--- /dev/null
+From e6b26e30e277ccf1f8276392e7fce4aa99e961d1 Mon Sep 17 00:00:00 2001
+From: zhengbin <zhengbin13@huawei.com>
+Date: Mon, 8 Jul 2019 20:42:18 +0800
+Subject: auxdisplay: panel: need to delete scan_timer when misc_register fails
+ in panel_attach
+
+[ Upstream commit b33d567560c1aadf3033290d74d4fd67af47aa61 ]
+
+In panel_attach, if misc_register fails, we need to delete scan_timer,
+which was setup in keypad_init->init_scan_timer.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/auxdisplay/panel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/auxdisplay/panel.c b/drivers/auxdisplay/panel.c
+index 6911acd896d93..e30953ceb7dfd 100644
+--- a/drivers/auxdisplay/panel.c
++++ b/drivers/auxdisplay/panel.c
+@@ -1622,6 +1622,8 @@ static void panel_attach(struct parport *port)
+ return;
+
+ err_lcd_unreg:
++ if (scan_timer.function)
++ del_timer_sync(&scan_timer);
+ if (lcd.enabled)
+ charlcd_unregister(lcd.charlcd);
+ err_unreg_device:
+--
+2.20.1
+
--- /dev/null
+From a9cd4a5249f521fffec83c267c52fd2934f1394b Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 12 Jul 2019 11:13:30 +0200
+Subject: dmaengine: ste_dma40: fix unneeded variable warning
+
+[ Upstream commit 5d6fb560729a5d5554e23db8d00eb57cd0021083 ]
+
+clang-9 points out that there are two variables that depending on the
+configuration may only be used in an ARRAY_SIZE() expression but not
+referenced:
+
+drivers/dma/ste_dma40.c:145:12: error: variable 'd40_backup_regs' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
+static u32 d40_backup_regs[] = {
+ ^
+drivers/dma/ste_dma40.c:214:12: error: variable 'd40_backup_regs_chan' is not needed and will not be emitted [-Werror,-Wunneeded-internal-declaration]
+static u32 d40_backup_regs_chan[] = {
+
+Mark these __maybe_unused to shut up the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20190712091357.744515-1-arnd@arndb.de
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ste_dma40.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
+index c2b089af04208..90feb6a05e59b 100644
+--- a/drivers/dma/ste_dma40.c
++++ b/drivers/dma/ste_dma40.c
+@@ -142,7 +142,7 @@ enum d40_events {
+ * when the DMA hw is powered off.
+ * TODO: Add save/restore of D40_DREG_GCC on dma40 v3 or later, if that works.
+ */
+-static u32 d40_backup_regs[] = {
++static __maybe_unused u32 d40_backup_regs[] = {
+ D40_DREG_LCPA,
+ D40_DREG_LCLA,
+ D40_DREG_PRMSE,
+@@ -211,7 +211,7 @@ static u32 d40_backup_regs_v4b[] = {
+
+ #define BACKUP_REGS_SZ_V4B ARRAY_SIZE(d40_backup_regs_v4b)
+
+-static u32 d40_backup_regs_chan[] = {
++static __maybe_unused u32 d40_backup_regs_chan[] = {
+ D40_CHAN_REG_SSCFG,
+ D40_CHAN_REG_SSELT,
+ D40_CHAN_REG_SSPTR,
+--
+2.20.1
+
--- /dev/null
+From 8bd708a43e8e28c73b92e76d24fe90cd1f0593a1 Mon Sep 17 00:00:00 2001
+From: "Y.C. Chen" <yc_chen@aspeedtech.com>
+Date: Wed, 11 Apr 2018 09:27:39 +0800
+Subject: drm/ast: Fixed reboot test may cause system hanged
+
+[ Upstream commit 05b439711f6ff8700e8660f97a1179650778b9cb ]
+
+There is another thread still access standard VGA I/O while loading drm driver.
+Disable standard VGA I/O decode to avoid this issue.
+
+Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com>
+Reviewed-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1523410059-18415-1-git-send-email-yc_chen@aspeedtech.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/ast/ast_main.c | 5 ++++-
+ drivers/gpu/drm/ast/ast_mode.c | 2 +-
+ drivers/gpu/drm/ast/ast_post.c | 2 +-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index 373700c05a00f..224fa1ef87ff9 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -131,8 +131,8 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post)
+
+
+ /* Enable extended register access */
+- ast_enable_mmio(dev);
+ ast_open_key(ast);
++ ast_enable_mmio(dev);
+
+ /* Find out whether P2A works or whether to use device-tree */
+ ast_detect_config_mode(dev, &scu_rev);
+@@ -576,6 +576,9 @@ void ast_driver_unload(struct drm_device *dev)
+ {
+ struct ast_private *ast = dev->dev_private;
+
++ /* enable standard VGA decode */
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x04);
++
+ ast_release_firmware(dev);
+ kfree(ast->dp501_fw_addr);
+ ast_mode_fini(dev);
+diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
+index 343867b182dd8..a09fafa270822 100644
+--- a/drivers/gpu/drm/ast/ast_mode.c
++++ b/drivers/gpu/drm/ast/ast_mode.c
+@@ -600,7 +600,7 @@ static int ast_crtc_mode_set(struct drm_crtc *crtc,
+ return -EINVAL;
+ ast_open_key(ast);
+
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
+
+ ast_set_std_reg(crtc, adjusted_mode, &vbios_mode);
+ ast_set_crtc_reg(crtc, adjusted_mode, &vbios_mode);
+diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c
+index f7d421359d564..c1d1ac51d1c20 100644
+--- a/drivers/gpu/drm/ast/ast_post.c
++++ b/drivers/gpu/drm/ast/ast_post.c
+@@ -46,7 +46,7 @@ void ast_enable_mmio(struct drm_device *dev)
+ {
+ struct ast_private *ast = dev->dev_private;
+
+- ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa1, 0xff, 0x04);
++ ast_set_index_reg(ast, AST_IO_CRTC_PORT, 0xa1, 0x06);
+ }
+
+
+--
+2.20.1
+
--- /dev/null
+From ce9e934c1a66df2e74bc62a520779db9353e2698 Mon Sep 17 00:00:00 2001
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Date: Mon, 10 Jun 2019 16:57:38 +0300
+Subject: drm/bridge: tfp410: fix memleak in get_modes()
+
+[ Upstream commit c08f99c39083ab55a9c93b3e93cef48711294dad ]
+
+We don't free the edid blob allocated by the call to drm_get_edid(),
+causing a memleak. Fix this by calling kfree(edid) at the end of the
+get_modes().
+
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190610135739.6077-1-tomi.valkeinen@ti.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/bridge/ti-tfp410.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/bridge/ti-tfp410.c b/drivers/gpu/drm/bridge/ti-tfp410.c
+index acb857030951a..1bb01905be8e3 100644
+--- a/drivers/gpu/drm/bridge/ti-tfp410.c
++++ b/drivers/gpu/drm/bridge/ti-tfp410.c
+@@ -64,7 +64,12 @@ static int tfp410_get_modes(struct drm_connector *connector)
+
+ drm_mode_connector_update_edid_property(connector, edid);
+
+- return drm_add_edid_modes(connector, edid);
++ ret = drm_add_edid_modes(connector, edid);
++
++ kfree(edid);
++
++ return ret;
++
+ fallback:
+ /* No EDID, fallback on the XGA standard modes */
+ ret = drm_add_modes_noedid(connector, 1920, 1200);
+--
+2.20.1
+
--- /dev/null
+From c3ab3782358257bdad61ffa55c5ec03b94c54388 Mon Sep 17 00:00:00 2001
+From: Jyri Sarha <jsarha@ti.com>
+Date: Wed, 12 Dec 2018 19:26:32 +0200
+Subject: drm/tilcdc: Register cpufreq notifier after we have initialized crtc
+
+[ Upstream commit 432973fd3a20102840d5f7e61af9f1a03c217a4c ]
+
+Register cpufreq notifier after we have initialized the crtc and
+unregister it before we remove the ctrc. Receiving a cpufreq notify
+without crtc causes a crash.
+
+Reported-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/tilcdc/tilcdc_drv.c | 34 ++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+index b0d70f943cec5..56039897607c6 100644
+--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
++++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+@@ -189,6 +189,12 @@ static void tilcdc_fini(struct drm_device *dev)
+ {
+ struct tilcdc_drm_private *priv = dev->dev_private;
+
++#ifdef CONFIG_CPU_FREQ
++ if (priv->freq_transition.notifier_call)
++ cpufreq_unregister_notifier(&priv->freq_transition,
++ CPUFREQ_TRANSITION_NOTIFIER);
++#endif
++
+ if (priv->crtc)
+ tilcdc_crtc_shutdown(priv->crtc);
+
+@@ -204,12 +210,6 @@ static void tilcdc_fini(struct drm_device *dev)
+ drm_mode_config_cleanup(dev);
+ tilcdc_remove_external_device(dev);
+
+-#ifdef CONFIG_CPU_FREQ
+- if (priv->freq_transition.notifier_call)
+- cpufreq_unregister_notifier(&priv->freq_transition,
+- CPUFREQ_TRANSITION_NOTIFIER);
+-#endif
+-
+ if (priv->clk)
+ clk_put(priv->clk);
+
+@@ -282,17 +282,6 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
+ goto init_failed;
+ }
+
+-#ifdef CONFIG_CPU_FREQ
+- priv->freq_transition.notifier_call = cpufreq_transition;
+- ret = cpufreq_register_notifier(&priv->freq_transition,
+- CPUFREQ_TRANSITION_NOTIFIER);
+- if (ret) {
+- dev_err(dev, "failed to register cpufreq notifier\n");
+- priv->freq_transition.notifier_call = NULL;
+- goto init_failed;
+- }
+-#endif
+-
+ if (of_property_read_u32(node, "max-bandwidth", &priv->max_bandwidth))
+ priv->max_bandwidth = TILCDC_DEFAULT_MAX_BANDWIDTH;
+
+@@ -369,6 +358,17 @@ static int tilcdc_init(struct drm_driver *ddrv, struct device *dev)
+ }
+ modeset_init(ddev);
+
++#ifdef CONFIG_CPU_FREQ
++ priv->freq_transition.notifier_call = cpufreq_transition;
++ ret = cpufreq_register_notifier(&priv->freq_transition,
++ CPUFREQ_TRANSITION_NOTIFIER);
++ if (ret) {
++ dev_err(dev, "failed to register cpufreq notifier\n");
++ priv->freq_transition.notifier_call = NULL;
++ goto init_failed;
++ }
++#endif
++
+ if (priv->is_componentized) {
+ ret = component_bind_all(dev, ddev);
+ if (ret < 0)
+--
+2.20.1
+
--- /dev/null
+From 7fb7693004160bccff13b8d65ada815d93bb2385 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 8 Aug 2019 21:54:17 +0200
+Subject: i2c: emev2: avoid race when unregistering slave client
+
+[ Upstream commit d7437fc0d8291181debe032671a289b6bd93f46f ]
+
+After we disabled interrupts, there might still be an active one
+running. Sync before clearing the pointer to the slave device.
+
+Fixes: c31d0a00021d ("i2c: emev2: add slave support")
+Reported-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-emev2.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-emev2.c b/drivers/i2c/busses/i2c-emev2.c
+index d2e84480fbe96..dd97e5d9f49a2 100644
+--- a/drivers/i2c/busses/i2c-emev2.c
++++ b/drivers/i2c/busses/i2c-emev2.c
+@@ -72,6 +72,7 @@ struct em_i2c_device {
+ struct completion msg_done;
+ struct clk *sclk;
+ struct i2c_client *slave;
++ int irq;
+ };
+
+ static inline void em_clear_set_bit(struct em_i2c_device *priv, u8 clear, u8 set, u8 reg)
+@@ -342,6 +343,12 @@ static int em_i2c_unreg_slave(struct i2c_client *slave)
+
+ writeb(0, priv->base + I2C_OFS_SVA0);
+
++ /*
++ * Wait for interrupt to finish. New slave irqs cannot happen because we
++ * cleared the slave address and, thus, only extension codes will be
++ * detected which do not use the slave ptr.
++ */
++ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ return 0;
+@@ -358,7 +365,7 @@ static int em_i2c_probe(struct platform_device *pdev)
+ {
+ struct em_i2c_device *priv;
+ struct resource *r;
+- int irq, ret;
++ int ret;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+@@ -393,8 +400,8 @@ static int em_i2c_probe(struct platform_device *pdev)
+
+ em_i2c_reset(&priv->adap);
+
+- irq = platform_get_irq(pdev, 0);
+- ret = devm_request_irq(&pdev->dev, irq, em_i2c_irq_handler, 0,
++ priv->irq = platform_get_irq(pdev, 0);
++ ret = devm_request_irq(&pdev->dev, priv->irq, em_i2c_irq_handler, 0,
+ "em_i2c", priv);
+ if (ret)
+ goto err_clk;
+@@ -404,7 +411,8 @@ static int em_i2c_probe(struct platform_device *pdev)
+ if (ret)
+ goto err_clk;
+
+- dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr, irq);
++ dev_info(&pdev->dev, "Added i2c controller %d, irq %d\n", priv->adap.nr,
++ priv->irq);
+
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From 5c67e498ff6bfab272fa9419a82591127caf4230 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Thu, 8 Aug 2019 21:39:10 +0200
+Subject: i2c: rcar: avoid race when unregistering slave client
+
+[ Upstream commit 7b814d852af6944657c2961039f404c4490771c0 ]
+
+After we disabled interrupts, there might still be an active one
+running. Sync before clearing the pointer to the slave device.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Reported-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Krzysztof Adamski <krzysztof.adamski@nokia.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 3415733a93645..132c4a405bf83 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -144,6 +144,7 @@ struct rcar_i2c_priv {
+ enum dma_data_direction dma_direction;
+
+ struct reset_control *rstc;
++ int irq;
+ };
+
+ #define rcar_i2c_priv_to_dev(p) ((p)->adap.dev.parent)
+@@ -813,9 +814,11 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+
+ WARN_ON(!priv->slave);
+
++ /* disable irqs and ensure none is running before clearing ptr */
+ rcar_i2c_write(priv, ICSIER, 0);
+ rcar_i2c_write(priv, ICSCR, 0);
+
++ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+
+ pm_runtime_put(rcar_i2c_priv_to_dev(priv));
+@@ -866,7 +869,7 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ struct i2c_adapter *adap;
+ struct device *dev = &pdev->dev;
+ struct i2c_timings i2c_t;
+- int irq, ret;
++ int ret;
+
+ priv = devm_kzalloc(dev, sizeof(struct rcar_i2c_priv), GFP_KERNEL);
+ if (!priv)
+@@ -927,10 +930,10 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ pm_runtime_put(dev);
+
+
+- irq = platform_get_irq(pdev, 0);
+- ret = devm_request_irq(dev, irq, rcar_i2c_irq, 0, dev_name(dev), priv);
++ priv->irq = platform_get_irq(pdev, 0);
++ ret = devm_request_irq(dev, priv->irq, rcar_i2c_irq, 0, dev_name(dev), priv);
+ if (ret < 0) {
+- dev_err(dev, "cannot get irq %d\n", irq);
++ dev_err(dev, "cannot get irq %d\n", priv->irq);
+ goto out_pm_disable;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2f83769d3ef83676838820d4ccf252d2ba7454ff Mon Sep 17 00:00:00 2001
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Mon, 29 Jul 2019 17:46:00 +0100
+Subject: iommu/dma: Handle SG length overflow better
+
+[ Upstream commit ab2cbeb0ed301a9f0460078e91b09f39958212ef ]
+
+Since scatterlist dimensions are all unsigned ints, in the relatively
+rare cases where a device's max_segment_size is set to UINT_MAX, then
+the "cur_len + s_length <= max_len" check in __finalise_sg() will always
+return true. As a result, the corner case of such a device mapping an
+excessively large scatterlist which is mergeable to or beyond a total
+length of 4GB can lead to overflow and a bogus truncated dma_length in
+the resulting segment.
+
+As we already assume that any single segment must be no longer than
+max_len to begin with, this can easily be addressed by reshuffling the
+comparison.
+
+Fixes: 809eac54cdd6 ("iommu/dma: Implement scatterlist segment merging")
+Reported-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Tested-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/dma-iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
+index 9d1cebe7f6cbb..c87764a4e2126 100644
+--- a/drivers/iommu/dma-iommu.c
++++ b/drivers/iommu/dma-iommu.c
+@@ -684,7 +684,7 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
+ * - and wouldn't make the resulting output segment too long
+ */
+ if (cur_len && !s_iova_off && (dma_addr & seg_mask) &&
+- (cur_len + s_length <= max_len)) {
++ (max_len - cur_len >= s_length)) {
+ /* ...then concatenate it with the previous one */
+ cur_len += s_length;
+ } else {
+--
+2.20.1
+
--- /dev/null
+From c94ece35822be7248fb4bd231cbfbf9d6de4eb15 Mon Sep 17 00:00:00 2001
+From: Pedro Sousa <sousa@synopsys.com>
+Date: Thu, 18 Apr 2019 21:13:34 +0200
+Subject: scsi: ufs: Fix RX_TERMINATION_FORCE_ENABLE define value
+
+[ Upstream commit ebcb8f8508c5edf428f52525cec74d28edea7bcb ]
+
+Fix RX_TERMINATION_FORCE_ENABLE define value from 0x0089 to 0x00A9
+according to MIPI Alliance MPHY specification.
+
+Fixes: e785060ea3a1 ("ufs: definitions for phy interface")
+Signed-off-by: Pedro Sousa <sousa@synopsys.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/unipro.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ufs/unipro.h b/drivers/scsi/ufs/unipro.h
+index 23129d7b2678d..c77e365264478 100644
+--- a/drivers/scsi/ufs/unipro.h
++++ b/drivers/scsi/ufs/unipro.h
+@@ -52,7 +52,7 @@
+ #define RX_HS_UNTERMINATED_ENABLE 0x00A6
+ #define RX_ENTER_HIBERN8 0x00A7
+ #define RX_BYPASS_8B10B_ENABLE 0x00A8
+-#define RX_TERMINATION_FORCE_ENABLE 0x0089
++#define RX_TERMINATION_FORCE_ENABLE 0x00A9
+ #define RX_MIN_ACTIVATETIME_CAPABILITY 0x008F
+ #define RX_HIBERN8TIME_CAPABILITY 0x0092
+ #define RX_REFCLKFREQ 0x00EB
+--
+2.20.1
+
--- /dev/null
+dmaengine-ste_dma40-fix-unneeded-variable-warning.patch
+auxdisplay-panel-need-to-delete-scan_timer-when-misc.patch
+iommu-dma-handle-sg-length-overflow-better.patch
+usb-gadget-composite-clear-suspended-on-reset-discon.patch
+usb-gadget-mass_storage-fix-races-between-fsg_disabl.patch
+xen-blkback-fix-memory-leaks.patch
+i2c-rcar-avoid-race-when-unregistering-slave-client.patch
+i2c-emev2-avoid-race-when-unregistering-slave-client.patch
+drm-ast-fixed-reboot-test-may-cause-system-hanged.patch
+usb-host-fotg2-restart-hcd-after-port-reset.patch
+tools-hv-fix-kvp-and-vss-daemons-exit-code.patch
+watchdog-bcm2835_wdt-fix-module-autoload.patch
+drm-bridge-tfp410-fix-memleak-in-get_modes.patch
+scsi-ufs-fix-rx_termination_force_enable-define-valu.patch
+drm-tilcdc-register-cpufreq-notifier-after-we-have-i.patch
--- /dev/null
+From f573b3ac50d2d5db2fd046b8b429e1aa7b63fd5b Mon Sep 17 00:00:00 2001
+From: Adrian Vladu <avladu@cloudbasesolutions.com>
+Date: Mon, 6 May 2019 16:50:58 +0000
+Subject: tools: hv: fix KVP and VSS daemons exit code
+
+[ Upstream commit b0995156071b0ff29a5902964a9dc8cfad6f81c0 ]
+
+HyperV KVP and VSS daemons should exit with 0 when the '--help'
+or '-h' flags are used.
+
+Signed-off-by: Adrian Vladu <avladu@cloudbasesolutions.com>
+
+Cc: "K. Y. Srinivasan" <kys@microsoft.com>
+Cc: Haiyang Zhang <haiyangz@microsoft.com>
+Cc: Stephen Hemminger <sthemmin@microsoft.com>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Alessandro Pilotti <apilotti@cloudbasesolutions.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/hv/hv_kvp_daemon.c | 2 ++
+ tools/hv/hv_vss_daemon.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
+index 62c9a503ae052..0ef215061fb50 100644
+--- a/tools/hv/hv_kvp_daemon.c
++++ b/tools/hv/hv_kvp_daemon.c
+@@ -1380,6 +1380,8 @@ int main(int argc, char *argv[])
+ daemonize = 0;
+ break;
+ case 'h':
++ print_usage(argv);
++ exit(0);
+ default:
+ print_usage(argv);
+ exit(EXIT_FAILURE);
+diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
+index 34031a297f024..514d29966ac67 100644
+--- a/tools/hv/hv_vss_daemon.c
++++ b/tools/hv/hv_vss_daemon.c
+@@ -172,6 +172,8 @@ int main(int argc, char *argv[])
+ daemonize = 0;
+ break;
+ case 'h':
++ print_usage(argv);
++ exit(0);
+ default:
+ print_usage(argv);
+ exit(EXIT_FAILURE);
+--
+2.20.1
+
--- /dev/null
+From f9fbb05d34246a84c11229f347a860ea068505f1 Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 26 Jul 2019 14:59:03 +1000
+Subject: usb: gadget: composite: Clear "suspended" on reset/disconnect
+
+[ Upstream commit 602fda17c7356bb7ae98467d93549057481d11dd ]
+
+In some cases, one can get out of suspend with a reset or
+a disconnect followed by a reconnect. Previously we would
+leave a stale suspended flag set.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/composite.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
+index b805962f51543..75c42393b64ba 100644
+--- a/drivers/usb/gadget/composite.c
++++ b/drivers/usb/gadget/composite.c
+@@ -2008,6 +2008,7 @@ void composite_disconnect(struct usb_gadget *gadget)
+ * disconnect callbacks?
+ */
+ spin_lock_irqsave(&cdev->lock, flags);
++ cdev->suspended = 0;
+ if (cdev->config)
+ reset_config(cdev);
+ if (cdev->driver->disconnect)
+--
+2.20.1
+
--- /dev/null
+From f98d34e9bcb09c44c325d18aa4f4626f68accb3f Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Fri, 26 Jul 2019 14:59:04 +1000
+Subject: usb: gadget: mass_storage: Fix races between fsg_disable and
+ fsg_set_alt
+
+[ Upstream commit 4a56a478a525d6427be90753451c40e1327caa1a ]
+
+If fsg_disable() and fsg_set_alt() are called too closely to each
+other (for example due to a quick reset/reconnect), what can happen
+is that fsg_set_alt sets common->new_fsg from an interrupt while
+handle_exception is trying to process the config change caused by
+fsg_disable():
+
+ fsg_disable()
+ ...
+ handle_exception()
+ sets state back to FSG_STATE_NORMAL
+ hasn't yet called do_set_interface()
+ or is inside it.
+
+ ---> interrupt
+ fsg_set_alt
+ sets common->new_fsg
+ queues a new FSG_STATE_CONFIG_CHANGE
+ <---
+
+Now, the first handle_exception can "see" the updated
+new_fsg, treats it as if it was a fsg_set_alt() response,
+call usb_composite_setup_continue() etc...
+
+But then, the thread sees the second FSG_STATE_CONFIG_CHANGE,
+and goes back down the same path, wipes and reattaches a now
+active fsg, and .. calls usb_composite_setup_continue() which
+at this point is wrong.
+
+Not only we get a backtrace, but I suspect the second set_interface
+wrecks some state causing the host to get upset in my case.
+
+This fixes it by replacing "new_fsg" by a "state argument" (same
+principle) which is set in the same lock section as the state
+update, and retrieved similarly.
+
+That way, there is never any discrepancy between the dequeued
+state and the observed value of it. We keep the ability to have
+the latest reconfig operation take precedence, but we guarantee
+that once "dequeued" the argument (new_fsg) will not be clobbered
+by any new event.
+
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/function/f_mass_storage.c | 28 +++++++++++++-------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
+index 25ba303295332..41b5baa1f43b7 100644
+--- a/drivers/usb/gadget/function/f_mass_storage.c
++++ b/drivers/usb/gadget/function/f_mass_storage.c
+@@ -261,7 +261,7 @@ struct fsg_common;
+ struct fsg_common {
+ struct usb_gadget *gadget;
+ struct usb_composite_dev *cdev;
+- struct fsg_dev *fsg, *new_fsg;
++ struct fsg_dev *fsg;
+ wait_queue_head_t io_wait;
+ wait_queue_head_t fsg_wait;
+
+@@ -290,6 +290,7 @@ struct fsg_common {
+ unsigned int bulk_out_maxpacket;
+ enum fsg_state state; /* For exception handling */
+ unsigned int exception_req_tag;
++ void *exception_arg;
+
+ enum data_direction data_dir;
+ u32 data_size;
+@@ -393,7 +394,8 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep)
+
+ /* These routines may be called in process context or in_irq */
+
+-static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
++static void __raise_exception(struct fsg_common *common, enum fsg_state new_state,
++ void *arg)
+ {
+ unsigned long flags;
+
+@@ -406,6 +408,7 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+ if (common->state <= new_state) {
+ common->exception_req_tag = common->ep0_req_tag;
+ common->state = new_state;
++ common->exception_arg = arg;
+ if (common->thread_task)
+ send_sig_info(SIGUSR1, SEND_SIG_FORCED,
+ common->thread_task);
+@@ -413,6 +416,10 @@ static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
+ spin_unlock_irqrestore(&common->lock, flags);
+ }
+
++static void raise_exception(struct fsg_common *common, enum fsg_state new_state)
++{
++ __raise_exception(common, new_state, NULL);
++}
+
+ /*-------------------------------------------------------------------------*/
+
+@@ -2287,16 +2294,16 @@ reset:
+ static int fsg_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
+ {
+ struct fsg_dev *fsg = fsg_from_func(f);
+- fsg->common->new_fsg = fsg;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, fsg);
+ return USB_GADGET_DELAYED_STATUS;
+ }
+
+ static void fsg_disable(struct usb_function *f)
+ {
+ struct fsg_dev *fsg = fsg_from_func(f);
+- fsg->common->new_fsg = NULL;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
+ }
+
+
+@@ -2309,6 +2316,7 @@ static void handle_exception(struct fsg_common *common)
+ enum fsg_state old_state;
+ struct fsg_lun *curlun;
+ unsigned int exception_req_tag;
++ struct fsg_dev *new_fsg;
+
+ /*
+ * Clear the existing signals. Anything but SIGUSR1 is converted
+@@ -2362,6 +2370,7 @@ static void handle_exception(struct fsg_common *common)
+ common->next_buffhd_to_fill = &common->buffhds[0];
+ common->next_buffhd_to_drain = &common->buffhds[0];
+ exception_req_tag = common->exception_req_tag;
++ new_fsg = common->exception_arg;
+ old_state = common->state;
+ common->state = FSG_STATE_NORMAL;
+
+@@ -2415,8 +2424,8 @@ static void handle_exception(struct fsg_common *common)
+ break;
+
+ case FSG_STATE_CONFIG_CHANGE:
+- do_set_interface(common, common->new_fsg);
+- if (common->new_fsg)
++ do_set_interface(common, new_fsg);
++ if (new_fsg)
+ usb_composite_setup_continue(common->cdev);
+ break;
+
+@@ -3007,8 +3016,7 @@ static void fsg_unbind(struct usb_configuration *c, struct usb_function *f)
+
+ DBG(fsg, "unbind\n");
+ if (fsg->common->fsg == fsg) {
+- fsg->common->new_fsg = NULL;
+- raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE);
++ __raise_exception(fsg->common, FSG_STATE_CONFIG_CHANGE, NULL);
+ /* FIXME: make interruptible or killable somehow? */
+ wait_event(common->fsg_wait, common->fsg != fsg);
+ }
+--
+2.20.1
+
--- /dev/null
+From 7e7d16b40733aabd133af1ba0df8950ad6b94659 Mon Sep 17 00:00:00 2001
+From: Hans Ulli Kroll <ulli.kroll@googlemail.com>
+Date: Sat, 10 Aug 2019 17:04:58 +0200
+Subject: usb: host: fotg2: restart hcd after port reset
+
+[ Upstream commit 777758888ffe59ef754cc39ab2f275dc277732f4 ]
+
+On the Gemini SoC the FOTG2 stalls after port reset
+so restart the HCD after each port reset.
+
+Signed-off-by: Hans Ulli Kroll <ulli.kroll@googlemail.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20190810150458.817-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/fotg210-hcd.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index 457cc6525abd6..aa21036828084 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -1652,6 +1652,10 @@ static int fotg210_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ /* see what we found out */
+ temp = check_reset_complete(fotg210, wIndex, status_reg,
+ fotg210_readl(fotg210, status_reg));
++
++ /* restart schedule */
++ fotg210->command |= CMD_RUN;
++ fotg210_writel(fotg210, fotg210->command, &fotg210->regs->command);
+ }
+
+ if (!(temp & (PORT_RESUME|PORT_RESET))) {
+--
+2.20.1
+
--- /dev/null
+From f87117b85eb5d2f9706b350f5a5321f061e1313f Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <wahrenst@gmx.net>
+Date: Wed, 15 May 2019 19:14:18 +0200
+Subject: watchdog: bcm2835_wdt: Fix module autoload
+
+[ Upstream commit 215e06f0d18d5d653d6ea269e4dfc684854d48bf ]
+
+The commit 5e6acc3e678e ("bcm2835-pm: Move bcm2835-watchdog's DT probe
+to an MFD.") broke module autoloading on Raspberry Pi. So add a
+module alias this fix this.
+
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/bcm2835_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
+index b339e0e67b4c1..adb699145a071 100644
+--- a/drivers/watchdog/bcm2835_wdt.c
++++ b/drivers/watchdog/bcm2835_wdt.c
+@@ -252,6 +252,7 @@ module_param(nowayout, bool, 0);
+ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
+ __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
++MODULE_ALIAS("platform:bcm2835-wdt");
+ MODULE_AUTHOR("Lubomir Rintel <lkundrak@v3.sk>");
+ MODULE_DESCRIPTION("Driver for Broadcom BCM2835 watchdog timer");
+ MODULE_LICENSE("GPL");
+--
+2.20.1
+
--- /dev/null
+From 8b8be3a2433c03e6a8778195b1e7a675e95eecbb Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Sun, 11 Aug 2019 12:23:22 -0500
+Subject: xen/blkback: fix memory leaks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit ae78ca3cf3d9e9f914bfcd0bc5c389ff18b9c2e0 ]
+
+In read_per_ring_refs(), after 'req' and related memory regions are
+allocated, xen_blkif_map() is invoked to map the shared frame, irq, and
+etc. However, if this mapping process fails, no cleanup is performed,
+leading to memory leaks. To fix this issue, invoke the cleanup before
+returning the error.
+
+Acked-by: Roger Pau Monné <roger.pau@citrix.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/xen-blkback/xenbus.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
+index 21c1be1eb2260..ed4e807791243 100644
+--- a/drivers/block/xen-blkback/xenbus.c
++++ b/drivers/block/xen-blkback/xenbus.c
+@@ -973,6 +973,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ }
+ blkif->nr_ring_pages = nr_grefs;
+
++ err = -ENOMEM;
+ for (i = 0; i < nr_grefs * XEN_BLKIF_REQS_PER_PAGE; i++) {
+ req = kzalloc(sizeof(*req), GFP_KERNEL);
+ if (!req)
+@@ -995,7 +996,7 @@ static int read_per_ring_refs(struct xen_blkif_ring *ring, const char *dir)
+ err = xen_blkif_map(ring, ring_ref, nr_grefs, evtchn);
+ if (err) {
+ xenbus_dev_fatal(dev, err, "mapping ring-ref port %u", evtchn);
+- return err;
++ goto fail;
+ }
+
+ return 0;
+@@ -1015,8 +1016,7 @@ fail:
+ }
+ kfree(req);
+ }
+- return -ENOMEM;
+-
++ return err;
+ }
+
+ static int connect_ring(struct backend_info *be)
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
