--- /dev/null
+From 54505a1e2083fc54cbe8779b97479f969cd30a00 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 26 May 2020 10:47:49 -0400
+Subject: alpha: fix memory barriers so that they conform to the specification
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 54505a1e2083fc54cbe8779b97479f969cd30a00 upstream.
+
+The commits cd0e00c10672 and 92d7223a7423 broke boot on the Alpha Avanti
+platform. The patches move memory barriers after a write before the write.
+The result is that if there's iowrite followed by ioread, there is no
+barrier between them.
+
+The Alpha architecture allows reordering of the accesses to the I/O space,
+and the missing barrier between write and read causes hang with serial
+port and real time clock.
+
+This patch makes barriers confiorm to the specification.
+
+1. We add mb() before readX_relaxed and writeX_relaxed -
+ memory-barriers.txt claims that these functions must be ordered w.r.t.
+ each other. Alpha doesn't order them, so we need an explicit barrier.
+2. We add mb() before reads from the I/O space - so that if there's a
+ write followed by a read, there should be a barrier between them.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Fixes: cd0e00c10672 ("alpha: io: reorder barriers to guarantee writeX() and iowriteX() ordering")
+Fixes: 92d7223a7423 ("alpha: io: reorder barriers to guarantee writeX() and iowriteX() ordering #2")
+Cc: stable@vger.kernel.org # v4.17+
+Acked-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
+Reviewed-by: Maciej W. Rozycki <macro@linux-mips.org>
+Signed-off-by: Matt Turner <mattst88@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/alpha/include/asm/io.h | 74 +++++++++++++++++++++++++++++++++++---------
+ arch/alpha/kernel/io.c | 60 +++++++++++++++++++++++++++++++----
+ 2 files changed, 112 insertions(+), 22 deletions(-)
+
+--- a/arch/alpha/include/asm/io.h
++++ b/arch/alpha/include/asm/io.h
+@@ -322,14 +322,18 @@ static inline int __is_mmio(const volati
+ #if IO_CONCAT(__IO_PREFIX,trivial_io_bw)
+ extern inline unsigned int ioread8(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
+ mb();
+ return ret;
+ }
+
+ extern inline unsigned int ioread16(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
+ mb();
+ return ret;
+ }
+@@ -370,7 +374,9 @@ extern inline void outw(u16 b, unsigned
+ #if IO_CONCAT(__IO_PREFIX,trivial_io_lq)
+ extern inline unsigned int ioread32(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
+ mb();
+ return ret;
+ }
+@@ -415,14 +421,18 @@ extern inline void __raw_writew(u16 b, v
+
+ extern inline u8 readb(const volatile void __iomem *addr)
+ {
+- u8 ret = __raw_readb(addr);
++ u8 ret;
++ mb();
++ ret = __raw_readb(addr);
+ mb();
+ return ret;
+ }
+
+ extern inline u16 readw(const volatile void __iomem *addr)
+ {
+- u16 ret = __raw_readw(addr);
++ u16 ret;
++ mb();
++ ret = __raw_readw(addr);
+ mb();
+ return ret;
+ }
+@@ -463,14 +473,18 @@ extern inline void __raw_writeq(u64 b, v
+
+ extern inline u32 readl(const volatile void __iomem *addr)
+ {
+- u32 ret = __raw_readl(addr);
++ u32 ret;
++ mb();
++ ret = __raw_readl(addr);
+ mb();
+ return ret;
+ }
+
+ extern inline u64 readq(const volatile void __iomem *addr)
+ {
+- u64 ret = __raw_readq(addr);
++ u64 ret;
++ mb();
++ ret = __raw_readq(addr);
+ mb();
+ return ret;
+ }
+@@ -499,14 +513,44 @@ extern inline void writeq(u64 b, volatil
+ #define outb_p outb
+ #define outw_p outw
+ #define outl_p outl
+-#define readb_relaxed(addr) __raw_readb(addr)
+-#define readw_relaxed(addr) __raw_readw(addr)
+-#define readl_relaxed(addr) __raw_readl(addr)
+-#define readq_relaxed(addr) __raw_readq(addr)
+-#define writeb_relaxed(b, addr) __raw_writeb(b, addr)
+-#define writew_relaxed(b, addr) __raw_writew(b, addr)
+-#define writel_relaxed(b, addr) __raw_writel(b, addr)
+-#define writeq_relaxed(b, addr) __raw_writeq(b, addr)
++
++extern u8 readb_relaxed(const volatile void __iomem *addr);
++extern u16 readw_relaxed(const volatile void __iomem *addr);
++extern u32 readl_relaxed(const volatile void __iomem *addr);
++extern u64 readq_relaxed(const volatile void __iomem *addr);
++
++#if IO_CONCAT(__IO_PREFIX,trivial_io_bw)
++extern inline u8 readb_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readb(addr);
++}
++
++extern inline u16 readw_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readw(addr);
++}
++#endif
++
++#if IO_CONCAT(__IO_PREFIX,trivial_io_lq)
++extern inline u32 readl_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readl(addr);
++}
++
++extern inline u64 readq_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readq(addr);
++}
++#endif
++
++#define writeb_relaxed writeb
++#define writew_relaxed writew
++#define writel_relaxed writel
++#define writeq_relaxed writeq
+
+ /*
+ * String version of IO memory access ops:
+--- a/arch/alpha/kernel/io.c
++++ b/arch/alpha/kernel/io.c
+@@ -16,21 +16,27 @@
+ unsigned int
+ ioread8(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread8)(addr);
+ mb();
+ return ret;
+ }
+
+ unsigned int ioread16(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread16)(addr);
+ mb();
+ return ret;
+ }
+
+ unsigned int ioread32(void __iomem *addr)
+ {
+- unsigned int ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
++ unsigned int ret;
++ mb();
++ ret = IO_CONCAT(__IO_PREFIX,ioread32)(addr);
+ mb();
+ return ret;
+ }
+@@ -148,28 +154,36 @@ EXPORT_SYMBOL(__raw_writeq);
+
+ u8 readb(const volatile void __iomem *addr)
+ {
+- u8 ret = __raw_readb(addr);
++ u8 ret;
++ mb();
++ ret = __raw_readb(addr);
+ mb();
+ return ret;
+ }
+
+ u16 readw(const volatile void __iomem *addr)
+ {
+- u16 ret = __raw_readw(addr);
++ u16 ret;
++ mb();
++ ret = __raw_readw(addr);
+ mb();
+ return ret;
+ }
+
+ u32 readl(const volatile void __iomem *addr)
+ {
+- u32 ret = __raw_readl(addr);
++ u32 ret;
++ mb();
++ ret = __raw_readl(addr);
+ mb();
+ return ret;
+ }
+
+ u64 readq(const volatile void __iomem *addr)
+ {
+- u64 ret = __raw_readq(addr);
++ u64 ret;
++ mb();
++ ret = __raw_readq(addr);
+ mb();
+ return ret;
+ }
+@@ -207,6 +221,38 @@ EXPORT_SYMBOL(writew);
+ EXPORT_SYMBOL(writel);
+ EXPORT_SYMBOL(writeq);
+
++/*
++ * The _relaxed functions must be ordered w.r.t. each other, but they don't
++ * have to be ordered w.r.t. other memory accesses.
++ */
++u8 readb_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readb(addr);
++}
++
++u16 readw_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readw(addr);
++}
++
++u32 readl_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readl(addr);
++}
++
++u64 readq_relaxed(const volatile void __iomem *addr)
++{
++ mb();
++ return __raw_readq(addr);
++}
++
++EXPORT_SYMBOL(readb_relaxed);
++EXPORT_SYMBOL(readw_relaxed);
++EXPORT_SYMBOL(readl_relaxed);
++EXPORT_SYMBOL(readq_relaxed);
+
+ /*
+ * Read COUNT 8-bit bytes from port PORT into memory starting at SRC.
--- /dev/null
+From baa998aecb75c04d62be0a4ab6b724af6d73a0f9 Mon Sep 17 00:00:00 2001
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+Date: Thu, 2 Apr 2020 00:19:47 +0200
+Subject: ARM: dts: at91: sama5d2_ptc_ek: fix vbus pin
+
+From: Ludovic Desroches <ludovic.desroches@microchip.com>
+
+commit baa998aecb75c04d62be0a4ab6b724af6d73a0f9 upstream.
+
+The gpio property for the vbus pin doesn't match the pinctrl and is
+not correct.
+
+Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Fixes: 42ed535595ec "ARM: dts: at91: introduce the sama5d2 ptc ek board"
+Cc: stable@vger.kernel.org # 4.19 and later
+Link: https://lore.kernel.org/r/20200401221947.41502-1-ludovic.desroches@microchip.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
++++ b/arch/arm/boot/dts/at91-sama5d2_ptc_ek.dts
+@@ -40,7 +40,7 @@
+
+ ahb {
+ usb0: gadget@300000 {
+- atmel,vbus-gpio = <&pioA PIN_PA27 GPIO_ACTIVE_HIGH>;
++ atmel,vbus-gpio = <&pioA PIN_PB11 GPIO_ACTIVE_HIGH>;
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_usba_vbus>;
+ status = "okay";
--- /dev/null
+From 8807d356bfea92b0a8f04ce421800ed83400cd22 Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 26 Mar 2020 15:20:37 +0100
+Subject: ARM: dts: exynos: Fix GPIO polarity for thr GalaxyS3 CM36651 sensor's bus
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+commit 8807d356bfea92b0a8f04ce421800ed83400cd22 upstream.
+
+GPIO lines for the CM36651 sensor I2C bus use the normal not the inverted
+polarity. This bug has been there since adding the CM36651 sensor by
+commit 85cb4e0bd229 ("ARM: dts: add cm36651 light/proximity sensor node
+for exynos4412-trats2"), but went unnoticed because the "i2c-gpio"
+driver ignored the GPIO polarity specified in the device-tree.
+
+The recent conversion of "i2c-gpio" driver to the new, descriptor based
+GPIO API, automatically made it the DT-specified polarity aware, what
+broke the CM36651 sensor operation.
+
+Fixes: 85cb4e0bd229 ("ARM: dts: add cm36651 light/proximity sensor node for exynos4412-trats2")
+CC: stable@vger.kernel.org # 4.16+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi
++++ b/arch/arm/boot/dts/exynos4412-galaxy-s3.dtsi
+@@ -68,7 +68,7 @@
+
+ i2c_cm36651: i2c-gpio-2 {
+ compatible = "i2c-gpio";
+- gpios = <&gpf0 0 GPIO_ACTIVE_LOW>, <&gpf0 1 GPIO_ACTIVE_LOW>;
++ gpios = <&gpf0 0 GPIO_ACTIVE_HIGH>, <&gpf0 1 GPIO_ACTIVE_HIGH>;
+ i2c-gpio,delay-us = <2>;
+ #address-cells = <1>;
+ #size-cells = <0>;
--- /dev/null
+From 869d42e6eba821905e1a0950623aadafe1a6e6d3 Mon Sep 17 00:00:00 2001
+From: Jonathan Bakker <xc-racer2@live.ca>
+Date: Fri, 1 May 2020 16:50:05 -0700
+Subject: ARM: dts: s5pv210: Set keep-power-in-suspend for SDHCI1 on Aries
+
+From: Jonathan Bakker <xc-racer2@live.ca>
+
+commit 869d42e6eba821905e1a0950623aadafe1a6e6d3 upstream.
+
+SDHCI1 is connected to a BCM4329 WiFi/BT chip which requires
+power to be kept over suspend. As the surrounding hardware supports
+this, mark it as such. This fixes WiFi after a suspend/resume cycle.
+
+Fixes: 170642468a51 ("ARM: dts: s5pv210: Add initial DTS for Samsung Aries based phones")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/s5pv210-aries.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/boot/dts/s5pv210-aries.dtsi
++++ b/arch/arm/boot/dts/s5pv210-aries.dtsi
+@@ -454,6 +454,7 @@
+ pinctrl-names = "default";
+ cap-sd-highspeed;
+ cap-mmc-highspeed;
++ keep-power-in-suspend;
+
+ mmc-pwrseq = <&wifi_pwrseq>;
+ non-removable;
--- /dev/null
+From 35509737c8f958944e059d501255a0bf18361ba0 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 13 Mar 2020 12:01:04 +0300
+Subject: ARM: tegra: Correct PL310 Auxiliary Control Register initialization
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+commit 35509737c8f958944e059d501255a0bf18361ba0 upstream.
+
+The PL310 Auxiliary Control Register shouldn't have the "Full line of
+zero" optimization bit being set before L2 cache is enabled. The L2X0
+driver takes care of enabling the optimization by itself.
+
+This patch fixes a noisy error message on Tegra20 and Tegra30 telling
+that cache optimization is erroneously enabled without enabling it for
+the CPU:
+
+ L2C-310: enabling full line of zeros but not enabled in Cortex-A9
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Tested-by: Nicolas Chauvet <kwizart@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-tegra/tegra.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-tegra/tegra.c
++++ b/arch/arm/mach-tegra/tegra.c
+@@ -106,8 +106,8 @@ static const char * const tegra_dt_board
+ };
+
+ DT_MACHINE_START(TEGRA_DT, "NVIDIA Tegra SoC (Flattened Device Tree)")
+- .l2c_aux_val = 0x3c400001,
+- .l2c_aux_mask = 0xc20fc3fe,
++ .l2c_aux_val = 0x3c400000,
++ .l2c_aux_mask = 0xc20fc3ff,
+ .smp = smp_ops(tegra_smp_ops),
+ .map_io = tegra_map_common_io,
+ .init_early = tegra_init_early,
--- /dev/null
+From 64611a15ca9da91ff532982429c44686f4593b5f Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Thu, 4 Jun 2020 12:01:26 -0700
+Subject: dm crypt: avoid truncating the logical block size
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 64611a15ca9da91ff532982429c44686f4593b5f upstream.
+
+queue_limits::logical_block_size got changed from unsigned short to
+unsigned int, but it was forgotten to update crypt_io_hints() to use the
+new type. Fix it.
+
+Fixes: ad6bf88a6c19 ("block: fix an integer overflow in logical block size")
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-crypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -2957,7 +2957,7 @@ static void crypt_io_hints(struct dm_tar
+ limits->max_segment_size = PAGE_SIZE;
+
+ limits->logical_block_size =
+- max_t(unsigned short, limits->logical_block_size, cc->sector_size);
++ max_t(unsigned, limits->logical_block_size, cc->sector_size);
+ limits->physical_block_size =
+ max_t(unsigned, limits->physical_block_size, cc->sector_size);
+ limits->io_min = max_t(unsigned, limits->io_min, cc->sector_size);
--- /dev/null
+From 93900337b9ac2f4eca427eff6d187be2dc3b5551 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 23 Apr 2020 16:00:38 +1000
+Subject: drivers/macintosh: Fix memleak in windfarm_pm112 driver
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 93900337b9ac2f4eca427eff6d187be2dc3b5551 upstream.
+
+create_cpu_loop() calls smu_sat_get_sdb_partition() which does
+kmalloc() and returns the allocated buffer. In fact it's called twice,
+and neither buffer is freed.
+
+This results in a memory leak as reported by Erhard:
+ unreferenced object 0xc00000047081f840 (size 32):
+ comm "kwindfarm", pid 203, jiffies 4294880630 (age 5552.877s)
+ hex dump (first 32 bytes):
+ c8 06 02 7f ff 02 ff 01 fb bf 00 41 00 20 00 00 ...........A. ..
+ 00 07 89 37 00 a0 00 00 00 00 00 00 00 00 00 00 ...7............
+ backtrace:
+ [<0000000083f0a65c>] .smu_sat_get_sdb_partition+0xc4/0x2d0 [windfarm_smu_sat]
+ [<000000003010fcb7>] .pm112_wf_notify+0x104c/0x13bc [windfarm_pm112]
+ [<00000000b958b2dd>] .notifier_call_chain+0xa8/0x180
+ [<0000000070490868>] .blocking_notifier_call_chain+0x64/0x90
+ [<00000000131d8149>] .wf_thread_func+0x114/0x1a0
+ [<000000000d54838d>] .kthread+0x13c/0x190
+ [<00000000669b72bc>] .ret_from_kernel_thread+0x58/0x64
+ unreferenced object 0xc0000004737089f0 (size 16):
+ comm "kwindfarm", pid 203, jiffies 4294880879 (age 5552.050s)
+ hex dump (first 16 bytes):
+ c4 04 01 7f 22 11 e0 e6 ff 55 7b 12 ec 11 00 00 ...."....U{.....
+ backtrace:
+ [<0000000083f0a65c>] .smu_sat_get_sdb_partition+0xc4/0x2d0 [windfarm_smu_sat]
+ [<00000000b94ef7e1>] .pm112_wf_notify+0x1294/0x13bc [windfarm_pm112]
+ [<00000000b958b2dd>] .notifier_call_chain+0xa8/0x180
+ [<0000000070490868>] .blocking_notifier_call_chain+0x64/0x90
+ [<00000000131d8149>] .wf_thread_func+0x114/0x1a0
+ [<000000000d54838d>] .kthread+0x13c/0x190
+ [<00000000669b72bc>] .ret_from_kernel_thread+0x58/0x64
+
+Fix it by rearranging the logic so we deal with each buffer
+separately, which then makes it easy to free the buffer once we're
+done with it.
+
+Fixes: ac171c46667c ("[PATCH] powerpc: Thermal control for dual core G5s")
+Cc: stable@vger.kernel.org # v2.6.16+
+Reported-by: Erhard F. <erhard_f@mailbox.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Tested-by: Erhard F. <erhard_f@mailbox.org>
+Link: https://lore.kernel.org/r/20200423060038.3308530-1-mpe@ellerman.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/macintosh/windfarm_pm112.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/macintosh/windfarm_pm112.c
++++ b/drivers/macintosh/windfarm_pm112.c
+@@ -132,14 +132,6 @@ static int create_cpu_loop(int cpu)
+ s32 tmax;
+ int fmin;
+
+- /* Get PID params from the appropriate SAT */
+- hdr = smu_sat_get_sdb_partition(chip, 0xC8 + core, NULL);
+- if (hdr == NULL) {
+- printk(KERN_WARNING"windfarm: can't get CPU PID fan config\n");
+- return -EINVAL;
+- }
+- piddata = (struct smu_sdbp_cpupiddata *)&hdr[1];
+-
+ /* Get FVT params to get Tmax; if not found, assume default */
+ hdr = smu_sat_get_sdb_partition(chip, 0xC4 + core, NULL);
+ if (hdr) {
+@@ -152,6 +144,16 @@ static int create_cpu_loop(int cpu)
+ if (tmax < cpu_all_tmax)
+ cpu_all_tmax = tmax;
+
++ kfree(hdr);
++
++ /* Get PID params from the appropriate SAT */
++ hdr = smu_sat_get_sdb_partition(chip, 0xC8 + core, NULL);
++ if (hdr == NULL) {
++ printk(KERN_WARNING"windfarm: can't get CPU PID fan config\n");
++ return -EINVAL;
++ }
++ piddata = (struct smu_sdbp_cpupiddata *)&hdr[1];
++
+ /*
+ * Darwin has a minimum fan speed of 1000 rpm for the 4-way and
+ * 515 for the 2-way. That appears to be overkill, so for now,
+@@ -174,6 +176,9 @@ static int create_cpu_loop(int cpu)
+ pid.min = fmin;
+
+ wf_cpu_pid_init(&cpu_pid[cpu], &pid);
++
++ kfree(hdr);
++
+ return 0;
+ }
+
--- /dev/null
+From 43d7ce70ae43dd8523754b17f567417e0e75dbce Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Thu, 7 May 2020 09:42:52 +0000
+Subject: gnss: sirf: fix error return code in sirf_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit 43d7ce70ae43dd8523754b17f567417e0e75dbce upstream.
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+This avoids a use-after-free in case the driver is later unbound.
+
+Fixes: d2efbbd18b1e ("gnss: add driver for sirfstar-based receivers")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+[ johan: amend commit message; mention potential use-after-free ]
+Cc: stable <stable@vger.kernel.org> # 4.19
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gnss/sirf.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/gnss/sirf.c
++++ b/drivers/gnss/sirf.c
+@@ -439,14 +439,18 @@ static int sirf_probe(struct serdev_devi
+
+ data->on_off = devm_gpiod_get_optional(dev, "sirf,onoff",
+ GPIOD_OUT_LOW);
+- if (IS_ERR(data->on_off))
++ if (IS_ERR(data->on_off)) {
++ ret = PTR_ERR(data->on_off);
+ goto err_put_device;
++ }
+
+ if (data->on_off) {
+ data->wakeup = devm_gpiod_get_optional(dev, "sirf,wakeup",
+ GPIOD_IN);
+- if (IS_ERR(data->wakeup))
++ if (IS_ERR(data->wakeup)) {
++ ret = PTR_ERR(data->wakeup);
+ goto err_put_device;
++ }
+
+ ret = regulator_enable(data->vcc);
+ if (ret)
--- /dev/null
+From 4b50c8c4eaf06a825d1c005c0b1b4a8307087b83 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <masahiroy@kernel.org>
+Date: Sun, 31 May 2020 17:47:06 +0900
+Subject: kbuild: force to build vmlinux if CONFIG_MODVERSION=y
+
+From: Masahiro Yamada <masahiroy@kernel.org>
+
+commit 4b50c8c4eaf06a825d1c005c0b1b4a8307087b83 upstream.
+
+This code does not work as stated in the comment.
+
+$(CONFIG_MODVERSIONS) is always empty because it is expanded before
+include/config/auto.conf is included. Hence, 'make modules' with
+CONFIG_MODVERSION=y cannot record the version CRCs.
+
+This has been broken since 2003, commit ("kbuild: Enable modules to be
+build using the "make dir/" syntax"). [1]
+
+[1]: https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?id=15c6240cdc44bbeef3c4797ec860f9765ef4f1a7
+Cc: linux-stable <stable@vger.kernel.org> # v2.5.71+
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Makefile | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -587,12 +587,8 @@ KBUILD_MODULES :=
+ KBUILD_BUILTIN := 1
+
+ # If we have only "make modules", don't compile built-in objects.
+-# When we're building modules with modversions, we need to consider
+-# the built-in objects during the descend as well, in order to
+-# make sure the checksums are up to date before we record them.
+-
+ ifeq ($(MAKECMDGOALS),modules)
+- KBUILD_BUILTIN := $(if $(CONFIG_MODVERSIONS),1)
++ KBUILD_BUILTIN :=
+ endif
+
+ # If we have "make <whatever> modules", compile modules
+@@ -1282,6 +1278,13 @@ ifdef CONFIG_MODULES
+
+ all: modules
+
++# When we're building modules with modversions, we need to consider
++# the built-in objects during the descend as well, in order to
++# make sure the checksums are up to date before we record them.
++ifdef CONFIG_MODVERSIONS
++ KBUILD_BUILTIN := 1
++endif
++
+ # Build modules
+ #
+ # A module can be listed more than once in obj-m resulting in
--- /dev/null
+From b5945214b76a1f22929481724ffd448000ede914 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Mon, 4 May 2020 10:50:17 -0700
+Subject: kernel/cpu_pm: Fix uninitted local in cpu_pm
+
+From: Douglas Anderson <dianders@chromium.org>
+
+commit b5945214b76a1f22929481724ffd448000ede914 upstream.
+
+cpu_pm_notify() is basically a wrapper of notifier_call_chain().
+notifier_call_chain() doesn't initialize *nr_calls to 0 before it
+starts incrementing it--presumably it's up to the callers to do this.
+
+Unfortunately the callers of cpu_pm_notify() don't init *nr_calls.
+This potentially means you could get too many or two few calls to
+CPU_PM_ENTER_FAILED or CPU_CLUSTER_PM_ENTER_FAILED depending on the
+luck of the stack.
+
+Let's fix this.
+
+Fixes: ab10023e0088 ("cpu_pm: Add cpu power management notifiers")
+Cc: stable@vger.kernel.org
+Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://lore.kernel.org/r/20200504104917.v6.3.I2d44fc0053d019f239527a4e5829416714b7e299@changeid
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/cpu_pm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/cpu_pm.c
++++ b/kernel/cpu_pm.c
+@@ -80,7 +80,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_unregister_noti
+ */
+ int cpu_pm_enter(void)
+ {
+- int nr_calls;
++ int nr_calls = 0;
+ int ret = 0;
+
+ ret = cpu_pm_notify(CPU_PM_ENTER, -1, &nr_calls);
+@@ -131,7 +131,7 @@ EXPORT_SYMBOL_GPL(cpu_pm_exit);
+ */
+ int cpu_cluster_pm_enter(void)
+ {
+- int nr_calls;
++ int nr_calls = 0;
+ int ret = 0;
+
+ ret = cpu_pm_notify(CPU_CLUSTER_PM_ENTER, -1, &nr_calls);
--- /dev/null
+From 130bbde4809b011faf64f99dddc14b4b01f440c3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Tue, 12 May 2020 09:57:32 +0200
+Subject: mtd: rawnand: brcmnand: fix hamming oob layout
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Álvaro Fernández Rojas <noltari@gmail.com>
+
+commit 130bbde4809b011faf64f99dddc14b4b01f440c3 upstream.
+
+First 2 bytes are used in large-page nand.
+
+Fixes: ef5eeea6e911 ("mtd: nand: brcm: switch to mtd_ooblayout_ops")
+Cc: stable@vger.kernel.org
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20200512075733.745374-2-noltari@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/brcmnand/brcmnand.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+@@ -1019,11 +1019,14 @@ static int brcmnand_hamming_ooblayout_fr
+ if (!section) {
+ /*
+ * Small-page NAND use byte 6 for BBI while large-page
+- * NAND use byte 0.
++ * NAND use bytes 0 and 1.
+ */
+- if (cfg->page_size > 512)
+- oobregion->offset++;
+- oobregion->length--;
++ if (cfg->page_size > 512) {
++ oobregion->offset += 2;
++ oobregion->length -= 2;
++ } else {
++ oobregion->length--;
++ }
+ }
+ }
+
--- /dev/null
+From c5be12e45940f1aa1b5dfa04db5d15ad24f7c896 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 14:59:45 +0200
+Subject: mtd: rawnand: diskonchip: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit c5be12e45940f1aa1b5dfa04db5d15ad24f7c896 upstream.
+
+Not sure nand_cleanup() is the right function to call here but in any
+case it is not nand_release(). Indeed, even a comment says that
+calling nand_release() is a bit of a hack as there is no MTD device to
+unregister. So switch to nand_cleanup() for now and drop this
+comment.
+
+There is no Fixes tag applying here as the use of nand_release()
+in this driver predates by far the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. However, pointing this commit as the
+culprit for backporting purposes makes sense even if it did not intruce
+any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-13-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/diskonchip.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/mtd/nand/raw/diskonchip.c
++++ b/drivers/mtd/nand/raw/diskonchip.c
+@@ -1609,13 +1609,10 @@ static int __init doc_probe(unsigned lon
+ numchips = doc2001_init(mtd);
+
+ if ((ret = nand_scan(nand, numchips)) || (ret = doc->late_init(mtd))) {
+- /* DBB note: i believe nand_release is necessary here, as
++ /* DBB note: i believe nand_cleanup is necessary here, as
+ buffers may have been allocated in nand_base. Check with
+ Thomas. FIX ME! */
+- /* nand_release will call mtd_device_unregister, but we
+- haven't yet added it. This is handled without incident by
+- mtd_device_unregister, as far as I can tell. */
+- nand_release(nand);
++ nand_cleanup(nand);
+ goto fail;
+ }
+
--- /dev/null
+From e45a4b652dbd2f8b5a3b8e97e89f602a58cb28aa Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Mon, 18 May 2020 17:52:37 +0200
+Subject: mtd: rawnand: Fix nand_gpio_waitrdy()
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit e45a4b652dbd2f8b5a3b8e97e89f602a58cb28aa upstream.
+
+Mimic what's done in nand_soft_waitrdy() and add one to the jiffies
+timeout so we don't end up waiting less than actually required.
+
+Reported-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Fixes: b0e137ad24b6c ("mtd: rawnand: Provide helper for polling GPIO R/B pin")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20200518155237.297549-1-boris.brezillon@collabora.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/nand_base.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/mtd/nand/raw/nand_base.c
++++ b/drivers/mtd/nand/raw/nand_base.c
+@@ -731,8 +731,14 @@ EXPORT_SYMBOL_GPL(nand_soft_waitrdy);
+ int nand_gpio_waitrdy(struct nand_chip *chip, struct gpio_desc *gpiod,
+ unsigned long timeout_ms)
+ {
+- /* Wait until R/B pin indicates chip is ready or timeout occurs */
+- timeout_ms = jiffies + msecs_to_jiffies(timeout_ms);
++
++ /*
++ * Wait until R/B pin indicates chip is ready or timeout occurs.
++ * +1 below is necessary because if we are now in the last fraction
++ * of jiffy and msecs_to_jiffies is 1 then we will wait only that
++ * small jiffy fraction - possibly leading to false timeout.
++ */
++ timeout_ms = jiffies + msecs_to_jiffies(timeout_ms) + 1;
+ do {
+ if (gpiod_get_value_cansleep(gpiod))
+ return 0;
--- /dev/null
+From de17cade0e034e9b721a6db9b488014effac1e5a Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 14:59:54 +0200
+Subject: mtd: rawnand: ingenic: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit de17cade0e034e9b721a6db9b488014effac1e5a upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. Hence, pointing it as the commit to
+fix for backporting purposes, even if this commit is not introducing
+any bug makes sense.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Cc: Paul Cercueil <paul@crapouillou.net>
+Cc: Harvey Hunt <harveyhuntnexus@gmail.com>
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-22-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
++++ b/drivers/mtd/nand/raw/ingenic/ingenic_nand_drv.c
+@@ -376,7 +376,7 @@ static int ingenic_nand_init_chip(struct
+
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+- nand_release(chip);
++ nand_cleanup(chip);
+ return ret;
+ }
+
--- /dev/null
+From 8a82bbcadec877f5f938c54026278dfc1f05a332 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:00 +0200
+Subject: mtd: rawnand: mtk: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 8a82bbcadec877f5f938c54026278dfc1f05a332 upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. However, pointing this commit as the
+culprit for backporting purposes makes sense even if this commit is not
+introducing any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-28-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/mtk_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/mtk_nand.c
++++ b/drivers/mtd/nand/raw/mtk_nand.c
+@@ -1419,7 +1419,7 @@ static int mtk_nfc_nand_chip_init(struct
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+ dev_err(dev, "mtd parse partition error\n");
+- nand_release(nand);
++ nand_cleanup(nand);
+ return ret;
+ }
+
--- /dev/null
+From 1d5d08ee9b28cff907326b4ad5a2463fd2808be1 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 28 Apr 2020 11:42:56 +0200
+Subject: mtd: rawnand: onfi: Fix redundancy detection check
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 1d5d08ee9b28cff907326b4ad5a2463fd2808be1 upstream.
+
+During ONFI detection, the CRC derived from the parameter page and the
+CRC supposed to be at the end of the parameter page are compared. If
+they do not match, the second then the third copies of the page are
+tried.
+
+The current implementation compares the newly derived CRC with the CRC
+contained in the first page only. So if this particular CRC area has
+been corrupted, then the detection will fail for a wrong reason.
+
+Fix this issue by checking the derived CRC against the right one.
+
+Fixes: 39138c1f4a31 ("mtd: rawnand: use bit-wise majority to recover the ONFI param page")
+Cc: stable@vger.kernel.org
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Link: https://lore.kernel.org/linux-mtd/20200428094302.14624-4-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/nand_onfi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/nand_onfi.c
++++ b/drivers/mtd/nand/raw/nand_onfi.c
+@@ -173,7 +173,7 @@ int nand_onfi_detect(struct nand_chip *c
+ }
+
+ if (onfi_crc16(ONFI_CRC_BASE, (u8 *)&p[i], 254) ==
+- le16_to_cpu(p->crc)) {
++ le16_to_cpu(p[i].crc)) {
+ if (i)
+ memcpy(p, &p[i], sizeof(*p));
+ break;
--- /dev/null
+From be238fbf78e4c7c586dac235ab967d3e565a4d1a Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:06 +0200
+Subject: mtd: rawnand: orion: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit be238fbf78e4c7c586dac235ab967d3e565a4d1a upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates by far the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. However, pointing this commit as the
+culprit for backporting purposes makes sense even if this commit is not
+introducing any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-34-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/orion_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/orion_nand.c
++++ b/drivers/mtd/nand/raw/orion_nand.c
+@@ -180,7 +180,7 @@ static int __init orion_nand_probe(struc
+ mtd->name = "orion_nand";
+ ret = mtd_device_register(mtd, board->parts, board->nr_parts);
+ if (ret) {
+- nand_release(nc);
++ nand_cleanup(nc);
+ goto no_dev;
+ }
+
--- /dev/null
+From 154298e2a3f6c9ce1d76cdb48d89fd5b107ea1a3 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:09 +0200
+Subject: mtd: rawnand: oxnas: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 154298e2a3f6c9ce1d76cdb48d89fd5b107ea1a3 upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+While at it, be consistent and move the function call in the error
+path thanks to a goto statement.
+
+Fixes: 668592492409 ("mtd: nand: Add OX820 NAND Support")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-37-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/oxnas_nand.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/mtd/nand/raw/oxnas_nand.c
++++ b/drivers/mtd/nand/raw/oxnas_nand.c
+@@ -140,10 +140,8 @@ static int oxnas_nand_probe(struct platf
+ goto err_release_child;
+
+ err = mtd_device_register(mtd, NULL, 0);
+- if (err) {
+- nand_release(chip);
+- goto err_release_child;
+- }
++ if (err)
++ goto err_cleanup_nand;
+
+ oxnas->chips[nchips] = chip;
+ ++nchips;
+@@ -159,6 +157,8 @@ static int oxnas_nand_probe(struct platf
+
+ return 0;
+
++err_cleanup_nand:
++ nand_cleanup(chip);
+ err_release_child:
+ of_node_put(nand_np);
+ err_clk_unprepare:
--- /dev/null
+From f51466901c07e6930435d30b02a21f0841174f61 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:13 +0200
+Subject: mtd: rawnand: pasemi: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit f51466901c07e6930435d30b02a21f0841174f61 upstream.
+
+nand_cleanup() is supposed to be called on error after a successful
+call to nand_scan() to free all NAND resources.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates by far the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible, hence pointing it as the commit to
+fix for backporting purposes, even if this commit is not introducing
+any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-41-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/pasemi_nand.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/pasemi_nand.c
++++ b/drivers/mtd/nand/raw/pasemi_nand.c
+@@ -146,7 +146,7 @@ static int pasemi_nand_probe(struct plat
+ if (mtd_device_register(pasemi_nand_mtd, NULL, 0)) {
+ dev_err(dev, "Unable to register MTD device\n");
+ err = -ENODEV;
+- goto out_lpc;
++ goto out_cleanup_nand;
+ }
+
+ dev_info(dev, "PA Semi NAND flash at %pR, control at I/O %x\n", &res,
+@@ -154,6 +154,8 @@ static int pasemi_nand_probe(struct plat
+
+ return 0;
+
++ out_cleanup_nand:
++ nand_cleanup(chip);
+ out_lpc:
+ release_region(lpcctl, 4);
+ out_ior:
--- /dev/null
+From 5284024b4dac5e94f7f374ca905c7580dbc455e9 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:15 +0200
+Subject: mtd: rawnand: plat_nand: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 5284024b4dac5e94f7f374ca905c7580dbc455e9 upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates by far the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible, hence pointing it as the commit to
+fix for backporting purposes, even if this commit is not introducing
+any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-43-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/plat_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/plat_nand.c
++++ b/drivers/mtd/nand/raw/plat_nand.c
+@@ -92,7 +92,7 @@ static int plat_nand_probe(struct platfo
+ if (!err)
+ return err;
+
+- nand_release(&data->chip);
++ nand_cleanup(&data->chip);
+ out:
+ if (pdata->ctrl.remove)
+ pdata->ctrl.remove(pdev);
--- /dev/null
+From 0f44b3275b3798ccb97a2f51ac85871c30d6fbbc Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:21 +0200
+Subject: mtd: rawnand: sharpsl: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 0f44b3275b3798ccb97a2f51ac85871c30d6fbbc upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no Fixes tag applying here as the use of nand_release()
+in this driver predates by far the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. However, pointing this commit as the
+culprit for backporting purposes makes sense.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-49-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/sharpsl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/sharpsl.c
++++ b/drivers/mtd/nand/raw/sharpsl.c
+@@ -183,7 +183,7 @@ static int sharpsl_nand_probe(struct pla
+ return 0;
+
+ err_add:
+- nand_release(this);
++ nand_cleanup(this);
+
+ err_scan:
+ iounmap(sharpsl->io);
--- /dev/null
+From 9c6c2e5cc77119ce0dacb4f9feedb73ce0354421 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:23 +0200
+Subject: mtd: rawnand: socrates: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 9c6c2e5cc77119ce0dacb4f9feedb73ce0354421 upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates by far the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. However, pointing this commit as the
+culprit for backporting purposes makes sense even if this commit is not
+introducing any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-51-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/socrates_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/socrates_nand.c
++++ b/drivers/mtd/nand/raw/socrates_nand.c
+@@ -169,7 +169,7 @@ static int socrates_nand_probe(struct pl
+ if (!res)
+ return res;
+
+- nand_release(nand_chip);
++ nand_cleanup(nand_chip);
+
+ out:
+ iounmap(host->io_base);
--- /dev/null
+From 3d84515ffd8fb657e10fa5b1215e9f095fa7efca Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:26 +0200
+Subject: mtd: rawnand: sunxi: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 3d84515ffd8fb657e10fa5b1215e9f095fa7efca upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-54-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -2003,7 +2003,7 @@ static int sunxi_nand_chip_init(struct d
+ ret = mtd_device_register(mtd, NULL, 0);
+ if (ret) {
+ dev_err(dev, "failed to register mtd device: %d\n", ret);
+- nand_release(nand);
++ nand_cleanup(nand);
+ return ret;
+ }
+
--- /dev/null
+From 75e9a330a9bd48f97a55a08000236084fe3dae56 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:29 +0200
+Subject: mtd: rawnand: tmio: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 75e9a330a9bd48f97a55a08000236084fe3dae56 upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates by far the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. However, pointing this commit as the
+culprit for backporting purposes makes sense even if this commit is not
+introducing any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-57-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/tmio_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/tmio_nand.c
++++ b/drivers/mtd/nand/raw/tmio_nand.c
+@@ -448,7 +448,7 @@ static int tmio_probe(struct platform_de
+ if (!retval)
+ return retval;
+
+- nand_release(nand_chip);
++ nand_cleanup(nand_chip);
+
+ err_irq:
+ tmio_hw_stop(dev, tmio);
--- /dev/null
+From 34531be5e804a8e1abf314a6c3a19fe342e4a154 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Tue, 19 May 2020 15:00:33 +0200
+Subject: mtd: rawnand: xway: Fix the probe error path
+
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+
+commit 34531be5e804a8e1abf314a6c3a19fe342e4a154 upstream.
+
+nand_release() is supposed be called after MTD device registration.
+Here, only nand_scan() happened, so use nand_cleanup() instead.
+
+There is no real Fixes tag applying here as the use of nand_release()
+in this driver predates the introduction of nand_cleanup() in
+commit d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+which makes this change possible. However, pointing this commit as the
+culprit for backporting purposes makes sense even if this commit is not
+introducing any bug.
+
+Fixes: d44154f969a4 ("mtd: nand: Provide nand_cleanup() function to free NAND related resources")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-61-miquel.raynal@bootlin.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/nand/raw/xway_nand.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/nand/raw/xway_nand.c
++++ b/drivers/mtd/nand/raw/xway_nand.c
+@@ -210,7 +210,7 @@ static int xway_nand_probe(struct platfo
+
+ err = mtd_device_register(mtd, NULL, 0);
+ if (err)
+- nand_release(&data->chip);
++ nand_cleanup(&data->chip);
+
+ return err;
+ }
--- /dev/null
+From b577a279914085c6b657c33e9f39ef56d96a3302 Mon Sep 17 00:00:00 2001
+From: Jonathan Bakker <xc-racer2@live.ca>
+Date: Sat, 4 Apr 2020 10:08:49 -0700
+Subject: pinctrl: samsung: Correct setting of eint wakeup mask on s5pv210
+
+From: Jonathan Bakker <xc-racer2@live.ca>
+
+commit b577a279914085c6b657c33e9f39ef56d96a3302 upstream.
+
+Commit a8be2af0218c ("pinctrl: samsung: Write external wakeup interrupt
+mask") started writing the eint wakeup mask from the pinctrl driver.
+Unfortunately, it made the assumption that the private retention data
+was always a regmap while in the case of s5pv210 it is a raw pointer
+to the clock base (as the eint wakeup mask not in the PMU as with newer
+Exynos platforms).
+
+Fixes: a8be2af0218c ("pinctrl: samsung: Write external wakeup interrupt mask")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-exynos.c | 73 ++++++++++++++++++++-----------
+ 1 file changed, 49 insertions(+), 24 deletions(-)
+
+--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
+@@ -40,6 +40,8 @@ struct exynos_irq_chip {
+ u32 eint_pend;
+ u32 eint_wake_mask_value;
+ u32 eint_wake_mask_reg;
++ void (*set_eint_wakeup_mask)(struct samsung_pinctrl_drv_data *drvdata,
++ struct exynos_irq_chip *irq_chip);
+ };
+
+ static inline struct exynos_irq_chip *to_exynos_irq_chip(struct irq_chip *chip)
+@@ -342,6 +344,47 @@ static int exynos_wkup_irq_set_wake(stru
+ return 0;
+ }
+
++static void
++exynos_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata,
++ struct exynos_irq_chip *irq_chip)
++{
++ struct regmap *pmu_regs;
++
++ if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) {
++ dev_warn(drvdata->dev,
++ "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n");
++ return;
++ }
++
++ pmu_regs = drvdata->retention_ctrl->priv;
++ dev_info(drvdata->dev,
++ "Setting external wakeup interrupt mask: 0x%x\n",
++ irq_chip->eint_wake_mask_value);
++
++ regmap_write(pmu_regs, irq_chip->eint_wake_mask_reg,
++ irq_chip->eint_wake_mask_value);
++}
++
++static void
++s5pv210_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata,
++ struct exynos_irq_chip *irq_chip)
++
++{
++ void __iomem *clk_base;
++
++ if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) {
++ dev_warn(drvdata->dev,
++ "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n");
++ return;
++ }
++
++
++ clk_base = (void __iomem *) drvdata->retention_ctrl->priv;
++
++ __raw_writel(irq_chip->eint_wake_mask_value,
++ clk_base + irq_chip->eint_wake_mask_reg);
++}
++
+ /*
+ * irq_chip for wakeup interrupts
+ */
+@@ -360,8 +403,9 @@ static const struct exynos_irq_chip s5pv
+ .eint_mask = EXYNOS_WKUP_EMASK_OFFSET,
+ .eint_pend = EXYNOS_WKUP_EPEND_OFFSET,
+ .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED,
+- /* Only difference with exynos4210_wkup_irq_chip: */
++ /* Only differences with exynos4210_wkup_irq_chip: */
+ .eint_wake_mask_reg = S5PV210_EINT_WAKEUP_MASK,
++ .set_eint_wakeup_mask = s5pv210_pinctrl_set_eint_wakeup_mask,
+ };
+
+ static const struct exynos_irq_chip exynos4210_wkup_irq_chip __initconst = {
+@@ -380,6 +424,7 @@ static const struct exynos_irq_chip exyn
+ .eint_pend = EXYNOS_WKUP_EPEND_OFFSET,
+ .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED,
+ .eint_wake_mask_reg = EXYNOS_EINT_WAKEUP_MASK,
++ .set_eint_wakeup_mask = exynos_pinctrl_set_eint_wakeup_mask,
+ };
+
+ static const struct exynos_irq_chip exynos7_wkup_irq_chip __initconst = {
+@@ -398,6 +443,7 @@ static const struct exynos_irq_chip exyn
+ .eint_pend = EXYNOS7_WKUP_EPEND_OFFSET,
+ .eint_wake_mask_value = EXYNOS_EINT_WAKEUP_MASK_DISABLED,
+ .eint_wake_mask_reg = EXYNOS5433_EINT_WAKEUP_MASK,
++ .set_eint_wakeup_mask = exynos_pinctrl_set_eint_wakeup_mask,
+ };
+
+ /* list of external wakeup controllers supported */
+@@ -574,27 +620,6 @@ int exynos_eint_wkup_init(struct samsung
+ return 0;
+ }
+
+-static void
+-exynos_pinctrl_set_eint_wakeup_mask(struct samsung_pinctrl_drv_data *drvdata,
+- struct exynos_irq_chip *irq_chip)
+-{
+- struct regmap *pmu_regs;
+-
+- if (!drvdata->retention_ctrl || !drvdata->retention_ctrl->priv) {
+- dev_warn(drvdata->dev,
+- "No retention data configured bank with external wakeup interrupt. Wake-up mask will not be set.\n");
+- return;
+- }
+-
+- pmu_regs = drvdata->retention_ctrl->priv;
+- dev_info(drvdata->dev,
+- "Setting external wakeup interrupt mask: 0x%x\n",
+- irq_chip->eint_wake_mask_value);
+-
+- regmap_write(pmu_regs, irq_chip->eint_wake_mask_reg,
+- irq_chip->eint_wake_mask_value);
+-}
+-
+ static void exynos_pinctrl_suspend_bank(
+ struct samsung_pinctrl_drv_data *drvdata,
+ struct samsung_pin_bank *bank)
+@@ -626,8 +651,8 @@ void exynos_pinctrl_suspend(struct samsu
+ else if (bank->eint_type == EINT_TYPE_WKUP) {
+ if (!irq_chip) {
+ irq_chip = bank->irq_chip;
+- exynos_pinctrl_set_eint_wakeup_mask(drvdata,
+- irq_chip);
++ irq_chip->set_eint_wakeup_mask(drvdata,
++ irq_chip);
+ } else if (bank->irq_chip != irq_chip) {
+ dev_warn(drvdata->dev,
+ "More than one external wakeup interrupt chip configured (bank: %s). This is not supported by hardware nor by driver.\n",
--- /dev/null
+From f354157a7d184db430c1a564c506434e33b1bec5 Mon Sep 17 00:00:00 2001
+From: Jonathan Bakker <xc-racer2@live.ca>
+Date: Sat, 25 Apr 2020 16:10:46 -0700
+Subject: pinctrl: samsung: Save/restore eint_mask over suspend for EINT_TYPE GPIOs
+
+From: Jonathan Bakker <xc-racer2@live.ca>
+
+commit f354157a7d184db430c1a564c506434e33b1bec5 upstream.
+
+Currently, for EINT_TYPE GPIOs, the CON and FLTCON registers
+are saved and restored over a suspend/resume cycle. However, the
+EINT_MASK registers are not.
+
+On S5PV210 at the very least, these registers are not retained over
+suspend, leading to the interrupts remaining masked upon resume and
+therefore no interrupts being triggered for the device. There should
+be no effect on any SoCs that do retain these registers as theoretically
+we would just be re-writing what was already there.
+
+Fixes: 7ccbc60cd9c2 ("pinctrl: exynos: Handle suspend/resume of GPIO EINT registers")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Bakker <xc-racer2@live.ca>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/samsung/pinctrl-exynos.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/pinctrl/samsung/pinctrl-exynos.c
++++ b/drivers/pinctrl/samsung/pinctrl-exynos.c
+@@ -267,6 +267,7 @@ struct exynos_eint_gpio_save {
+ u32 eint_con;
+ u32 eint_fltcon0;
+ u32 eint_fltcon1;
++ u32 eint_mask;
+ };
+
+ /*
+@@ -633,10 +634,13 @@ static void exynos_pinctrl_suspend_bank(
+ + 2 * bank->eint_offset);
+ save->eint_fltcon1 = readl(regs + EXYNOS_GPIO_EFLTCON_OFFSET
+ + 2 * bank->eint_offset + 4);
++ save->eint_mask = readl(regs + bank->irq_chip->eint_mask
++ + bank->eint_offset);
+
+ pr_debug("%s: save con %#010x\n", bank->name, save->eint_con);
+ pr_debug("%s: save fltcon0 %#010x\n", bank->name, save->eint_fltcon0);
+ pr_debug("%s: save fltcon1 %#010x\n", bank->name, save->eint_fltcon1);
++ pr_debug("%s: save mask %#010x\n", bank->name, save->eint_mask);
+ }
+
+ void exynos_pinctrl_suspend(struct samsung_pinctrl_drv_data *drvdata)
+@@ -678,6 +682,9 @@ static void exynos_pinctrl_resume_bank(
+ pr_debug("%s: fltcon1 %#010x => %#010x\n", bank->name,
+ readl(regs + EXYNOS_GPIO_EFLTCON_OFFSET
+ + 2 * bank->eint_offset + 4), save->eint_fltcon1);
++ pr_debug("%s: mask %#010x => %#010x\n", bank->name,
++ readl(regs + bank->irq_chip->eint_mask
++ + bank->eint_offset), save->eint_mask);
+
+ writel(save->eint_con, regs + EXYNOS_GPIO_ECON_OFFSET
+ + bank->eint_offset);
+@@ -685,6 +692,8 @@ static void exynos_pinctrl_resume_bank(
+ + 2 * bank->eint_offset);
+ writel(save->eint_fltcon1, regs + EXYNOS_GPIO_EFLTCON_OFFSET
+ + 2 * bank->eint_offset + 4);
++ writel(save->eint_mask, regs + bank->irq_chip->eint_mask
++ + bank->eint_offset);
+ }
+
+ void exynos_pinctrl_resume(struct samsung_pinctrl_drv_data *drvdata)
--- /dev/null
+From 6b20464ad9fb5fd76ef6f219ce62156aa9639dcc Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl>
+Date: Fri, 3 Apr 2020 22:20:33 +0200
+Subject: power: supply: core: fix HWMON temperature labels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+
+commit 6b20464ad9fb5fd76ef6f219ce62156aa9639dcc upstream.
+
+tempX_label files are swapped compared to what
+power_supply_hwmon_temp_to_property() uses. Make them match.
+
+Cc: stable@vger.kernel.org
+Fixes: e67d4dfc9ff1 ("power: supply: Add HWMON compatibility layer")
+Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/power_supply_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/supply/power_supply_hwmon.c
++++ b/drivers/power/supply/power_supply_hwmon.c
+@@ -144,7 +144,7 @@ static int power_supply_hwmon_read_strin
+ u32 attr, int channel,
+ const char **str)
+ {
+- *str = channel ? "temp" : "temp ambient";
++ *str = channel ? "temp ambient" : "temp";
+ return 0;
+ }
+
--- /dev/null
+From 1d7a7128a2e9e1f137c99b0a44e94d70a77343e3 Mon Sep 17 00:00:00 2001
+From: Qiushi Wu <wu000273@umn.edu>
+Date: Sat, 2 May 2020 18:33:38 -0500
+Subject: power: supply: core: fix memory leak in HWMON error path
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+commit 1d7a7128a2e9e1f137c99b0a44e94d70a77343e3 upstream.
+
+In function power_supply_add_hwmon_sysfs(), psyhw->props is
+allocated by bitmap_zalloc(). But this pointer is not deallocated
+when devm_add_action fail, which lead to a memory leak bug. To fix
+this, we replace devm_add_action with devm_add_action_or_reset.
+
+Cc: stable@kernel.org
+Fixes: e67d4dfc9ff19 ("power: supply: Add HWMON compatibility layer")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/supply/power_supply_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/power/supply/power_supply_hwmon.c
++++ b/drivers/power/supply/power_supply_hwmon.c
+@@ -304,7 +304,7 @@ int power_supply_add_hwmon_sysfs(struct
+ goto error;
+ }
+
+- ret = devm_add_action(dev, power_supply_hwmon_bitmap_free,
++ ret = devm_add_action_or_reset(dev, power_supply_hwmon_bitmap_free,
+ psyhw->props);
+ if (ret)
+ goto error;
--- /dev/null
+From 73174acc9c75960af2daa7dcbdb9781fc0d135cb Mon Sep 17 00:00:00 2001
+From: Anders Roxell <anders.roxell@linaro.org>
+Date: Wed, 27 May 2020 13:26:04 +0200
+Subject: power: vexpress: add suppress_bind_attrs to true
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+commit 73174acc9c75960af2daa7dcbdb9781fc0d135cb upstream.
+
+Make sure that the POWER_RESET_VEXPRESS driver won't have bind/unbind
+attributes available via the sysfs, so lets be explicit here and use
+".suppress_bind_attrs = true" to prevent userspace from doing something
+silly.
+
+Link: https://lore.kernel.org/r/20200527112608.3886105-2-anders.roxell@linaro.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/power/reset/vexpress-poweroff.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/power/reset/vexpress-poweroff.c
++++ b/drivers/power/reset/vexpress-poweroff.c
+@@ -143,6 +143,7 @@ static struct platform_driver vexpress_r
+ .driver = {
+ .name = "vexpress-reset",
+ .of_match_table = vexpress_reset_of_match,
++ .suppress_bind_attrs = true,
+ },
+ };
+
--- /dev/null
+From 888468ce725a4cd56d72dc7e5096078f7a9251a0 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Thu, 28 May 2020 10:17:04 +0000
+Subject: powerpc/32: Disable KASAN with pages bigger than 16k
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 888468ce725a4cd56d72dc7e5096078f7a9251a0 upstream.
+
+Mapping of early shadow area is implemented by using a single static
+page table having all entries pointing to the same early shadow page.
+The shadow area must therefore occupy full PGD entries.
+
+The shadow area has a size of 128MB starting at 0xf8000000.
+With 4k pages, a PGD entry is 4MB
+With 16k pages, a PGD entry is 64MB
+With 64k pages, a PGD entry is 1GB which is too big.
+
+Until we rework the early shadow mapping, disable KASAN when the page
+size is too big.
+
+Fixes: 2edb16efc899 ("powerpc/32: Add KASAN support")
+Cc: stable@vger.kernel.org # v5.2+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/7195fcde7314ccbf7a081b356084a69d421b10d4.1590660977.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -171,7 +171,7 @@ config PPC
+ select HAVE_ARCH_AUDITSYSCALL
+ select HAVE_ARCH_HUGE_VMAP if PPC_BOOK3S_64 && PPC_RADIX_MMU
+ select HAVE_ARCH_JUMP_LABEL
+- select HAVE_ARCH_KASAN if PPC32
++ select HAVE_ARCH_KASAN if PPC32 && PPC_PAGE_SHIFT <= 14
+ select HAVE_ARCH_KGDB
+ select HAVE_ARCH_MMAP_RND_BITS
+ select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT
--- /dev/null
+From 74016701fe5f873ae23bf02835407227138d874d Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Sat, 30 May 2020 17:16:33 +0000
+Subject: powerpc/32s: Fix another build failure with CONFIG_PPC_KUAP_DEBUG
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 74016701fe5f873ae23bf02835407227138d874d upstream.
+
+'thread' doesn't exist in kuap_check() macro.
+
+Use 'current' instead.
+
+Fixes: a68c31fc01ef ("powerpc/32s: Implement Kernel Userspace Access Protection")
+Cc: stable@vger.kernel.org
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/b459e1600b969047a74e34251a84a3d6fdf1f312.1590858925.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/book3s/32/kup.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/include/asm/book3s/32/kup.h
++++ b/arch/powerpc/include/asm/book3s/32/kup.h
+@@ -2,6 +2,7 @@
+ #ifndef _ASM_POWERPC_BOOK3S_32_KUP_H
+ #define _ASM_POWERPC_BOOK3S_32_KUP_H
+
++#include <asm/bug.h>
+ #include <asm/book3s/32/mmu-hash.h>
+
+ #ifdef __ASSEMBLY__
+@@ -75,7 +76,7 @@
+
+ .macro kuap_check current, gpr
+ #ifdef CONFIG_PPC_KUAP_DEBUG
+- lwz \gpr, KUAP(thread)
++ lwz \gpr, THREAD + KUAP(\current)
+ 999: twnei \gpr, 0
+ EMIT_BUG_ENTRY 999b, __FILE__, __LINE__, (BUGFLAG_WARNING | BUGFLAG_ONCE)
+ #endif
--- /dev/null
+From 993e3d96fd08c3ebf7566e43be9b8cd622063e6d Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 28 May 2020 00:58:41 +1000
+Subject: powerpc/64s: Don't let DT CPU features set FSCR_DSCR
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 993e3d96fd08c3ebf7566e43be9b8cd622063e6d upstream.
+
+The device tree CPU features binding includes FSCR bit numbers which
+Linux is instructed to set by firmware.
+
+Whether that's a good idea or not, in the case of the DSCR the Linux
+implementation has a hard requirement that the FSCR_DSCR bit not be
+set by default. We use it to track when a process reads/writes to
+DSCR, so it must be clear to begin with.
+
+So if firmware tells us to set FSCR_DSCR we must ignore it.
+
+Currently this does not cause a bug in our DSCR handling because the
+value of FSCR that the device tree CPU features code establishes is
+only used by swapper. All other tasks use the value hard coded in
+init_task.thread.fscr.
+
+However we'd like to fix that in a future commit, at which point this
+will become necessary.
+
+Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
+Cc: stable@vger.kernel.org # v4.12+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200527145843.2761782-2-mpe@ellerman.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/dt_cpu_ftrs.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -346,6 +346,14 @@ static int __init feat_enable_dscr(struc
+ {
+ u64 lpcr;
+
++ /*
++ * Linux relies on FSCR[DSCR] being clear, so that we can take the
++ * facility unavailable interrupt and track the task's usage of DSCR.
++ * See facility_unavailable_exception().
++ * Clear the bit here so that feat_enable() doesn't set it.
++ */
++ f->fscr_bit_nr = -1;
++
+ feat_enable(f);
+
+ lpcr = mfspr(SPRN_LPCR);
--- /dev/null
+From 912c0a7f2b5daa3cbb2bc10f303981e493de73bd Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 28 May 2020 00:58:42 +1000
+Subject: powerpc/64s: Save FSCR to init_task.thread.fscr after feature init
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit 912c0a7f2b5daa3cbb2bc10f303981e493de73bd upstream.
+
+At boot the FSCR is initialised via one of two paths. On most systems
+it's set to a hard coded value in __init_FSCR().
+
+On newer skiboot systems we use the device tree CPU features binding,
+where firmware can tell Linux what bits to set in FSCR (and HFSCR).
+
+In both cases the value that's configured at boot is not propagated
+into the init_task.thread.fscr value prior to the initial fork of init
+(pid 1), which means the value is not used by any processes other than
+swapper (the idle task).
+
+For the __init_FSCR() case this is OK, because the value in
+init_task.thread.fscr is initialised to something sensible. However it
+does mean that the value set in __init_FSCR() is not used other than
+for swapper, which is odd and confusing.
+
+The bigger problem is for the device tree CPU features case it
+prevents firmware from setting (or clearing) FSCR bits for use by user
+space. This means all existing kernels can not have features
+enabled/disabled by firmware if those features require
+setting/clearing FSCR bits.
+
+We can handle both cases by saving the FSCR value into
+init_task.thread.fscr after we have initialised it at boot. This fixes
+the bug for device tree CPU features, and will allow us to simplify
+the initialisation for the __init_FSCR() case in a future patch.
+
+Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
+Cc: stable@vger.kernel.org # v4.12+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200527145843.2761782-3-mpe@ellerman.id.au
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/prom.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/arch/powerpc/kernel/prom.c
++++ b/arch/powerpc/kernel/prom.c
+@@ -685,6 +685,23 @@ static void __init tm_init(void)
+ static void tm_init(void) { }
+ #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
+
++#ifdef CONFIG_PPC64
++static void __init save_fscr_to_task(void)
++{
++ /*
++ * Ensure the init_task (pid 0, aka swapper) uses the value of FSCR we
++ * have configured via the device tree features or via __init_FSCR().
++ * That value will then be propagated to pid 1 (init) and all future
++ * processes.
++ */
++ if (early_cpu_has_feature(CPU_FTR_ARCH_207S))
++ init_task.thread.fscr = mfspr(SPRN_FSCR);
++}
++#else
++static inline void save_fscr_to_task(void) {};
++#endif
++
++
+ void __init early_init_devtree(void *params)
+ {
+ phys_addr_t limit;
+@@ -773,6 +790,8 @@ void __init early_init_devtree(void *par
+ BUG();
+ }
+
++ save_fscr_to_task();
++
+ #if defined(CONFIG_SMP) && defined(CONFIG_PPC64)
+ /* We'll later wait for secondaries to check in; there are
+ * NCPUS-1 non-boot CPUs :-)
--- /dev/null
+From 9a2921e5baca1d25eb8d21f21d1e90581a6d0f68 Mon Sep 17 00:00:00 2001
+From: Hari Bathini <hbathini@linux.ibm.com>
+Date: Wed, 27 May 2020 15:14:35 +0530
+Subject: powerpc/fadump: Account for memory_limit while reserving memory
+
+From: Hari Bathini <hbathini@linux.ibm.com>
+
+commit 9a2921e5baca1d25eb8d21f21d1e90581a6d0f68 upstream.
+
+If the memory chunk found for reserving memory overshoots the memory
+limit imposed, do not proceed with reserving memory. Default behavior
+was this until commit 140777a3d8df ("powerpc/fadump: consider reserved
+ranges while reserving memory") changed it unwittingly.
+
+Fixes: 140777a3d8df ("powerpc/fadump: consider reserved ranges while reserving memory")
+Cc: stable@vger.kernel.org
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/159057266320.22331.6571453892066907320.stgit@hbathini.in.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/fadump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -601,7 +601,7 @@ int __init fadump_reserve_mem(void)
+ */
+ base = fadump_locate_reserve_mem(base, size);
+
+- if (!base) {
++ if (!base || (base + size > mem_boundary)) {
+ pr_err("Failed to find memory chunk for reservation!\n");
+ goto error_out;
+ }
--- /dev/null
+From 140777a3d8dfdb3d3f20ea7707c0f1c0ce1b0aa5 Mon Sep 17 00:00:00 2001
+From: Hari Bathini <hbathini@linux.ibm.com>
+Date: Mon, 20 Apr 2020 14:26:22 +0530
+Subject: powerpc/fadump: consider reserved ranges while reserving memory
+
+From: Hari Bathini <hbathini@linux.ibm.com>
+
+commit 140777a3d8dfdb3d3f20ea7707c0f1c0ce1b0aa5 upstream.
+
+Commit 0962e8004e97 ("powerpc/prom: Scan reserved-ranges node for
+memory reservations") enabled support to parse reserved-ranges DT
+node and reserve kernel memory falling in these ranges for F/W
+purposes. Memory reserved for FADump should not overlap with these
+ranges as it could corrupt memory meant for F/W or crash'ed kernel
+memory to be exported as vmcore.
+
+But since commit 579ca1a27675 ("powerpc/fadump: make use of memblock's
+bottom up allocation mode"), memblock_find_in_range() is being used to
+find the appropriate area to reserve memory for FADump, which can't
+account for reserved-ranges as these ranges are reserved only after
+FADump memory reservation.
+
+With reserved-ranges now being populated during early boot, look out
+for these memory ranges while reserving memory for FADump. Without
+this change, MPIPL on PowerNV systems aborts with hostboot failure,
+when memory reserved for FADump is less than 4096MB.
+
+Fixes: 579ca1a27675 ("powerpc/fadump: make use of memblock's bottom up allocation mode")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
+Reviewed-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/158737297693.26700.16193820746269425424.stgit@hbathini.in.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/fadump.c | 76 +++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 67 insertions(+), 9 deletions(-)
+
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -443,10 +443,72 @@ static int __init fadump_get_boot_mem_re
+ return ret;
+ }
+
++/*
++ * Returns true, if the given range overlaps with reserved memory ranges
++ * starting at idx. Also, updates idx to index of overlapping memory range
++ * with the given memory range.
++ * False, otherwise.
++ */
++static bool overlaps_reserved_ranges(u64 base, u64 end, int *idx)
++{
++ bool ret = false;
++ int i;
++
++ for (i = *idx; i < reserved_mrange_info.mem_range_cnt; i++) {
++ u64 rbase = reserved_mrange_info.mem_ranges[i].base;
++ u64 rend = rbase + reserved_mrange_info.mem_ranges[i].size;
++
++ if (end <= rbase)
++ break;
++
++ if ((end > rbase) && (base < rend)) {
++ *idx = i;
++ ret = true;
++ break;
++ }
++ }
++
++ return ret;
++}
++
++/*
++ * Locate a suitable memory area to reserve memory for FADump. While at it,
++ * lookup reserved-ranges & avoid overlap with them, as they are used by F/W.
++ */
++static u64 __init fadump_locate_reserve_mem(u64 base, u64 size)
++{
++ struct fadump_memory_range *mrngs;
++ phys_addr_t mstart, mend;
++ int idx = 0;
++ u64 i, ret = 0;
++
++ mrngs = reserved_mrange_info.mem_ranges;
++ for_each_free_mem_range(i, NUMA_NO_NODE, MEMBLOCK_NONE,
++ &mstart, &mend, NULL) {
++ pr_debug("%llu) mstart: %llx, mend: %llx, base: %llx\n",
++ i, mstart, mend, base);
++
++ if (mstart > base)
++ base = PAGE_ALIGN(mstart);
++
++ while ((mend > base) && ((mend - base) >= size)) {
++ if (!overlaps_reserved_ranges(base, base+size, &idx)) {
++ ret = base;
++ goto out;
++ }
++
++ base = mrngs[idx].base + mrngs[idx].size;
++ base = PAGE_ALIGN(base);
++ }
++ }
++
++out:
++ return ret;
++}
++
+ int __init fadump_reserve_mem(void)
+ {
+- u64 base, size, mem_boundary, bootmem_min, align = PAGE_SIZE;
+- bool is_memblock_bottom_up = memblock_bottom_up();
++ u64 base, size, mem_boundary, bootmem_min;
+ int ret = 1;
+
+ if (!fw_dump.fadump_enabled)
+@@ -467,9 +529,9 @@ int __init fadump_reserve_mem(void)
+ PAGE_ALIGN(fadump_calculate_reserve_size());
+ #ifdef CONFIG_CMA
+ if (!fw_dump.nocma) {
+- align = FADUMP_CMA_ALIGNMENT;
+ fw_dump.boot_memory_size =
+- ALIGN(fw_dump.boot_memory_size, align);
++ ALIGN(fw_dump.boot_memory_size,
++ FADUMP_CMA_ALIGNMENT);
+ }
+ #endif
+
+@@ -537,11 +599,7 @@ int __init fadump_reserve_mem(void)
+ * Reserve memory at an offset closer to bottom of the RAM to
+ * minimize the impact of memory hot-remove operation.
+ */
+- memblock_set_bottom_up(true);
+- base = memblock_find_in_range(base, mem_boundary, size, align);
+-
+- /* Restore the previous allocation mode */
+- memblock_set_bottom_up(is_memblock_bottom_up);
++ base = fadump_locate_reserve_mem(base, size);
+
+ if (!base) {
+ pr_err("Failed to find memory chunk for reservation!\n");
--- /dev/null
+From 02c04e374e176ae3a3f64a682f80702f8d2fb65d Mon Sep 17 00:00:00 2001
+From: Hari Bathini <hbathini@linux.ibm.com>
+Date: Mon, 20 Apr 2020 14:26:09 +0530
+Subject: powerpc/fadump: use static allocation for reserved memory ranges
+
+From: Hari Bathini <hbathini@linux.ibm.com>
+
+commit 02c04e374e176ae3a3f64a682f80702f8d2fb65d upstream.
+
+At times, memory ranges have to be looked up during early boot, when
+kernel couldn't be initialized for dynamic memory allocation. In fact,
+reserved-ranges look up is needed during FADump memory reservation.
+Without accounting for reserved-ranges in reserving memory for FADump,
+MPIPL boot fails with memory corruption issues. So, extend memory
+ranges handling to support static allocation and populate reserved
+memory ranges during early boot.
+
+Fixes: dda9dbfeeb7a ("powerpc/fadump: consider reserved ranges while releasing memory")
+Cc: stable@vger.kernel.org
+Signed-off-by: Hari Bathini <hbathini@linux.ibm.com>
+Reviewed-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/158737294432.26700.4830263187856221314.stgit@hbathini.in.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/fadump-internal.h | 4 +
+ arch/powerpc/kernel/fadump.c | 77 ++++++++++++++++-------------
+ 2 files changed, 48 insertions(+), 33 deletions(-)
+
+--- a/arch/powerpc/include/asm/fadump-internal.h
++++ b/arch/powerpc/include/asm/fadump-internal.h
+@@ -64,12 +64,14 @@ struct fadump_memory_range {
+ };
+
+ /* fadump memory ranges info */
++#define RNG_NAME_SZ 16
+ struct fadump_mrange_info {
+- char name[16];
++ char name[RNG_NAME_SZ];
+ struct fadump_memory_range *mem_ranges;
+ u32 mem_ranges_sz;
+ u32 mem_range_cnt;
+ u32 max_mem_ranges;
++ bool is_static;
+ };
+
+ /* Platform specific callback functions */
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -38,8 +38,17 @@ static void __init fadump_reserve_crash_
+
+ #ifndef CONFIG_PRESERVE_FA_DUMP
+ static DEFINE_MUTEX(fadump_mutex);
+-struct fadump_mrange_info crash_mrange_info = { "crash", NULL, 0, 0, 0 };
+-struct fadump_mrange_info reserved_mrange_info = { "reserved", NULL, 0, 0, 0 };
++struct fadump_mrange_info crash_mrange_info = { "crash", NULL, 0, 0, 0, false };
++
++#define RESERVED_RNGS_SZ 16384 /* 16K - 128 entries */
++#define RESERVED_RNGS_CNT (RESERVED_RNGS_SZ / \
++ sizeof(struct fadump_memory_range))
++static struct fadump_memory_range rngs[RESERVED_RNGS_CNT];
++struct fadump_mrange_info reserved_mrange_info = { "reserved", rngs,
++ RESERVED_RNGS_SZ, 0,
++ RESERVED_RNGS_CNT, true };
++
++static void __init early_init_dt_scan_reserved_ranges(unsigned long node);
+
+ #ifdef CONFIG_CMA
+ static struct cma *fadump_cma;
+@@ -108,6 +117,11 @@ static int __init fadump_cma_init(void)
+ int __init early_init_dt_scan_fw_dump(unsigned long node, const char *uname,
+ int depth, void *data)
+ {
++ if (depth == 0) {
++ early_init_dt_scan_reserved_ranges(node);
++ return 0;
++ }
++
+ if (depth != 1)
+ return 0;
+
+@@ -726,10 +740,14 @@ void fadump_free_cpu_notes_buf(void)
+
+ static void fadump_free_mem_ranges(struct fadump_mrange_info *mrange_info)
+ {
++ if (mrange_info->is_static) {
++ mrange_info->mem_range_cnt = 0;
++ return;
++ }
++
+ kfree(mrange_info->mem_ranges);
+- mrange_info->mem_ranges = NULL;
+- mrange_info->mem_ranges_sz = 0;
+- mrange_info->max_mem_ranges = 0;
++ memset((void *)((u64)mrange_info + RNG_NAME_SZ), 0,
++ (sizeof(struct fadump_mrange_info) - RNG_NAME_SZ));
+ }
+
+ /*
+@@ -786,6 +804,12 @@ static inline int fadump_add_mem_range(s
+ if (mrange_info->mem_range_cnt == mrange_info->max_mem_ranges) {
+ int ret;
+
++ if (mrange_info->is_static) {
++ pr_err("Reached array size limit for %s memory ranges\n",
++ mrange_info->name);
++ return -ENOSPC;
++ }
++
+ ret = fadump_alloc_mem_ranges(mrange_info);
+ if (ret)
+ return ret;
+@@ -1202,20 +1226,19 @@ static void sort_and_merge_mem_ranges(st
+ * Scan reserved-ranges to consider them while reserving/releasing
+ * memory for FADump.
+ */
+-static inline int fadump_scan_reserved_mem_ranges(void)
++static void __init early_init_dt_scan_reserved_ranges(unsigned long node)
+ {
+- struct device_node *root;
+ const __be32 *prop;
+ int len, ret = -1;
+ unsigned long i;
+
+- root = of_find_node_by_path("/");
+- if (!root)
+- return ret;
++ /* reserved-ranges already scanned */
++ if (reserved_mrange_info.mem_range_cnt != 0)
++ return;
+
+- prop = of_get_property(root, "reserved-ranges", &len);
++ prop = of_get_flat_dt_prop(node, "reserved-ranges", &len);
+ if (!prop)
+- return ret;
++ return;
+
+ /*
+ * Each reserved range is an (address,size) pair, 2 cells each,
+@@ -1237,7 +1260,8 @@ static inline int fadump_scan_reserved_m
+ }
+ }
+
+- return ret;
++ /* Compact reserved ranges */
++ sort_and_merge_mem_ranges(&reserved_mrange_info);
+ }
+
+ /*
+@@ -1251,32 +1275,21 @@ static void fadump_release_memory(u64 be
+ u64 ra_start, ra_end, tstart;
+ int i, ret;
+
+- fadump_scan_reserved_mem_ranges();
+-
+ ra_start = fw_dump.reserve_dump_area_start;
+ ra_end = ra_start + fw_dump.reserve_dump_area_size;
+
+ /*
+- * Add reserved dump area to reserved ranges list
+- * and exclude all these ranges while releasing memory.
++ * If reserved ranges array limit is hit, overwrite the last reserved
++ * memory range with reserved dump area to ensure it is excluded from
++ * the memory being released (reused for next FADump registration).
+ */
+- ret = fadump_add_mem_range(&reserved_mrange_info, ra_start, ra_end);
+- if (ret != 0) {
+- /*
+- * Not enough memory to setup reserved ranges but the system is
+- * running shortage of memory. So, release all the memory except
+- * Reserved dump area (reused for next fadump registration).
+- */
+- if (begin < ra_end && end > ra_start) {
+- if (begin < ra_start)
+- fadump_release_reserved_area(begin, ra_start);
+- if (end > ra_end)
+- fadump_release_reserved_area(ra_end, end);
+- } else
+- fadump_release_reserved_area(begin, end);
++ if (reserved_mrange_info.mem_range_cnt ==
++ reserved_mrange_info.max_mem_ranges)
++ reserved_mrange_info.mem_range_cnt--;
+
++ ret = fadump_add_mem_range(&reserved_mrange_info, ra_start, ra_end);
++ if (ret != 0)
+ return;
+- }
+
+ /* Get the reserved ranges list in order first. */
+ sort_and_merge_mem_ranges(&reserved_mrange_info);
--- /dev/null
+From 3a66a24f6060e6775f8c02ac52329ea0152d7e58 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Tue, 19 May 2020 05:48:44 +0000
+Subject: powerpc/kasan: Fix issues by lowering KASAN_SHADOW_END
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 3a66a24f6060e6775f8c02ac52329ea0152d7e58 upstream.
+
+At the time being, KASAN_SHADOW_END is 0x100000000, which
+is 0 in 32 bits representation.
+
+This leads to a couple of issues:
+- kasan_remap_early_shadow_ro() does nothing because the comparison
+k_cur < k_end is always false.
+- In ptdump, address comparison for markers display fails and the
+marker's name is printed at the start of the KASAN area instead of
+being printed at the end.
+
+However, there is no need to shadow the KASAN shadow area itself,
+so the KASAN shadow area can stop shadowing memory at the start
+of itself.
+
+With a PAGE_OFFSET set to 0xc0000000, KASAN shadow area is then going
+from 0xf8000000 to 0xff000000.
+
+Fixes: cbd18991e24f ("powerpc/mm: Fix an Oops in kasan_mmu_init()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/ae1a3c0d19a37410c209c3fc453634cfcc0ee318.1589866984.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/kasan.h | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/arch/powerpc/include/asm/kasan.h
++++ b/arch/powerpc/include/asm/kasan.h
+@@ -23,9 +23,7 @@
+
+ #define KASAN_SHADOW_OFFSET ASM_CONST(CONFIG_KASAN_SHADOW_OFFSET)
+
+-#define KASAN_SHADOW_END 0UL
+-
+-#define KASAN_SHADOW_SIZE (KASAN_SHADOW_END - KASAN_SHADOW_START)
++#define KASAN_SHADOW_END (-(-KASAN_SHADOW_START >> KASAN_SHADOW_SCALE_SHIFT))
+
+ #ifdef CONFIG_KASAN
+ void kasan_early_init(void);
--- /dev/null
+From d2a91cef9bbdeb87b7449fdab1a6be6000930210 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Tue, 19 May 2020 05:48:45 +0000
+Subject: powerpc/kasan: Fix shadow pages allocation failure
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit d2a91cef9bbdeb87b7449fdab1a6be6000930210 upstream.
+
+Doing kasan pages allocation in MMU_init is too early, kernel doesn't
+have access yet to the entire memory space and memblock_alloc() fails
+when the kernel is a bit big.
+
+Do it from kasan_init() instead.
+
+Fixes: 2edb16efc899 ("powerpc/32: Add KASAN support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/c24163ee5d5f8cdf52fefa45055ceb35435b8f15.1589866984.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/kasan.h | 2 --
+ arch/powerpc/mm/init_32.c | 2 --
+ arch/powerpc/mm/kasan/kasan_init_32.c | 4 +++-
+ 3 files changed, 3 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/include/asm/kasan.h
++++ b/arch/powerpc/include/asm/kasan.h
+@@ -27,11 +27,9 @@
+
+ #ifdef CONFIG_KASAN
+ void kasan_early_init(void);
+-void kasan_mmu_init(void);
+ void kasan_init(void);
+ #else
+ static inline void kasan_init(void) { }
+-static inline void kasan_mmu_init(void) { }
+ #endif
+
+ #endif /* __ASSEMBLY */
+--- a/arch/powerpc/mm/init_32.c
++++ b/arch/powerpc/mm/init_32.c
+@@ -175,8 +175,6 @@ void __init MMU_init(void)
+ btext_unmap();
+ #endif
+
+- kasan_mmu_init();
+-
+ setup_kup();
+
+ /* Shortly after that, the entire linear mapping will be available */
+--- a/arch/powerpc/mm/kasan/kasan_init_32.c
++++ b/arch/powerpc/mm/kasan/kasan_init_32.c
+@@ -129,7 +129,7 @@ static void __init kasan_remap_early_sha
+ flush_tlb_kernel_range(KASAN_SHADOW_START, KASAN_SHADOW_END);
+ }
+
+-void __init kasan_mmu_init(void)
++static void __init kasan_mmu_init(void)
+ {
+ int ret;
+ struct memblock_region *reg;
+@@ -156,6 +156,8 @@ void __init kasan_mmu_init(void)
+
+ void __init kasan_init(void)
+ {
++ kasan_mmu_init();
++
+ kasan_remap_early_shadow_ro();
+
+ clear_page(kasan_early_shadow_page);
igb-report-speed-and-duplex-as-unknown-when-device-is-runtime-suspended.patch
hwmon-k10temp-add-amd-family-17h-model-60h-pci-match.patch
edac-amd64-add-amd-family-17h-model-60h-pci-ids.patch
+power-vexpress-add-suppress_bind_attrs-to-true.patch
+power-supply-core-fix-hwmon-temperature-labels.patch
+power-supply-core-fix-memory-leak-in-hwmon-error-path.patch
+pinctrl-samsung-correct-setting-of-eint-wakeup-mask-on-s5pv210.patch
+pinctrl-samsung-save-restore-eint_mask-over-suspend-for-eint_type-gpios.patch
+gnss-sirf-fix-error-return-code-in-sirf_probe.patch
+sparc32-fix-register-window-handling-in-genregs32_et.patch
+sparc64-fix-misuses-of-access_process_vm-in-genregs32_et.patch
+dm-crypt-avoid-truncating-the-logical-block-size.patch
+alpha-fix-memory-barriers-so-that-they-conform-to-the-specification.patch
+powerpc-fadump-use-static-allocation-for-reserved-memory-ranges.patch
+powerpc-fadump-consider-reserved-ranges-while-reserving-memory.patch
+powerpc-fadump-account-for-memory_limit-while-reserving-memory.patch
+kernel-cpu_pm-fix-uninitted-local-in-cpu_pm.patch
+arm-tegra-correct-pl310-auxiliary-control-register-initialization.patch
+soc-tegra-pmc-select-generic_pinconf.patch
+arm-dts-exynos-fix-gpio-polarity-for-thr-galaxys3-cm36651-sensor-s-bus.patch
+arm-dts-at91-sama5d2_ptc_ek-fix-vbus-pin.patch
+arm-dts-s5pv210-set-keep-power-in-suspend-for-sdhci1-on-aries.patch
+drivers-macintosh-fix-memleak-in-windfarm_pm112-driver.patch
+powerpc-32s-fix-another-build-failure-with-config_ppc_kuap_debug.patch
+powerpc-kasan-fix-issues-by-lowering-kasan_shadow_end.patch
+powerpc-kasan-fix-shadow-pages-allocation-failure.patch
+powerpc-32-disable-kasan-with-pages-bigger-than-16k.patch
+powerpc-64s-don-t-let-dt-cpu-features-set-fscr_dscr.patch
+powerpc-64s-save-fscr-to-init_task.thread.fscr-after-feature-init.patch
+kbuild-force-to-build-vmlinux-if-config_modversion-y.patch
+sunrpc-svcauth_gss_register_pseudoflavor-must-reject-duplicate-registrations.patch
+sunrpc-clean-up-properly-in-gss_mech_unregister.patch
+mtd-rawnand-fix-nand_gpio_waitrdy.patch
+mtd-rawnand-onfi-fix-redundancy-detection-check.patch
+mtd-rawnand-brcmnand-fix-hamming-oob-layout.patch
+mtd-rawnand-diskonchip-fix-the-probe-error-path.patch
+mtd-rawnand-sharpsl-fix-the-probe-error-path.patch
+mtd-rawnand-ingenic-fix-the-probe-error-path.patch
+mtd-rawnand-xway-fix-the-probe-error-path.patch
+mtd-rawnand-orion-fix-the-probe-error-path.patch
+mtd-rawnand-socrates-fix-the-probe-error-path.patch
+mtd-rawnand-oxnas-fix-the-probe-error-path.patch
+mtd-rawnand-sunxi-fix-the-probe-error-path.patch
+mtd-rawnand-plat_nand-fix-the-probe-error-path.patch
+mtd-rawnand-pasemi-fix-the-probe-error-path.patch
+mtd-rawnand-mtk-fix-the-probe-error-path.patch
+mtd-rawnand-tmio-fix-the-probe-error-path.patch
+w1-omap-hdq-cleanup-to-add-missing-newline-for-some-dev_dbg.patch
--- /dev/null
+From 5098e2b95e8e6f56266c2d5c180c75917090082a Mon Sep 17 00:00:00 2001
+From: Corentin Labbe <clabbe@baylibre.com>
+Date: Wed, 18 Mar 2020 15:25:08 +0000
+Subject: soc/tegra: pmc: Select GENERIC_PINCONF
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+commit 5098e2b95e8e6f56266c2d5c180c75917090082a upstream.
+
+I have hit the following build error:
+armv7a-hardfloat-linux-gnueabi-ld: drivers/soc/tegra/pmc.o: in function `pinconf_generic_dt_node_to_map_pin':
+pmc.c:(.text+0x500): undefined reference to `pinconf_generic_dt_node_to_map'
+armv7a-hardfloat-linux-gnueabi-ld: drivers/soc/tegra/pmc.o:(.rodata+0x1f88): undefined reference to `pinconf_generic_dt_free_map'
+
+So SOC_TEGRA_PMC should select GENERIC_PINCONF.
+
+Fixes: 4a37f11c8f57 ("soc/tegra: pmc: Implement pad configuration via pinctrl")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/tegra/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/soc/tegra/Kconfig
++++ b/drivers/soc/tegra/Kconfig
+@@ -130,6 +130,7 @@ config SOC_TEGRA_FLOWCTRL
+
+ config SOC_TEGRA_PMC
+ bool
++ select GENERIC_PINCONF
+
+ config SOC_TEGRA_POWERGATE_BPMP
+ def_bool y
--- /dev/null
+From cf51e129b96847f969bfb8af1ee1516a01a70b39 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 17 May 2020 12:20:40 -0400
+Subject: sparc32: fix register window handling in genregs32_[gs]et()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit cf51e129b96847f969bfb8af1ee1516a01a70b39 upstream.
+
+It needs access_process_vm() if the traced process does not share
+mm with the caller. Solution is similar to what sparc64 does.
+Note that genregs32_set() is only ever called with pos being 0
+or 32 * sizeof(u32) (the latter - as part of PTRACE_SETREGS
+handling).
+
+Cc: stable@kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/kernel/ptrace_32.c | 230 ++++++++++++++++++------------------------
+ 1 file changed, 99 insertions(+), 131 deletions(-)
+
+--- a/arch/sparc/kernel/ptrace_32.c
++++ b/arch/sparc/kernel/ptrace_32.c
+@@ -46,82 +46,79 @@ enum sparc_regset {
+ REGSET_FP,
+ };
+
++static int regwindow32_get(struct task_struct *target,
++ const struct pt_regs *regs,
++ u32 *uregs)
++{
++ unsigned long reg_window = regs->u_regs[UREG_I6];
++ int size = 16 * sizeof(u32);
++
++ if (target == current) {
++ if (copy_from_user(uregs, (void __user *)reg_window, size))
++ return -EFAULT;
++ } else {
++ if (access_process_vm(target, reg_window, uregs, size,
++ FOLL_FORCE) != size)
++ return -EFAULT;
++ }
++ return 0;
++}
++
++static int regwindow32_set(struct task_struct *target,
++ const struct pt_regs *regs,
++ u32 *uregs)
++{
++ unsigned long reg_window = regs->u_regs[UREG_I6];
++ int size = 16 * sizeof(u32);
++
++ if (target == current) {
++ if (copy_to_user((void __user *)reg_window, uregs, size))
++ return -EFAULT;
++ } else {
++ if (access_process_vm(target, reg_window, uregs, size,
++ FOLL_FORCE | FOLL_WRITE) != size)
++ return -EFAULT;
++ }
++ return 0;
++}
++
+ static int genregs32_get(struct task_struct *target,
+ const struct user_regset *regset,
+ unsigned int pos, unsigned int count,
+ void *kbuf, void __user *ubuf)
+ {
+ const struct pt_regs *regs = target->thread.kregs;
+- unsigned long __user *reg_window;
+- unsigned long *k = kbuf;
+- unsigned long __user *u = ubuf;
+- unsigned long reg;
++ u32 uregs[16];
++ int ret;
+
+ if (target == current)
+ flush_user_windows();
+
+- pos /= sizeof(reg);
+- count /= sizeof(reg);
++ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
++ regs->u_regs,
++ 0, 16 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+
+- if (kbuf) {
+- for (; count > 0 && pos < 16; count--)
+- *k++ = regs->u_regs[pos++];
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (get_user(*k++, ®_window[pos++]))
+- return -EFAULT;
+- }
+- } else {
+- for (; count > 0 && pos < 16; count--) {
+- if (put_user(regs->u_regs[pos++], u++))
+- return -EFAULT;
+- }
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (get_user(reg, ®_window[pos++]) ||
+- put_user(reg, u++))
+- return -EFAULT;
+- }
+- }
+- while (count > 0) {
+- switch (pos) {
+- case 32: /* PSR */
+- reg = regs->psr;
+- break;
+- case 33: /* PC */
+- reg = regs->pc;
+- break;
+- case 34: /* NPC */
+- reg = regs->npc;
+- break;
+- case 35: /* Y */
+- reg = regs->y;
+- break;
+- case 36: /* WIM */
+- case 37: /* TBR */
+- reg = 0;
+- break;
+- default:
+- goto finish;
+- }
+-
+- if (kbuf)
+- *k++ = reg;
+- else if (put_user(reg, u++))
++ if (pos < 32 * sizeof(u32)) {
++ if (regwindow32_get(target, regs, uregs))
+ return -EFAULT;
+- pos++;
+- count--;
++ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf,
++ uregs,
++ 16 * sizeof(u32), 32 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+ }
+-finish:
+- pos *= sizeof(reg);
+- count *= sizeof(reg);
+
+- return user_regset_copyout_zero(&pos, &count, &kbuf, &ubuf,
+- 38 * sizeof(reg), -1);
++ uregs[0] = regs->psr;
++ uregs[1] = regs->pc;
++ uregs[2] = regs->npc;
++ uregs[3] = regs->y;
++ uregs[4] = 0; /* WIM */
++ uregs[5] = 0; /* TBR */
++ return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
++ uregs,
++ 32 * sizeof(u32), 38 * sizeof(u32));
+ }
+
+ static int genregs32_set(struct task_struct *target,
+@@ -130,82 +127,53 @@ static int genregs32_set(struct task_str
+ const void *kbuf, const void __user *ubuf)
+ {
+ struct pt_regs *regs = target->thread.kregs;
+- unsigned long __user *reg_window;
+- const unsigned long *k = kbuf;
+- const unsigned long __user *u = ubuf;
+- unsigned long reg;
++ u32 uregs[16];
++ u32 psr;
++ int ret;
+
+ if (target == current)
+ flush_user_windows();
+
+- pos /= sizeof(reg);
+- count /= sizeof(reg);
+-
+- if (kbuf) {
+- for (; count > 0 && pos < 16; count--)
+- regs->u_regs[pos++] = *k++;
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (put_user(*k++, ®_window[pos++]))
+- return -EFAULT;
+- }
+- } else {
+- for (; count > 0 && pos < 16; count--) {
+- if (get_user(reg, u++))
+- return -EFAULT;
+- regs->u_regs[pos++] = reg;
+- }
+-
+- reg_window = (unsigned long __user *) regs->u_regs[UREG_I6];
+- reg_window -= 16;
+- for (; count > 0 && pos < 32; count--) {
+- if (get_user(reg, u++) ||
+- put_user(reg, ®_window[pos++]))
+- return -EFAULT;
+- }
+- }
+- while (count > 0) {
+- unsigned long psr;
+-
+- if (kbuf)
+- reg = *k++;
+- else if (get_user(reg, u++))
+- return -EFAULT;
+-
+- switch (pos) {
+- case 32: /* PSR */
+- psr = regs->psr;
+- psr &= ~(PSR_ICC | PSR_SYSCALL);
+- psr |= (reg & (PSR_ICC | PSR_SYSCALL));
+- regs->psr = psr;
+- break;
+- case 33: /* PC */
+- regs->pc = reg;
+- break;
+- case 34: /* NPC */
+- regs->npc = reg;
+- break;
+- case 35: /* Y */
+- regs->y = reg;
+- break;
+- case 36: /* WIM */
+- case 37: /* TBR */
+- break;
+- default:
+- goto finish;
+- }
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ regs->u_regs,
++ 0, 16 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+
+- pos++;
+- count--;
++ if (pos < 32 * sizeof(u32)) {
++ if (regwindow32_get(target, regs, uregs))
++ return -EFAULT;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ uregs,
++ 16 * sizeof(u32), 32 * sizeof(u32));
++ if (ret)
++ return ret;
++ if (regwindow32_set(target, regs, uregs))
++ return -EFAULT;
++ if (!count)
++ return 0;
+ }
+-finish:
+- pos *= sizeof(reg);
+- count *= sizeof(reg);
+-
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ &psr,
++ 32 * sizeof(u32), 33 * sizeof(u32));
++ if (ret)
++ return ret;
++ regs->psr = (regs->psr & ~(PSR_ICC | PSR_SYSCALL)) |
++ (psr & (PSR_ICC | PSR_SYSCALL));
++ if (!count)
++ return 0;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ ®s->pc,
++ 33 * sizeof(u32), 34 * sizeof(u32));
++ if (ret || !count)
++ return ret;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ ®s->y,
++ 34 * sizeof(u32), 35 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+ return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
+- 38 * sizeof(reg), -1);
++ 35 * sizeof(u32), 38 * sizeof(u32));
+ }
+
+ static int fpregs32_get(struct task_struct *target,
--- /dev/null
+From 142cd25293f6a7ecbdff4fb0af17de6438d46433 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 17 May 2020 15:37:50 -0400
+Subject: sparc64: fix misuses of access_process_vm() in genregs32_[sg]et()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 142cd25293f6a7ecbdff4fb0af17de6438d46433 upstream.
+
+We do need access_process_vm() to access the target's reg_window.
+However, access to caller's memory (storing the result in
+genregs32_get(), fetching the new values in case of genregs32_set())
+should be done by normal uaccess primitives.
+
+Fixes: ad4f95764040 ([SPARC64]: Fix user accesses in regset code.)
+Cc: stable@kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/kernel/ptrace_64.c | 17 +++--------------
+ 1 file changed, 3 insertions(+), 14 deletions(-)
+
+--- a/arch/sparc/kernel/ptrace_64.c
++++ b/arch/sparc/kernel/ptrace_64.c
+@@ -572,19 +572,13 @@ static int genregs32_get(struct task_str
+ for (; count > 0 && pos < 32; count--) {
+ if (access_process_vm(target,
+ (unsigned long)
+- ®_window[pos],
++ ®_window[pos++],
+ ®, sizeof(reg),
+ FOLL_FORCE)
+ != sizeof(reg))
+ return -EFAULT;
+- if (access_process_vm(target,
+- (unsigned long) u,
+- ®, sizeof(reg),
+- FOLL_FORCE | FOLL_WRITE)
+- != sizeof(reg))
++ if (put_user(reg, u++))
+ return -EFAULT;
+- pos++;
+- u++;
+ }
+ }
+ }
+@@ -684,12 +678,7 @@ static int genregs32_set(struct task_str
+ }
+ } else {
+ for (; count > 0 && pos < 32; count--) {
+- if (access_process_vm(target,
+- (unsigned long)
+- u,
+- ®, sizeof(reg),
+- FOLL_FORCE)
+- != sizeof(reg))
++ if (get_user(reg, u++))
+ return -EFAULT;
+ if (access_process_vm(target,
+ (unsigned long)
--- /dev/null
+From 24c5efe41c29ee3e55bcf5a1c9f61ca8709622e8 Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Fri, 22 May 2020 12:01:33 +1000
+Subject: sunrpc: clean up properly in gss_mech_unregister()
+
+From: NeilBrown <neilb@suse.de>
+
+commit 24c5efe41c29ee3e55bcf5a1c9f61ca8709622e8 upstream.
+
+gss_mech_register() calls svcauth_gss_register_pseudoflavor() for each
+flavour, but gss_mech_unregister() does not call auth_domain_put().
+This is unbalanced and makes it impossible to reload the module.
+
+Change svcauth_gss_register_pseudoflavor() to return the registered
+auth_domain, and save it for later release.
+
+Cc: stable@vger.kernel.org (v2.6.12+)
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206651
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/sunrpc/gss_api.h | 1 +
+ include/linux/sunrpc/svcauth_gss.h | 3 ++-
+ net/sunrpc/auth_gss/gss_mech_switch.c | 12 +++++++++---
+ net/sunrpc/auth_gss/svcauth_gss.c | 12 ++++++------
+ 4 files changed, 18 insertions(+), 10 deletions(-)
+
+--- a/include/linux/sunrpc/gss_api.h
++++ b/include/linux/sunrpc/gss_api.h
+@@ -85,6 +85,7 @@ struct pf_desc {
+ u32 service;
+ char *name;
+ char *auth_domain_name;
++ struct auth_domain *domain;
+ bool datatouch;
+ };
+
+--- a/include/linux/sunrpc/svcauth_gss.h
++++ b/include/linux/sunrpc/svcauth_gss.h
+@@ -21,7 +21,8 @@ int gss_svc_init(void);
+ void gss_svc_shutdown(void);
+ int gss_svc_init_net(struct net *net);
+ void gss_svc_shutdown_net(struct net *net);
+-int svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name);
++struct auth_domain *svcauth_gss_register_pseudoflavor(u32 pseudoflavor,
++ char *name);
+ u32 svcauth_gss_flavor(struct auth_domain *dom);
+
+ #endif /* __KERNEL__ */
+--- a/net/sunrpc/auth_gss/gss_mech_switch.c
++++ b/net/sunrpc/auth_gss/gss_mech_switch.c
+@@ -36,6 +36,8 @@ gss_mech_free(struct gss_api_mech *gm)
+
+ for (i = 0; i < gm->gm_pf_num; i++) {
+ pf = &gm->gm_pfs[i];
++ if (pf->domain)
++ auth_domain_put(pf->domain);
+ kfree(pf->auth_domain_name);
+ pf->auth_domain_name = NULL;
+ }
+@@ -58,6 +60,7 @@ make_auth_domain_name(char *name)
+ static int
+ gss_mech_svc_setup(struct gss_api_mech *gm)
+ {
++ struct auth_domain *dom;
+ struct pf_desc *pf;
+ int i, status;
+
+@@ -67,10 +70,13 @@ gss_mech_svc_setup(struct gss_api_mech *
+ status = -ENOMEM;
+ if (pf->auth_domain_name == NULL)
+ goto out;
+- status = svcauth_gss_register_pseudoflavor(pf->pseudoflavor,
+- pf->auth_domain_name);
+- if (status)
++ dom = svcauth_gss_register_pseudoflavor(
++ pf->pseudoflavor, pf->auth_domain_name);
++ if (IS_ERR(dom)) {
++ status = PTR_ERR(dom);
+ goto out;
++ }
++ pf->domain = dom;
+ }
+ return 0;
+ out:
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -800,7 +800,7 @@ u32 svcauth_gss_flavor(struct auth_domai
+
+ EXPORT_SYMBOL_GPL(svcauth_gss_flavor);
+
+-int
++struct auth_domain *
+ svcauth_gss_register_pseudoflavor(u32 pseudoflavor, char * name)
+ {
+ struct gss_domain *new;
+@@ -823,17 +823,17 @@ svcauth_gss_register_pseudoflavor(u32 ps
+ name);
+ stat = -EADDRINUSE;
+ auth_domain_put(test);
+- kfree(new->h.name);
+- goto out_free_dom;
++ goto out_free_name;
+ }
+- return 0;
++ return test;
+
++out_free_name:
++ kfree(new->h.name);
+ out_free_dom:
+ kfree(new);
+ out:
+- return stat;
++ return ERR_PTR(stat);
+ }
+-
+ EXPORT_SYMBOL_GPL(svcauth_gss_register_pseudoflavor);
+
+ static inline int
--- /dev/null
+From d47a5dc2888fd1b94adf1553068b8dad76cec96c Mon Sep 17 00:00:00 2001
+From: NeilBrown <neilb@suse.de>
+Date: Fri, 22 May 2020 12:01:33 +1000
+Subject: sunrpc: svcauth_gss_register_pseudoflavor must reject duplicate registrations.
+
+From: NeilBrown <neilb@suse.de>
+
+commit d47a5dc2888fd1b94adf1553068b8dad76cec96c upstream.
+
+There is no valid case for supporting duplicate pseudoflavor
+registrations.
+Currently the silent acceptance of such registrations is hiding a bug.
+The rpcsec_gss_krb5 module registers 2 flavours but does not unregister
+them, so if you load, unload, reload the module, it will happily
+continue to use the old registration which now has pointers to the
+memory were the module was originally loaded. This could lead to
+unexpected results.
+
+So disallow duplicate registrations.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=206651
+Cc: stable@vger.kernel.org (v2.6.12+)
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/auth_gss/svcauth_gss.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -817,9 +817,11 @@ svcauth_gss_register_pseudoflavor(u32 ps
+ new->h.flavour = &svcauthops_gss;
+ new->pseudoflavor = pseudoflavor;
+
+- stat = 0;
+ test = auth_domain_lookup(name, &new->h);
+- if (test != &new->h) { /* Duplicate registration */
++ if (test != &new->h) {
++ pr_warn("svc: duplicate registration of gss pseudo flavour %s.\n",
++ name);
++ stat = -EADDRINUSE;
+ auth_domain_put(test);
+ kfree(new->h.name);
+ goto out_free_dom;
--- /dev/null
+From 5e02f3b31704e24537697bce54f8156bdb72b7a6 Mon Sep 17 00:00:00 2001
+From: "H. Nikolaus Schaller" <hns@goldelico.com>
+Date: Sat, 23 May 2020 19:32:54 +0200
+Subject: w1: omap-hdq: cleanup to add missing newline for some dev_dbg
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+commit 5e02f3b31704e24537697bce54f8156bdb72b7a6 upstream.
+
+Otherwise it will corrupt the console log during debugging.
+
+Fixes: 7b5362a603a1 ("w1: omap_hdq: Fix some error/debug handling.")
+Cc: stable@vger.kernel.org
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Link: https://lore.kernel.org/r/cd0d55749a091214106575f6e1d363c6db56622f.1590255176.git.hns@goldelico.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/w1/masters/omap_hdq.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/w1/masters/omap_hdq.c
++++ b/drivers/w1/masters/omap_hdq.c
+@@ -176,7 +176,7 @@ static int hdq_write_byte(struct hdq_dat
+ /* check irqstatus */
+ if (!(*status & OMAP_HDQ_INT_STATUS_TXCOMPLETE)) {
+ dev_dbg(hdq_data->dev, "timeout waiting for"
+- " TXCOMPLETE/RXCOMPLETE, %x", *status);
++ " TXCOMPLETE/RXCOMPLETE, %x\n", *status);
+ ret = -ETIMEDOUT;
+ goto out;
+ }
+@@ -187,7 +187,7 @@ static int hdq_write_byte(struct hdq_dat
+ OMAP_HDQ_FLAG_CLEAR, &tmp_status);
+ if (ret) {
+ dev_dbg(hdq_data->dev, "timeout waiting GO bit"
+- " return to zero, %x", tmp_status);
++ " return to zero, %x\n", tmp_status);
+ }
+
+ out:
+@@ -203,7 +203,7 @@ static irqreturn_t hdq_isr(int irq, void
+ spin_lock_irqsave(&hdq_data->hdq_spinlock, irqflags);
+ hdq_data->hdq_irqstatus = hdq_reg_in(hdq_data, OMAP_HDQ_INT_STATUS);
+ spin_unlock_irqrestore(&hdq_data->hdq_spinlock, irqflags);
+- dev_dbg(hdq_data->dev, "hdq_isr: %x", hdq_data->hdq_irqstatus);
++ dev_dbg(hdq_data->dev, "hdq_isr: %x\n", hdq_data->hdq_irqstatus);
+
+ if (hdq_data->hdq_irqstatus &
+ (OMAP_HDQ_INT_STATUS_TXCOMPLETE | OMAP_HDQ_INT_STATUS_RXCOMPLETE
+@@ -311,7 +311,7 @@ static int omap_hdq_break(struct hdq_dat
+ tmp_status = hdq_data->hdq_irqstatus;
+ /* check irqstatus */
+ if (!(tmp_status & OMAP_HDQ_INT_STATUS_TIMEOUT)) {
+- dev_dbg(hdq_data->dev, "timeout waiting for TIMEOUT, %x",
++ dev_dbg(hdq_data->dev, "timeout waiting for TIMEOUT, %x\n",
+ tmp_status);
+ ret = -ETIMEDOUT;
+ goto out;
+@@ -338,7 +338,7 @@ static int omap_hdq_break(struct hdq_dat
+ &tmp_status);
+ if (ret)
+ dev_dbg(hdq_data->dev, "timeout waiting INIT&GO bits"
+- " return to zero, %x", tmp_status);
++ " return to zero, %x\n", tmp_status);
+
+ out:
+ mutex_unlock(&hdq_data->hdq_mutex);
projects / thirdparty / kernel / stable-queue.git / commitdiff
