-link-is-disabled.patch
+net-aquantia-fix-rss-table-and-key-sizes.patch
--- /dev/null
+From aa85b14b2524e79ea86e91884ca9f1aff1f72173 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Nov 2018 12:25:25 +0000
+Subject: slimbus: ngd: Fix build error on x86
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+[ Upstream commit 458a445deb9c9fb13cec46fe9b179a84d2ff514f ]
+
+on non DT platforms like x86 of_match_node is set to NULL, dereferencing
+directly would throw an error.
+Fix this by doing this in two steps, get the match then the data.
+
+Reported-by: Greg KH <gregkh@linuxfoundation.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
+index d72f8eed2e8b7..9221ba7b78637 100644
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1326,11 +1326,12 @@ static int of_qcom_slim_ngd_register(struct device *parent,
+ {
+ const struct ngd_reg_offset_data *data;
+ struct qcom_slim_ngd *ngd;
++ const struct of_device_id *match;
+ struct device_node *node;
+ u32 id;
+
+- data = of_match_node(qcom_slim_ngd_dt_match, parent->of_node)->data;
+-
++ match = of_match_node(qcom_slim_ngd_dt_match, parent->of_node);
++ data = match->data;
+ for_each_available_child_of_node(parent->of_node, node) {
+ if (of_property_read_u32(node, "reg", &id))
+ continue;
+--
+2.20.1
+
--- /dev/null
+From 4a7fac1ebd743609182b4011c7084f9cbd26d001 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 11:56:16 +0100
+Subject: soc: renesas: r8a77970-sysc: Correct names of A2DP/A2CN power domains
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b5eb730e031acaba2d25e8f522ac5966a70885ae ]
+
+The R-Car Gen3 HardWare Manual Errata for Rev. 0.80 (Feb 28, 2018)
+renamed the A2IR2 and A2IR3 power domains on R-Car V3M to A2DP resp.
+A2CN.
+
+As these definitions are not yet used from DT, they can just be renamed.
+
+While at it, fix the indentation of the A3IR definition.
+
+Fixes: 833bdb47c826a1a6 ("dt-bindings: power: add R8A77970 SYSC power domain definitions")
+Fixes: bab9b2a74fe9da96 ("soc: renesas: rcar-sysc: add R8A77970 support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/r8a77970-sysc.c | 4 ++--
+ include/dt-bindings/power/r8a77970-sysc.h | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/soc/renesas/r8a77970-sysc.c b/drivers/soc/renesas/r8a77970-sysc.c
+index caf894f193edc..77422baa7a56a 100644
+--- a/drivers/soc/renesas/r8a77970-sysc.c
++++ b/drivers/soc/renesas/r8a77970-sysc.c
+@@ -27,8 +27,8 @@ static const struct rcar_sysc_area r8a77970_areas[] __initconst = {
+ { "a3ir", 0x180, 0, R8A77970_PD_A3IR, R8A77970_PD_ALWAYS_ON },
+ { "a2ir0", 0x400, 0, R8A77970_PD_A2IR0, R8A77970_PD_A3IR },
+ { "a2ir1", 0x400, 1, R8A77970_PD_A2IR1, R8A77970_PD_A3IR },
+- { "a2ir2", 0x400, 2, R8A77970_PD_A2IR2, R8A77970_PD_A3IR },
+- { "a2ir3", 0x400, 3, R8A77970_PD_A2IR3, R8A77970_PD_A3IR },
++ { "a2dp", 0x400, 2, R8A77970_PD_A2DP, R8A77970_PD_A3IR },
++ { "a2cn", 0x400, 3, R8A77970_PD_A2CN, R8A77970_PD_A3IR },
+ { "a2sc0", 0x400, 4, R8A77970_PD_A2SC0, R8A77970_PD_A3IR },
+ { "a2sc1", 0x400, 5, R8A77970_PD_A2SC1, R8A77970_PD_A3IR },
+ };
+diff --git a/include/dt-bindings/power/r8a77970-sysc.h b/include/dt-bindings/power/r8a77970-sysc.h
+index bf54779d16252..9eaf824b15826 100644
+--- a/include/dt-bindings/power/r8a77970-sysc.h
++++ b/include/dt-bindings/power/r8a77970-sysc.h
+@@ -19,10 +19,10 @@
+ #define R8A77970_PD_CR7 13
+ #define R8A77970_PD_CA53_SCU 21
+ #define R8A77970_PD_A2IR0 23
+-#define R8A77970_PD_A3IR 24
++#define R8A77970_PD_A3IR 24
+ #define R8A77970_PD_A2IR1 27
+-#define R8A77970_PD_A2IR2 28
+-#define R8A77970_PD_A2IR3 29
++#define R8A77970_PD_A2DP 28
++#define R8A77970_PD_A2CN 29
+ #define R8A77970_PD_A2SC0 30
+ #define R8A77970_PD_A2SC1 31
+
+--
+2.20.1
+
--- /dev/null
+From 933317dbc60ef5e1dd9bc2ec94557c88626cb375 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 11:56:18 +0100
+Subject: soc: renesas: r8a77980-sysc: Correct A3VIP[012] power domain
+ hierarchy
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 160bfa7c724b348a90a12dd9694f351927a15b8e ]
+
+The R-Car Gen3 HardWare Manual Errata for Rev. 0.80 (Feb 28, 2018)
+renamed the A3VIP power domain on R-Car V3H to A3VIP0, and clarified the
+power domain hierarchy for the A3VIP[012] power domains.
+
+As the definition for the A3VIP0 domain is not yet used from DT, it can
+just be renamed.
+
+Fixes: 7755b40d07a8dba7 ("dt-bindings: power: add R8A77980 SYSC power domain definitions")
+Fixes: 41d6d8bd8ae94ca9 ("soc: renesas: rcar-sysc: add R8A77980 support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/r8a77980-sysc.c | 6 +++---
+ include/dt-bindings/power/r8a77980-sysc.h | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soc/renesas/r8a77980-sysc.c b/drivers/soc/renesas/r8a77980-sysc.c
+index dbb2621ce4e3e..a8dbe55e8ba82 100644
+--- a/drivers/soc/renesas/r8a77980-sysc.c
++++ b/drivers/soc/renesas/r8a77980-sysc.c
+@@ -41,9 +41,9 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = {
+ { "a2dp0", 0x400, 11, R8A77980_PD_A2DP0, R8A77980_PD_A3IR },
+ { "a2dp1", 0x400, 12, R8A77980_PD_A2DP1, R8A77980_PD_A3IR },
+ { "a2cn", 0x400, 13, R8A77980_PD_A2CN, R8A77980_PD_A3IR },
+- { "a3vip", 0x2c0, 0, R8A77980_PD_A3VIP, R8A77980_PD_ALWAYS_ON },
+- { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_A3VIP },
+- { "a3vip2", 0x280, 0, R8A77980_PD_A3VIP2, R8A77980_PD_A3VIP },
++ { "a3vip0", 0x2c0, 0, R8A77980_PD_A3VIP0, R8A77980_PD_ALWAYS_ON },
++ { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_ALWAYS_ON },
++ { "a3vip2", 0x280, 0, R8A77980_PD_A3VIP2, R8A77980_PD_ALWAYS_ON },
+ };
+
+ const struct rcar_sysc_info r8a77980_sysc_info __initconst = {
+diff --git a/include/dt-bindings/power/r8a77980-sysc.h b/include/dt-bindings/power/r8a77980-sysc.h
+index 7bebe7e8dbdbb..e12c8587b87ec 100644
+--- a/include/dt-bindings/power/r8a77980-sysc.h
++++ b/include/dt-bindings/power/r8a77980-sysc.h
+@@ -22,7 +22,7 @@
+ #define R8A77980_PD_CA53_CPU2 7
+ #define R8A77980_PD_CA53_CPU3 8
+ #define R8A77980_PD_A2CN 10
+-#define R8A77980_PD_A3VIP 11
++#define R8A77980_PD_A3VIP0 11
+ #define R8A77980_PD_A2IR5 12
+ #define R8A77980_PD_CR7 13
+ #define R8A77980_PD_A2IR4 15
+--
+2.20.1
+
--- /dev/null
+From 325907c80a4b2c2350dbbc4070c70637327e1173 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 11:56:17 +0100
+Subject: soc: renesas: r8a77980-sysc: Correct names of A2DP[01] power domains
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 97473bc85b22ac610b1810b6a9a4669a6cb0b7b0 ]
+
+The R-Car Gen3 HardWare Manual Errata for Rev. 0.80 (Feb 28, 2018)
+renamed the A2PD0 and A2DP0 power domains on R-Car V3H to A2DP0 resp.
+A2DP1.
+
+As these definitions are not yet used from DT, they can just be renamed.
+
+Fixes: 7755b40d07a8dba7 ("dt-bindings: power: add R8A77980 SYSC power domain definitions")
+Fixes: 41d6d8bd8ae94ca9 ("soc: renesas: rcar-sysc: add R8A77980 support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/r8a77980-sysc.c | 4 ++--
+ include/dt-bindings/power/r8a77980-sysc.h | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soc/renesas/r8a77980-sysc.c b/drivers/soc/renesas/r8a77980-sysc.c
+index 9265fb525ef34..dbb2621ce4e3e 100644
+--- a/drivers/soc/renesas/r8a77980-sysc.c
++++ b/drivers/soc/renesas/r8a77980-sysc.c
+@@ -38,8 +38,8 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = {
+ { "a2sc2", 0x400, 8, R8A77980_PD_A2SC2, R8A77980_PD_A3IR },
+ { "a2sc3", 0x400, 9, R8A77980_PD_A2SC3, R8A77980_PD_A3IR },
+ { "a2sc4", 0x400, 10, R8A77980_PD_A2SC4, R8A77980_PD_A3IR },
+- { "a2pd0", 0x400, 11, R8A77980_PD_A2PD0, R8A77980_PD_A3IR },
+- { "a2pd1", 0x400, 12, R8A77980_PD_A2PD1, R8A77980_PD_A3IR },
++ { "a2dp0", 0x400, 11, R8A77980_PD_A2DP0, R8A77980_PD_A3IR },
++ { "a2dp1", 0x400, 12, R8A77980_PD_A2DP1, R8A77980_PD_A3IR },
+ { "a2cn", 0x400, 13, R8A77980_PD_A2CN, R8A77980_PD_A3IR },
+ { "a3vip", 0x2c0, 0, R8A77980_PD_A3VIP, R8A77980_PD_ALWAYS_ON },
+ { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_A3VIP },
+diff --git a/include/dt-bindings/power/r8a77980-sysc.h b/include/dt-bindings/power/r8a77980-sysc.h
+index 2c90c12377253..7bebe7e8dbdbb 100644
+--- a/include/dt-bindings/power/r8a77980-sysc.h
++++ b/include/dt-bindings/power/r8a77980-sysc.h
+@@ -15,8 +15,8 @@
+ #define R8A77980_PD_A2SC2 0
+ #define R8A77980_PD_A2SC3 1
+ #define R8A77980_PD_A2SC4 2
+-#define R8A77980_PD_A2PD0 3
+-#define R8A77980_PD_A2PD1 4
++#define R8A77980_PD_A2DP0 3
++#define R8A77980_PD_A2DP1 4
+ #define R8A77980_PD_CA53_CPU0 5
+ #define R8A77980_PD_CA53_CPU1 6
+ #define R8A77980_PD_CA53_CPU2 7
+--
+2.20.1
+
--- /dev/null
+From af5078c5c96e7a45beade6ab45c19f94fc985b9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 5 Dec 2018 16:39:42 +0100
+Subject: soc: renesas: r8a77990-sysc: Fix initialization order of 3DG-{A,B}
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b0d7fbf8b174168c580bb310964c3c809e5569a9 ]
+
+The workaround for the wrong hierarchy of the 3DG-{A,B} power
+domains on R-Car E3 ES1.0 corrected the parent domains.
+However, the 3DG-{A,B} power domains were still initialized and powered
+in the wrong order, causing 3DG operation to fail.
+
+Fix this by changing the order in the table at runtime, when running on
+an affected SoC.
+
+Fixes: 086b399965a7ee7e ("soc: renesas: r8a77990-sysc: Add workaround for 3DG-{A,B}")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/renesas/r8a77990-sysc.c | 23 ++++-------------------
+ 1 file changed, 4 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/soc/renesas/r8a77990-sysc.c b/drivers/soc/renesas/r8a77990-sysc.c
+index 15579ebc5ed20..664b244eb1dd9 100644
+--- a/drivers/soc/renesas/r8a77990-sysc.c
++++ b/drivers/soc/renesas/r8a77990-sysc.c
+@@ -28,19 +28,6 @@ static struct rcar_sysc_area r8a77990_areas[] __initdata = {
+ { "3dg-b", 0x100, 1, R8A77990_PD_3DG_B, R8A77990_PD_3DG_A },
+ };
+
+-static void __init rcar_sysc_fix_parent(struct rcar_sysc_area *areas,
+- unsigned int num_areas, u8 id,
+- int new_parent)
+-{
+- unsigned int i;
+-
+- for (i = 0; i < num_areas; i++)
+- if (areas[i].isr_bit == id) {
+- areas[i].parent = new_parent;
+- return;
+- }
+-}
+-
+ /* Fixups for R-Car E3 ES1.0 revision */
+ static const struct soc_device_attribute r8a77990[] __initconst = {
+ { .soc_id = "r8a77990", .revision = "ES1.0" },
+@@ -50,12 +37,10 @@ static const struct soc_device_attribute r8a77990[] __initconst = {
+ static int __init r8a77990_sysc_init(void)
+ {
+ if (soc_device_match(r8a77990)) {
+- rcar_sysc_fix_parent(r8a77990_areas,
+- ARRAY_SIZE(r8a77990_areas),
+- R8A77990_PD_3DG_A, R8A77990_PD_3DG_B);
+- rcar_sysc_fix_parent(r8a77990_areas,
+- ARRAY_SIZE(r8a77990_areas),
+- R8A77990_PD_3DG_B, R8A77990_PD_ALWAYS_ON);
++ /* Fix incorrect 3DG hierarchy */
++ swap(r8a77990_areas[7], r8a77990_areas[8]);
++ r8a77990_areas[7].parent = R8A77990_PD_ALWAYS_ON;
++ r8a77990_areas[8].parent = R8A77990_PD_3DG_B;
+ }
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 3b0f977d42379ab3f66bfe85710f3519ef0450dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 14:52:18 -0800
+Subject: sparc: Correct ctx->saw_frame_pointer logic.
+
+From: David Miller <davem@davemloft.net>
+
+[ Upstream commit e2ac579a7a18bcd9e8cf14cf42eac0b8a2ba6c4b ]
+
+We need to initialize the frame pointer register not just if it is
+seen as a source operand, but also if it is seen as the destination
+operand of a store or an atomic instruction (which effectively is a
+source operand).
+
+This is exercised by test_verifier's "non-invalid fp arithmetic"
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/net/bpf_jit_comp_64.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
+index 7217d63596431..ec4da4dc98f12 100644
+--- a/arch/sparc/net/bpf_jit_comp_64.c
++++ b/arch/sparc/net/bpf_jit_comp_64.c
+@@ -1270,6 +1270,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ u32 opcode = 0, rs2;
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_2_used = true;
+ emit_loadimm(imm, tmp2, ctx);
+
+@@ -1308,6 +1311,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp = bpf2sparc[TMP_REG_1];
+ u32 opcode = 0, rs2;
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ switch (BPF_SIZE(code)) {
+ case BPF_W:
+ opcode = ST32;
+@@ -1340,6 +1346,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ const u8 tmp3 = bpf2sparc[TMP_REG_3];
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_1_used = true;
+ ctx->tmp_2_used = true;
+ ctx->tmp_3_used = true;
+@@ -1360,6 +1369,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
+ const u8 tmp2 = bpf2sparc[TMP_REG_2];
+ const u8 tmp3 = bpf2sparc[TMP_REG_3];
+
++ if (insn->dst_reg == BPF_REG_FP)
++ ctx->saw_frame_pointer = true;
++
+ ctx->tmp_1_used = true;
+ ctx->tmp_2_used = true;
+ ctx->tmp_3_used = true;
+--
+2.20.1
+
--- /dev/null
+From 16b0dfb086f7808ffc8fda9a77141ff822a2b73d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 26 Nov 2018 13:03:46 -0800
+Subject: sparc: Fix JIT fused branch convergance.
+
+From: David Miller <davem@davemloft.net>
+
+[ Upstream commit c44768a33da81b4a0986e79bbf0588f1a0651dec ]
+
+On T4 and later sparc64 cpus we can use the fused compare and branch
+instruction.
+
+However, it can only be used if the branch destination is in the range
+of a signed 10-bit immediate offset. This amounts to 1024
+instructions forwards or backwards.
+
+After the commit referenced in the Fixes: tag, the largest possible
+size program seen by the JIT explodes by a significant factor.
+
+As a result of this convergance takes many more passes since the
+expanded "BPF_LDX | BPF_MSH | BPF_B" code sequence, for example,
+contains several embedded branch on condition instructions.
+
+On each pass, as suddenly new fused compare and branch instances
+become valid, this makes thousands more in range for the next pass.
+And so on and so forth.
+
+This is most greatly exemplified by "BPF_MAXINSNS: exec all MSH" which
+takes 35 passes to converge, and shrinks the image by about 64K.
+
+To decrease the cost of this number of convergance passes, do the
+convergance pass before we have the program image allocated, just like
+other JITs (such as x86) do.
+
+Fixes: e0cea7ce988c ("bpf: implement ld_abs/ld_ind in native bpf")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/net/bpf_jit_comp_64.c | 77 ++++++++++++++++++++------------
+ 1 file changed, 49 insertions(+), 28 deletions(-)
+
+diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
+index 222785af550b4..7217d63596431 100644
+--- a/arch/sparc/net/bpf_jit_comp_64.c
++++ b/arch/sparc/net/bpf_jit_comp_64.c
+@@ -1425,12 +1425,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ struct bpf_prog *tmp, *orig_prog = prog;
+ struct sparc64_jit_data *jit_data;
+ struct bpf_binary_header *header;
++ u32 prev_image_size, image_size;
+ bool tmp_blinded = false;
+ bool extra_pass = false;
+ struct jit_ctx ctx;
+- u32 image_size;
+ u8 *image_ptr;
+- int pass;
++ int pass, i;
+
+ if (!prog->jit_requested)
+ return orig_prog;
+@@ -1461,61 +1461,82 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
+ header = jit_data->header;
+ extra_pass = true;
+ image_size = sizeof(u32) * ctx.idx;
++ prev_image_size = image_size;
++ pass = 1;
+ goto skip_init_ctx;
+ }
+
+ memset(&ctx, 0, sizeof(ctx));
+ ctx.prog = prog;
+
+- ctx.offset = kcalloc(prog->len, sizeof(unsigned int), GFP_KERNEL);
++ ctx.offset = kmalloc_array(prog->len, sizeof(unsigned int), GFP_KERNEL);
+ if (ctx.offset == NULL) {
+ prog = orig_prog;
+ goto out_off;
+ }
+
+- /* Fake pass to detect features used, and get an accurate assessment
+- * of what the final image size will be.
++ /* Longest sequence emitted is for bswap32, 12 instructions. Pre-cook
++ * the offset array so that we converge faster.
+ */
+- if (build_body(&ctx)) {
+- prog = orig_prog;
+- goto out_off;
+- }
+- build_prologue(&ctx);
+- build_epilogue(&ctx);
++ for (i = 0; i < prog->len; i++)
++ ctx.offset[i] = i * (12 * 4);
+
+- /* Now we know the actual image size. */
+- image_size = sizeof(u32) * ctx.idx;
+- header = bpf_jit_binary_alloc(image_size, &image_ptr,
+- sizeof(u32), jit_fill_hole);
+- if (header == NULL) {
+- prog = orig_prog;
+- goto out_off;
+- }
+-
+- ctx.image = (u32 *)image_ptr;
+-skip_init_ctx:
+- for (pass = 1; pass < 3; pass++) {
++ prev_image_size = ~0U;
++ for (pass = 1; pass < 40; pass++) {
+ ctx.idx = 0;
+
+ build_prologue(&ctx);
+-
+ if (build_body(&ctx)) {
+- bpf_jit_binary_free(header);
+ prog = orig_prog;
+ goto out_off;
+ }
+-
+ build_epilogue(&ctx);
+
+ if (bpf_jit_enable > 1)
+- pr_info("Pass %d: shrink = %d, seen = [%c%c%c%c%c%c]\n", pass,
+- image_size - (ctx.idx * 4),
++ pr_info("Pass %d: size = %u, seen = [%c%c%c%c%c%c]\n", pass,
++ ctx.idx * 4,
+ ctx.tmp_1_used ? '1' : ' ',
+ ctx.tmp_2_used ? '2' : ' ',
+ ctx.tmp_3_used ? '3' : ' ',
+ ctx.saw_frame_pointer ? 'F' : ' ',
+ ctx.saw_call ? 'C' : ' ',
+ ctx.saw_tail_call ? 'T' : ' ');
++
++ if (ctx.idx * 4 == prev_image_size)
++ break;
++ prev_image_size = ctx.idx * 4;
++ cond_resched();
++ }
++
++ /* Now we know the actual image size. */
++ image_size = sizeof(u32) * ctx.idx;
++ header = bpf_jit_binary_alloc(image_size, &image_ptr,
++ sizeof(u32), jit_fill_hole);
++ if (header == NULL) {
++ prog = orig_prog;
++ goto out_off;
++ }
++
++ ctx.image = (u32 *)image_ptr;
++skip_init_ctx:
++ ctx.idx = 0;
++
++ build_prologue(&ctx);
++
++ if (build_body(&ctx)) {
++ bpf_jit_binary_free(header);
++ prog = orig_prog;
++ goto out_off;
++ }
++
++ build_epilogue(&ctx);
++
++ if (ctx.idx * 4 != prev_image_size) {
++ pr_err("bpf_jit: Failed to converge, prev_size=%u size=%d\n",
++ prev_image_size, ctx.idx * 4);
++ bpf_jit_binary_free(header);
++ prog = orig_prog;
++ goto out_off;
+ }
+
+ if (bpf_jit_enable > 1)
+--
+2.20.1
+
--- /dev/null
+From d38e6028da8d578c3a5a1ed35a13f6407da2b9cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Nov 2018 04:19:07 +0530
+Subject: Staging: iio: adt7316: Fix i2c data reading, set the data field
+
+From: Shreeya Patel <shreeya.patel23498@gmail.com>
+
+[ Upstream commit 688cd642ba0c393344c802647848da5f0d925d0e ]
+
+adt7316_i2c_read function nowhere sets the data field.
+It is necessary to have an appropriate value for it.
+Hence, assign the value stored in 'ret' variable to data field.
+
+This is an ancient bug, and as no one seems to have noticed,
+probably no sense in applying it to stable.
+
+Signed-off-by: Shreeya Patel <shreeya.patel23498@gmail.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/iio/addac/adt7316-i2c.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c
+index f66dd3ebbab1f..856bcfa60c6c4 100644
+--- a/drivers/staging/iio/addac/adt7316-i2c.c
++++ b/drivers/staging/iio/addac/adt7316-i2c.c
+@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data)
+ return ret;
+ }
+
++ *data = ret;
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 119f092d794527f144ab181f7117cae7313d6d03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 16:06:43 -0800
+Subject: tcp: fix off-by-one bug on aborting window-probing socket
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit 3976535af0cb9fe34a55f2ffb8d7e6b39a2f8188 ]
+
+Previously there is an off-by-one bug on determining when to abort
+a stalled window-probing socket. This patch fixes that so it is
+consistent with tcp_write_timeout().
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_timer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index c719a41d2eba2..50b15e1c633b4 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -378,7 +378,7 @@ static void tcp_probe_timer(struct sock *sk)
+ return;
+ }
+
+- if (icsk->icsk_probes_out > max_probes) {
++ if (icsk->icsk_probes_out >= max_probes) {
+ abort: tcp_write_err(sk);
+ } else {
+ /* Only send another probe if we didn't close things up. */
+--
+2.20.1
+
--- /dev/null
+From 8729908c46864c5f0fc9ab0edcc0ca45cf45e3b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 16:06:45 -0800
+Subject: tcp: fix SNMP TCP timeout under-estimation
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit e1561fe2dd69dc5dddd69bd73aa65355bdfb048b ]
+
+Previously the SNMP TCPTIMEOUTS counter has inconsistent accounting:
+1. It counts all SYN and SYN-ACK timeouts
+2. It counts timeouts in other states except recurring timeouts and
+ timeouts after fast recovery or disorder state.
+
+Such selective accounting makes analysis difficult and complicated. For
+example the monitoring system needs to collect many other SNMP counters
+to infer the total amount of timeout events. This patch makes TCPTIMEOUTS
+counter simply counts all the retransmit timeout (SYN or data or FIN).
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_timer.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 50b15e1c633b4..681882a409686 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -482,11 +482,12 @@ void tcp_retransmit_timer(struct sock *sk)
+ goto out_reset_timer;
+ }
+
++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS);
+ if (tcp_write_timeout(sk))
+ goto out;
+
+ if (icsk->icsk_retransmits == 0) {
+- int mib_idx;
++ int mib_idx = 0;
+
+ if (icsk->icsk_ca_state == TCP_CA_Recovery) {
+ if (tcp_is_sack(tp))
+@@ -501,10 +502,9 @@ void tcp_retransmit_timer(struct sock *sk)
+ mib_idx = LINUX_MIB_TCPSACKFAILURES;
+ else
+ mib_idx = LINUX_MIB_TCPRENOFAILURES;
+- } else {
+- mib_idx = LINUX_MIB_TCPTIMEOUTS;
+ }
+- __NET_INC_STATS(sock_net(sk), mib_idx);
++ if (mib_idx)
++ __NET_INC_STATS(sock_net(sk), mib_idx);
+ }
+
+ tcp_enter_loss(sk);
+--
+2.20.1
+
--- /dev/null
+From bcdaa263a36678b6f27bd42b62f40d403cca9395 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 16:06:44 -0800
+Subject: tcp: fix SNMP under-estimation on failed retransmission
+
+From: Yuchung Cheng <ycheng@google.com>
+
+[ Upstream commit ec641b39457e17774313b66697a8a1dc070257bd ]
+
+Previously the SNMP counter LINUX_MIB_TCPRETRANSFAIL is not counting
+the TSO/GSO properly on failed retransmission. This patch fixes that.
+
+Signed-off-by: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/tcp_output.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 53f910bb55087..8971cc15d278b 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2919,7 +2919,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)
+ TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS;
+ trace_tcp_retransmit_skb(sk, skb);
+ } else if (err != -EBUSY) {
+- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL);
++ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs);
+ }
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From c49305c5b845dec79ca6a4010a0866ca07842026 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Nov 2018 14:42:02 -0800
+Subject: tcp: make tcp_space() aware of socket backlog
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 85bdf7db5b53cdcc7a901db12bcb3d0063e3866d ]
+
+Jean-Louis Dupond reported poor iscsi TCP receive performance
+that we tracked to backlog drops.
+
+Apparently we fail to send window updates reflecting the
+fact that we are under stress.
+
+Note that we might lack a proper window increase when
+backlog is fully processed, since __release_sock() clears
+sk->sk_backlog.len _after_ all skbs have been processed.
+
+This should not matter in practice. If we had a significant
+load through socket backlog, we are in a dangerous
+situation.
+
+Reported-by: Jean-Louis Dupond <jean-louis@dupond.be>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Tested-by: Jean-Louis Dupond<jean-louis@dupond.be>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index abcf53a6db045..3f4223a550d92 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1353,7 +1353,7 @@ static inline int tcp_win_from_space(const struct sock *sk, int space)
+ /* Note: caller must be prepared to deal with negative returns */
+ static inline int tcp_space(const struct sock *sk)
+ {
+- return tcp_win_from_space(sk, sk->sk_rcvbuf -
++ return tcp_win_from_space(sk, sk->sk_rcvbuf - sk->sk_backlog.len -
+ atomic_read(&sk->sk_rmem_alloc));
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4aee2528a413d35015e65333818229898493b329 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 15:31:45 -0800
+Subject: tools/bpf: make libbpf _GNU_SOURCE friendly
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit b42699547fc9fb1057795bccc21a6445743a7fde ]
+
+During porting libbpf to bcc, I got some warnings like below:
+ ...
+ [ 2%] Building C object src/cc/CMakeFiles/bpf-shared.dir/libbpf/src/libbpf.c.o
+ /home/yhs/work/bcc2/src/cc/libbpf/src/libbpf.c:12:0:
+ warning: "_GNU_SOURCE" redefined [enabled by default]
+ #define _GNU_SOURCE
+ ...
+ [ 3%] Building C object src/cc/CMakeFiles/bpf-shared.dir/libbpf/src/libbpf_errno.c.o
+ /home/yhs/work/bcc2/src/cc/libbpf/src/libbpf_errno.c: In function ‘libbpf_strerror’:
+ /home/yhs/work/bcc2/src/cc/libbpf/src/libbpf_errno.c:45:7:
+ warning: assignment makes integer from pointer without a cast [enabled by default]
+ ret = strerror_r(err, buf, size);
+ ...
+
+bcc is built with _GNU_SOURCE defined and this caused the above warning.
+This patch intends to make libpf _GNU_SOURCE friendly by
+ . define _GNU_SOURCE in libbpf.c unless it is not defined
+ . undefine _GNU_SOURCE as non-gnu version of strerror_r is expected.
+
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 2 ++
+ tools/lib/bpf/libbpf_errno.c | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index a350f97e3a1a4..a62be78fc07b1 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -22,7 +22,9 @@
+ * License along with this program; if not, see <http://www.gnu.org/licenses>
+ */
+
++#ifndef _GNU_SOURCE
+ #define _GNU_SOURCE
++#endif
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <stdarg.h>
+diff --git a/tools/lib/bpf/libbpf_errno.c b/tools/lib/bpf/libbpf_errno.c
+index d9ba851bd7f9f..d2d17226d9d6b 100644
+--- a/tools/lib/bpf/libbpf_errno.c
++++ b/tools/lib/bpf/libbpf_errno.c
+@@ -20,6 +20,7 @@
+ * License along with this program; if not, see <http://www.gnu.org/licenses>
+ */
+
++#undef _GNU_SOURCE
+ #include <stdio.h>
+ #include <string.h>
+
+--
+2.20.1
+
--- /dev/null
+From 2652bd56bc9e07f3e4b9265787f7e2a6375f1bf6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 09:38:23 -0800
+Subject: tools: bpftool: fix a bitfield pretty print issue
+
+From: Yonghong Song <yhs@fb.com>
+
+[ Upstream commit 528bff0cdb6649f97f2c4802e4ac7a4b50645f2f ]
+
+Commit b12d6ec09730 ("bpf: btf: add btf print functionality")
+added btf pretty print functionality to bpftool.
+There is a problem though in printing a bitfield whose type
+has modifiers.
+
+For example, for a type like
+ typedef int ___int;
+ struct tmp_t {
+ int a:3;
+ ___int b:3;
+ };
+Suppose we have a map
+ struct bpf_map_def SEC("maps") tmpmap = {
+ .type = BPF_MAP_TYPE_HASH,
+ .key_size = sizeof(__u32),
+ .value_size = sizeof(struct tmp_t),
+ .max_entries = 1,
+ };
+and the hash table is populated with one element with
+key 0 and value (.a = 1 and .b = 2).
+
+In BTF, the struct member "b" will have a type "typedef" which
+points to an int type. The current implementation does not
+pass the bit offset during transition from typedef to int type,
+hence incorrectly print the value as
+ $ bpftool m d id 79
+ [{
+ "key": 0,
+ "value": {
+ "a": 0x1,
+ "b": 0x1
+ }
+ }
+ ]
+
+This patch fixed the issue by carrying bit_offset along the type
+chain during bit_field print. The correct result can be printed as
+ $ bpftool m d id 76
+ [{
+ "key": 0,
+ "value": {
+ "a": 0x1,
+ "b": 0x2
+ }
+ }
+ ]
+
+The kernel pretty print is implemented correctly and does not
+have this issue.
+
+Fixes: b12d6ec09730 ("bpf: btf: add btf print functionality")
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/bpf/bpftool/btf_dumper.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c
+index 55bc512a18318..e4e6e2b3fd847 100644
+--- a/tools/bpf/bpftool/btf_dumper.c
++++ b/tools/bpf/bpftool/btf_dumper.c
+@@ -32,7 +32,7 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw,
+ }
+
+ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
+- const void *data)
++ __u8 bit_offset, const void *data)
+ {
+ int actual_type_id;
+
+@@ -40,7 +40,7 @@ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id,
+ if (actual_type_id < 0)
+ return actual_type_id;
+
+- return btf_dumper_do_type(d, actual_type_id, 0, data);
++ return btf_dumper_do_type(d, actual_type_id, bit_offset, data);
+ }
+
+ static void btf_dumper_enum(const void *data, json_writer_t *jw)
+@@ -237,7 +237,7 @@ static int btf_dumper_do_type(const struct btf_dumper *d, __u32 type_id,
+ case BTF_KIND_VOLATILE:
+ case BTF_KIND_CONST:
+ case BTF_KIND_RESTRICT:
+- return btf_dumper_modifier(d, type_id, data);
++ return btf_dumper_modifier(d, type_id, bit_offset, data);
+ default:
+ jsonw_printf(d->jw, "(unsupported-kind");
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 6ee5c0a9837c1100ea2b426dae243f56fe8636a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Nov 2018 00:24:48 +0000
+Subject: tty: Don't block on IO when ldisc change is pending
+
+From: Dmitry Safonov <dima@arista.com>
+
+[ Upstream commit c96cf923a98d1b094df9f0cf97a83e118817e31b ]
+
+There might be situations where tty_ldisc_lock() has blocked, but there
+is already IO on tty and it prevents line discipline changes.
+It might theoretically turn into dead-lock.
+
+Basically, provide more priority to pending tty_ldisc_lock() than to
+servicing reads/writes over tty.
+
+User-visible issue was reported by Mikulas where on pa-risc with
+Debian 5 reboot took either 80 seconds, 3 minutes or 3:25 after proper
+locking in tty_reopen().
+
+Cc: Jiri Slaby <jslaby@suse.com>
+Reported-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/n_hdlc.c | 4 ++--
+ drivers/tty/n_r3964.c | 2 +-
+ drivers/tty/n_tty.c | 8 ++++----
+ drivers/tty/tty_ldisc.c | 7 +++++++
+ include/linux/tty.h | 7 +++++++
+ 5 files changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c
+index c943716c019e4..0636e10c76c7f 100644
+--- a/drivers/tty/n_hdlc.c
++++ b/drivers/tty/n_hdlc.c
+@@ -613,7 +613,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file,
+ }
+
+ /* no data */
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ ret = -EAGAIN;
+ break;
+ }
+@@ -680,7 +680,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file,
+ if (tbuf)
+ break;
+
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ error = -EAGAIN;
+ break;
+ }
+diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c
+index dbf1ab36758eb..a3969b773cbe4 100644
+--- a/drivers/tty/n_r3964.c
++++ b/drivers/tty/n_r3964.c
+@@ -1078,7 +1078,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
+ pMsg = remove_msg(pInfo, pClient);
+ if (pMsg == NULL) {
+ /* no messages available. */
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ ret = -EAGAIN;
+ goto unlock;
+ }
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 3ad460219fd62..5dc9686697cfa 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1702,7 +1702,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+
+ down_read(&tty->termios_rwsem);
+
+- while (1) {
++ do {
+ /*
+ * When PARMRK is set, each input char may take up to 3 chars
+ * in the read buf; reduce the buffer space avail by 3x
+@@ -1744,7 +1744,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp,
+ fp += n;
+ count -= n;
+ rcvd += n;
+- }
++ } while (!test_bit(TTY_LDISC_CHANGING, &tty->flags));
+
+ tty->receive_room = room;
+
+@@ -2211,7 +2211,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
+ break;
+ if (!timeout)
+ break;
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ retval = -EAGAIN;
+ break;
+ }
+@@ -2365,7 +2365,7 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
+ }
+ if (!nr)
+ break;
+- if (file->f_flags & O_NONBLOCK) {
++ if (tty_io_nonblock(tty, file)) {
+ retval = -EAGAIN;
+ break;
+ }
+diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
+index 53bb6d4e9e8d9..245c9a51c2de2 100644
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -336,6 +336,11 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ {
+ int ret;
+
++ /* Kindly asking blocked readers to release the read side */
++ set_bit(TTY_LDISC_CHANGING, &tty->flags);
++ wake_up_interruptible_all(&tty->read_wait);
++ wake_up_interruptible_all(&tty->write_wait);
++
+ ret = __tty_ldisc_lock(tty, timeout);
+ if (!ret)
+ return -EBUSY;
+@@ -346,6 +351,8 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ void tty_ldisc_unlock(struct tty_struct *tty)
+ {
+ clear_bit(TTY_LDISC_HALTED, &tty->flags);
++ /* Can be cleared here - ldisc_unlock will wake up writers firstly */
++ clear_bit(TTY_LDISC_CHANGING, &tty->flags);
+ __tty_ldisc_unlock(tty);
+ }
+
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 808fbfe86f858..76db046f09ab6 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -366,6 +366,7 @@ struct tty_file_private {
+ #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */
+ #define TTY_HUPPED 18 /* Post driver->hangup() */
+ #define TTY_HUPPING 19 /* Hangup in progress */
++#define TTY_LDISC_CHANGING 20 /* Change pending - non-block IO */
+ #define TTY_LDISC_HALTED 22 /* Line discipline is halted */
+
+ /* Values for tty->flow_change */
+@@ -383,6 +384,12 @@ static inline void tty_set_flow_change(struct tty_struct *tty, int val)
+ smp_mb();
+ }
+
++static inline bool tty_io_nonblock(struct tty_struct *tty, struct file *file)
++{
++ return file->f_flags & O_NONBLOCK ||
++ test_bit(TTY_LDISC_CHANGING, &tty->flags);
++}
++
+ static inline bool tty_io_error(struct tty_struct *tty)
+ {
+ return test_bit(TTY_IO_ERROR, &tty->flags);
+--
+2.20.1
+
--- /dev/null
+From 60ccf0d8459dc3cb43a4d80ace7a02ce12cf4dbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 18:18:40 -0800
+Subject: tty: serial: qcom_geni_serial: Fix softlock
+
+From: Ryan Case <ryandcase@chromium.org>
+
+[ Upstream commit a1fee899e5bed457afc20a6a2ff3915a95cc5942 ]
+
+Transfers were being divided into device FIFO sized (64 byte max)
+operations which would poll for completion within a spin_lock_irqsave /
+spin_unlock_irqrestore block. This both made things slow by waiting for
+the FIFO to completely drain before adding further data and would also
+result in softlocks on large transmissions.
+
+This patch allows larger transfers with continuous FIFO additions as
+space becomes available and removes polling from the interrupt handler.
+
+Signed-off-by: Ryan Case <ryandcase@chromium.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/qcom_geni_serial.c | 56 +++++++++++++++++++--------
+ 1 file changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
+index 69b980bb8ac29..b3f7d1a1e97f8 100644
+--- a/drivers/tty/serial/qcom_geni_serial.c
++++ b/drivers/tty/serial/qcom_geni_serial.c
+@@ -113,6 +113,8 @@ struct qcom_geni_serial_port {
+ u32 *rx_fifo;
+ u32 loopback;
+ bool brk;
++
++ unsigned int tx_remaining;
+ };
+
+ static const struct uart_ops qcom_geni_console_pops;
+@@ -435,6 +437,7 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ struct qcom_geni_serial_port *port;
+ bool locked = true;
+ unsigned long flags;
++ u32 geni_status;
+
+ WARN_ON(co->index < 0 || co->index >= GENI_UART_CONS_PORTS);
+
+@@ -448,6 +451,8 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ else
+ spin_lock_irqsave(&uport->lock, flags);
+
++ geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS);
++
+ /* Cancel the current write to log the fault */
+ if (!locked) {
+ geni_se_cancel_m_cmd(&port->se);
+@@ -461,9 +466,19 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s,
+ }
+ writel_relaxed(M_CMD_CANCEL_EN, uport->membase +
+ SE_GENI_M_IRQ_CLEAR);
++ } else if ((geni_status & M_GENI_CMD_ACTIVE) && !port->tx_remaining) {
++ /*
++ * It seems we can't interrupt existing transfers if all data
++ * has been sent, in which case we need to look for done first.
++ */
++ qcom_geni_serial_poll_tx_done(uport);
+ }
+
+ __qcom_geni_serial_console_write(uport, s, count);
++
++ if (port->tx_remaining)
++ qcom_geni_serial_setup_tx(uport, port->tx_remaining);
++
+ if (locked)
+ spin_unlock_irqrestore(&uport->lock, flags);
+ }
+@@ -694,40 +709,45 @@ static void qcom_geni_serial_handle_rx(struct uart_port *uport, bool drop)
+ port->handle_rx(uport, total_bytes, drop);
+ }
+
+-static void qcom_geni_serial_handle_tx(struct uart_port *uport)
++static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done,
++ bool active)
+ {
+ struct qcom_geni_serial_port *port = to_dev_port(uport, uport);
+ struct circ_buf *xmit = &uport->state->xmit;
+ size_t avail;
+ size_t remaining;
++ size_t pending;
+ int i;
+ u32 status;
+ unsigned int chunk;
+ int tail;
+- u32 irq_en;
+
+- chunk = uart_circ_chars_pending(xmit);
+ status = readl_relaxed(uport->membase + SE_GENI_TX_FIFO_STATUS);
+- /* Both FIFO and framework buffer are drained */
+- if (!chunk && !status) {
++
++ /* Complete the current tx command before taking newly added data */
++ if (active)
++ pending = port->tx_remaining;
++ else
++ pending = uart_circ_chars_pending(xmit);
++
++ /* All data has been transmitted and acknowledged as received */
++ if (!pending && !status && done) {
+ qcom_geni_serial_stop_tx(uport);
+ goto out_write_wakeup;
+ }
+
+- if (!uart_console(uport)) {
+- irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+- irq_en &= ~(M_TX_FIFO_WATERMARK_EN);
+- writel_relaxed(0, uport->membase + SE_GENI_TX_WATERMARK_REG);
+- writel_relaxed(irq_en, uport->membase + SE_GENI_M_IRQ_EN);
+- }
++ avail = port->tx_fifo_depth - (status & TX_FIFO_WC);
++ avail *= port->tx_bytes_pw;
+
+- avail = (port->tx_fifo_depth - port->tx_wm) * port->tx_bytes_pw;
+ tail = xmit->tail;
+- chunk = min3((size_t)chunk, (size_t)(UART_XMIT_SIZE - tail), avail);
++ chunk = min3(avail, pending, (size_t)(UART_XMIT_SIZE - tail));
+ if (!chunk)
+ goto out_write_wakeup;
+
+- qcom_geni_serial_setup_tx(uport, chunk);
++ if (!port->tx_remaining) {
++ qcom_geni_serial_setup_tx(uport, pending);
++ port->tx_remaining = pending;
++ }
+
+ remaining = chunk;
+ for (i = 0; i < chunk; ) {
+@@ -746,11 +766,10 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport)
+ tail += tx_bytes;
+ uport->icount.tx += tx_bytes;
+ remaining -= tx_bytes;
++ port->tx_remaining -= tx_bytes;
+ }
+
+ xmit->tail = tail & (UART_XMIT_SIZE - 1);
+- if (uart_console(uport))
+- qcom_geni_serial_poll_tx_done(uport);
+ out_write_wakeup:
+ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+ uart_write_wakeup(uport);
+@@ -760,6 +779,7 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+ {
+ unsigned int m_irq_status;
+ unsigned int s_irq_status;
++ unsigned int geni_status;
+ struct uart_port *uport = dev;
+ unsigned long flags;
+ unsigned int m_irq_en;
+@@ -773,6 +793,7 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+ spin_lock_irqsave(&uport->lock, flags);
+ m_irq_status = readl_relaxed(uport->membase + SE_GENI_M_IRQ_STATUS);
+ s_irq_status = readl_relaxed(uport->membase + SE_GENI_S_IRQ_STATUS);
++ geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS);
+ m_irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN);
+ writel_relaxed(m_irq_status, uport->membase + SE_GENI_M_IRQ_CLEAR);
+ writel_relaxed(s_irq_status, uport->membase + SE_GENI_S_IRQ_CLEAR);
+@@ -787,7 +808,8 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev)
+
+ if (m_irq_status & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN) &&
+ m_irq_en & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN))
+- qcom_geni_serial_handle_tx(uport);
++ qcom_geni_serial_handle_tx(uport, m_irq_status & M_CMD_DONE_EN,
++ geni_status & M_GENI_CMD_ACTIVE);
+
+ if (s_irq_status & S_GP_IRQ_0_EN || s_irq_status & S_GP_IRQ_1_EN) {
+ if (s_irq_status & S_GP_IRQ_0_EN)
+--
+2.20.1
+
--- /dev/null
+From 9f05643100992723bb5aed90511232d48bd62b64 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 17:55:19 -0800
+Subject: usb: dwc3: debugfs: Properly print/set link state for HS
+
+From: Thinh Nguyen <thinh.nguyen@synopsys.com>
+
+[ Upstream commit 0d36dede457873404becd7c9cb9d0f2bcfd0dcd9 ]
+
+Highspeed device and below has different state names than superspeed and
+higher. Add proper checks and printouts of link states for highspeed and
+below.
+
+Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/debug.h | 29 +++++++++++++++++++++++++++++
+ drivers/usb/dwc3/debugfs.c | 19 +++++++++++++++++--
+ 2 files changed, 46 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h
+index c66d216dcc304..4f75ab3505b77 100644
+--- a/drivers/usb/dwc3/debug.h
++++ b/drivers/usb/dwc3/debug.h
+@@ -116,6 +116,35 @@ dwc3_gadget_link_string(enum dwc3_link_state link_state)
+ }
+ }
+
++/**
++ * dwc3_gadget_hs_link_string - returns highspeed and below link name
++ * @link_state: link state code
++ */
++static inline const char *
++dwc3_gadget_hs_link_string(enum dwc3_link_state link_state)
++{
++ switch (link_state) {
++ case DWC3_LINK_STATE_U0:
++ return "On";
++ case DWC3_LINK_STATE_U2:
++ return "Sleep";
++ case DWC3_LINK_STATE_U3:
++ return "Suspend";
++ case DWC3_LINK_STATE_SS_DIS:
++ return "Disconnected";
++ case DWC3_LINK_STATE_RX_DET:
++ return "Early Suspend";
++ case DWC3_LINK_STATE_RECOV:
++ return "Recovery";
++ case DWC3_LINK_STATE_RESET:
++ return "Reset";
++ case DWC3_LINK_STATE_RESUME:
++ return "Resume";
++ default:
++ return "UNKNOWN link state\n";
++ }
++}
++
+ /**
+ * dwc3_trb_type_string - returns TRB type as a string
+ * @type: the type of the TRB
+diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
+index df8e73ec3342e..04ce7c01a09e6 100644
+--- a/drivers/usb/dwc3/debugfs.c
++++ b/drivers/usb/dwc3/debugfs.c
+@@ -433,13 +433,17 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused)
+ unsigned long flags;
+ enum dwc3_link_state state;
+ u32 reg;
++ u8 speed;
+
+ spin_lock_irqsave(&dwc->lock, flags);
+ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ state = DWC3_DSTS_USBLNKST(reg);
+- spin_unlock_irqrestore(&dwc->lock, flags);
++ speed = reg & DWC3_DSTS_CONNECTSPD;
+
+- seq_printf(s, "%s\n", dwc3_gadget_link_string(state));
++ seq_printf(s, "%s\n", (speed >= DWC3_DSTS_SUPERSPEED) ?
++ dwc3_gadget_link_string(state) :
++ dwc3_gadget_hs_link_string(state));
++ spin_unlock_irqrestore(&dwc->lock, flags);
+
+ return 0;
+ }
+@@ -457,6 +461,8 @@ static ssize_t dwc3_link_state_write(struct file *file,
+ unsigned long flags;
+ enum dwc3_link_state state = 0;
+ char buf[32];
++ u32 reg;
++ u8 speed;
+
+ if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))
+ return -EFAULT;
+@@ -477,6 +483,15 @@ static ssize_t dwc3_link_state_write(struct file *file,
+ return -EINVAL;
+
+ spin_lock_irqsave(&dwc->lock, flags);
++ reg = dwc3_readl(dwc->regs, DWC3_DSTS);
++ speed = reg & DWC3_DSTS_CONNECTSPD;
++
++ if (speed < DWC3_DSTS_SUPERSPEED &&
++ state != DWC3_LINK_STATE_RECOV) {
++ spin_unlock_irqrestore(&dwc->lock, flags);
++ return -EINVAL;
++ }
++
+ dwc3_gadget_set_link_state(dwc, state);
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+--
+2.20.1
+
--- /dev/null
+From fae69c9ab9875e5b339b1713ca214b3d7a1c480d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 12:40:29 -0800
+Subject: usb: dwc3: don't log probe deferrals; but do log other error codes
+
+From: Brian Norris <briannorris@chromium.org>
+
+[ Upstream commit 408d3ba006af57380fa48858b39f72fde6405031 ]
+
+It's not very useful to repeat a bunch of probe deferral errors. And
+it's also not very useful to log "failed" without telling the error
+code.
+
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index aca7e7fa5e47d..f52fcbc5c9718 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1481,7 +1481,8 @@ static int dwc3_probe(struct platform_device *pdev)
+
+ ret = dwc3_core_init(dwc);
+ if (ret) {
+- dev_err(dev, "failed to initialize core\n");
++ if (ret != -EPROBE_DEFER)
++ dev_err(dev, "failed to initialize core: %d\n", ret);
+ goto err4;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From f66efcef01b696190df0006f1bf89d5687cece25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Dec 2018 03:52:43 +0000
+Subject: usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit f770e3bc236ee954a3b4052bdf55739e26ee25db ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/usb/mtu3/mtu3_qmu.c: In function 'qmu_tx_zlp_error_handler':
+drivers/usb/mtu3/mtu3_qmu.c:385:22: warning:
+ variable 'req' set but not used [-Wunused-but-set-variable]
+
+It seems dbginfo original intention is print 'req' other than 'mreq'
+
+Acked-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/mtu3/mtu3_qmu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c
+index ff62ba2321779..326b40747128c 100644
+--- a/drivers/usb/mtu3/mtu3_qmu.c
++++ b/drivers/usb/mtu3/mtu3_qmu.c
+@@ -427,7 +427,7 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum)
+ return;
+ }
+
+- dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, mreq);
++ dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, req);
+
+ mtu3_clrbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_DMAREQEN);
+
+--
+2.20.1
+
--- /dev/null
+From 1e597035a3ea1c8ff5c726db821f1e5c88ca1d19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Nov 2018 10:58:44 +0800
+Subject: USB: serial: f81534: fix reading old/new IC config
+
+From: Ji-Ze Hong (Peter Hong) <hpeter@gmail.com>
+
+[ Upstream commit ab60075f2a4eebca1abb04f712569963fb4d9d6c ]
+
+The F81532/534 had a internal configuration space to save & control
+IC state with address F81534_CUSTOM_ADDRESS_START (0x2f00). Layout
+as following:
+ +00h: to indicate the section is valid
+ +01h~04h: UART Mode & port availability
+ +05h~08h: Output pin control on IC power on
+ +09h~12h: Output pin control on working <-- New added
+
+Old driver will use +05~08h as default on working, but newer IC will
+configed with shutdown mode(7) in 05h~08h and working mode with RS232(1)
+in 09h~12h. It'll make mainstream driver not working.
+
+This patch will make mainstream driver compatible older and newer IC.
+If using a old IC, the +05h~08h will be 00h~06h, we'll direct apply it.
+If using a new IC, the +05h~08h will be 07h or larger, we'll read +09h~12h
+to apply newer configuration.
+
+Signed-off-by: Ji-Ze Hong (Peter Hong) <hpeter+linux_kernel@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/serial/f81534.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/serial/f81534.c b/drivers/usb/serial/f81534.c
+index 4dfbff20bda4c..db6c93c04b3c8 100644
+--- a/drivers/usb/serial/f81534.c
++++ b/drivers/usb/serial/f81534.c
+@@ -45,14 +45,17 @@
+ #define F81534_CONFIG1_REG (0x09 + F81534_UART_BASE_ADDRESS)
+
+ #define F81534_DEF_CONF_ADDRESS_START 0x3000
+-#define F81534_DEF_CONF_SIZE 8
++#define F81534_DEF_CONF_SIZE 12
+
+ #define F81534_CUSTOM_ADDRESS_START 0x2f00
+ #define F81534_CUSTOM_DATA_SIZE 0x10
+ #define F81534_CUSTOM_NO_CUSTOM_DATA 0xff
+ #define F81534_CUSTOM_VALID_TOKEN 0xf0
+ #define F81534_CONF_OFFSET 1
+-#define F81534_CONF_GPIO_OFFSET 4
++#define F81534_CONF_INIT_GPIO_OFFSET 4
++#define F81534_CONF_WORK_GPIO_OFFSET 8
++#define F81534_CONF_GPIO_SHUTDOWN 7
++#define F81534_CONF_GPIO_RS232 1
+
+ #define F81534_MAX_DATA_BLOCK 64
+ #define F81534_MAX_BUS_RETRY 20
+@@ -1359,8 +1362,19 @@ static int f81534_set_port_output_pin(struct usb_serial_port *port)
+ serial_priv = usb_get_serial_data(serial);
+ port_priv = usb_get_serial_port_data(port);
+
+- idx = F81534_CONF_GPIO_OFFSET + port_priv->phy_num;
++ idx = F81534_CONF_INIT_GPIO_OFFSET + port_priv->phy_num;
+ value = serial_priv->conf_data[idx];
++ if (value >= F81534_CONF_GPIO_SHUTDOWN) {
++ /*
++ * Newer IC configure will make transceiver in shutdown mode on
++ * initial power on. We need enable it before using UARTs.
++ */
++ idx = F81534_CONF_WORK_GPIO_OFFSET + port_priv->phy_num;
++ value = serial_priv->conf_data[idx];
++ if (value >= F81534_CONF_GPIO_SHUTDOWN)
++ value = F81534_CONF_GPIO_RS232;
++ }
++
+ pins = &f81534_port_out_pins[port_priv->phy_num];
+
+ for (i = 0; i < ARRAY_SIZE(pins->pin); ++i) {
+--
+2.20.1
+
--- /dev/null
+From f44f170d26a2786f2737b7ba34c7251835ea3a09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Oct 2018 14:33:31 -0700
+Subject: virtchnl: Fix off by one error
+
+From: Alice Michael <alice.michael@intel.com>
+
+[ Upstream commit 843faff87af261bf55eda719a06087af0486a168 ]
+
+When calculating the valid length for a VIRTCHNL_OP_ENABLE_CHANNELS
+message, we accidentally allowed messages with one extra
+virtchnl_channel_info structure on the end. This happened due
+to an off by one error, because we forgot that valid_len already
+accounted for one virtchnl_channel_info structure, so we need to
+subtract one from the num_tc value.
+
+Signed-off-by: Alice Michael <alice.michael@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/avf/virtchnl.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h
+index 212b3822d1804..92d179fb6d59e 100644
+--- a/include/linux/avf/virtchnl.h
++++ b/include/linux/avf/virtchnl.h
+@@ -798,8 +798,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode,
+ if (msglen >= valid_len) {
+ struct virtchnl_tc_info *vti =
+ (struct virtchnl_tc_info *)msg;
+- valid_len += vti->num_tc *
+- sizeof(struct virtchnl_channel_info);
++ valid_len += (vti->num_tc - 1) *
++ sizeof(struct virtchnl_channel_info);
+ if (vti->num_tc == 0)
+ err_msg_format = true;
+ }
+--
+2.20.1
+
--- /dev/null
+From 67cdeb32d10af8753f3eef6b74830e6de581cc3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 15:05:46 -0800
+Subject: xfrm: release device reference for invalid state
+
+From: Xiaodong Xu <stid.smth@gmail.com>
+
+[ Upstream commit 4944a4b1077f74d89073624bd286219d2fcbfce3 ]
+
+An ESP packet could be decrypted in async mode if the input handler for
+this packet returns -EINPROGRESS in xfrm_input(). At this moment the device
+reference in skb is held. Later xfrm_input() will be invoked again to
+resume the processing.
+If the transform state is still valid it would continue to release the
+device reference and there won't be a problem; however if the transform
+state is not valid when async resumption happens, the packet will be
+dropped while the device reference is still being held.
+When the device is deleted for some reason and the reference to this
+device is not properly released, the kernel will keep logging like:
+
+unregister_netdevice: waiting for ppp2 to become free. Usage count = 1
+
+The issue is observed when running IPsec traffic over a PPPoE device based
+on a bridge interface. By terminating the PPPoE connection on the server
+end for multiple times, the PPPoE device on the client side will eventually
+get stuck on the above warning message.
+
+This patch will check the async mode first and continue to release device
+reference in async resumption, before it is dropped due to invalid state.
+
+v2: Do not assign address family from outer_mode in the transform if the
+state is invalid
+
+v3: Release device reference in the error path instead of jumping to resume
+
+Fixes: 4ce3dbe397d7b ("xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)")
+Signed-off-by: Xiaodong Xu <stid.smth@gmail.com>
+Reported-by: Bo Chen <chenborfc@163.com>
+Tested-by: Bo Chen <chenborfc@163.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_input.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index d5635908587f4..82b0a99ee1f43 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -246,6 +246,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ else
+ XFRM_INC_STATS(net,
+ LINUX_MIB_XFRMINSTATEINVALID);
++
++ if (encap_type == -1)
++ dev_put(skb->dev);
+ goto drop;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e22f257cd35dbf71844996f9569168c1dd071a2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 13:31:09 -0800
+Subject: xfs: extent shifting doesn't fully invalidate page cache
+
+From: Dave Chinner <dchinner@redhat.com>
+
+[ Upstream commit 7f9f71be84bcab368e58020a42f6d0dd97adf0ce ]
+
+The extent shifting code uses a flush and invalidate mechainsm prior
+to shifting extents around. This is similar to what
+xfs_free_file_space() does, but it doesn't take into account things
+like page cache vs block size differences, and it will fail if there
+is a page that it currently busy.
+
+xfs_flush_unmap_range() handles all of these cases, so just convert
+xfs_prepare_shift() to us that mechanism rather than having it's own
+special sauce.
+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/xfs/xfs_bmap_util.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index 41ad9eaab6ce9..c045723678be9 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1244,13 +1244,7 @@ xfs_prepare_shift(
+ * Writeback and invalidate cache for the remainder of the file as we're
+ * about to shift down every extent from offset to EOF.
+ */
+- error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1);
+- if (error)
+- return error;
+- error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping,
+- offset >> PAGE_SHIFT, -1);
+- if (error)
+- return error;
++ error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip));
+
+ /*
+ * Clean out anything hanging around in the cow fork now that
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
