--- /dev/null
+From c8a9d82b9f8764c68ddd9c8f705ccb1faa7f014f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 08:34:16 +0300
+Subject: 6lowpan: Off by one handling ->nexthdr
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ]
+
+NEXTHDR_MAX is 255. What happens here is that we take a u8 value
+"hdr->nexthdr" from the network and then look it up in
+lowpan_nexthdr_nhcs[]. The problem is that if hdr->nexthdr is 0xff then
+we read one element beyond the end of the array so the array needs to
+be one element larger.
+
+Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Acked-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/6lowpan/nhc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
+index 4fa2fdda174d0..9e56fb98f33cf 100644
+--- a/net/6lowpan/nhc.c
++++ b/net/6lowpan/nhc.c
+@@ -18,7 +18,7 @@
+ #include "nhc.h"
+
+ static struct rb_root rb_root = RB_ROOT;
+-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
++static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
+ static DEFINE_SPINLOCK(lowpan_nhc_lock);
+
+ static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
+--
+2.20.1
+
--- /dev/null
+From 829aa82dd4968ba8a18ab05b4241594792c9cd44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 11:10:52 +0800
+Subject: act_mirred: Fix mirred_init_module error handling
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 11c9a7d38af524217efb7a176ad322b97ac2f163 ]
+
+If tcf_register_action failed, mirred_device_notifier
+should be unregistered.
+
+Fixes: 3b87956ea645 ("net sched: fix race in mirred device removal")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/act_mirred.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index 529bb064c4a4d..dcfaa4f9c7c5b 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -371,7 +371,11 @@ static int __init mirred_init_module(void)
+ return err;
+
+ pr_info("Mirror/redirect action on\n");
+- return tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++ err = tcf_register_action(&act_mirred_ops, &mirred_net_ops);
++ if (err)
++ unregister_netdevice_notifier(&mirred_device_notifier);
++
++ return err;
+ }
+
+ static void __exit mirred_cleanup_module(void)
+--
+2.20.1
+
--- /dev/null
+From 644036c4676eb3f56d71f2ef36178ebd44a6337e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 16:52:37 -0500
+Subject: affs: fix a memory leak in affs_remount
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 450c3d4166837c496ebce03650c08800991f2150 ]
+
+In affs_remount if data is provided it is duplicated into new_opts. The
+allocated memory for new_opts is only released if parse_options fails.
+
+There's a bit of history behind new_options, originally there was
+save/replace options on the VFS layer so the 'data' passed must not
+change (thus strdup), this got cleaned up in later patches. But not
+completely.
+
+There's no reason to do the strdup in cases where the filesystem does
+not need to reuse the 'data' again, because strsep would modify it
+directly.
+
+Fixes: c8f33d0bec99 ("affs: kstrdup() memory handling")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+[ update changelog ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/affs/super.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/fs/affs/super.c b/fs/affs/super.c
+index 884bedab7266a..789a1c7db5d8c 100644
+--- a/fs/affs/super.c
++++ b/fs/affs/super.c
+@@ -559,14 +559,9 @@ affs_remount(struct super_block *sb, int *flags, char *data)
+ int root_block;
+ unsigned long mount_flags;
+ int res = 0;
+- char *new_opts;
+ char volume[32];
+ char *prefix = NULL;
+
+- new_opts = kstrdup(data, GFP_KERNEL);
+- if (data && !new_opts)
+- return -ENOMEM;
+-
+ pr_debug("%s(flags=0x%x,opts=\"%s\")\n", __func__, *flags, data);
+
+ sync_filesystem(sb);
+@@ -577,7 +572,6 @@ affs_remount(struct super_block *sb, int *flags, char *data)
+ &blocksize, &prefix, volume,
+ &mount_flags)) {
+ kfree(prefix);
+- kfree(new_opts);
+ return -EINVAL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ab196de4f2e9b1026aecce9337a4f0efb4db394a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 15:37:26 +0000
+Subject: afs: Fix large file support
+
+From: Marc Dionne <marc.dionne@auristor.com>
+
+[ Upstream commit b485275f1aca8a9da37fd35e4fad673935e827da ]
+
+By default s_maxbytes is set to MAX_NON_LFS, which limits the usable
+file size to 2GB, enforced by the vfs.
+
+Commit b9b1f8d5930a ("AFS: write support fixes") added support for the
+64-bit fetch and store server operations, but did not change this value.
+As a result, attempts to write past the 2G mark result in EFBIG errors:
+
+ $ dd if=/dev/zero of=foo bs=1M count=1 seek=2048
+ dd: error writing 'foo': File too large
+
+Set s_maxbytes to MAX_LFS_FILESIZE.
+
+Fixes: b9b1f8d5930a ("AFS: write support fixes")
+Signed-off-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/afs/super.c b/fs/afs/super.c
+index 689173c0a682f..f8529ddbd587f 100644
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -359,6 +359,7 @@ static int afs_fill_super(struct super_block *sb,
+ /* fill in the superblock */
+ sb->s_blocksize = PAGE_SIZE;
+ sb->s_blocksize_bits = PAGE_SHIFT;
++ sb->s_maxbytes = MAX_LFS_FILESIZE;
+ sb->s_magic = AFS_FS_MAGIC;
+ sb->s_op = &afs_super_ops;
+ sb->s_xattr = afs_xattr_handlers;
+--
+2.20.1
+
--- /dev/null
+From ea43c50cf8f0c20cde1034214320b45e8d2e5d2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 13:27:09 +0100
+Subject: afs: Fix the afs.cell and afs.volume xattr handlers
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit c73aa4102f5b9f261a907c3b3df94cd2c478504d ]
+
+Fix the ->get handlers for the afs.cell and afs.volume xattrs to pass the
+source data size to memcpy() rather than target buffer size.
+
+Overcopying the source data occasionally causes the kernel to oops.
+
+Fixes: d3e3b7eac886 ("afs: Add metadata xattrs")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/xattr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c
+index 2830e4f48d854..7c6b62a94e7e7 100644
+--- a/fs/afs/xattr.c
++++ b/fs/afs/xattr.c
+@@ -50,7 +50,7 @@ static int afs_xattr_get_cell(const struct xattr_handler *handler,
+ return namelen;
+ if (namelen > size)
+ return -ERANGE;
+- memcpy(buffer, cell->name, size);
++ memcpy(buffer, cell->name, namelen);
+ return namelen;
+ }
+
+@@ -104,7 +104,7 @@ static int afs_xattr_get_volume(const struct xattr_handler *handler,
+ return namelen;
+ if (namelen > size)
+ return -ERANGE;
+- memcpy(buffer, volname, size);
++ memcpy(buffer, volname, namelen);
+ return namelen;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d6f355a1a31b5e3ac4b8ea10d7a7cc5eb9b63e96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 22:42:55 +0300
+Subject: ahci: Do not export local variable ahci_em_messages
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 60fc35f327e0a9e60b955c0f3c3ed623608d1baa ]
+
+The commit ed08d40cdec4
+ ("ahci: Changing two module params with static and __read_mostly")
+moved ahci_em_messages to be static while missing the fact of exporting it.
+
+WARNING: "ahci_em_messages" [vmlinux] is a static EXPORT_SYMBOL_GPL
+
+Drop export for the local variable ahci_em_messages.
+
+Fixes: ed08d40cdec4 ("ahci: Changing two module params with static and __read_mostly")
+Cc: Chuansheng Liu <chuansheng.liu@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libahci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index cda9a0b5bdaaa..7473ff46de66c 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -191,7 +191,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
+ EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
+
+ static bool ahci_em_messages __read_mostly = true;
+-EXPORT_SYMBOL_GPL(ahci_em_messages);
+ module_param(ahci_em_messages, bool, 0444);
+ /* add other LED protocol types when they become supported */
+ MODULE_PARM_DESC(ahci_em_messages,
+--
+2.20.1
+
--- /dev/null
+From 480ea4da7ffbd17da1e8656ae16020108b85583a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 09:14:22 +0200
+Subject: ALSA: aoa: onyx: always initialize register read value
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+[ Upstream commit f474808acb3c4b30552d9c59b181244e0300d218 ]
+
+A lot of places in the driver use onyx_read_register() without
+checking the return value, and it's been working OK for ~10 years
+or so, so probably never fails ... Rather than trying to check the
+return value everywhere, which would be relatively intrusive, at
+least make sure we don't use an uninitialized value.
+
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/aoa/codecs/onyx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
+index d2d96ca082b71..6224fd3bbf7cc 100644
+--- a/sound/aoa/codecs/onyx.c
++++ b/sound/aoa/codecs/onyx.c
+@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
+ return 0;
+ }
+ v = i2c_smbus_read_byte_data(onyx->i2c, reg);
+- if (v < 0)
++ if (v < 0) {
++ *value = 0;
+ return -1;
++ }
+ *value = (u8)v;
+ onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 6d07d8e3d1efd54c26f6e9f9cf04a7add0ffb53c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 16:18:36 +0200
+Subject: ALSA: hda: fix unused variable warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ]
+
+When CONFIG_X86=n function azx_snoop doesn't use the variable chip it
+only returns true.
+
+sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’:
+sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable]
+ struct azx *chip = bus_to_azx(bus);
+ ^~~~
+
+Create a inline function of azx_snoop.
+
+Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object")
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_controller.h | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index 8a9dd4767b1ec..63cc10604afc7 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -176,11 +176,10 @@ struct azx {
+ #define azx_bus(chip) (&(chip)->bus.core)
+ #define bus_to_azx(_bus) container_of(_bus, struct azx, bus.core)
+
+-#ifdef CONFIG_X86
+-#define azx_snoop(chip) ((chip)->snoop)
+-#else
+-#define azx_snoop(chip) true
+-#endif
++static inline bool azx_snoop(struct azx *chip)
++{
++ return !IS_ENABLED(CONFIG_X86) || chip->snoop;
++}
+
+ /*
+ * macros for easy use
+--
+2.20.1
+
--- /dev/null
+From 336c6d07fe74316ce5355bb746b4fdaa6bcaf4df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 13:00:03 +0200
+Subject: ALSA: usb-audio: Handle the error from
+ snd_usb_mixer_apply_create_quirk()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ]
+
+The error from snd_usb_mixer_apply_create_quirk() is ignored in the
+current usb-audio driver code, which will continue the probing even
+after the error. Let's take it more serious.
+
+Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 044193b2364d0..e6e4c3b9d9d3f 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2632,7 +2632,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ (err = snd_usb_mixer_status_create(mixer)) < 0)
+ goto _error;
+
+- snd_usb_mixer_apply_create_quirk(mixer);
++ err = snd_usb_mixer_apply_create_quirk(mixer);
++ if (err < 0)
++ goto _error;
+
+ err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ if (err < 0)
+--
+2.20.1
+
--- /dev/null
+From 904dc76212993332e7faf953ec3a341992286260 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 16:42:05 +0200
+Subject: ALSA: usb-audio: update quirk for B&W PX to remove microphone
+
+From: Nicolas Huaman <nicolas@herochao.de>
+
+[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ]
+
+A quirk in snd-usb-audio was added to automate setting sample rate to
+4800k and remove the previously exposed nonfunctional microphone for
+the Bowers & Wilkins PX:
+commit 240a8af929c7c57dcde28682725b29cf8474e8e5
+https://lore.kernel.org/patchwork/patch/919689/
+
+However the headphones where updated shortly after that to remove the
+unintentional microphone functionality. I guess because of this the
+headphones now crash when connecting them via USB while the quirk is
+active. Dmesg:
+
+snd-usb-audio: probe of 2-3:1.0 failed with error -22
+usb 2-3: 2:1: cannot get min/max values for control 2 (id 2)
+
+This patch removes the microfone and allows the headphones to connect
+and work out of the box. It is based on the current mainline kernel
+ and successfully applied an tested on my machine (4.18.10.arch1-1).
+
+Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
+Signed-off-by: Nicolas Huaman <nicolas@herochao.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks-table.h | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index d32727c74a168..c892b4d1e733f 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3293,19 +3293,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ .ifnum = 0,
+ .type = QUIRK_AUDIO_STANDARD_MIXER,
+ },
+- /* Capture */
+- {
+- .ifnum = 1,
+- .type = QUIRK_IGNORE_INTERFACE,
+- },
+ /* Playback */
+ {
+- .ifnum = 2,
++ .ifnum = 1,
+ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
+ .data = &(const struct audioformat) {
+ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ .channels = 2,
+- .iface = 2,
++ .iface = 1,
+ .altsetting = 1,
+ .altset_idx = 1,
+ .attributes = UAC_EP_CS_ATTR_FILL_MAX |
+--
+2.20.1
+
--- /dev/null
+From 11ad6a6c20d99cd81283b3c556483b7c63c3edba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Sep 2018 18:12:09 +0200
+Subject: apparmor: don't try to replace stale label in ptrace access check
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit 1f8266ff58840d698a1e96d2274189de1bdf7969 ]
+
+As a comment above begin_current_label_crit_section() explains,
+begin_current_label_crit_section() must run in sleepable context because
+when label_is_stale() is true, aa_replace_current_label() runs, which uses
+prepare_creds(), which can sleep.
+Until now, the ptrace access check (which runs with a task lock held)
+violated this rule.
+
+Also add a might_sleep() assertion to begin_current_label_crit_section(),
+because asserts are less likely to be ignored than comments.
+
+Fixes: b2d09ae449ced ("apparmor: move ptrace checks to using labels")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: John Johansen <john.johansen@canonical.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/apparmor/include/context.h | 2 ++
+ security/apparmor/lsm.c | 4 ++--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/security/apparmor/include/context.h b/security/apparmor/include/context.h
+index 6ae07e9aaa172..812cdec9dd3be 100644
+--- a/security/apparmor/include/context.h
++++ b/security/apparmor/include/context.h
+@@ -191,6 +191,8 @@ static inline struct aa_label *begin_current_label_crit_section(void)
+ {
+ struct aa_label *label = aa_current_raw_label();
+
++ might_sleep();
++
+ if (label_is_stale(label)) {
+ label = aa_get_newest_label(label);
+ if (aa_replace_current_label(label) == 0)
+diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
+index 1346ee5be04f1..4f08023101f3c 100644
+--- a/security/apparmor/lsm.c
++++ b/security/apparmor/lsm.c
+@@ -108,12 +108,12 @@ static int apparmor_ptrace_access_check(struct task_struct *child,
+ struct aa_label *tracer, *tracee;
+ int error;
+
+- tracer = begin_current_label_crit_section();
++ tracer = __begin_current_label_crit_section();
+ tracee = aa_get_task_label(child);
+ error = aa_may_ptrace(tracer, tracee,
+ mode == PTRACE_MODE_READ ? AA_PTRACE_READ : AA_PTRACE_TRACE);
+ aa_put_label(tracee);
+- end_current_label_crit_section(tracer);
++ __end_current_label_crit_section(tracer);
+
+ return error;
+ }
+--
+2.20.1
+
--- /dev/null
+From 966776b2c5bae94af70d8aa4e18789e514f2fd70 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 09:31:41 +0100
+Subject: ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]
+
+MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
+perform low-level platform initialization. This results in a try to install
+HYP stubs for the second time for each CPU and results in false HYP/SVC
+mode mismatch detection. The HYP stubs are already installed at the
+beginning of the kernel initialization on the boot CPU (head.S) or in the
+secondary_startup() for other CPUs. To fix this issue MCPM code should use
+a cpu_resume() routine without HYP stubs installation.
+
+This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
+XU3/XU4/HC1 boards.
+
+Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Tested-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/common/mcpm_entry.c | 2 +-
+ arch/arm/include/asm/suspend.h | 1 +
+ arch/arm/kernel/sleep.S | 12 ++++++++++++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
+index 2b913f17d50f5..c24a55b0deac7 100644
+--- a/arch/arm/common/mcpm_entry.c
++++ b/arch/arm/common/mcpm_entry.c
+@@ -379,7 +379,7 @@ static int __init nocache_trampoline(unsigned long _arg)
+ unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
+ phys_reset_t phys_reset;
+
+- mcpm_set_entry_vector(cpu, cluster, cpu_resume);
++ mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
+ setup_mm_for_reboot();
+
+ __mcpm_cpu_going_down(cpu, cluster);
+diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
+index 452bbdcbcc835..506314265c6f1 100644
+--- a/arch/arm/include/asm/suspend.h
++++ b/arch/arm/include/asm/suspend.h
+@@ -10,6 +10,7 @@ struct sleep_save_sp {
+ };
+
+ extern void cpu_resume(void);
++extern void cpu_resume_no_hyp(void);
+ extern void cpu_resume_arm(void);
+ extern int cpu_suspend(unsigned long, int (*)(unsigned long));
+
+diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
+index a8257fc9cf2a9..5dc8b80bb6938 100644
+--- a/arch/arm/kernel/sleep.S
++++ b/arch/arm/kernel/sleep.S
+@@ -120,6 +120,14 @@ ENDPROC(cpu_resume_after_mmu)
+ .text
+ .align
+
++#ifdef CONFIG_MCPM
++ .arm
++THUMB( .thumb )
++ENTRY(cpu_resume_no_hyp)
++ARM_BE8(setend be) @ ensure we are in BE mode
++ b no_hyp
++#endif
++
+ #ifdef CONFIG_MMU
+ .arm
+ ENTRY(cpu_resume_arm)
+@@ -135,6 +143,7 @@ ARM_BE8(setend be) @ ensure we are in BE mode
+ bl __hyp_stub_install_secondary
+ #endif
+ safe_svcmode_maskall r1
++no_hyp:
+ mov r1, #0
+ ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
+ ALT_UP_B(1f)
+@@ -163,6 +172,9 @@ ENDPROC(cpu_resume)
+
+ #ifdef CONFIG_MMU
+ ENDPROC(cpu_resume_arm)
++#endif
++#ifdef CONFIG_MCPM
++ENDPROC(cpu_resume_no_hyp)
+ #endif
+
+ .align 2
+--
+2.20.1
+
--- /dev/null
+From 7ce84e3f9eabd22857a3f3ac2ffa795dcb96f354 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 15:00:13 +0100
+Subject: ARM: 8848/1: virt: Align GIC version check with arm64 counterpart
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 9db043d36bd379f4cc99054c079de0dabfc38d03 ]
+
+arm64 has got relaxation on GIC version check at early boot stage due
+to update of the GIC architecture let's align ARM with that.
+
+To help backports (even though the code was correct at the time of writing)
+Fixes: e59941b9b381 ("ARM: 8527/1: virt: enable GICv3 system registers")
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/hyp-stub.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index 60146e32619a5..82a942894fc04 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -180,8 +180,8 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE
+ @ Check whether GICv3 system registers are available
+ mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1
+ ubfx r7, r7, #28, #4
+- cmp r7, #1
+- bne 2f
++ teq r7, #0
++ beq 2f
+
+ @ Enable system register accesses
+ mrc p15, 4, r7, c12, c9, 5 @ ICC_HSRE
+--
+2.20.1
+
--- /dev/null
+From 0339f1cf342948182929ec7dd42d6590d3166521 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 16:29:20 +0200
+Subject: ARM: dts: lpc32xx: add required clocks property to keypad device node
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 3e88bc38b9f6fe4b69cecf81badd3c19fde97f97 ]
+
+NXP LPC32xx keypad controller requires a clock property to be defined.
+
+The change fixes the driver initialization problem:
+
+ lpc32xx_keys 40050000.key: failed to get clock
+ lpc32xx_keys: probe of 40050000.key failed with error -2
+
+Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index d077bd2b9583e..2ca881055ef0e 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -462,6 +462,7 @@
+ key: key@40050000 {
+ compatible = "nxp,lpc3220-key";
+ reg = <0x40050000 0x1000>;
++ clocks = <&clk LPC32XX_CLK_KEY>;
+ interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+--
+2.20.1
+
--- /dev/null
+From 5a1da7700c2889ecd3f954fa7223d1bf02128ff8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:40 +0200
+Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 30fc01bae3cda747e7d9c352b1aa51ca113c8a9d ]
+
+The originally added ARM PrimeCell PL111 clocks property misses
+the required "clcdclk" clock, which is the same as a clock to enable
+the LCD controller on NXP LPC3230 and NXP LPC3250 SoCs.
+
+Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index a08ebc9509234..c5b119ddb70b8 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -142,8 +142,8 @@
+ compatible = "arm,pl111", "arm,primecell";
+ reg = <0x31040000 0x1000>;
+ interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&clk LPC32XX_CLK_LCD>;
+- clock-names = "apb_pclk";
++ clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>;
++ clock-names = "clcdclk", "apb_pclk";
+ status = "disabled";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From ed108894e81cd4d881835fb9ebb4e4c458978543 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:39 +0200
+Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 7a0790a4121cbcd111cc537cdc801c46ccb789ee ]
+
+ARM PrimeCell PL111 LCD controller is found on On NXP LPC3230
+and LPC3250 SoCs variants, the original reference in compatible
+property to an older one ARM PrimeCell PL110 is invalid.
+
+Fixes: e04920d9efcb3 ("ARM: LPC32xx: DTS files for device tree conversion")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 9f9386c926d1e..a08ebc9509234 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -139,7 +139,7 @@
+ };
+
+ clcd: clcd@31040000 {
+- compatible = "arm,pl110", "arm,primecell";
++ compatible = "arm,pl111", "arm,primecell";
+ reg = <0x31040000 0x1000>;
+ interrupts = <14 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk LPC32XX_CLK_LCD>;
+--
+2.20.1
+
--- /dev/null
+From 96febaa92b6f3c3236b37fcb956593a086148c94 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 21:20:41 +0200
+Subject: ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit dc141b99fc36cf910a1d8d5ee30f43f2442fd1bd ]
+
+The fixed voltage regulator on Phytec phyCORE-LPC3250 board, which
+supplies SD/MMC card's power, has a constant output voltage level
+of either 3.15V or 3.3V, the actual value depends on JP4 position,
+the power rail is referenced as VCC_SDIO in the board hardware manual.
+
+Fixes: d06670e96267 ("arm: dts: phy3250: add SD fixed regulator")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts
+index b7bd3a110a8dd..dd0bdf765599d 100644
+--- a/arch/arm/boot/dts/lpc3250-phy3250.dts
++++ b/arch/arm/boot/dts/lpc3250-phy3250.dts
+@@ -49,8 +49,8 @@
+ sd_reg: regulator@2 {
+ compatible = "regulator-fixed";
+ regulator-name = "sd_reg";
+- regulator-min-microvolt = <1800000>;
+- regulator-max-microvolt = <1800000>;
++ regulator-min-microvolt = <3300000>;
++ regulator-max-microvolt = <3300000>;
+ gpio = <&gpio 5 5 0>;
+ enable-active-high;
+ };
+--
+2.20.1
+
--- /dev/null
+From dfc45d330b19ffa0e6790c74cda1fb0894c94c97 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 26 Jan 2019 16:29:21 +0200
+Subject: ARM: dts: lpc32xx: reparent keypad controller to SIC1
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+[ Upstream commit 489261c45f0ebbc1c2813f337bbdf858267f5033 ]
+
+After switching to a new interrupt controller scheme by separating SIC1
+and SIC2 from MIC interrupt controller just one SoC keypad controller
+was not taken into account, fix it now:
+
+ WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:524 irq_domain_associate+0x50/0x1b0
+ error: hwirq 0x36 is too large for interrupt-controller@40008000
+ ...
+ lpc32xx_keys 40050000.key: failed to get platform irq
+ lpc32xx_keys: probe of 40050000.key failed with error -22
+
+Fixes: 9b8ad3fb81ae ("ARM: dts: lpc32xx: reparent SIC1 and SIC2 interrupts from MIC")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/lpc32xx.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
+index 2ca881055ef0e..9f9386c926d1e 100644
+--- a/arch/arm/boot/dts/lpc32xx.dtsi
++++ b/arch/arm/boot/dts/lpc32xx.dtsi
+@@ -463,7 +463,8 @@
+ compatible = "nxp,lpc3220-key";
+ reg = <0x40050000 0x1000>;
+ clocks = <&clk LPC32XX_CLK_KEY>;
+- interrupts = <54 IRQ_TYPE_LEVEL_HIGH>;
++ interrupt-parent = <&sic1>;
++ interrupts = <22 IRQ_TYPE_LEVEL_HIGH>;
+ status = "disabled";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 518f5958d9ab82202de014ce3c243db4b2dd2c1c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Apr 2019 02:23:14 +0300
+Subject: ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY
+ disconnect
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ]
+
+Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus.
+But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC
+are pointing towards the same internal PCS. Therefore nobody is
+controlling the internal PCS of eTSEC0.
+
+Upon initial ndo_open, the SGMII link is ok by virtue of U-boot
+initialization. But upon an ifdown/ifup sequence, the code path from
+ndo_open -> init_phy -> gfar_configure_serdes does not get executed for
+the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII
+link remains down for eTSEC0. On the LS1021A-TWR board, to signal this
+failure condition, the PHY driver keeps printing
+'803x_aneg_done: SGMII link is not ok'.
+
+Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match
+mdio1 device.
+
+Fixes: 055223d4d22d ("ARM: dts: ls1021a: Enable the eTSEC ports on QDS and TWR")
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Reviewed-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/ls1021a-twr.dts | 9 ++++++++-
+ arch/arm/boot/dts/ls1021a.dtsi | 11 ++++++++++-
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts
+index 44715c8ef756b..72a3fc63d0ece 100644
+--- a/arch/arm/boot/dts/ls1021a-twr.dts
++++ b/arch/arm/boot/dts/ls1021a-twr.dts
+@@ -143,7 +143,7 @@
+ };
+
+ &enet0 {
+- tbi-handle = <&tbi1>;
++ tbi-handle = <&tbi0>;
+ phy-handle = <&sgmii_phy2>;
+ phy-connection-type = "sgmii";
+ status = "okay";
+@@ -222,6 +222,13 @@
+ sgmii_phy2: ethernet-phy@2 {
+ reg = <0x2>;
+ };
++ tbi0: tbi-phy@1f {
++ reg = <0x1f>;
++ device_type = "tbi-phy";
++ };
++};
++
++&mdio1 {
+ tbi1: tbi-phy@1f {
+ reg = <0x1f>;
+ device_type = "tbi-phy";
+diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi
+index 2d20f60947b95..1343c86988c54 100644
+--- a/arch/arm/boot/dts/ls1021a.dtsi
++++ b/arch/arm/boot/dts/ls1021a.dtsi
+@@ -562,13 +562,22 @@
+ };
+
+ mdio0: mdio@2d24000 {
+- compatible = "gianfar";
++ compatible = "fsl,etsec2-mdio";
+ device_type = "mdio";
+ #address-cells = <1>;
+ #size-cells = <0>;
+ reg = <0x0 0x2d24000 0x0 0x4000>;
+ };
+
++ mdio1: mdio@2d64000 {
++ compatible = "fsl,etsec2-mdio";
++ device_type = "mdio";
++ #address-cells = <1>;
++ #size-cells = <0>;
++ reg = <0x0 0x2d64000 0x0 0x4000>,
++ <0x0 0x2d50030 0x0 0x4>;
++ };
++
+ ptp_clock@2d10e00 {
+ compatible = "fsl,etsec-ptp";
+ reg = <0x0 0x2d10e00 0x0 0xb0>;
+--
+2.20.1
+
--- /dev/null
+From 65ad3ae557902eba3009b36b6ddaa5af20d9e439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Jun 2019 14:29:58 +0200
+Subject: ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+[ Upstream commit 493e84c5dc4d703d976b5875f5db22dae08a0782 ]
+
+Add missing vdda-supply required by STM32 ADC.
+
+Fixes: 090992a9ca54 ("ARM: dts: stm32: enable ADC on stm32h743i-eval
+board")
+
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32h743i-eval.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/stm32h743i-eval.dts b/arch/arm/boot/dts/stm32h743i-eval.dts
+index 6c07786e7ddb9..0d98b2865bd77 100644
+--- a/arch/arm/boot/dts/stm32h743i-eval.dts
++++ b/arch/arm/boot/dts/stm32h743i-eval.dts
+@@ -71,6 +71,7 @@
+ };
+
+ &adc_12 {
++ vdda-supply = <&vdda>;
+ vref-supply = <&vdda>;
+ status = "okay";
+ adc1: adc@0 {
+--
+2.20.1
+
--- /dev/null
+From 15f7406a0f7354f76cd58df43f59130cd06fb14d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 May 2019 17:40:14 +0200
+Subject: ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT
+
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+
+[ Upstream commit ca0961011db57e39880df0b5708df8aa3339dc6f ]
+
+mmc1 node where wifi module is connected doesn't have properly defined
+power supplies so wifi module is never powered up. Fix that by
+specifying additional power supplies.
+
+Additionally, this STB may have either Realtek or Broadcom based wifi
+module. One based on Broadcom module also needs external clock to work
+properly. Fix that by adding clock property to wifi_pwrseq node.
+
+Fixes: e582b47a9252 ("ARM: dts: sun8i-h3: Add dts for the Beelink X2 STB")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+index 10da56e86ab80..21b38c386f1b3 100644
+--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
++++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts
+@@ -79,6 +79,8 @@
+ wifi_pwrseq: wifi_pwrseq {
+ compatible = "mmc-pwrseq-simple";
+ reset-gpios = <&r_pio 0 7 GPIO_ACTIVE_LOW>; /* PL7 */
++ clocks = <&rtc 1>;
++ clock-names = "ext_clock";
+ };
+
+ sound_spdif {
+@@ -128,6 +130,8 @@
+ pinctrl-names = "default";
+ pinctrl-0 = <&mmc1_pins_a>;
+ vmmc-supply = <®_vcc3v3>;
++ vqmmc-supply = <®_vcc3v3>;
++ mmc-pwrseq = <&wifi_pwrseq>;
+ bus-width = <4>;
+ non-removable;
+ status = "okay";
+--
+2.20.1
+
--- /dev/null
+From 1d3291b4e15f21e20d0451a1a5c3c603b15d4c78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2019 11:00:21 -0700
+Subject: ARM: OMAP2+: Fix potentially uninitialized return value for
+ _setup_reset()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ]
+
+Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
+the call to _enable() conditional based on no oh->rst_lines_cnt. This
+caused the return value to be potentially uninitialized. Curiously we see
+no compiler warnings for this, probably as this gets inlined.
+
+We call _setup_reset() from _setup() and only _setup_postsetup() if the
+return value is zero. Currently the return value can be uninitialized for
+cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.
+
+Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
+Cc: Paul Walmsley <paul@pwsan.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index 45c8f2ef4e23c..9274a484c6a39 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2530,7 +2530,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
+ */
+ static int _setup_reset(struct omap_hwmod *oh)
+ {
+- int r;
++ int r = 0;
+
+ if (oh->_state != _HWMOD_STATE_INITIALIZED)
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 7bd39c2e0e3b993d078b98562c393c4bbea88036 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 16:03:24 +0800
+Subject: ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ]
+
+Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+kfree, iounmap, clk_put etc are not needed anymore in remove path.
+
+Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+[ commit message spelling fix ]
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/plat-pxa/ssp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
+index b92673efffffb..97bd43c16cd87 100644
+--- a/arch/arm/plat-pxa/ssp.c
++++ b/arch/arm/plat-pxa/ssp.c
+@@ -230,18 +230,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
+
+ static int pxa_ssp_remove(struct platform_device *pdev)
+ {
+- struct resource *res;
+ struct ssp_device *ssp;
+
+ ssp = platform_get_drvdata(pdev);
+ if (ssp == NULL)
+ return -ENODEV;
+
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- release_mem_region(res->start, resource_size(res));
+-
+- clk_put(ssp->clk);
+-
+ mutex_lock(&ssp_lock);
+ list_del(&ssp->node);
+ mutex_unlock(&ssp_lock);
+--
+2.20.1
+
--- /dev/null
+From e599d3a9f2cfde955fade1ef25758038fac92643 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Apr 2019 22:43:49 +0100
+Subject: ARM: riscpc: fix lack of keyboard interrupts after irq conversion
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ]
+
+Fix lack of keyboard interrupts for RiscPC due to incorrect conversion.
+
+Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-rpc/irq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
+index b8a61cb112073..7f0f401786344 100644
+--- a/arch/arm/mach-rpc/irq.c
++++ b/arch/arm/mach-rpc/irq.c
+@@ -118,7 +118,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
+
+ void __init rpc_init_irq(void)
+ {
+- unsigned int irq, clr, set = 0;
++ unsigned int irq, clr, set;
+
+ iomd_writeb(0, IOMD_IRQMASKA);
+ iomd_writeb(0, IOMD_IRQMASKB);
+@@ -130,6 +130,7 @@ void __init rpc_init_irq(void)
+
+ for (irq = 0; irq < NR_IRQS; irq++) {
+ clr = IRQ_NOREQUEST;
++ set = 0;
+
+ if (irq <= 6 || (irq >= 9 && irq <= 15))
+ clr |= IRQ_NOPROBE;
+--
+2.20.1
+
--- /dev/null
+From df507624e829295c15e560bdf7932f7edd5497f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Mar 2019 14:52:50 +0100
+Subject: arm64: dts: allwinner: a64: Add missing PIO clocks
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 562bf19611c000cb7219431c3cc78aa60c2b371e ]
+
+The pinctrl binding mandates that we have the three clocks fed into the PIO
+described.
+
+Even though the old case is still supported for backward compatibility, we
+should update our DTs to fix this.
+
+Fixes: 6bc37fac30cf ("arm64: dts: add Allwinner A64 SoC .dtsi")
+Acked-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+index 8c8db1b057dfc..788a6f8c5994e 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi
+@@ -274,7 +274,8 @@
+ interrupts = <GIC_SPI 11 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 17 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 21 IRQ_TYPE_LEVEL_HIGH>;
+- clocks = <&ccu 58>;
++ clocks = <&ccu 58>, <&osc24M>, <&rtc 0>;
++ clock-names = "apb", "hosc", "losc";
+ gpio-controller;
+ #gpio-cells = <3>;
+ interrupt-controller;
+--
+2.20.1
+
--- /dev/null
+From 6a89b1a0576555dfaee22ff8452861a189e82ed1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Dec 2018 12:01:02 +0100
+Subject: arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+[ Upstream commit af61bef513ba179559e56908b8c465e587bc3890 ]
+
+In the same way as for msm8974-hammerhead, l11 load, used for SDCARD
+VMMC, needs to be increased in order to prevent any voltage drop issues
+(due to limited current) happening with some SDCARDS or during specific
+operations (e.g. write).
+
+Tested on Dragonboard-410c and DART-SD410 boards.
+
+Fixes: 4c7d53d16d77 (arm64: dts: apq8016-sbc: add regulators support)
+Reported-by: Manabu Igusa <migusa@arrowjapan.com>
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Andy Gross <andy.gross@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+index b6b44fdf7face..c1028b47edde9 100644
+--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi
+@@ -458,6 +458,8 @@
+ l11 {
+ regulator-min-microvolt = <1750000>;
+ regulator-max-microvolt = <3337000>;
++ regulator-allow-set-load;
++ regulator-system-load = <200000>;
+ };
+
+ l12 {
+--
+2.20.1
+
--- /dev/null
+From 92ae7812fe46d4b553a3f75e8c625307ac9001b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 12:03:31 +0000
+Subject: arm64: dts: juno: Fix UART frequency
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 39a1a8941b27c37f79508426e27a2ec29829d66c ]
+
+Older versions of the Juno *SoC* TRM [1] recommended that the UART clock
+source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more
+correct value of 7.3728 MHz. Somehow the wrong value managed to end up in
+our DT.
+
+Doing a prime factorisation, a modulo divide by 115200 and trying
+to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest
+that the old value was actually a typo. The actual UART clock is driven
+by a PLL, configured via a parameter in some board.txt file in the
+firmware, which reads 7.37 MHz (sic!).
+
+Fix this to correct the baud rate divisor calculation on the Juno board.
+
+[1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf
+[2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf
+
+Fixes: 71f867ec130e ("arm64: Add Juno board device tree.")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/arm/juno-clocks.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+index e5e265dfa9025..2870b5eeb1984 100644
+--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+@@ -8,10 +8,10 @@
+ */
+ / {
+ /* SoC fixed clocks */
+- soc_uartclk: refclk7273800hz {
++ soc_uartclk: refclk7372800hz {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <7273800>;
++ clock-frequency = <7372800>;
+ clock-output-names = "juno:uartclk";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 3ab033dcca8434bff392765af25204ab2072d642 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Apr 2019 14:27:09 +0200
+Subject: arm64: dts: meson: libretech-cc: set eMMC as removable
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 9f72e321d5506fe3e162a6308a4a295d7f10bb5d ]
+
+The eMMC on this board is add-on module which is not mandatory. Removing
+'non-removable' property should prevent some errors when booting a board
+w/o an eMMC module present.
+
+Fixes: 72fb2c852188 ("ARM64: dts: meson-gxl-s905x-libretech-cc: fixup board definition")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Martin Blumenstingl<martin.blumenstingl@googlemail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+index e2c71753e3278..407d32f4fe734 100644
+--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts
+@@ -226,7 +226,6 @@
+ cap-mmc-highspeed;
+ mmc-ddr-3_3v;
+ max-frequency = <50000000>;
+- non-removable;
+ disable-wp;
+
+ mmc-pwrseq = <&emmc_pwrseq>;
+--
+2.20.1
+
--- /dev/null
+From 79fd3ff9a4b0946980b47b7454e209432333fe86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:01:57 +0800
+Subject: ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9b4275c415acca6264a3d7f1182589959c93d530 ]
+
+sound/soc/codecs/cs4349.c:358:32: warning:
+ cs4349_runtime_pm defined but not used [-Wunused-const-variable=]
+
+cs4349_runtime_pm ops already defined, it seems
+we should enable it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: e40da86 ("ASoC: cs4349: Add support for Cirrus Logic CS4349")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815090157.70036-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4349.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
+index 0a749c79ef579..1d38e53dc95c8 100644
+--- a/sound/soc/codecs/cs4349.c
++++ b/sound/soc/codecs/cs4349.c
+@@ -380,6 +380,7 @@ static struct i2c_driver cs4349_i2c_driver = {
+ .driver = {
+ .name = "cs4349",
+ .of_match_table = cs4349_of_match,
++ .pm = &cs4349_runtime_pm,
+ },
+ .id_table = cs4349_i2c_id,
+ .probe = cs4349_i2c_probe,
+--
+2.20.1
+
--- /dev/null
+From 5e9df4022bfec0c7a498f76a9987f904fb6cccbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:23:00 +0800
+Subject: ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 630742c296341a8cfe00dfd941392025ba8dd4e8 ]
+
+It seems 'es8328_rline_enum' should be used
+in es8328_right_line_controls
+
+Fixes: 567e4f98922c ("ASoC: add es8328 codec driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815092300.68712-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index bcdb8914ec16b..e2f44fa46262d 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -231,7 +231,7 @@ static const struct soc_enum es8328_rline_enum =
+ ARRAY_SIZE(es8328_line_texts),
+ es8328_line_texts);
+ static const struct snd_kcontrol_new es8328_right_line_controls =
+- SOC_DAPM_ENUM("Route", es8328_lline_enum);
++ SOC_DAPM_ENUM("Route", es8328_rline_enum);
+
+ /* Left Mixer */
+ static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
+--
+2.20.1
+
--- /dev/null
+From 072c0782d27c744a03a496b0bbc3e98b1b4003e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:47:49 +0200
+Subject: ASoC: fix valid stream condition
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ]
+
+A stream may specify a rate range using 'rate_min' and 'rate_max', so a
+stream may be valid and not specify any rates. However, as stream cannot
+be valid and not have any channel. Let's use this condition instead to
+determine if a stream is valid or not.
+
+Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 24047375c2fbb..70e1a60a2e980 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -48,8 +48,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ else
+ codec_stream = &dai->driver->capture;
+
+- /* If the codec specifies any rate at all, it supports the stream. */
+- return codec_stream->rates;
++ /* If the codec specifies any channels at all, it supports the stream */
++ return codec_stream->channels_min;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From af0605662056a0d179401679bca124ebe11fa24c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jan 2019 10:06:52 +0100
+Subject: ASoC: imx-sgtl5000: put of nodes if finding codec fails
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ]
+
+Make sure to properly put the of node in case finding the codec
+fails.
+
+Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-sgtl5000.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
+index 8e525f7ac08d1..3d99a8579c99f 100644
+--- a/sound/soc/fsl/imx-sgtl5000.c
++++ b/sound/soc/fsl/imx-sgtl5000.c
+@@ -119,7 +119,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
+ codec_dev = of_find_i2c_device_by_node(codec_np);
+ if (!codec_dev) {
+ dev_err(&pdev->dev, "failed to find codec platform device\n");
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto fail;
+ }
+
+ data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From 74f518625d9fa66bce2b0e1e169515376d07be9c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 16:46:50 +0100
+Subject: ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ]
+
+The apq8016 driver leaves the of-node refcount at aborting from the
+loop of for_each_child_of_node() in the error path. Not only the
+iterator node of for_each_child_of_node(), the children nodes referred
+from it for codec and cpu have to be properly unreferenced.
+
+Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support")
+Cc: Patrick Lai <plai@codeaurora.org>
+Cc: Banajit Goswami <bgoswami@codeaurora.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
+index d49adc822a110..8e6b88d68ca6c 100644
+--- a/sound/soc/qcom/apq8016_sbc.c
++++ b/sound/soc/qcom/apq8016_sbc.c
+@@ -163,41 +163,52 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+
+ if (!cpu || !codec) {
+ dev_err(dev, "Can't find cpu/codec DT node\n");
+- return ERR_PTR(-EINVAL);
++ ret = -EINVAL;
++ goto error;
+ }
+
+ link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
+ if (!link->cpu_of_node) {
+ dev_err(card->dev, "error getting cpu phandle\n");
+- return ERR_PTR(-EINVAL);
++ ret = -EINVAL;
++ goto error;
+ }
+
+ ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
+ if (ret) {
+ dev_err(card->dev, "error getting cpu dai name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ ret = snd_soc_of_get_dai_link_codecs(dev, codec, link);
+
+ if (ret < 0) {
+ dev_err(card->dev, "error getting codec dai name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ link->platform_of_node = link->cpu_of_node;
+ ret = of_property_read_string(np, "link-name", &link->name);
+ if (ret) {
+ dev_err(card->dev, "error getting codec dai_link name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ link->stream_name = link->name;
+ link->init = apq8016_sbc_dai_init;
+ link++;
++
++ of_node_put(cpu);
++ of_node_put(codec);
+ }
+
+ return data;
++
++ error:
++ of_node_put(np);
++ of_node_put(cpu);
++ of_node_put(codec);
++ return ERR_PTR(ret);
+ }
+
+ static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = {
+--
+2.20.1
+
--- /dev/null
+From 62de328a1c2d3582c84ad065b85034d8d7783bed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 21:25:17 +0200
+Subject: ASoC: sun4i-i2s: RX and TX counter registers are swapped
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit cf2c0e1ce9544df42170fb921f12da82dc0cc8d6 ]
+
+The RX and TX counters registers offset have been swapped, fix that.
+
+Fixes: fa7c0d13cb26 ("ASoC: sunxi: Add Allwinner A10 Digital Audio driver")
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://lore.kernel.org/r/8b26477560ad5fd8f69e037b167c5e61de5c26a3.1566242458.git-series.maxime.ripard@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-i2s.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c
+index da0a2083e12af..d2802fd8c1dd7 100644
+--- a/sound/soc/sunxi/sun4i-i2s.c
++++ b/sound/soc/sunxi/sun4i-i2s.c
+@@ -80,8 +80,8 @@
+ #define SUN4I_I2S_CLK_DIV_MCLK_MASK GENMASK(3, 0)
+ #define SUN4I_I2S_CLK_DIV_MCLK(mclk) ((mclk) << 0)
+
+-#define SUN4I_I2S_RX_CNT_REG 0x28
+-#define SUN4I_I2S_TX_CNT_REG 0x2c
++#define SUN4I_I2S_TX_CNT_REG 0x28
++#define SUN4I_I2S_RX_CNT_REG 0x2c
+
+ #define SUN4I_I2S_TX_CHAN_SEL_REG 0x30
+ #define SUN4I_I2S_CHAN_SEL(num_chan) (((num_chan) - 1) << 0)
+--
+2.20.1
+
--- /dev/null
+From 0b4b1dc8039fdb0cc8910f9b067337c7cd670e66 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jun 2019 12:20:02 +0300
+Subject: ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple
+ AXRs
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit fd14f4436fd47d5418023c90e933e66d3645552e ]
+
+If multiple serializers are connected in the system and the number of
+channels will need to use more than one serializer the mask to enable the
+serializers were left to 0 if tdm_mask is provided
+
+Fixes: dd55ff8346a97 ("ASoC: davinci-mcasp: Add set_tdm_slots() support")
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/davinci/davinci-mcasp.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index 07bac9ea65c41..e10e03800cce5 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -882,14 +882,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
+ active_slots = hweight32(mcasp->tdm_mask[stream]);
+ active_serializers = (channels + active_slots - 1) /
+ active_slots;
+- if (active_serializers == 1) {
++ if (active_serializers == 1)
+ active_slots = channels;
+- for (i = 0; i < total_slots; i++) {
+- if ((1 << i) & mcasp->tdm_mask[stream]) {
+- mask |= (1 << i);
+- if (--active_slots <= 0)
+- break;
+- }
++ for (i = 0; i < total_slots; i++) {
++ if ((1 << i) & mcasp->tdm_mask[stream]) {
++ mask |= (1 << i);
++ if (--active_slots <= 0)
++ break;
+ }
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 64e8654f51897283846ad786a05f4c8495d43a7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:19:20 +0800
+Subject: ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 554b75bde64bcad9662530726d1483f7ef012069 ]
+
+sound/soc/codecs/wm8737.c:112:29: warning:
+ high_3d defined but not used [-Wunused-const-variable=]
+
+'high_3d' should be used for 3D High Cut-off.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 2a9ae13a2641 ("ASoC: Add initial WM8737 driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190815091920.64480-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8737.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
+index f0cb1c4afe3ce..c5a8d758f58b8 100644
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
+ SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
+ SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
+ SOC_ENUM("3D Low Cut-off", low_3d),
+-SOC_ENUM("3D High Cut-off", low_3d),
++SOC_ENUM("3D High Cut-off", high_3d),
+ SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
+
+ SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
+--
+2.20.1
+
--- /dev/null
+From b816ffd1f17054dc9216add7f8ef4e37f7bb0e5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 16:46:17 +0300
+Subject: ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet
+
+From: Nicolas Boichat <drinkcat@chromium.org>
+
+[ Upstream commit b7139960832eb56fa15d390a4b5c8c5739bd0d1a ]
+
+When the FW bundles multiple packets, pkt->act_len may be incorrect
+as it refers to the first packet only (however, the FW will only
+bundle packets that fit into the same pkt->alloc_len).
+
+Before this patch, the skb length would be set (incorrectly) to
+pkt->act_len in ath10k_sdio_mbox_rx_packet, and then later manually
+adjusted in ath10k_sdio_mbox_rx_process_packet.
+
+The first problem is that ath10k_sdio_mbox_rx_process_packet does not
+use proper skb_put commands to adjust the length (it directly changes
+skb->len), so we end up with a mismatch between skb->head + skb->tail
+and skb->data + skb->len. This is quite serious, and causes corruptions
+in the TCP stack, as the stack tries to coalesce packets, and relies
+on skb->tail being correct (that is, skb_tail_pointer must point to
+the first byte_after_ the data).
+
+Instead of re-adjusting the size in ath10k_sdio_mbox_rx_process_packet,
+this moves the code to ath10k_sdio_mbox_rx_packet, and also add a
+bounds check, as skb_put would crash the kernel if not enough space is
+available.
+
+Tested with QCA6174 SDIO with firmware
+WLAN.RMH.4.4.1-00007-QCARMSWP-1.
+
+Fixes: 8530b4e7b22bc3b ("ath10k: sdio: set skb len for all rx packets")
+Signed-off-by: Nicolas Boichat <drinkcat@chromium.org>
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/sdio.c | 29 +++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c
+index 0a1248ebccf5f..f49b21b137c13 100644
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -392,16 +392,11 @@ static int ath10k_sdio_mbox_rx_process_packet(struct ath10k *ar,
+ struct ath10k_htc_hdr *htc_hdr = (struct ath10k_htc_hdr *)skb->data;
+ bool trailer_present = htc_hdr->flags & ATH10K_HTC_FLAG_TRAILER_PRESENT;
+ enum ath10k_htc_ep_id eid;
+- u16 payload_len;
+ u8 *trailer;
+ int ret;
+
+- payload_len = le16_to_cpu(htc_hdr->len);
+- skb->len = payload_len + sizeof(struct ath10k_htc_hdr);
+-
+ if (trailer_present) {
+- trailer = skb->data + sizeof(*htc_hdr) +
+- payload_len - htc_hdr->trailer_len;
++ trailer = skb->data + skb->len - htc_hdr->trailer_len;
+
+ eid = pipe_id_to_eid(htc_hdr->eid);
+
+@@ -635,13 +630,31 @@ static int ath10k_sdio_mbox_rx_packet(struct ath10k *ar,
+ {
+ struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar);
+ struct sk_buff *skb = pkt->skb;
++ struct ath10k_htc_hdr *htc_hdr;
+ int ret;
+
+ ret = ath10k_sdio_readsb(ar, ar_sdio->mbox_info.htc_addr,
+ skb->data, pkt->alloc_len);
++ if (ret)
++ goto out;
++
++ /* Update actual length. The original length may be incorrect,
++ * as the FW will bundle multiple packets as long as their sizes
++ * fit within the same aligned length (pkt->alloc_len).
++ */
++ htc_hdr = (struct ath10k_htc_hdr *)skb->data;
++ pkt->act_len = le16_to_cpu(htc_hdr->len) + sizeof(*htc_hdr);
++ if (pkt->act_len > pkt->alloc_len) {
++ ath10k_warn(ar, "rx packet too large (%zu > %zu)\n",
++ pkt->act_len, pkt->alloc_len);
++ ret = -EMSGSIZE;
++ goto out;
++ }
++
++ skb_put(skb, pkt->act_len);
++
++out:
+ pkt->status = ret;
+- if (!ret)
+- skb_put(skb, pkt->act_len);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From dcd849acf990e972c9a1a29fb94a74508dabb2ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 09:41:39 +0200
+Subject: ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit e1aa1a1db3b01c9890e82cf065cee99962ba1ed9 ]
+
+Fix following lockdep warning disabling bh in
+ath_dynack_node_init/ath_dynack_node_deinit
+
+[ 75.955878] --------------------------------
+[ 75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
+[ 75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
+[ 75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.955905] {SOFTIRQ-ON-W} state was registered at:
+[ 75.955912] lock_acquire+0x9a/0x160
+[ 75.955917] _raw_spin_lock+0x2c/0x70
+[ 75.955927] ath_dynack_node_init+0x2a/0x60 [ath9k_hw]
+[ 75.955934] ath9k_sta_state+0xec/0x160 [ath9k]
+[ 75.955976] drv_sta_state+0xb2/0x740 [mac80211]
+[ 75.956008] sta_info_insert_finish+0x21a/0x420 [mac80211]
+[ 75.956039] sta_info_insert_rcu+0x12b/0x2c0 [mac80211]
+[ 75.956069] sta_info_insert+0x7/0x70 [mac80211]
+[ 75.956093] ieee80211_prep_connection+0x42e/0x730 [mac80211]
+[ 75.956120] ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211]
+[ 75.956152] cfg80211_mlme_auth+0x143/0x350 [cfg80211]
+[ 75.956169] nl80211_authenticate+0x25e/0x2b0 [cfg80211]
+[ 75.956172] genl_family_rcv_msg+0x198/0x400
+[ 75.956174] genl_rcv_msg+0x42/0x90
+[ 75.956176] netlink_rcv_skb+0x35/0xf0
+[ 75.956178] genl_rcv+0x1f/0x30
+[ 75.956180] netlink_unicast+0x154/0x200
+[ 75.956182] netlink_sendmsg+0x1bf/0x3d0
+[ 75.956186] ___sys_sendmsg+0x2c2/0x2f0
+[ 75.956187] __sys_sendmsg+0x44/0x80
+[ 75.956190] do_syscall_64+0x55/0x1a0
+[ 75.956192] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 75.956194] irq event stamp: 2357092
+[ 75.956196] hardirqs last enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50
+[ 75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80
+[ 75.956202] softirqs last enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60
+[ 75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0
+[ 75.956206]
+ other info that might help us debug this:
+[ 75.956207] Possible unsafe locking scenario:
+
+[ 75.956208] CPU0
+[ 75.956209] ----
+[ 75.956210] lock(&(&da->qlock)->rlock);
+[ 75.956213] <Interrupt>
+[ 75.956214] lock(&(&da->qlock)->rlock);
+[ 75.956216]
+ *** DEADLOCK ***
+
+[ 75.956217] 1 lock held by swapper/0/0:
+[ 75.956219] #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k]
+[ 75.956225]
+ stack backtrace:
+[ 75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13
+[ 75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
+[ 75.956231] Call Trace:
+[ 75.956233] <IRQ>
+[ 75.956236] dump_stack+0x67/0x90
+[ 75.956239] mark_lock+0x4c1/0x640
+[ 75.956242] ? check_usage_backwards+0x130/0x130
+[ 75.956245] ? sched_clock_local+0x12/0x80
+[ 75.956247] __lock_acquire+0x484/0x7a0
+[ 75.956250] ? __lock_acquire+0x3b9/0x7a0
+[ 75.956252] lock_acquire+0x9a/0x160
+[ 75.956259] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.956262] _raw_spin_lock_bh+0x34/0x80
+[ 75.956268] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.956275] ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.956280] ath_rx_tasklet+0xd09/0xe90 [ath9k]
+[ 75.956286] ath9k_tasklet+0x102/0x240 [ath9k]
+[ 75.956288] tasklet_action_common.isra.0+0x6d/0x170
+[ 75.956291] __do_softirq+0xcc/0x425
+[ 75.956294] irq_exit+0xae/0xc0
+[ 75.956296] do_IRQ+0x8a/0x110
+[ 75.956298] common_interrupt+0xf/0xf
+[ 75.956300] </IRQ>
+[ 75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400
+[ 75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7
+[ 75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000
+[ 75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800
+[ 75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000
+[ 75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
+[ 75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800
+[ 75.956321] cpuidle_enter+0x24/0x40
+[ 75.956323] do_idle+0x1ac/0x220
+[ 75.956326] cpu_startup_entry+0x14/0x20
+[ 75.956329] start_kernel+0x482/0x489
+[ 75.956332] secondary_startup_64+0xa4/0xb0
+
+Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/dynack.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
+index 6e236a4854311..71b4888b30e71 100644
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -300,9 +300,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
+
+ an->ackto = ackto;
+
+- spin_lock(&da->qlock);
++ spin_lock_bh(&da->qlock);
+ list_add_tail(&an->list, &da->nodes);
+- spin_unlock(&da->qlock);
++ spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_init);
+
+@@ -316,9 +316,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
+ {
+ struct ath_dynack *da = &ah->dynack;
+
+- spin_lock(&da->qlock);
++ spin_lock_bh(&da->qlock);
+ list_del(&an->list);
+- spin_unlock(&da->qlock);
++ spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_deinit);
+
+--
+2.20.1
+
--- /dev/null
+From 800b4be48ce667dd4b40fb4cb54da1f1714ab58f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:25:03 -0400
+Subject: backlight: lm3630a: Return 0 on success in update_status functions
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ]
+
+lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
+both return the brightness value if the brightness was successfully
+updated. Writing to these attributes via sysfs would cause a 'Bad
+address' error to be returned. These functions should return 0 on
+success, so let's change it to correct that error.
+
+Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 2030a6b77a097..ef2553f452ca9 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access\n");
+@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+--
+2.20.1
+
--- /dev/null
+From 0da95693af53ed91c41b648edef07791f5ec8a75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 09:16:20 +0100
+Subject: bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 420c20be08a4597404d272ae9793b642401146eb ]
+
+An earlier commit re-worked the setting of the bitmask and is now
+assigning v with some bit flags rather than bitwise or-ing them
+into v, consequently the earlier bit-settings of v are being lost.
+Fix this by replacing an assignment with the bitwise or instead.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 2be25cac8402 ("bcma: add constants for PCI and use them")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bcma/driver_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
+index f499a469e66d0..12b2cc9a3fbe8 100644
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
+ v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ }
+
+- v = BCMA_CORE_PCI_MDIODATA_START;
++ v |= BCMA_CORE_PCI_MDIODATA_START;
+ v |= BCMA_CORE_PCI_MDIODATA_READ;
+ v |= BCMA_CORE_PCI_MDIODATA_TA;
+
+@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
+ v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ }
+
+- v = BCMA_CORE_PCI_MDIODATA_START;
++ v |= BCMA_CORE_PCI_MDIODATA_START;
+ v |= BCMA_CORE_PCI_MDIODATA_WRITE;
+ v |= BCMA_CORE_PCI_MDIODATA_TA;
+ v |= data;
+--
+2.20.1
+
--- /dev/null
+From 1af32052cf665e8b5b33fd2804467f67e80ac9fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 19:13:08 +0800
+Subject: block: don't use bio->bi_vcnt to figure out segment number
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ]
+
+It is wrong to use bio->bi_vcnt to figure out how many segments
+there are in the bio even though CLONED flag isn't set on this bio,
+because this bio may be splitted or advanced.
+
+So always use bio_segments() in blk_recount_segments(), and it shouldn't
+cause any performance loss now because the physical segment number is figured
+out in blk_queue_split() and BIO_SEG_VALID is set meantime since
+bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting").
+
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index f61b50a01bc7a..415b5dafd9e6e 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -299,13 +299,7 @@ void blk_recalc_rq_segments(struct request *rq)
+
+ void blk_recount_segments(struct request_queue *q, struct bio *bio)
+ {
+- unsigned short seg_cnt;
+-
+- /* estimate segment number by bi_vcnt for non-cloned bio */
+- if (bio_flagged(bio, BIO_CLONED))
+- seg_cnt = bio_segments(bio);
+- else
+- seg_cnt = bio->bi_vcnt;
++ unsigned short seg_cnt = bio_segments(bio);
+
+ if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
+ (seg_cnt < queue_max_segments(q)))
+--
+2.20.1
+
--- /dev/null
+From 63436ddffe5217fc5523ae6a8bf4d47cfb3ae977 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 29 Jun 2019 11:16:45 -0400
+Subject: bnxt_en: Fix ethtool selftest crash under error conditions.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit d27e2ca1166aefd54d9c48fb6647dee8115a5dfc ]
+
+After ethtool loopback packet tests, we re-open the nic for the next
+IRQ test. If the open fails, we must not proceed with the IRQ test
+or we will crash with NULL pointer dereference. Fix it by checking
+the bnxt_open_nic() return code before proceeding.
+
+Reported-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
+Fixes: 67fea463fd87 ("bnxt_en: Add interrupt test to ethtool -t selftest.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index fc8e185718a1d..963beaa8fabbc 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -2463,7 +2463,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
+ bool offline = false;
+ u8 test_results = 0;
+ u8 test_mask = 0;
+- int rc, i;
++ int rc = 0, i;
+
+ if (!bp->num_tests || !BNXT_SINGLE_PF(bp))
+ return;
+@@ -2521,9 +2521,9 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest,
+ }
+ bnxt_hwrm_phy_loopback(bp, false);
+ bnxt_half_close_nic(bp);
+- bnxt_open_nic(bp, false, true);
++ rc = bnxt_open_nic(bp, false, true);
+ }
+- if (bnxt_test_irq(bp)) {
++ if (rc || bnxt_test_irq(bp)) {
+ buf[BNXT_IRQ_TEST_IDX] = 1;
+ etest->flags |= ETH_TEST_FL_FAILED;
+ }
+--
+2.20.1
+
--- /dev/null
+From 4bace2e538bf5b9d0a981ac85862740d5d9047ee Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 17 Aug 2019 17:04:49 -0400
+Subject: bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit dd2ebf3404c7c295014bc025dea23960960ceb1a ]
+
+If FW returns FRAG_ERR in response error code, driver is resending the
+command only when HWRM command returns success. Fix the code to resend
+NVM_INSTALL_UPDATE command with DEFRAG install flags, if FW returns
+FRAG_ERR in its response error code.
+
+Fixes: cb4d1d626145 ("bnxt_en: Retry failed NVM_INSTALL_UPDATE with defragmentation flag enabled.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 963beaa8fabbc..3c78cd1cdd6fb 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1667,21 +1667,19 @@ static int bnxt_flash_package_from_file(struct net_device *dev,
+ mutex_lock(&bp->hwrm_cmd_lock);
+ hwrm_err = _hwrm_send_message(bp, &install, sizeof(install),
+ INSTALL_PACKAGE_TIMEOUT);
+- if (hwrm_err)
+- goto flash_pkg_exit;
+-
+- if (resp->error_code) {
++ if (hwrm_err) {
+ u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err;
+
+- if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
++ if (resp->error_code && error_code ==
++ NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) {
+ install.flags |= cpu_to_le16(
+ NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG);
+ hwrm_err = _hwrm_send_message(bp, &install,
+ sizeof(install),
+ INSTALL_PACKAGE_TIMEOUT);
+- if (hwrm_err)
+- goto flash_pkg_exit;
+ }
++ if (hwrm_err)
++ goto flash_pkg_exit;
+ }
+
+ if (resp->result) {
+--
+2.20.1
+
--- /dev/null
+From 00a6a1756f7f41d0cc665a8b2e50120fe3c6459e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:09 +0100
+Subject: Btrfs: fix hang when loading existing inode cache off disk
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 7764d56baa844d7f6206394f21a0e8c1f303c476 ]
+
+If we are able to load an existing inode cache off disk, we set the state
+of the cache to BTRFS_CACHE_FINISHED, but we don't wake up any one waiting
+for the cache to be available. This means that anyone waiting for the
+cache to be available, waiting on the condition that either its state is
+BTRFS_CACHE_FINISHED or its available free space is greather than zero,
+can hang forever.
+
+This could be observed running fstests with MOUNT_OPTIONS="-o inode_cache",
+in particular test case generic/161 triggered it very frequently for me,
+producing a trace like the following:
+
+ [63795.739712] BTRFS info (device sdc): enabling inode map caching
+ [63795.739714] BTRFS info (device sdc): disk space caching is enabled
+ [63795.739716] BTRFS info (device sdc): has skinny extents
+ [64036.653886] INFO: task btrfs-transacti:3917 blocked for more than 120 seconds.
+ [64036.654079] Not tainted 5.2.0-rc4-btrfs-next-50 #1
+ [64036.654143] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [64036.654232] btrfs-transacti D 0 3917 2 0x80004000
+ [64036.654239] Call Trace:
+ [64036.654258] ? __schedule+0x3ae/0x7b0
+ [64036.654271] schedule+0x3a/0xb0
+ [64036.654325] btrfs_commit_transaction+0x978/0xae0 [btrfs]
+ [64036.654339] ? remove_wait_queue+0x60/0x60
+ [64036.654395] transaction_kthread+0x146/0x180 [btrfs]
+ [64036.654450] ? btrfs_cleanup_transaction+0x620/0x620 [btrfs]
+ [64036.654456] kthread+0x103/0x140
+ [64036.654464] ? kthread_create_worker_on_cpu+0x70/0x70
+ [64036.654476] ret_from_fork+0x3a/0x50
+ [64036.654504] INFO: task xfs_io:3919 blocked for more than 120 seconds.
+ [64036.654568] Not tainted 5.2.0-rc4-btrfs-next-50 #1
+ [64036.654617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [64036.654685] xfs_io D 0 3919 3633 0x00000000
+ [64036.654691] Call Trace:
+ [64036.654703] ? __schedule+0x3ae/0x7b0
+ [64036.654716] schedule+0x3a/0xb0
+ [64036.654756] btrfs_find_free_ino+0xa9/0x120 [btrfs]
+ [64036.654764] ? remove_wait_queue+0x60/0x60
+ [64036.654809] btrfs_create+0x72/0x1f0 [btrfs]
+ [64036.654822] lookup_open+0x6bc/0x790
+ [64036.654849] path_openat+0x3bc/0xc00
+ [64036.654854] ? __lock_acquire+0x331/0x1cb0
+ [64036.654869] do_filp_open+0x99/0x110
+ [64036.654884] ? __alloc_fd+0xee/0x200
+ [64036.654895] ? do_raw_spin_unlock+0x49/0xc0
+ [64036.654909] ? do_sys_open+0x132/0x220
+ [64036.654913] do_sys_open+0x132/0x220
+ [64036.654926] do_syscall_64+0x60/0x1d0
+ [64036.654933] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fix this by adding a wake_up() call right after setting the cache state to
+BTRFS_CACHE_FINISHED, at start_caching(), when we are able to load the
+cache from disk.
+
+Fixes: 82d5902d9c681b ("Btrfs: Support reading/writing on disk free ino cache")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index d02019747d001..7dc2923655d98 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -159,6 +159,7 @@ static void start_caching(struct btrfs_root *root)
+ spin_lock(&root->ino_cache_lock);
+ root->ino_cache_state = BTRFS_CACHE_FINISHED;
+ spin_unlock(&root->ino_cache_lock);
++ wake_up(&root->ino_cache_wait);
+ return;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 7eb010ee5409574815d27ee643eccf2033a84f42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:32 +0100
+Subject: Btrfs: fix inode cache waiters hanging on failure to start caching
+ thread
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit a68ebe0790fc88b4314d17984a2cf99ce2361901 ]
+
+If we fail to start the inode caching thread, we print an error message
+and disable the inode cache, however we never wake up any waiters, so they
+hang forever waiting for the caching to finish. Fix this by waking them
+up and have them fallback to a call to btrfs_find_free_objectid().
+
+Fixes: e60efa84252c05 ("Btrfs: avoid triggering bug_on() when we fail to start inode caching task")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index 7dc2923655d98..b1c3a4ec76c8c 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -26,6 +26,19 @@
+ #include "inode-map.h"
+ #include "transaction.h"
+
++static void fail_caching_thread(struct btrfs_root *root)
++{
++ struct btrfs_fs_info *fs_info = root->fs_info;
++
++ btrfs_warn(fs_info, "failed to start inode caching task");
++ btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
++ "disabling inode map caching");
++ spin_lock(&root->ino_cache_lock);
++ root->ino_cache_state = BTRFS_CACHE_ERROR;
++ spin_unlock(&root->ino_cache_lock);
++ wake_up(&root->ino_cache_wait);
++}
++
+ static int caching_kthread(void *data)
+ {
+ struct btrfs_root *root = data;
+@@ -178,11 +191,8 @@ static void start_caching(struct btrfs_root *root)
+
+ tsk = kthread_run(caching_kthread, root, "btrfs-ino-cache-%llu",
+ root->root_key.objectid);
+- if (IS_ERR(tsk)) {
+- btrfs_warn(fs_info, "failed to start inode caching task");
+- btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE,
+- "disabling inode map caching");
+- }
++ if (IS_ERR(tsk))
++ fail_caching_thread(root);
+ }
+
+ int btrfs_find_free_ino(struct btrfs_root *root, u64 *objectid)
+@@ -200,11 +210,14 @@ again:
+
+ wait_event(root->ino_cache_wait,
+ root->ino_cache_state == BTRFS_CACHE_FINISHED ||
++ root->ino_cache_state == BTRFS_CACHE_ERROR ||
+ root->free_ino_ctl->free_space > 0);
+
+ if (root->ino_cache_state == BTRFS_CACHE_FINISHED &&
+ root->free_ino_ctl->free_space == 0)
+ return -ENOSPC;
++ else if (root->ino_cache_state == BTRFS_CACHE_ERROR)
++ return btrfs_find_free_objectid(root, objectid);
+ else
+ goto again;
+ }
+--
+2.20.1
+
--- /dev/null
+From 8b5385d7c7a1a2c18d3d89a9c44311bb6d5059f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:44 +0100
+Subject: Btrfs: fix inode cache waiters hanging on path allocation failure
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 9d123a35d7e97bb2139747b16127c9b22b6a593e ]
+
+If the caching thread fails to allocate a path, it returns without waking
+up any cache waiters, leaving them hang forever. Fix this by following the
+same approach as when we fail to start the caching thread: print an error
+message, disable inode caching and make the wakers fallback to non-caching
+mode behaviour (calling btrfs_find_free_objectid()).
+
+Fixes: 581bb050941b4f ("Btrfs: Cache free inode numbers in memory")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index b1c3a4ec76c8c..2ae32451fb5b0 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -55,8 +55,10 @@ static int caching_kthread(void *data)
+ return 0;
+
+ path = btrfs_alloc_path();
+- if (!path)
++ if (!path) {
++ fail_caching_thread(root);
+ return -ENOMEM;
++ }
+
+ /* Since the commit root is read-only, we can safely skip locking. */
+ path->skip_locking = 1;
+--
+2.20.1
+
--- /dev/null
+From c64f6d6a11e09fce3a41ff0dcb61d523ab0d582b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 14:04:02 -0700
+Subject: btrfs: use correct count in btrfs_file_write_iter()
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit c09767a8960ca0500fb636bf73686723337debf4 ]
+
+generic_write_checks() may modify iov_iter_count(), so we must get the
+count after the call, not before. Using the wrong one has a couple of
+consequences:
+
+1. We check a longer range in check_can_nocow() for nowait than we're
+ actually writing.
+2. We create extra hole extent maps in btrfs_cont_expand(). As far as I
+ can tell, this is harmless, but I might be missing something.
+
+These issues are pretty minor, but let's fix it before something more
+important trips on it.
+
+Fixes: edf064e7c6fe ("btrfs: nowait aio support")
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/file.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 97be32da857ab..c68ce3412dc11 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1882,7 +1882,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ bool sync = (file->f_flags & O_DSYNC) || IS_SYNC(file->f_mapping->host);
+ ssize_t err;
+ loff_t pos;
+- size_t count = iov_iter_count(from);
++ size_t count;
+ loff_t oldsize;
+ int clean_page = 0;
+
+@@ -1904,6 +1904,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb,
+ }
+
+ pos = iocb->ki_pos;
++ count = iov_iter_count(from);
+ if (iocb->ki_flags & IOCB_NOWAIT) {
+ /*
+ * We will allocate space in case nodatacow is not set,
+--
+2.20.1
+
--- /dev/null
+From 7377509ae4d9b299c1253de3c308d52671572ce0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 22:34:51 +0800
+Subject: cdc-wdm: pass return value of recover_from_urb_loss
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]
+
+'rv' is the correct return value, pass it upstream instead of 0
+
+Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index a593cdfc897fd..d5d42dccda10a 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -1085,7 +1085,7 @@ static int wdm_post_reset(struct usb_interface *intf)
+ rv = recover_from_urb_loss(desc);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
+- return 0;
++ return rv;
+ }
+
+ static struct usb_driver wdm_driver = {
+--
+2.20.1
+
--- /dev/null
+From e41f634075f1f271a83446f7409f4a29424c6761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2019 22:14:29 -0500
+Subject: cifs: fix rmmod regression in cifs.ko caused by force_sig changes
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 ]
+
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+
+The global change from force_sig caused module unloading of cifs.ko
+to fail (since the cifsd process could not be killed, "rmmod cifs"
+now would always fail)
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+CC: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 51bbb1c0b71ae..ed4a0352ea90e 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -921,6 +921,7 @@ cifs_demultiplex_thread(void *p)
+ mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+
+ set_freezable();
++ allow_signal(SIGKILL);
+ while (server->tcpStatus != CifsExiting) {
+ if (try_to_freeze())
+ continue;
+--
+2.20.1
+
--- /dev/null
+From 0f918d87510b8bc6c702993d2b4111e3e59af3de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:36:58 -0500
+Subject: clk: armada-370: fix refcount leak in a370_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-370.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
+index 2c7c1085f8830..8fdfa97900cd8 100644
+--- a/drivers/clk/mvebu/armada-370.c
++++ b/drivers/clk/mvebu/armada-370.c
+@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &a370_coreclks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, a370_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+
+--
+2.20.1
+
--- /dev/null
+From 93000d9d6d6a1f0ca1e6132f1ac16bc158face84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:42:26 -0500
+Subject: clk: armada-xp: fix refcount leak in axp_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-xp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
+index 0ec44ae9a2a26..df529982adc97 100644
+--- a/drivers/clk/mvebu/armada-xp.c
++++ b/drivers/clk/mvebu/armada-xp.c
+@@ -228,7 +228,9 @@ static void __init axp_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &axp_coreclks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, axp_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
+--
+2.20.1
+
--- /dev/null
+From cfac19ef0ec2d94fbb696b1f9c012472505259ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:50:13 -0500
+Subject: clk: dove: fix refcount leak in dove_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 8d726c5128298386b907963033be93407b0c4275 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 8f7fc5450b64 ("clk: mvebu: dove: maintain clock init order")
+Fixes: 63b8d92c793f ("clk: add Dove PLL divider support for GPU, VMeta and AXI clocks")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/dove.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c
+index 59fad9546c847..5f258c9bb68bf 100644
+--- a/drivers/clk/mvebu/dove.c
++++ b/drivers/clk/mvebu/dove.c
+@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &dove_coreclks);
+
+- if (ddnp)
++ if (ddnp) {
+ dove_divider_clk_init(ddnp);
++ of_node_put(ddnp);
++ }
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, dove_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init);
+--
+2.20.1
+
--- /dev/null
+From d66242bd750e11202d7ebd40f9bff0b0a24b4234 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:10:01 -0500
+Subject: clk: highbank: fix refcount leak in hb_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-highbank.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
+index 727ed8e1bb726..8e4581004695c 100644
+--- a/drivers/clk/clk-highbank.c
++++ b/drivers/clk/clk-highbank.c
+@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
+ /* Map system registers */
+ srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
+ hb_clk->reg = of_iomap(srnp, 0);
++ of_node_put(srnp);
+ BUG_ON(!hb_clk->reg);
+ hb_clk->reg += reg;
+
+--
+2.20.1
+
--- /dev/null
+From 155ac1e2c907fdb46c28aa895c6b24d272b33587 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:53:00 -0500
+Subject: clk: imx6q: fix refcount leak in imx6q_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6q.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index 8eb93eb2f8573..e0547654cb7bd 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -431,6 +431,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
+ anatop_base = base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ /* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
+ if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
+--
+2.20.1
+
--- /dev/null
+From ec6a1ba9dcb9414af9ae0b96625b3468f1b8377a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:55:10 -0500
+Subject: clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6sx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
+index e6d389e333d7d..baa07553a0ddc 100644
+--- a/drivers/clk/imx/clk-imx6sx.c
++++ b/drivers/clk/imx/clk-imx6sx.c
+@@ -164,6 +164,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
+ base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+ clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+--
+2.20.1
+
--- /dev/null
+From 77b65369e2be0d64d40c215238076cab1a110de0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:57:16 -0500
+Subject: clk: imx7d: fix refcount leak in imx7d_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx7d.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index 0ac9b30c8b906..9f5e5b9d4a25a 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -416,6 +416,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
+ base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ clks[IMX7D_PLL_ARM_MAIN_SRC] = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+ clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+--
+2.20.1
+
--- /dev/null
+From 9d0cc353b0d6387b14bc82370d5f97981db47c2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:40:19 -0500
+Subject: clk: kirkwood: fix refcount leak in kirkwood_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/kirkwood.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
+index a2a8d614039da..890ebf623261b 100644
+--- a/drivers/clk/mvebu/kirkwood.c
++++ b/drivers/clk/mvebu/kirkwood.c
+@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
+ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
+ kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
++
++ of_node_put(cgnp);
+ }
+ }
+ CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+--
+2.20.1
+
--- /dev/null
+From d0c1627e3b40dcbef233b938ba595dc34cbd5e47 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:48:05 -0500
+Subject: clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 9b4eedf627045ae5ddcff60a484200cdd554c413 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 337072604224 ("clk: mvebu: Expand mv98dx3236-core-clock support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/mv98dx3236.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/mv98dx3236.c b/drivers/clk/mvebu/mv98dx3236.c
+index 6e203af73cac1..c8a0d03d2cd60 100644
+--- a/drivers/clk/mvebu/mv98dx3236.c
++++ b/drivers/clk/mvebu/mv98dx3236.c
+@@ -174,7 +174,9 @@ static void __init mv98dx3236_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &mv98dx3236_core_clocks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, mv98dx3236_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(mv98dx3236_clk, "marvell,mv98dx3236-core-clock", mv98dx3236_clk_init);
+--
+2.20.1
+
--- /dev/null
+From e0889da8b55d605e10baf6a521e68963a7391830 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 14:11:34 -0700
+Subject: clk: qcom: Fix -Wunused-const-variable
+
+From: Nathan Huckleberry <nhuck@google.com>
+
+[ Upstream commit da642427bd7710ec4f4140f693f59aa8521a358c ]
+
+Clang produces the following warning
+
+drivers/clk/qcom/gcc-msm8996.c:133:32: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map' [-Wunused-const-variable]
+static const struct
+parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] =
+{ ^drivers/clk/qcom/gcc-msm8996.c:141:27: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div' [-Wunused-const-variable] static
+const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = { ^
+drivers/clk/qcom/gcc-msm8996.c:187:32: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map'
+[-Wunused-const-variable] static const struct parent_map
+gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = { ^
+drivers/clk/qcom/gcc-msm8996.c:197:27: warning: unused variable
+'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div'
+[-Wunused-const-variable] static const char * const
+gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
+
+It looks like these were never used.
+
+Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver")
+Cc: clang-built-linux@googlegroups.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/518
+Suggested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Nathan Huckleberry <nhuck@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/qcom/gcc-msm8996.c | 36 ----------------------------------
+ 1 file changed, 36 deletions(-)
+
+diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c
+index 7ddec886fcd35..c0b043b1bd248 100644
+--- a/drivers/clk/qcom/gcc-msm8996.c
++++ b/drivers/clk/qcom/gcc-msm8996.c
+@@ -140,22 +140,6 @@ static const char * const gcc_xo_gpll0_gpll4_gpll0_early_div[] = {
+ "gpll0_early_div"
+ };
+
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = {
+- { P_XO, 0 },
+- { P_GPLL0, 1 },
+- { P_GPLL2, 2 },
+- { P_GPLL3, 3 },
+- { P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = {
+- "xo",
+- "gpll0",
+- "gpll2",
+- "gpll3",
+- "gpll0_early_div"
+-};
+-
+ static const struct parent_map gcc_xo_gpll0_gpll1_early_div_gpll1_gpll4_gpll0_early_div_map[] = {
+ { P_XO, 0 },
+ { P_GPLL0, 1 },
+@@ -194,26 +178,6 @@ static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll2_early_gpll0_early
+ "gpll0_early_div"
+ };
+
+-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = {
+- { P_XO, 0 },
+- { P_GPLL0, 1 },
+- { P_GPLL2, 2 },
+- { P_GPLL3, 3 },
+- { P_GPLL1, 4 },
+- { P_GPLL4, 5 },
+- { P_GPLL0_EARLY_DIV, 6 }
+-};
+-
+-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = {
+- "xo",
+- "gpll0",
+- "gpll2",
+- "gpll3",
+- "gpll1",
+- "gpll4",
+- "gpll0_early_div"
+-};
+-
+ static struct clk_fixed_factor xo = {
+ .mult = 1,
+ .div = 1,
+--
+2.20.1
+
--- /dev/null
+From 959e0f0f055c7ba800237cbd7f719ddf447043a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:14:42 -0500
+Subject: clk: qoriq: fix refcount leak in clockgen_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-qoriq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index 1a292519d84f2..999a90a166092 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -1382,6 +1382,7 @@ static void __init clockgen_init(struct device_node *np)
+ pr_err("%s: Couldn't map %pOF regs\n", __func__,
+ guts);
+ }
++ of_node_put(guts);
+ }
+
+ }
+--
+2.20.1
+
--- /dev/null
+From 18b9899b52162e5d2a0c1951069cd1af9736e75b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:32:15 -0500
+Subject: clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos4.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index d8d3cb67b4029..3d30262219275 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1240,6 +1240,7 @@ static unsigned long __init exynos4_get_xom(void)
+ xom = readl(chipid_base + 8);
+
+ iounmap(chipid_base);
++ of_node_put(np);
+ }
+
+ return xom;
+--
+2.20.1
+
--- /dev/null
+From e1f2700f394da876ad3a0ad493e41a6428f3883b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:29:02 -0500
+Subject: clk: socfpga: fix refcount leak
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform")
+Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/socfpga/clk-pll-a10.c | 1 +
+ drivers/clk/socfpga/clk-pll.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
+index 35fabe1a32c30..269467e8e07e1 100644
+--- a/drivers/clk/socfpga/clk-pll-a10.c
++++ b/drivers/clk/socfpga/clk-pll-a10.c
+@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node,
+
+ clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
++ of_node_put(clkmgr_np);
+ BUG_ON(!clk_mgr_a10_base_addr);
+ pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
+
+diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
+index c7f463172e4b9..b4b44e9b59011 100644
+--- a/drivers/clk/socfpga/clk-pll.c
++++ b/drivers/clk/socfpga/clk-pll.c
+@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
+
+ clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
++ of_node_put(clkmgr_np);
+ BUG_ON(!clk_mgr_base_addr);
+ pll_clk->hw.reg = clk_mgr_base_addr + reg;
+
+--
+2.20.1
+
--- /dev/null
+From 75fa3d4d0ba4909d1148d61a551bba8bc88815d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 11:23:04 +0800
+Subject: clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 108a459ef4cd17a28711d81092044e597b5c7618 ]
+
+The PLL-MIPI clock is somewhat special as it has its own LDOs which
+need to be turned on for this PLL to actually work and output a clock
+signal.
+
+Add the 2 LDO enable bits to the gate bits.
+
+Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+index d93b452f0df97..1cef040ebe829 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c
+@@ -132,7 +132,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi",
+ 8, 4, /* N */
+ 4, 2, /* K */
+ 0, 4, /* M */
+- BIT(31), /* gate */
++ BIT(31) | BIT(23) | BIT(22), /* gate */
+ BIT(28), /* lock */
+ CLK_SET_RATE_UNGATE);
+
+--
+2.20.1
+
--- /dev/null
+From 9ac7acf49b24e0ad0b8b2cccccd6d4f5a5e54322 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 13 Jul 2019 11:46:28 +0800
+Subject: clk: sunxi-ng: v3s: add the missing PLL_DDR1
+
+From: Icenowy Zheng <icenowy@aosc.io>
+
+[ Upstream commit c5ed9475c22c89d5409402055142372e35d26a3f ]
+
+The user manual of V3/V3s/S3 declares a PLL_DDR1, however it's forgot
+when developing the V3s CCU driver.
+
+Add back the missing PLL_DDR1.
+
+Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU")
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 19 +++++++++++++++----
+ drivers/clk/sunxi-ng/ccu-sun8i-v3s.h | 6 ++++--
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+index 9e3f4088724b4..c7f9d974b10d5 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+@@ -84,7 +84,7 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(pll_ve_clk, "pll-ve",
+ BIT(28), /* lock */
+ 0);
+
+-static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr_clk, "pll-ddr",
++static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr0_clk, "pll-ddr0",
+ "osc24M", 0x020,
+ 8, 5, /* N */
+ 4, 2, /* K */
+@@ -123,6 +123,14 @@ static SUNXI_CCU_NK_WITH_GATE_LOCK_POSTDIV(pll_periph1_clk, "pll-periph1",
+ 2, /* post-div */
+ 0);
+
++static SUNXI_CCU_NM_WITH_GATE_LOCK(pll_ddr1_clk, "pll-ddr1",
++ "osc24M", 0x04c,
++ 8, 7, /* N */
++ 0, 2, /* M */
++ BIT(31), /* gate */
++ BIT(28), /* lock */
++ 0);
++
+ static const char * const cpu_parents[] = { "osc32k", "osc24M",
+ "pll-cpu", "pll-cpu" };
+ static SUNXI_CCU_MUX(cpu_clk, "cpu", cpu_parents,
+@@ -310,7 +318,8 @@ static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M",
+ static SUNXI_CCU_GATE(usb_ohci0_clk, "usb-ohci0", "osc24M",
+ 0x0cc, BIT(16), 0);
+
+-static const char * const dram_parents[] = { "pll-ddr", "pll-periph0-2x" };
++static const char * const dram_parents[] = { "pll-ddr0", "pll-ddr1",
++ "pll-periph0-2x" };
+ static SUNXI_CCU_M_WITH_MUX(dram_clk, "dram", dram_parents,
+ 0x0f4, 0, 4, 20, 2, CLK_IS_CRITICAL);
+
+@@ -369,10 +378,11 @@ static struct ccu_common *sun8i_v3s_ccu_clks[] = {
+ &pll_audio_base_clk.common,
+ &pll_video_clk.common,
+ &pll_ve_clk.common,
+- &pll_ddr_clk.common,
++ &pll_ddr0_clk.common,
+ &pll_periph0_clk.common,
+ &pll_isp_clk.common,
+ &pll_periph1_clk.common,
++ &pll_ddr1_clk.common,
+ &cpu_clk.common,
+ &axi_clk.common,
+ &ahb1_clk.common,
+@@ -457,11 +467,12 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = {
+ [CLK_PLL_AUDIO_8X] = &pll_audio_8x_clk.hw,
+ [CLK_PLL_VIDEO] = &pll_video_clk.common.hw,
+ [CLK_PLL_VE] = &pll_ve_clk.common.hw,
+- [CLK_PLL_DDR] = &pll_ddr_clk.common.hw,
++ [CLK_PLL_DDR0] = &pll_ddr0_clk.common.hw,
+ [CLK_PLL_PERIPH0] = &pll_periph0_clk.common.hw,
+ [CLK_PLL_PERIPH0_2X] = &pll_periph0_2x_clk.hw,
+ [CLK_PLL_ISP] = &pll_isp_clk.common.hw,
+ [CLK_PLL_PERIPH1] = &pll_periph1_clk.common.hw,
++ [CLK_PLL_DDR1] = &pll_ddr1_clk.common.hw,
+ [CLK_CPU] = &cpu_clk.common.hw,
+ [CLK_AXI] = &axi_clk.common.hw,
+ [CLK_AHB1] = &ahb1_clk.common.hw,
+diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+index 4a4d36fdad960..a091b7217dfd5 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h
+@@ -29,7 +29,7 @@
+ #define CLK_PLL_AUDIO_8X 5
+ #define CLK_PLL_VIDEO 6
+ #define CLK_PLL_VE 7
+-#define CLK_PLL_DDR 8
++#define CLK_PLL_DDR0 8
+ #define CLK_PLL_PERIPH0 9
+ #define CLK_PLL_PERIPH0_2X 10
+ #define CLK_PLL_ISP 11
+@@ -58,6 +58,8 @@
+
+ /* And the GPU module clock is exported */
+
+-#define CLK_NUMBER (CLK_MIPI_CSI + 1)
++#define CLK_PLL_DDR1 74
++
++#define CLK_NUMBER (CLK_PLL_DDR1 + 1)
+
+ #endif /* _CCU_SUN8I_H3_H_ */
+--
+2.20.1
+
--- /dev/null
+From a5a326747f2d449294341c6cec9d79e18d69b9e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:59:36 -0500
+Subject: clk: vf610: fix refcount leak in vf610_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-vf610.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
+index 6dae54325a91d..a334667c450a1 100644
+--- a/drivers/clk/imx/clk-vf610.c
++++ b/drivers/clk/imx/clk-vf610.c
+@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
+ anatop_base = of_iomap(np, 0);
+ BUG_ON(!anatop_base);
++ of_node_put(np);
+
+ np = ccm_node;
+ ccm_base = of_iomap(np, 0);
+--
+2.20.1
+
--- /dev/null
+From 410ae284ded75d36c33e44d530c6bb70ef5229ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Oct 2018 11:57:04 +0200
+Subject: clocksource/drivers/exynos_mct: Fix error path in timer resources
+ initialization
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit b9307420196009cdf18bad55e762ac49fb9a80f4 ]
+
+While freeing interrupt handlers in error path, don't assume that all
+requested interrupts are per-processor interrupts and properly release
+standard interrupts too.
+
+Reported-by: Krzysztof Kozlowski <krzk@kernel.org>
+Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/exynos_mct.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
+index aaf5bfa9bd9c9..e3ae041ac30e1 100644
+--- a/drivers/clocksource/exynos_mct.c
++++ b/drivers/clocksource/exynos_mct.c
+@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem *
+ return 0;
+
+ out_irq:
+- free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++ if (mct_int_type == MCT_INT_PPI) {
++ free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick);
++ } else {
++ for_each_possible_cpu(cpu) {
++ struct mct_clock_event_device *pcpu_mevt =
++ per_cpu_ptr(&percpu_mct_tick, cpu);
++
++ if (pcpu_mevt->evt.irq != -1) {
++ free_irq(pcpu_mevt->evt.irq, pcpu_mevt);
++ pcpu_mevt->evt.irq = -1;
++ }
++ }
++ }
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 780592d66cbebb52e4199897bbc92be1329a3ccd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 14:22:07 +0800
+Subject: clocksource/drivers/sun5i: Fail gracefully when clock rate is
+ unavailable
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ]
+
+If the clock tree is not fully populated when the timer-sun5i init code
+is called, attempts to get the clock rate for the timer would fail and
+return 0.
+
+Make the init code for both clock events and clocksource check the
+returned clock rate and fail gracefully if the result is 0, instead of
+causing a divide by 0 exception later on.
+
+Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-sun5i.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index 2a3fe83ec3377..6f4a9a8faccc2 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -202,6 +202,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
+ }
+
+ rate = clk_get_rate(clk);
++ if (!rate) {
++ pr_err("Couldn't get parent clock rate\n");
++ ret = -EINVAL;
++ goto err_disable_clk;
++ }
+
+ cs->timer.base = base;
+ cs->timer.clk = clk;
+@@ -275,6 +280,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
+ }
+
+ rate = clk_get_rate(clk);
++ if (!rate) {
++ pr_err("Couldn't get parent clock rate\n");
++ ret = -EINVAL;
++ goto err_disable_clk;
++ }
+
+ ce->timer.base = base;
+ ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+--
+2.20.1
+
--- /dev/null
+From a9b0d53c869059d13c0252f3ffe029952855d3de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:45:46 -0700
+Subject: cpufreq: brcmstb-avs-cpufreq: Fix initial command check
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 22a26cc6a51ef73dcfeb64c50513903f6b2d53d8 ]
+
+There is a logical error in brcm_avs_is_firmware_loaded() whereby if the
+firmware returns -EINVAL, we will be reporting this as an error. The
+comment is correct, the code was not.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Markus Mayer <mmayer@broadcom.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 7281a2c19c362..bae3190376582 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -762,8 +762,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv)
+ rc = brcm_avs_get_pmap(priv, NULL);
+ magic = readl(priv->base + AVS_MBOX_MAGIC);
+
+- return (magic == AVS_FIRMWARE_MAGIC) && (rc != -ENOTSUPP) &&
+- (rc != -EINVAL);
++ return (magic == AVS_FIRMWARE_MAGIC) && ((rc != -ENOTSUPP) ||
++ (rc != -EINVAL));
+ }
+
+ static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
+--
+2.20.1
+
--- /dev/null
+From 2ff71ef24470847ed86c589790b577e9b8624332 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:45:47 -0700
+Subject: cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 4c5681fcc684c762b09435de3e82ffeee7769d21 ]
+
+What we read back from the register is going to be capped at 32-bits,
+and cpufreq_freq_table.frequency is an unsigned int. Avoid any possible
+value truncation by using the appropriate return value.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Markus Mayer <mmayer@broadcom.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index bae3190376582..39c462711eae0 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -468,12 +468,12 @@ static int brcm_avs_set_pstate(struct private_data *priv, unsigned int pstate)
+ return __issue_avs_command(priv, AVS_CMD_SET_PSTATE, true, args);
+ }
+
+-static unsigned long brcm_avs_get_voltage(void __iomem *base)
++static u32 brcm_avs_get_voltage(void __iomem *base)
+ {
+ return readl(base + AVS_MBOX_VOLTAGE1);
+ }
+
+-static unsigned long brcm_avs_get_frequency(void __iomem *base)
++static u32 brcm_avs_get_frequency(void __iomem *base)
+ {
+ return readl(base + AVS_MBOX_FREQUENCY) * 1000; /* in kHz */
+ }
+@@ -973,14 +973,14 @@ static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf)
+ {
+ struct private_data *priv = policy->driver_data;
+
+- return sprintf(buf, "0x%08lx\n", brcm_avs_get_voltage(priv->base));
++ return sprintf(buf, "0x%08x\n", brcm_avs_get_voltage(priv->base));
+ }
+
+ static ssize_t show_brcm_avs_frequency(struct cpufreq_policy *policy, char *buf)
+ {
+ struct private_data *priv = policy->driver_data;
+
+- return sprintf(buf, "0x%08lx\n", brcm_avs_get_frequency(priv->base));
++ return sprintf(buf, "0x%08x\n", brcm_avs_get_frequency(priv->base));
+ }
+
+ cpufreq_freq_attr_ro(brcm_avs_pstate);
+--
+2.20.1
+
--- /dev/null
+From 732375593ae7e8c2ad02a432a6507ae9a8166586 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jan 2019 06:11:18 +0000
+Subject: crypto: brcm - Fix some set-but-not-used warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 707d0cf8f7cff6dfee9197002859912310532c4f ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req':
+drivers/crypto/bcm/cipher.c:720:15: warning:
+ variable 'chunk_start' set but not used [-Wunused-but-set-variable]
+
+drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback':
+drivers/crypto/bcm/cipher.c:1679:31: warning:
+ variable 'areq' set but not used [-Wunused-but-set-variable]
+
+drivers/crypto/bcm/cipher.c:1678:22: warning:
+ variable 'ctx' set but not used [-Wunused-but-set-variable]
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/bcm/cipher.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 84422435f39b4..279e907590e98 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -718,7 +718,7 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx)
+ */
+ unsigned int new_data_len;
+
+- unsigned int chunk_start = 0;
++ unsigned int __maybe_unused chunk_start = 0;
+ u32 db_size; /* Length of data field, incl gcm and hash padding */
+ int pad_len = 0; /* total pad len, including gcm, hash, stat padding */
+ u32 data_pad_len = 0; /* length of GCM/CCM padding */
+@@ -1676,8 +1676,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
+ struct spu_hw *spu = &iproc_priv.spu;
+ struct brcm_message *mssg = msg;
+ struct iproc_reqctx_s *rctx;
+- struct iproc_ctx_s *ctx;
+- struct crypto_async_request *areq;
+ int err = 0;
+
+ rctx = mssg->ctx;
+@@ -1687,8 +1685,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg)
+ err = -EFAULT;
+ goto cb_finish;
+ }
+- areq = rctx->parent;
+- ctx = rctx->ctx;
+
+ /* process the SPU status */
+ err = spu->spu_status_process(rctx->msg_buf.rx_stat);
+--
+2.20.1
+
--- /dev/null
+From 101f60a2e88506f6179ee8b7f27310a7545ab168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 May 2019 16:37:03 +0300
+Subject: crypto: caam - fix caam_dump_sg that iterates through scatterlist
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit 8c65d35435e8cbfdf953cafe5ebe3648ee9276a2 ]
+
+Fix caam_dump_sg by correctly determining the next scatterlist
+entry in the list.
+
+Fixes: 5ecf8ef9103c ("crypto: caam - fix sg dump")
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/error.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
+index 8da88beb1abbe..832ba2afdcd57 100644
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -22,7 +22,7 @@ void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type,
+ size_t len;
+ void *buf;
+
+- for (it = sg; it && tlen > 0 ; it = sg_next(sg)) {
++ for (it = sg; it && tlen > 0 ; it = sg_next(it)) {
+ /*
+ * make sure the scatterlist's page
+ * has a valid virtual memory mapping
+--
+2.20.1
+
--- /dev/null
+From 833461554fea4610558936ce52401cd2e147c590 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 16:08:12 +0300
+Subject: crypto: caam - free resources in case caam_rng registration failed
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit c59a1d41672a89b5cac49db1a472ff889e35a2d2 ]
+
+Check the return value of the hardware registration for caam_rng and free
+resources in case of failure.
+
+Fixes: e24f7c9e87d4 ("crypto: caam - hwrng support")
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Horia Geanta <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamrng.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index fde07d4ff0190..ff6718a11e9ec 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -353,7 +353,10 @@ static int __init caam_rng_init(void)
+ goto free_rng_ctx;
+
+ dev_info(dev, "registering rng-caam\n");
+- return hwrng_register(&caam_rng);
++
++ err = hwrng_register(&caam_rng);
++ if (!err)
++ return err;
+
+ free_rng_ctx:
+ kfree(rng_ctx);
+--
+2.20.1
+
--- /dev/null
+From badafd662191d6377aca49664c678805f52f85d1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 21:53:30 +0000
+Subject: crypto: ccp - Fix 3DES complaint from ccp-crypto module
+
+From: Hook, Gary <Gary.Hook@amd.com>
+
+[ Upstream commit 89646fdda4cae203185444ac7988835f36a21ee1 ]
+
+Crypto self-tests reveal an error:
+
+alg: skcipher: cbc-des3-ccp encryption test failed (wrong output IV) on test vector 0, cfg="in-place"
+
+The offset value should not be recomputed when retrieving the context.
+Also, a code path exists which makes decisions based on older (version 3)
+hardware; a v3 device deosn't support 3DES so remove this check.
+
+Fixes: 990672d48515 ('crypto: ccp - Enable 3DES function on v5 CCPs')
+
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-ops.c | 15 ++++-----------
+ 1 file changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 1e2e42106dee0..4b48b8523a40c 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -1293,6 +1293,9 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ int ret;
+
+ /* Error checks */
++ if (cmd_q->ccp->vdata->version < CCP_VERSION(5, 0))
++ return -EINVAL;
++
+ if (!cmd_q->ccp->vdata->perform->des3)
+ return -EINVAL;
+
+@@ -1375,8 +1378,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ * passthru option to convert from big endian to little endian.
+ */
+ if (des3->mode != CCP_DES3_MODE_ECB) {
+- u32 load_mode;
+-
+ op.sb_ctx = cmd_q->sb_ctx;
+
+ ret = ccp_init_dm_workarea(&ctx, cmd_q,
+@@ -1392,12 +1393,8 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ if (ret)
+ goto e_ctx;
+
+- if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+- load_mode = CCP_PASSTHRU_BYTESWAP_NOOP;
+- else
+- load_mode = CCP_PASSTHRU_BYTESWAP_256BIT;
+ ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx,
+- load_mode);
++ CCP_PASSTHRU_BYTESWAP_256BIT);
+ if (ret) {
+ cmd->engine_error = cmd_q->cmd_error;
+ goto e_ctx;
+@@ -1459,10 +1456,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ }
+
+ /* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */
+- if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0))
+- dm_offset = CCP_SB_BYTES - des3->iv_len;
+- else
+- dm_offset = 0;
+ ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0,
+ DES3_EDE_BLOCK_SIZE);
+ }
+--
+2.20.1
+
--- /dev/null
+From ded9202bd06fd198484e8ef58c375ed17209d7cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 21:53:23 +0000
+Subject: crypto: ccp - fix AES CFB error exposed by new test vectors
+
+From: Hook, Gary <Gary.Hook@amd.com>
+
+[ Upstream commit c3b359d6567c0b8f413e924feb37cf025067d55a ]
+
+Updated testmgr will exhibit this error message when loading the
+ccp-crypto module:
+
+alg: skcipher: cfb-aes-ccp encryption failed with err -22 on test vector 3, cfg="in-place"
+
+Update the CCP crypto driver to correctly treat CFB as a streaming mode
+cipher (instead of block mode). Update the configuration for CFB to
+specify the block size as a single byte;
+
+Fixes: 2b789435d7f3 ('crypto: ccp - CCP AES crypto API support')
+
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-crypto-aes.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
+index 89291c15015cd..3f768699332ba 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes.c
+@@ -1,7 +1,8 @@
++// SPDX-License-Identifier: GPL-2.0
+ /*
+ * AMD Cryptographic Coprocessor (CCP) AES crypto API support
+ *
+- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc.
++ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc.
+ *
+ * Author: Tom Lendacky <thomas.lendacky@amd.com>
+ *
+@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt)
+ return -EINVAL;
+
+ if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) ||
+- (ctx->u.aes.mode == CCP_AES_MODE_CBC) ||
+- (ctx->u.aes.mode == CCP_AES_MODE_CFB)) &&
++ (ctx->u.aes.mode == CCP_AES_MODE_CBC)) &&
+ (req->nbytes & (AES_BLOCK_SIZE - 1)))
+ return -EINVAL;
+
+@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = {
+ .version = CCP_VERSION(3, 0),
+ .name = "cfb(aes)",
+ .driver_name = "cfb-aes-ccp",
+- .blocksize = AES_BLOCK_SIZE,
++ .blocksize = 1,
+ .ivsize = AES_BLOCK_SIZE,
+ .alg_defaults = &ccp_aes_defaults,
+ },
+--
+2.20.1
+
--- /dev/null
+From 6a928cf40af816420f49d44f6e00b10bfe934adc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 10:59:24 +0200
+Subject: crypto: ccp - Reduce maximum stack usage
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 72c8117adfced37df101c8c0b3f363e0906f83f0 ]
+
+Each of the operations in ccp_run_cmd() needs several hundred
+bytes of kernel stack. Depending on the inlining, these may
+need separate stack slots that add up to more than the warning
+limit, as shown in this clang based build:
+
+drivers/crypto/ccp/ccp-ops.c:871:12: error: stack frame size of 1164 bytes in function 'ccp_run_aes_cmd' [-Werror,-Wframe-larger-than=]
+static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+
+The problem may also happen when there is no warning, e.g. in the
+ccp_run_cmd()->ccp_run_aes_cmd()->ccp_run_aes_gcm_cmd() call chain with
+over 2000 bytes.
+
+Mark each individual function as 'noinline_for_stack' to prevent
+this from happening, and move the calls to the two special cases for aes
+into the top-level function. This will keep the actual combined stack
+usage to the mimimum: 828 bytes for ccp_run_aes_gcm_cmd() and
+at most 524 bytes for each of the other cases.
+
+Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/ccp/ccp-ops.c | 52 +++++++++++++++++++++---------------
+ 1 file changed, 31 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 4b48b8523a40c..330853a2702f0 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -458,8 +458,8 @@ static int ccp_copy_from_sb(struct ccp_cmd_queue *cmd_q,
+ return ccp_copy_to_from_sb(cmd_q, wa, jobid, sb, byte_swap, true);
+ }
+
+-static int ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_aes_engine *aes = &cmd->u.aes;
+ struct ccp_dm_workarea key, ctx;
+@@ -614,8 +614,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_aes_engine *aes = &cmd->u.aes;
+ struct ccp_dm_workarea key, ctx, final_wa, tag;
+@@ -897,7 +897,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_aes_engine *aes = &cmd->u.aes;
+ struct ccp_dm_workarea key, ctx;
+@@ -907,12 +908,6 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ bool in_place = false;
+ int ret;
+
+- if (aes->mode == CCP_AES_MODE_CMAC)
+- return ccp_run_aes_cmac_cmd(cmd_q, cmd);
+-
+- if (aes->mode == CCP_AES_MODE_GCM)
+- return ccp_run_aes_gcm_cmd(cmd_q, cmd);
+-
+ if (!((aes->key_len == AES_KEYSIZE_128) ||
+ (aes->key_len == AES_KEYSIZE_192) ||
+ (aes->key_len == AES_KEYSIZE_256)))
+@@ -1080,8 +1075,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_xts_aes_engine *xts = &cmd->u.xts;
+ struct ccp_dm_workarea key, ctx;
+@@ -1280,7 +1275,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_des3_engine *des3 = &cmd->u.des3;
+
+@@ -1476,7 +1472,8 @@ e_key:
+ return ret;
+ }
+
+-static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_sha_engine *sha = &cmd->u.sha;
+ struct ccp_dm_workarea ctx;
+@@ -1820,7 +1817,8 @@ e_ctx:
+ return ret;
+ }
+
+-static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_rsa_engine *rsa = &cmd->u.rsa;
+ struct ccp_dm_workarea exp, src, dst;
+@@ -1951,8 +1949,8 @@ e_sb:
+ return ret;
+ }
+
+-static int ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q,
+- struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_passthru_engine *pt = &cmd->u.passthru;
+ struct ccp_dm_workarea mask;
+@@ -2083,7 +2081,8 @@ e_mask:
+ return ret;
+ }
+
+-static int ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
++static noinline_for_stack int
++ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q,
+ struct ccp_cmd *cmd)
+ {
+ struct ccp_passthru_nomap_engine *pt = &cmd->u.passthru_nomap;
+@@ -2424,7 +2423,8 @@ e_src:
+ return ret;
+ }
+
+-static int ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
++static noinline_for_stack int
++ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+ {
+ struct ccp_ecc_engine *ecc = &cmd->u.ecc;
+
+@@ -2461,7 +2461,17 @@ int ccp_run_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
+
+ switch (cmd->engine) {
+ case CCP_ENGINE_AES:
+- ret = ccp_run_aes_cmd(cmd_q, cmd);
++ switch (cmd->u.aes.mode) {
++ case CCP_AES_MODE_CMAC:
++ ret = ccp_run_aes_cmac_cmd(cmd_q, cmd);
++ break;
++ case CCP_AES_MODE_GCM:
++ ret = ccp_run_aes_gcm_cmd(cmd_q, cmd);
++ break;
++ default:
++ ret = ccp_run_aes_cmd(cmd_q, cmd);
++ break;
++ }
+ break;
+ case CCP_ENGINE_XTS_AES_128:
+ ret = ccp_run_xts_aes_cmd(cmd_q, cmd);
+--
+2.20.1
+
--- /dev/null
+From a0b3d38d8d902e616fce85e25c4283c8d9c1fd28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 11:24:18 +0000
+Subject: crypto: crypto4xx - Fix wrong
+ ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
+
+From: Corentin Labbe <clabbe@baylibre.com>
+
+[ Upstream commit 6e88098ca43a3d80ae86908f7badba683c8a0d84 ]
+
+When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
+drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
+drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
+In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
+drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
+drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
+drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
+In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
+drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
+
+This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.
+
+Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
+Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h
+index 931d22531f515..7bbda51b7337c 100644
+--- a/drivers/crypto/amcc/crypto4xx_trng.h
++++ b/drivers/crypto/amcc/crypto4xx_trng.h
+@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev);
+ void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
+ #else
+ static inline void ppc4xx_trng_probe(
+- struct crypto4xx_device *dev __maybe_unused) { }
++ struct crypto4xx_core_device *dev __maybe_unused) { }
+ static inline void ppc4xx_trng_remove(
+- struct crypto4xx_device *dev __maybe_unused) { }
++ struct crypto4xx_core_device *dev __maybe_unused) { }
+ #endif
+
+ #endif
+--
+2.20.1
+
--- /dev/null
+From befa103f26c77ac41ec1b1641ad20c08dd9d773b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 12:17:58 -0800
+Subject: crypto: tgr192 - fix unaligned memory access
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ]
+
+Fix an unaligned memory access in tgr192_transform() by using the
+unaligned access helpers.
+
+Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/tgr192.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/crypto/tgr192.c b/crypto/tgr192.c
+index 321bc6ff2a9d1..904c8444aa0a2 100644
+--- a/crypto/tgr192.c
++++ b/crypto/tgr192.c
+@@ -25,8 +25,9 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/mm.h>
+-#include <asm/byteorder.h>
+ #include <linux/types.h>
++#include <asm/byteorder.h>
++#include <asm/unaligned.h>
+
+ #define TGR192_DIGEST_SIZE 24
+ #define TGR160_DIGEST_SIZE 20
+@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
+ u64 a, b, c, aa, bb, cc;
+ u64 x[8];
+ int i;
+- const __le64 *ptr = (const __le64 *)data;
+
+ for (i = 0; i < 8; i++)
+- x[i] = le64_to_cpu(ptr[i]);
++ x[i] = get_unaligned_le64(data + i * sizeof(__le64));
+
+ /* save */
+ a = aa = tctx->a;
+--
+2.20.1
+
--- /dev/null
+From 8f8af7fd491365b48c6730277e0f6595c838534e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 16:59:45 +0200
+Subject: devres: allow const resource arguments
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9dea44c91469512d346e638694c22c30a5273992 ]
+
+devm_ioremap_resource() does not currently take 'const' arguments,
+which results in a warning from the first driver trying to do it
+anyway:
+
+drivers/gpio/gpio-amd-fch.c: In function 'amd_fch_gpio_probe':
+drivers/gpio/gpio-amd-fch.c:171:49: error: passing argument 2 of 'devm_ioremap_resource' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
+ priv->base = devm_ioremap_resource(&pdev->dev, &amd_fch_gpio_iores);
+ ^~~~~~~~~~~~~~~~~~~
+
+Change the prototype to allow it, as there is no real reason not to.
+
+Fixes: 9bb2e0452508 ("gpio: amd: Make resource struct const")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190628150049.1108048-1-arnd@arndb.de
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviwed-By: Enrico Weigelt <info@metux.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/device.h | 3 ++-
+ lib/devres.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 66fe271c2544d..0b2e67014a833 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -682,7 +682,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
+ gfp_t gfp_mask, unsigned int order);
+ extern void devm_free_pages(struct device *dev, unsigned long addr);
+
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
++void __iomem *devm_ioremap_resource(struct device *dev,
++ const struct resource *res);
+
+ /* allows to add/remove a custom action to devres stack */
+ int devm_add_action(struct device *dev, void (*action)(void *), void *data);
+diff --git a/lib/devres.c b/lib/devres.c
+index 5f2aedd58bc50..40a8b12a8b6b9 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -132,7 +132,8 @@ EXPORT_SYMBOL(devm_iounmap);
+ * if (IS_ERR(base))
+ * return PTR_ERR(base);
+ */
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
++void __iomem *devm_ioremap_resource(struct device *dev,
++ const struct resource *res)
+ {
+ resource_size_t size;
+ const char *name;
+--
+2.20.1
+
--- /dev/null
+From 1add46b76166dcd99d3d2492f14c0cad360fd568 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 16:05:20 +0200
+Subject: dmaengine: axi-dmac: Don't check the number of frames for alignment
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ]
+
+In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
+Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
+for video transfers where screen resolutions ( X * Y ) are typically
+aligned for X, but not for Y.
+
+There is no requirement for Y_LENGTH to be aligned to the bus-width (or
+anything), and this is also true for AXI DMAC.
+
+Checking the Y_LENGTH for alignment causes false errors when initiating DMA
+transfers. This change fixes this by checking only that the Y_LENGTH is
+non-zero.
+
+Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-axi-dmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index 7f0b9aa158679..9887f2a14aa98 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -451,7 +451,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+
+ if (chan->hw_2d) {
+ if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+- !axi_dmac_check_len(chan, xt->numf))
++ xt->numf == 0)
+ return NULL;
+ if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ xt->sgl[0].size + src_icg > chan->max_length)
+--
+2.20.1
+
--- /dev/null
+From c531b4f28fe48120ade236353128ffa79b24c6c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 16:15:43 +0300
+Subject: dmaengine: dw: platform: Switch to acpi_dma_controller_register()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit e7b8514e4d68bec21fc6385fa0a66797ddc34ac9 ]
+
+There is a possibility to have registered ACPI DMA controller
+while it has been gone already.
+
+To avoid the potential crash, move to non-managed
+acpi_dma_controller_register().
+
+Fixes: 42c91ee71d6d ("dw_dmac: add ACPI support")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20190820131546.75744-8-andriy.shevchenko@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw/platform.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index 46a519e07195c..b408c07662f59 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
+ dma_cap_set(DMA_SLAVE, info->dma_cap);
+ info->filter_fn = dw_dma_acpi_filter;
+
+- ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
+- info);
++ ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
+ if (ret)
+ dev_err(dev, "could not register acpi_dma_controller\n");
+ }
++
++static void dw_dma_acpi_controller_free(struct dw_dma *dw)
++{
++ struct device *dev = dw->dma.dev;
++
++ acpi_dma_controller_free(dev);
++}
+ #else /* !CONFIG_ACPI */
+ static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
++static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
+ #endif /* !CONFIG_ACPI */
+
+ #ifdef CONFIG_OF
+@@ -249,6 +256,9 @@ static int dw_remove(struct platform_device *pdev)
+ {
+ struct dw_dma_chip *chip = platform_get_drvdata(pdev);
+
++ if (ACPI_HANDLE(&pdev->dev))
++ dw_dma_acpi_controller_free(chip->dw);
++
+ if (pdev->dev.of_node)
+ of_dma_controller_free(pdev->dev.of_node);
+
+--
+2.20.1
+
--- /dev/null
+From 65afdf3355484f5f9f7d71a779d14c96b87489c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 16:32:32 +0300
+Subject: dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width"
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit c24a5c735f87d0549060de31367c095e8810b895 ]
+
+The commit
+
+ 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
+
+has been mistakenly submitted. The further investigations show that
+the original code does better job since the memory side transfer size
+has never been configured by DMA users.
+
+As per latest revision of documentation: "Channel minimum transfer size
+(CHnMTSR)... For IOSF UART, maximum value that can be programmed is 64 and
+minimum value that can be programmed is 1."
+
+This reverts commit 080edf75d337d35faa6fc3df99342b10d2848d16.
+
+Fixes: 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/hsu/hsu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c
+index 29d04ca71d52e..15525a2b8ebd7 100644
+--- a/drivers/dma/hsu/hsu.c
++++ b/drivers/dma/hsu/hsu.c
+@@ -64,10 +64,10 @@ static void hsu_dma_chan_start(struct hsu_dma_chan *hsuc)
+
+ if (hsuc->direction == DMA_MEM_TO_DEV) {
+ bsr = config->dst_maxburst;
+- mtsr = config->src_addr_width;
++ mtsr = config->dst_addr_width;
+ } else if (hsuc->direction == DMA_DEV_TO_MEM) {
+ bsr = config->src_maxburst;
+- mtsr = config->dst_addr_width;
++ mtsr = config->src_addr_width;
+ }
+
+ hsu_chan_disable(hsuc);
+--
+2.20.1
+
--- /dev/null
+From c2bd2d49ea6e0d601b8727895ca36481a9e42a24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 09:49:18 +0000
+Subject: dmaengine: imx-sdma: fix size check for sdma script_number
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ]
+
+Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(41) exceed the size of structure sdma_script_start_addrs(40),
+thus cause memory corrupt such as slob block header so that kernel
+trap into while() loop forever in slob_free(). Please refer to below
+code piece in imx-sdma.c:
+for (i = 0; i < sdma->script_number; i++)
+ if (addr_arr[i] > 0)
+ saddr_arr[i] = addr_arr[i]; /* memory corrupt here */
+That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add
+support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(38->41 3 scripts added) not align with script number added in
+sdma_script_start_addrs(2 scripts).
+
+Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware")
+Cc: stable@vger.kernel
+Link: https://www.spinics.net/lists/arm-kernel/msg754895.html
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com>
+Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com
+[vkoul: update the patch title]
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-sdma.c | 8 ++++++++
+ include/linux/platform_data/dma-imx-sdma.h | 3 +++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 0fc12a8783e39..99f3f22ed6476 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1441,6 +1441,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
+ if (!sdma->script_number)
+ sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
+
++ if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
++ / sizeof(s32)) {
++ dev_err(sdma->dev,
++ "SDMA script number %d not match with firmware.\n",
++ sdma->script_number);
++ return;
++ }
++
+ for (i = 0; i < sdma->script_number; i++)
+ if (addr_arr[i] > 0)
+ saddr_arr[i] = addr_arr[i];
+diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
+index 6eaa53cef0bd2..30e676b36b247 100644
+--- a/include/linux/platform_data/dma-imx-sdma.h
++++ b/include/linux/platform_data/dma-imx-sdma.h
+@@ -51,7 +51,10 @@ struct sdma_script_start_addrs {
+ /* End of v2 array */
+ s32 zcanfd_2_mcu_addr;
+ s32 zqspi_2_mcu_addr;
++ s32 mcu_2_ecspi_addr;
+ /* End of v3 array */
++ s32 mcu_2_zqspi_addr;
++ /* End of v4 array */
+ };
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 048bda76a6f02fedcffb98491486f46b72cfe04c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 18:27:06 +0000
+Subject: dmaengine: mv_xor: Use correct device for DMA API
+
+From: Robin Murphy <robin.murphy@arm.com>
+
+[ Upstream commit 3e5daee5ecf314da33a890fabaa2404244cd2a36 ]
+
+Using dma_dev->dev for mappings before it's assigned with the correct
+device is unlikely to work as expected, and with future dma-direct
+changes, passing a NULL device may end up crashing entirely. I don't
+know enough about this hardware or the mv_xor_prep_dma_interrupt()
+operation to implement the appropriate error-handling logic that would
+have revealed those dma_map_single() calls failing on arm64 for as long
+as the driver has been enabled there, but moving the assignment earlier
+will at least make the current code operate as intended.
+
+Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT")
+Reported-by: John David Anglin <dave.anglin@bell.net>
+Tested-by: John David Anglin <dave.anglin@bell.net>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Tested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/mv_xor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 1993889003fd1..1c57577f49fea 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -1059,6 +1059,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ mv_chan->op_in_desc = XOR_MODE_IN_DESC;
+
+ dma_dev = &mv_chan->dmadev;
++ dma_dev->dev = &pdev->dev;
+ mv_chan->xordev = xordev;
+
+ /*
+@@ -1091,7 +1092,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
+ dma_dev->device_free_chan_resources = mv_xor_free_chan_resources;
+ dma_dev->device_tx_status = mv_xor_status;
+ dma_dev->device_issue_pending = mv_xor_issue_pending;
+- dma_dev->dev = &pdev->dev;
+
+ /* set prep routines based on capability */
+ if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask))
+--
+2.20.1
+
--- /dev/null
+From 0e0eaa163b8438611c0b0c7ed8f205c072ae6abb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 May 2019 16:53:52 +0100
+Subject: dmaengine: tegra210-adma: Fix crash during probe
+
+From: Jon Hunter <jonathanh@nvidia.com>
+
+[ Upstream commit b53611fb1ce9b1786bd18205473e0c1d6bfa8934 ]
+
+Commit f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
+added support to save and restore the DMA channel registers when runtime
+suspending the ADMA. This change is causing the kernel to crash when
+probing the ADMA, if the device is probed deferred when looking up the
+channel interrupts. The crash occurs because not all of the channel base
+addresses have been setup at this point and in the clean-up path of the
+probe, pm_runtime_suspend() is called invoking its callback which
+expects all the channel base addresses to be initialised.
+
+Although this could be fixed by simply checking for a NULL address, on
+further review of the driver it seems more appropriate that we only call
+pm_runtime_get_sync() after all the channel interrupts and base
+addresses have been configured. Therefore, fix this crash by moving the
+calls to pm_runtime_enable(), pm_runtime_get_sync() and
+tegra_adma_init() after the DMA channels have been initialised.
+
+Fixes: f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status")
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index ac2a6b800db3e..4f4733d831a1a 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -744,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ return PTR_ERR(tdma->ahub_clk);
+ }
+
+- pm_runtime_enable(&pdev->dev);
+-
+- ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
+- goto rpm_disable;
+-
+- ret = tegra_adma_init(tdma);
+- if (ret)
+- goto rpm_put;
+-
+ INIT_LIST_HEAD(&tdma->dma_dev.channels);
+ for (i = 0; i < tdma->nr_channels; i++) {
+ struct tegra_adma_chan *tdc = &tdma->channels[i];
+@@ -771,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ tdc->tdma = tdma;
+ }
+
++ pm_runtime_enable(&pdev->dev);
++
++ ret = pm_runtime_get_sync(&pdev->dev);
++ if (ret < 0)
++ goto rpm_disable;
++
++ ret = tegra_adma_init(tdma);
++ if (ret)
++ goto rpm_put;
++
+ dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask);
+ dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask);
+ dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask);
+@@ -812,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev)
+
+ dma_remove:
+ dma_async_device_unregister(&tdma->dma_dev);
+-irq_dispose:
+- while (--i >= 0)
+- irq_dispose_mapping(tdma->channels[i].irq);
+ rpm_put:
+ pm_runtime_put_sync(&pdev->dev);
+ rpm_disable:
+ pm_runtime_disable(&pdev->dev);
++irq_dispose:
++ while (--i >= 0)
++ irq_dispose_mapping(tdma->channels[i].irq);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From c84f754f87875877140a2c3cc7d35d6f79845ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 18:25:17 +0530
+Subject: dmaengine: tegra210-adma: restore channel status
+
+From: Sameer Pujar <spujar@nvidia.com>
+
+[ Upstream commit f33e7bb3eb922618612a90f0a828c790e8880773 ]
+
+Status of ADMA channel registers is not saved and restored during system
+suspend. During active playback if system enters suspend, this results in
+wrong state of channel registers during system resume and playback fails
+to resume properly. Fix this by saving following channel registers in
+runtime suspend and restore during runtime resume.
+ * ADMA_CH_LOWER_SRC_ADDR
+ * ADMA_CH_LOWER_TRG_ADDR
+ * ADMA_CH_FIFO_CTRL
+ * ADMA_CH_CONFIG
+ * ADMA_CH_CTRL
+ * ADMA_CH_CMD
+ * ADMA_CH_TC
+Runtime PM calls will be inovked during system resume path if a playback
+or capture needs to be resumed. Hence above changes work fine for system
+suspend case.
+
+Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 46 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 45 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 09b6756366c30..ac2a6b800db3e 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs {
+ unsigned int src_addr;
+ unsigned int trg_addr;
+ unsigned int fifo_ctrl;
++ unsigned int cmd;
+ unsigned int tc;
+ };
+
+@@ -127,6 +128,7 @@ struct tegra_adma_chan {
+ enum dma_transfer_direction sreq_dir;
+ unsigned int sreq_index;
+ bool sreq_reserved;
++ struct tegra_adma_chan_regs ch_regs;
+
+ /* Transfer count and position info */
+ unsigned int tx_buf_count;
+@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec,
+ static int tegra_adma_runtime_suspend(struct device *dev)
+ {
+ struct tegra_adma *tdma = dev_get_drvdata(dev);
++ struct tegra_adma_chan_regs *ch_reg;
++ struct tegra_adma_chan *tdc;
++ int i;
+
+ tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD);
++ if (!tdma->global_cmd)
++ goto clk_disable;
++
++ for (i = 0; i < tdma->nr_channels; i++) {
++ tdc = &tdma->channels[i];
++ ch_reg = &tdc->ch_regs;
++ ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD);
++ /* skip if channel is not active */
++ if (!ch_reg->cmd)
++ continue;
++ ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC);
++ ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR);
++ ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR);
++ ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL);
++ ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL);
++ ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG);
++ }
++
++clk_disable:
+ clk_disable_unprepare(tdma->ahub_clk);
+
+ return 0;
+@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev)
+ static int tegra_adma_runtime_resume(struct device *dev)
+ {
+ struct tegra_adma *tdma = dev_get_drvdata(dev);
+- int ret;
++ struct tegra_adma_chan_regs *ch_reg;
++ struct tegra_adma_chan *tdc;
++ int ret, i;
+
+ ret = clk_prepare_enable(tdma->ahub_clk);
+ if (ret) {
+@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev)
+ }
+ tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd);
+
++ if (!tdma->global_cmd)
++ return 0;
++
++ for (i = 0; i < tdma->nr_channels; i++) {
++ tdc = &tdma->channels[i];
++ ch_reg = &tdc->ch_regs;
++ /* skip if channel was not active earlier */
++ if (!ch_reg->cmd)
++ continue;
++ tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc);
++ tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr);
++ tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr);
++ tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl);
++ tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl);
++ tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config);
++ tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd);
++ }
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c4276df8167301b7ade0b47c1b44c8f4ebc95f49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 15:38:02 +0800
+Subject: dmaengine: ti: edma: fix missed failure handling
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ]
+
+When devm_kcalloc fails, it forgets to call edma_free_slot.
+Replace direct return with failure handler to fix it.
+
+Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/edma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
+index 519c24465dea4..57a49fe713fdc 100644
+--- a/drivers/dma/edma.c
++++ b/drivers/dma/edma.c
+@@ -2340,8 +2340,10 @@ static int edma_probe(struct platform_device *pdev)
+
+ ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
+ sizeof(*ecc->tc_list), GFP_KERNEL);
+- if (!ecc->tc_list)
+- return -ENOMEM;
++ if (!ecc->tc_list) {
++ ret = -ENOMEM;
++ goto err_reg1;
++ }
+
+ for (i = 0;; i++) {
+ ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
+--
+2.20.1
+
--- /dev/null
+From 60cf8eab5241566e6bdb5919e39f8e2e2140b80e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 01:47:53 +0100
+Subject: driver core: Do not resume suppliers under device_links_write_lock()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 5db25c9eb893df8f6b93c1d97b8006d768e1b6f5 ]
+
+It is incorrect to call pm_runtime_get_sync() under
+device_links_write_lock(), because it may end up trying to take
+device_links_read_lock() while resuming the target device and that
+will deadlock in the non-SRCU case, so avoid that by resuming the
+supplier device in device_link_add() before calling
+device_links_write_lock().
+
+Fixes: 21d5c57b3726 ("PM / runtime: Use device links")
+Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/core.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 2b0a1054535ce..93c2fc58013ed 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -180,11 +180,20 @@ struct device_link *device_link_add(struct device *consumer,
+ struct device *supplier, u32 flags)
+ {
+ struct device_link *link;
++ bool rpm_put_supplier = false;
+
+ if (!consumer || !supplier ||
+ ((flags & DL_FLAG_STATELESS) && (flags & DL_FLAG_AUTOREMOVE)))
+ return NULL;
+
++ if (flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) {
++ if (pm_runtime_get_sync(supplier) < 0) {
++ pm_runtime_put_noidle(supplier);
++ return NULL;
++ }
++ rpm_put_supplier = true;
++ }
++
+ device_links_write_lock();
+ device_pm_lock();
+
+@@ -209,13 +218,8 @@ struct device_link *device_link_add(struct device *consumer,
+
+ if (flags & DL_FLAG_PM_RUNTIME) {
+ if (flags & DL_FLAG_RPM_ACTIVE) {
+- if (pm_runtime_get_sync(supplier) < 0) {
+- pm_runtime_put_noidle(supplier);
+- kfree(link);
+- link = NULL;
+- goto out;
+- }
+ link->rpm_active = true;
++ rpm_put_supplier = false;
+ }
+ pm_runtime_new_link(consumer);
+ /*
+@@ -286,6 +290,10 @@ struct device_link *device_link_add(struct device *consumer,
+ out:
+ device_pm_unlock();
+ device_links_write_unlock();
++
++ if (rpm_put_supplier)
++ pm_runtime_put(supplier);
++
+ return link;
+ }
+ EXPORT_SYMBOL_GPL(device_link_add);
+--
+2.20.1
+
--- /dev/null
+From 2b9d0c07d9c3a1c32e9af4688be70011afa4f5c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 06:45:37 +0800
+Subject: driver: uio: fix possible memory leak in __uio_register_device
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 1a392b3de7c5747506b38fc14b2e79977d3c7770 ]
+
+'idev' is malloced in __uio_register_device() and leak free it before
+leaving from the uio_get_minor() error handing case, it will cause
+memory leak.
+
+Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/uio/uio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index fb5c9701b1fbd..4e9b0ff79b131 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -939,8 +939,10 @@ int __uio_register_device(struct module *owner,
+ atomic_set(&idev->event, 0);
+
+ ret = uio_get_minor(idev);
+- if (ret)
++ if (ret) {
++ kfree(idev);
+ return ret;
++ }
+
+ idev->dev.devt = MKDEV(uio_major, idev->minor);
+ idev->dev.class = &uio_class;
+--
+2.20.1
+
--- /dev/null
+From bcd5a08c22efd307b112886068d7f7d6db75a7a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 06:45:38 +0800
+Subject: driver: uio: fix possible use-after-free in __uio_register_device
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ]
+
+In uio_dev_add_attributes() error handing case, idev is used after
+device_unregister(), in which 'idev' has been released, touch idev cause
+use-after-free.
+
+Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/uio/uio.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
+index 4e9b0ff79b131..7c18536a3742a 100644
+--- a/drivers/uio/uio.c
++++ b/drivers/uio/uio.c
+@@ -944,6 +944,7 @@ int __uio_register_device(struct module *owner,
+ return ret;
+ }
+
++ device_initialize(&idev->dev);
+ idev->dev.devt = MKDEV(uio_major, idev->minor);
+ idev->dev.class = &uio_class;
+ idev->dev.parent = parent;
+@@ -954,7 +955,7 @@ int __uio_register_device(struct module *owner,
+ if (ret)
+ goto err_device_create;
+
+- ret = device_register(&idev->dev);
++ ret = device_add(&idev->dev);
+ if (ret)
+ goto err_device_create;
+
+@@ -986,9 +987,10 @@ int __uio_register_device(struct module *owner,
+ err_request_irq:
+ uio_dev_del_attributes(idev);
+ err_uio_dev_add_attributes:
+- device_unregister(&idev->dev);
++ device_del(&idev->dev);
+ err_device_create:
+ uio_free_minor(idev);
++ put_device(&idev->dev);
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(__uio_register_device);
+--
+2.20.1
+
--- /dev/null
+From 3d2af266f25f6aaafb867da54593186a949585f7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 16:29:33 -0800
+Subject: drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5ac188b12e7cbdd92dee60877d1fac913fc1d074 ]
+
+If riocm_get_channel() fails, then we should just return -EINVAL.
+Calling riocm_put_channel() will trigger a NULL dereference and
+generally we should call put() if the get() didn't succeed.
+
+Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam
+Fixes: b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Matt Porter <mporter@kernel.crashing.org>
+Cc: Alexandre Bounine <alexandre.bounine@idt.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rapidio/rio_cm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c
+index ef989a15aefc4..b29fc258eeba4 100644
+--- a/drivers/rapidio/rio_cm.c
++++ b/drivers/rapidio/rio_cm.c
+@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id)
+ riocm_debug(CHOP, "(ch_%d)", ch_id);
+
+ ch = riocm_get_channel(ch_id);
+- if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
++ if (!ch)
++ return -EINVAL;
++ if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN))
+ ret = -EINVAL;
+ riocm_put_channel(ch);
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From c0140d2eb318a51d41cd75822a372fc6bc4f0470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 17:46:14 -0500
+Subject: drm/dp_mst: Skip validating ports during destruction, just ref
+
+From: Lyude Paul <lyude@redhat.com>
+
+[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ]
+
+Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
+accidentally introduced into DRM two years ago.
+
+Pretend we have a topology like this:
+
+|- DP-1: mst_primary
+ |- DP-4: active display
+ |- DP-5: disconnected
+ |- DP-6: active hub
+ |- DP-7: active display
+ |- DP-8: disconnected
+ |- DP-9: disconnected
+
+If we unplug DP-6, the topology starting at DP-7 will be destroyed but
+it's payloads will live on in DP-1's VCPI allocations and thus require
+removal. However, this removal currently fails because
+drm_dp_update_payload_part1() will (rightly so) try to validate the port
+before accessing it, fail then abort. If we keep going, eventually we
+run the MST hub out of bandwidth and all new allocations will start to
+fail (or in my case; all new displays just start flickering a ton).
+
+We could just teach drm_dp_update_payload_part1() not to drop the port
+ref in this case, but then we also need to teach
+drm_dp_destroy_payload_step1() to do the same thing, then hope no one
+ever adds anything to the that requires a validated port reference in
+drm_dp_destroy_connector_work(). Kind of sketchy.
+
+So let's go with a more clever solution: any port that
+drm_dp_destroy_connector_work() interacts with is guaranteed to still
+exist in memory until we say so. While said port might not be valid we
+don't really care: that's the whole reason we're destroying it in the
+first place! So, teach drm_dp_get_validated_port_ref() to use the all
+mighty current_work() function to avoid attempting to validate ports
+from the context of mgr->destroy_connector_work. I can't see any
+situation where this wouldn't be safe, and this avoids having to play
+whack-a-mole in the future of trying to work around port validation.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
+Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: <stable@vger.kernel.org> # v4.6+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index c8c83f84acedd..9d94c306c8ca1 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -982,9 +982,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
+ static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
+ {
+ struct drm_dp_mst_port *rport = NULL;
++
+ mutex_lock(&mgr->lock);
+- if (mgr->mst_primary)
+- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
++ /*
++ * Port may or may not be 'valid' but we don't care about that when
++ * destroying the port and we are guaranteed that the port pointer
++ * will be valid until we've finished
++ */
++ if (current_work() == &mgr->destroy_connector_work) {
++ kref_get(&port->kref);
++ rport = port;
++ } else if (mgr->mst_primary) {
++ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
++ port);
++ }
+ mutex_unlock(&mgr->lock);
+ return rport;
+ }
+--
+2.20.1
+
--- /dev/null
+From 43fc63afeccd4b8b35aca4ac829598db30d13ebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Jan 2019 13:49:46 +0300
+Subject: drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f8261c376e7f8cb9024af5a6c54be540c7f9108e ]
+
+The etnaviv_gem_get_pages() never returns NULL. It returns error
+pointers on error.
+
+Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+index 2d955d7d7b6d8..e154e6fb64dac 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+@@ -207,7 +207,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ mutex_lock(&obj->lock);
+ pages = etnaviv_gem_get_pages(obj);
+ mutex_unlock(&obj->lock);
+- if (pages) {
++ if (!IS_ERR(pages)) {
+ int j;
+
+ iter.hdr->data[0] = bomap - bomap_start;
+--
+2.20.1
+
--- /dev/null
+From 29061f400cf487a3a77a60c0b547dcacc1b6ce33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Feb 2019 12:08:19 +0300
+Subject: drm/etnaviv: potential NULL dereference
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 9e05352340d3a3e68c144136db9810b26ebb88c3 ]
+
+The etnaviv_gem_prime_get_sg_table() is supposed to return error
+pointers. Otherwise it can lead to a NULL dereference when it's called
+from drm_gem_map_dma_buf().
+
+Fixes: 5f4a4a73f437 ("drm/etnaviv: fix gem_prime_get_sg_table to return new SG table")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+index ae884723e9b1b..880b95511b987 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+@@ -26,7 +26,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
+ int npages = obj->size >> PAGE_SHIFT;
+
+ if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */
+- return NULL;
++ return ERR_PTR(-EINVAL);
+
+ return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
+ }
+--
+2.20.1
+
--- /dev/null
+From 622e607e5abc7d8b28031807a6c67d2d1191716b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 22 Sep 2018 01:25:26 +0800
+Subject: drm/hisilicon: hibmc: Don't overwrite fb helper surface depth
+
+From: John Garry <john.garry@huawei.com>
+
+[ Upstream commit 0ff9f49646353ce31312411e7e7bd2281492a40e ]
+
+Currently the driver overwrites the surface depth provided by the fb
+helper to give an invalid bpp/surface depth combination.
+
+This has been exposed by commit 70109354fed2 ("drm: Reject unknown legacy
+bpp and depth for drm_mode_addfb ioctl"), which now causes the driver to
+fail to probe.
+
+Fix by not overwriting the surface depth.
+
+Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index 8bd29075ae4eb..edcca17615001 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n",
+ sizes->surface_width, sizes->surface_height,
+ sizes->surface_bpp);
+- sizes->surface_depth = 32;
+
+ bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
+
+--
+2.20.1
+
--- /dev/null
+From e88421de676a119c65265e43fabbe6fa53c1fe6a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 09:09:47 -0700
+Subject: drm/msm/a3xx: remove TPL1 regs from snapshot
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit f47bee2ba447bebc304111c16ef1e1a73a9744dd ]
+
+These regs are write-only, and the hw throws a hissy-fit (ie. reboots)
+when we try to read them for GPU state snapshot, in response to a GPU
+hang. It is rather impolite when GPU recovery triggers an insta-
+reboot, so lets remove the TPL1 registers from the snapshot.
+
+Fixes: 7198e6b03155 drm/msm: add a3xx gpu support
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+index 7791313405b5f..c8671b1578c66 100644
+--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+@@ -394,19 +394,17 @@ static const unsigned int a3xx_registers[] = {
+ 0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
+ 0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
+ 0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
+- 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
+- 0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
+- 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
+- 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
+- 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
+- 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
+- 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
+- 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
+- 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
+- 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
+- 0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
+- 0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
+- 0x303c, 0x303c, 0x305e, 0x305f,
++ 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
++ 0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
++ 0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
++ 0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
++ 0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
++ 0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
++ 0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
++ 0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
++ 0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
++ 0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
++ 0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
+ ~0 /* sentinel */
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 80081b7014eac8c56d265811223e8409f6373736 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 06:39:39 -0700
+Subject: drm/msm/dsi: Implement reset correctly
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 78e31c42261779a01bc73472d0f65f15378e9de3 ]
+
+On msm8998, vblank timeouts are observed because the DSI controller is not
+reset properly, which ends up stalling the MDP. This is because the reset
+logic is not correct per the hardware documentation.
+
+The documentation states that after asserting reset, software should wait
+some time (no indication of how long), or poll the status register until it
+returns 0 before deasserting reset.
+
+wmb() is insufficient for this purpose since it just ensures ordering, not
+timing between writes. Since asserting and deasserting reset occurs on the
+same register, ordering is already guaranteed by the architecture, making
+the wmb extraneous.
+
+Since we would define a timeout for polling the status register to avoid a
+possible infinite loop, lets just use a static delay of 20 ms, since 16.666
+ms is the time available to process one frame at 60 fps.
+
+Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
+Cc: Hai Li <hali@codeaurora.org>
+Cc: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Sean Paul <sean@poorly.run>
+[seanpaul renamed RESET_DELAY to DSI_RESET_TOGGLE_DELAY_MS]
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191011133939.16551-1-jeffrey.l.hugo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index a9a0b56f1fbc5..b9cb7c09e05a6 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -34,6 +34,8 @@
+ #include "dsi_cfg.h"
+ #include "msm_kms.h"
+
++#define DSI_RESET_TOGGLE_DELAY_MS 20
++
+ static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
+ {
+ u32 ver;
+@@ -906,7 +908,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
+ wmb(); /* clocks need to be enabled before reset */
+
+ dsi_write(msm_host, REG_DSI_RESET, 1);
+- wmb(); /* make sure reset happen */
++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ dsi_write(msm_host, REG_DSI_RESET, 0);
+ }
+
+@@ -1288,7 +1290,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
+
+ /* dsi controller can only be reset while clocks are running */
+ dsi_write(msm_host, REG_DSI_RESET, 1);
+- wmb(); /* make sure reset happen */
++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ dsi_write(msm_host, REG_DSI_RESET, 0);
+ wmb(); /* controller out of reset */
+ dsi_write(msm_host, REG_DSI_CTRL, data0);
+--
+2.20.1
+
--- /dev/null
+From bb65c5b7b75930c1dd86363e0c409cefee5a93e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 08:00:30 -0700
+Subject: drm/msm/mdp5: Fix mdp5_cfg_init error return
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit fc19cbb785d7bbd1a1af26229b5240a3ab332744 ]
+
+If mdp5_cfg_init fails because of an unknown major version, a null pointer
+dereference occurs. This is because the caller of init expects error
+pointers, but init returns NULL on error. Fix this by returning the
+expected values on error.
+
+Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+index 824067d2d4277..42f0ecb0cf35f 100644
+--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+@@ -635,7 +635,7 @@ fail:
+ if (cfg_handler)
+ mdp5_cfg_destroy(cfg_handler);
+
+- return NULL;
++ return ERR_PTR(ret);
+ }
+
+ static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
+--
+2.20.1
+
--- /dev/null
+From 996aa04b87f2b40d8667d23f367d711c5703960d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Nov 2018 17:09:18 +0000
+Subject: drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ]
+
+Currently, the expression for calculating RON is always going to result
+in zero no matter the value of ram->mr[1] because the ! operator has
+higher precedence than the shift >> operator. I believe the missing
+parentheses around the expression before appying the ! operator will
+result in the desired result.
+
+[ Note, not tested ]
+
+Detected by CoveritScan, CID#1324005 ("Operands don't affect result")
+
+Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+index 60ece0a8a2e1b..1d2d6bae73cd1 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
+ WR = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
+ /* XXX: Get these values from the VBIOS instead */
+ DLL = !(ram->mr[1] & 0x1);
+- RON = !(ram->mr[1] & 0x300) >> 8;
++ RON = !((ram->mr[1] & 0x300) >> 8);
+ break;
+ default:
+ return -ENOSYS;
+--
+2.20.1
+
--- /dev/null
+From 59ab8f784d9585d7aa4efdc15160706c4c69fa42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:29:49 +0000
+Subject: drm/nouveau/pmu: don't print reply values if exec is false
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ]
+
+Currently the uninitialized values in the array reply are printed out
+when exec is false and nvkm_pmu_send has not updated the array. Avoid
+confusion by only dumping out these values if they have been actually
+updated.
+
+Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable")
+Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+index 11b28b086a062..7b052879af728 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+@@ -88,10 +88,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
+ if (exec) {
+ nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
+ memx->base, finish);
++ nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
++ reply[0], reply[1]);
+ }
+
+- nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+- reply[0], reply[1]);
+ kfree(memx);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3e0ea72a8669ee3005bb1389885363c6f8bd1f84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 10:53:53 +1100
+Subject: drm/radeon: fix bad DMA from INTERRUPT_CNTL2
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ]
+
+The INTERRUPT_CNTL2 register expects a valid DMA address, but is
+currently set with a GPU MC address. This can cause problems on
+systems that detect the resulting DMA read from an invalid address
+(found on a Power8 guest).
+
+Instead, use the DMA address of the dummy page because it will always
+be safe.
+
+Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)")
+Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI")
+Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)")
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c | 4 ++--
+ drivers/gpu/drm/radeon/r600.c | 4 ++--
+ drivers/gpu/drm/radeon/si.c | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index ce8b353b5753a..ba31c7674fcdd 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7012,8 +7012,8 @@ static int cik_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* XXX this should actually be a bus address, not an MC address. same on older asics */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index e06e2d8feab39..a724bb87cfad7 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3690,8 +3690,8 @@ int r600_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 1907c950d76f0..1144cafea9acd 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -5993,8 +5993,8 @@ static int si_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+--
+2.20.1
+
--- /dev/null
+From f3ddce731d0e5e3e0bfa77e3ceb16bcd24636105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Dec 2018 17:18:30 +0800
+Subject: drm/shmob: Fix return value check in shmob_drm_probe
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 06c3bbd3c12737a50c2e981821b5585e1786e73d ]
+
+In case of error, the function devm_ioremap_resource() returns ERR_PTR()
+and never returns NULL. The NULL test in the return value check should
+be replaced with IS_ERR().
+
+Fixes: 8f1597c8f1a5 ("drm: shmobile: Perform initialization/cleanup at probe/remove time")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/shmobile/shmob_drm_drv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+index 592572554eb0e..58d8a98c749b4 100644
+--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
++++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+@@ -233,8 +233,8 @@ static int shmob_drm_probe(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ sdev->mmio = devm_ioremap_resource(&pdev->dev, res);
+- if (sdev->mmio == NULL)
+- return -ENOMEM;
++ if (IS_ERR(sdev->mmio))
++ return PTR_ERR(sdev->mmio);
+
+ ret = shmob_drm_setup_clocks(sdev, pdata->clk_source);
+ if (ret < 0)
+--
+2.20.1
+
--- /dev/null
+From 272fdae3eff7372a1d926085eac90372579540f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Aug 2018 08:19:09 +0200
+Subject: drm/sti: do not remove the drm_bridge that was never added
+
+From: Peter Rosin <peda@axentia.se>
+
+[ Upstream commit 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd ]
+
+Removing the drm_bridge_remove call should avoid a NULL dereference
+during list processing in drm_bridge_remove if the error path is ever
+taken.
+
+The more natural approach would perhaps be to add a drm_bridge_add,
+but there are several other bridges that never call drm_bridge_add.
+Just removing the drm_bridge_remove is the easier fix.
+
+Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sti/sti_hda.c | 1 -
+ drivers/gpu/drm/sti/sti_hdmi.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
+index cf65e32b5090a..0399bb18d3872 100644
+--- a/drivers/gpu/drm/sti/sti_hda.c
++++ b/drivers/gpu/drm/sti/sti_hda.c
+@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
+index 30f02d2fdd034..bbb195a92e93f 100644
+--- a/drivers/gpu/drm/sti/sti_hdmi.c
++++ b/drivers/gpu/drm/sti/sti_hdmi.c
+@@ -1314,7 +1314,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ hdmi->drm_connector = NULL;
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From a47fc3e622e3f69e5a9d1b0af1548ea081cb2378 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Oct 2018 18:34:46 +0200
+Subject: drm/sun4i: hdmi: Fix double flag assignation
+
+From: Maxime Ripard <maxime.ripard@bootlin.com>
+
+[ Upstream commit 1e0ff648940e603cab6c52cf3723017d30d78f30 ]
+
+The is_double flag is a boolean currently assigned to the value of the d
+variable, that is either 1 or 2. It means that this is_double variable is
+always set to true, even though the initial intent was to have it set to
+true when d is 2.
+
+Fix this.
+
+Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Reviewed-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181021163446.29135-2-maxime.ripard@bootlin.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+index 5cf2527bffc86..d7a8fea945574 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c
+@@ -50,7 +50,7 @@ static unsigned long sun4i_tmds_calc_divider(unsigned long rate,
+ (rate - tmp_rate) < (rate - best_rate)) {
+ best_rate = tmp_rate;
+ best_m = m;
+- is_double = d;
++ is_double = (d == 2) ? true : false;
+ }
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From aa09b14aeaca15848dab17e2b0fb05870053c715 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 12:42:50 +0300
+Subject: drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ]
+
+This doesn't affect runtime because in the current code "idx" is always
+valid.
+
+First, we read from "vgdev->capsets[idx].max_size" before checking
+whether "idx" is within bounds. And secondly the bounds check is off by
+one so we could end up reading one element beyond the end of the
+vgdev->capsets[] array.
+
+Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 21c2de81f3e32..a3be65e689fd2 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -648,11 +648,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ {
+ struct virtio_gpu_get_capset *cmd_p;
+ struct virtio_gpu_vbuffer *vbuf;
+- int max_size = vgdev->capsets[idx].max_size;
++ int max_size;
+ struct virtio_gpu_drv_cap_cache *cache_ent;
+ void *resp_buf;
+
+- if (idx > vgdev->num_capsets)
++ if (idx >= vgdev->num_capsets)
+ return -EINVAL;
+
+ if (version > vgdev->capsets[idx].max_version)
+@@ -662,6 +662,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ if (!cache_ent)
+ return -ENOMEM;
+
++ max_size = vgdev->capsets[idx].max_size;
+ cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
+ if (!cache_ent->caps_cache) {
+ kfree(cache_ent);
+--
+2.20.1
+
--- /dev/null
+From 223fb18f5efa3293b697a1f41feb88fe73a0252c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 15:49:19 +0400
+Subject: dwc2: gadget: Fix completed transfer size calculation in DDMA
+
+From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
+
+[ Upstream commit 5acb4b970184d189d901192d075997c933b82260 ]
+
+Fix calculation of transfer size on completion in function
+dwc2_gadget_get_xfersize_ddma().
+
+Added increment of descriptor pointer to move to next descriptor in
+the loop.
+
+Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")
+
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc2/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index e164439b21542..4af9a1c652edb 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2276,6 +2276,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
+ if (status & DEV_DMA_STS_MASK)
+ dev_err(hsotg->dev, "descriptor %d closed with %x\n",
+ i, status & DEV_DMA_STS_MASK);
++ desc++;
+ }
+
+ return bytes_rem;
+--
+2.20.1
+
--- /dev/null
+From f6f54143c6e7a864631bb0b81c016197e4ee8fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 May 2019 10:49:09 +0000
+Subject: EDAC/mc: Fix edac_mc_find() in case no device is found
+
+From: Robert Richter <rrichter@marvell.com>
+
+[ Upstream commit 29a0c843973bc385918158c6976e4dbe891df969 ]
+
+The function should return NULL in case no device is found, but it
+always returns the last checked mc device from the list even if the
+index did not match. Fix that.
+
+I did some analysis why this did not raise any issues for about 3 years
+and the reason is that edac_mc_find() is mostly used to search for
+existing devices. Thus, the bug is not triggered.
+
+ [ bp: Drop the if (mci->mc_idx > idx) test in favor of readability. ]
+
+Fixes: c73e8833bec5 ("EDAC, mc: Fix locking around mc_devices list")
+Signed-off-by: Robert Richter <rrichter@marvell.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "linux-edac@vger.kernel.org" <linux-edac@vger.kernel.org>
+Cc: James Morse <james.morse@arm.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Link: https://lkml.kernel.org/r/20190514104838.15065-1-rrichter@marvell.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/edac/edac_mc.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
+index f7fa05fee45a1..329021189c38b 100644
+--- a/drivers/edac/edac_mc.c
++++ b/drivers/edac/edac_mc.c
+@@ -680,22 +680,18 @@ static int del_mc_from_global_list(struct mem_ctl_info *mci)
+
+ struct mem_ctl_info *edac_mc_find(int idx)
+ {
+- struct mem_ctl_info *mci = NULL;
++ struct mem_ctl_info *mci;
+ struct list_head *item;
+
+ mutex_lock(&mem_ctls_mutex);
+
+ list_for_each(item, &mc_devices) {
+ mci = list_entry(item, struct mem_ctl_info, link);
+-
+- if (mci->mc_idx >= idx) {
+- if (mci->mc_idx == idx) {
+- goto unlock;
+- }
+- break;
+- }
++ if (mci->mc_idx == idx)
++ goto unlock;
+ }
+
++ mci = NULL;
+ unlock:
+ mutex_unlock(&mem_ctls_mutex);
+ return mci;
+--
+2.20.1
+
--- /dev/null
+From bddf10c971709c6af88790ff674527360807d518 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 15:47:59 +0800
+Subject: ehea: Fix a copy-paste err in ehea_init_port_res
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ]
+
+pr->tx_bytes should be assigned to tx_bytes other than
+rx_bytes.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: ce45b873028f ("ehea: Fixing statistics")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 30cbdf0fed595..373deb247ac01 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -1475,7 +1475,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
+
+ memset(pr, 0, sizeof(struct ehea_port_res));
+
+- pr->tx_bytes = rx_bytes;
++ pr->tx_bytes = tx_bytes;
+ pr->tx_packets = tx_packets;
+ pr->rx_bytes = rx_bytes;
+ pr->rx_packets = rx_packets;
+--
+2.20.1
+
--- /dev/null
+From a6b706622a48233eab809af18b0ebb99d95c49da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 11:32:41 +0800
+Subject: exportfs: fix 'passing zero to ERR_PTR()' warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ]
+
+Fix a static code checker warning:
+ fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR'
+
+The error path for lookup_one_len_unlocked failure
+should set err to PTR_ERR.
+
+Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exportfs/expfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index a561ae17cf435..c08960040dd05 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
+ tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf));
+ if (IS_ERR(tmp)) {
+ dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
++ err = PTR_ERR(tmp);
+ goto out_err;
+ }
+ if (tmp != dentry) {
+--
+2.20.1
+
--- /dev/null
+From a6c9e9163f82c9e1ad9f52b234c184444c49bcf3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 14:29:38 -0400
+Subject: ext4: set error return correctly when ext4_htree_store_dirent fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 7a14826ede1d714f0bb56de8167c0e519041eeda ]
+
+Currently when the call to ext4_htree_store_dirent fails the error return
+variable 'ret' is is not being set to the error code and variable count is
+instead, hence the error code is not being returned. Fix this by assigning
+ret to the error return code.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 8af0f0822797 ("ext4: fix readdir error in the case of inline_data+dir_index")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 137c752ab9853..6064bcb8572b3 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1425,7 +1425,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
+ err = ext4_htree_store_dirent(dir_file, hinfo->hash,
+ hinfo->minor_hash, de, &tmp_str);
+ if (err) {
+- count = err;
++ ret = err;
+ goto out;
+ }
+ count++;
+--
+2.20.1
+
--- /dev/null
+From 94a3a811f2b9bac9ed3ca01b7343f5de1f09549f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Feb 2019 19:24:45 +0100
+Subject: fbdev: chipsfb: remove set but not used variable 'size'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
+drivers/video/fbdev/chipsfb.c:352:22: warning:
+ variable 'size' set but not used [-Wunused-but-set-variable]
+
+Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+[b.zolnierkie: minor commit summary and description fixups]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/chipsfb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index f103665cad431..f9b366d175875 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
+ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ {
+ struct fb_info *p;
+- unsigned long addr, size;
++ unsigned long addr;
+ unsigned short cmd;
+ int rc = -ENODEV;
+
+@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
+ goto err_disable;
+ addr = pci_resource_start(dp, 0);
+- size = pci_resource_len(dp, 0);
+ if (addr == 0)
+ goto err_disable;
+
+--
+2.20.1
+
--- /dev/null
+From ba1873e42cf2f944dcaf785113bc069838688810 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 07:58:38 -0600
+Subject: fs/nfs: Fix nfs_parse_devname to not modify it's argument
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ]
+
+In the rare and unsupported case of a hostname list nfs_parse_devname
+will modify dev_name. There is no need to modify dev_name as the all
+that is being computed is the length of the hostname, so the computed
+length can just be shorted.
+
+Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index f464f8d9060c0..470b761839a51 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1925,7 +1925,7 @@ static int nfs_parse_devname(const char *dev_name,
+ /* kill possible hostname list: not supported */
+ comma = strchr(dev_name, ',');
+ if (comma != NULL && comma < end)
+- *comma = 0;
++ len = comma - dev_name;
+ }
+
+ if (len > maxnamlen)
+--
+2.20.1
+
--- /dev/null
+From e9a4003300f8f5848c2f239a8548befe5eb4fa72 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 16:42:37 -0700
+Subject: hv_netvsc: flag software created hash value
+
+From: Stephen Hemminger <sthemmin@microsoft.com>
+
+[ Upstream commit df9f540ca74297a84bafacfa197e9347b20beea5 ]
+
+When the driver needs to create a hash value because it
+was not done at higher level, then the hash should be marked
+as a software not hardware hash.
+
+Fixes: f72860afa2e3 ("hv_netvsc: Exclude non-TCP port numbers from vRSS hashing")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc_drv.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 9e48855f64074..14451e14d99dc 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -282,9 +282,9 @@ static inline u32 netvsc_get_hash(
+ else if (flow.basic.n_proto == htons(ETH_P_IPV6))
+ hash = jhash2((u32 *)&flow.addrs.v6addrs, 8, hashrnd);
+ else
+- hash = 0;
++ return 0;
+
+- skb_set_hash(skb, hash, PKT_HASH_TYPE_L3);
++ __skb_set_sw_hash(skb, hash, false);
+ }
+
+ return hash;
+@@ -802,8 +802,7 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
+ skb->protocol == htons(ETH_P_IP))
+ netvsc_comp_ipcsum(skb);
+
+- /* Do L4 checksum offload if enabled and present.
+- */
++ /* Do L4 checksum offload if enabled and present. */
+ if (csum_info && (net->features & NETIF_F_RXCSUM)) {
+ if (csum_info->receive.tcp_checksum_succeeded ||
+ csum_info->receive.udp_checksum_succeeded)
+--
+2.20.1
+
--- /dev/null
+From da303e946aa52aeb3ea574ff18f495f7d1a54113 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 12:00:18 -0700
+Subject: hwmon: (lm75) Fix write operations for negative temperatures
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 7d82fcc9d9e81241778aaa22fda7be753e237d86 ]
+
+Writes into limit registers fail if the temperature written is negative.
+The regmap write operation checks the value range, regmap_write accepts
+an unsigned int as parameter, and the temperature value passed to
+regmap_write is kept in a variable declared as long. Negative values
+are converted large unsigned integers, which fails the range check.
+Fix by type casting the temperature to u16 when calling regmap_write().
+
+Cc: Iker Perez del Palomar Sustatxa <iker.perez@codethink.co.uk>
+Fixes: e65365fed87f ("hwmon: (lm75) Convert to use regmap")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm75.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c
+index 005ffb5ffa92d..1737bb5fbaafe 100644
+--- a/drivers/hwmon/lm75.c
++++ b/drivers/hwmon/lm75.c
+@@ -165,7 +165,7 @@ static int lm75_write(struct device *dev, enum hwmon_sensor_types type,
+ temp = DIV_ROUND_CLOSEST(temp << (resolution - 8),
+ 1000) << (16 - resolution);
+
+- return regmap_write(data->regmap, reg, temp);
++ return regmap_write(data->regmap, reg, (u16)temp);
+ }
+
+ static umode_t lm75_is_visible(const void *data, enum hwmon_sensor_types type,
+--
+2.20.1
+
--- /dev/null
+From 6afcf3efabcfb2b029b47925492c015c3e84b5f5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 19:54:40 +0000
+Subject: hwmon: (pmbus/tps53679) Fix driver info initialization in probe
+ routine
+
+From: Vadim Pasternak <vadimp@mellanox.com>
+
+[ Upstream commit ff066653aeed8ee2d4dadb1e35774dd91ecbb19f ]
+
+Fix tps53679_probe() by using dynamically allocated "pmbus_driver_info"
+structure instead of static. Usage of static structures causes
+overwritten of the field "vrm_version", in case the system is equipped
+with several tps53679 devices with the different "vrm_version".
+In such case the last probed device overwrites this field for all
+others.
+
+Fixes: 610526527a13 ("hwmon: (pmbus) Add support for Texas Instruments tps53679 device")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/tps53679.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c
+index 85b515cd9df0e..2bc352c5357f4 100644
+--- a/drivers/hwmon/pmbus/tps53679.c
++++ b/drivers/hwmon/pmbus/tps53679.c
+@@ -80,7 +80,14 @@ static struct pmbus_driver_info tps53679_info = {
+ static int tps53679_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+- return pmbus_do_probe(client, id, &tps53679_info);
++ struct pmbus_driver_info *info;
++
++ info = devm_kmemdup(&client->dev, &tps53679_info, sizeof(*info),
++ GFP_KERNEL);
++ if (!info)
++ return -ENOMEM;
++
++ return pmbus_do_probe(client, id, info);
+ }
+
+ static const struct i2c_device_id tps53679_id[] = {
+--
+2.20.1
+
--- /dev/null
+From c4d4cd4b0ba84e1456ccd1c40f0ede138acdfb51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 01:45:54 +0000
+Subject: hwmon: (shtc1) fix shtc1 and shtw1 id mask
+
+From: Dan Robertson <dan@dlrobertson.com>
+
+[ Upstream commit fdc7d8e829ec755c5cfb2f5a8d8c0cdfb664f895 ]
+
+Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to
+retrieve the chip ID from the ID register. See section 5.7 of the shtw1
+or shtc1 datasheet for details.
+
+Fixes: 1a539d372edd9832444e7a3daa710c444c014dc9 ("hwmon: add support for Sensirion SHTC1 sensor")
+Signed-off-by: Dan Robertson <dan@dlrobertson.com>
+Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com
+[groeck: Reordered to be first in series and adjusted accordingly]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/shtc1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
+index decd7df995abf..2a18539591eaf 100644
+--- a/drivers/hwmon/shtc1.c
++++ b/drivers/hwmon/shtc1.c
+@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[] = { 0xef, 0xc8 };
+
+ /* constants for reading the ID register */
+ #define SHTC1_ID 0x07
+-#define SHTC1_ID_REG_MASK 0x1f
++#define SHTC1_ID_REG_MASK 0x3f
+
+ /* delays for non-blocking i2c commands, both in us */
+ #define SHTC1_NONBLOCKING_WAIT_TIME_HPM 14400
+--
+2.20.1
+
--- /dev/null
+From 796c473ee983fd37bb18d11325e3842c72606dd4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Apr 2019 08:44:41 -0700
+Subject: hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 37 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
+index 8ac89d0781ccc..a575e1cdb81a8 100644
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
+ outb(ld, sio->sioaddr + 1);
+ }
+
+-static inline void
++static inline int
+ superio_enter(struct w83627hf_sio_data *sio)
+ {
++ if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, sio->sioaddr);
+ outb(0x87, sio->sioaddr);
++
++ return 0;
+ }
+
+ static inline void
+ superio_exit(struct w83627hf_sio_data *sio)
+ {
+ outb(0xAA, sio->sioaddr);
++ release_region(sio->sioaddr, 2);
+ }
+
+ #define W627_DEVID 0x52
+@@ -1278,7 +1284,7 @@ static DEVICE_ATTR_RO(name);
+ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ struct w83627hf_sio_data *sio_data)
+ {
+- int err = -ENODEV;
++ int err;
+ u16 val;
+
+ static __initconst char *const names[] = {
+@@ -1290,7 +1296,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ };
+
+ sio_data->sioaddr = sioaddr;
+- superio_enter(sio_data);
++ err = superio_enter(sio_data);
++ if (err)
++ return err;
++
++ err = -ENODEV;
+ val = force_id ? force_id : superio_inb(sio_data, DEVID);
+ switch (val) {
+ case W627_DEVID:
+@@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff, sel;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_GPIO5);
+
++ res = 0xff;
++
+ /* Make sure these GPIO pins are enabled */
+ if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
+ dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
+@@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_HWM);
+
+ /* Make sure these GPIO pins are enabled */
+--
+2.20.1
+
--- /dev/null
+From 3870533dd7ea821412f7662a50e6d6f4ec4b2c91 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Sep 2018 10:56:03 -0700
+Subject: IB/hfi1: Add mtu check for operational data VLs
+
+From: Alex Estrin <alex.estrin@intel.com>
+
+[ Upstream commit eb50130964e8c1379f37c3d3bab33a411ec62e98 ]
+
+Since Virtual Lanes BCT credits and MTU are set through separate MADs, we
+have to ensure both are valid, and data VLs are ready for transmission
+before we allow port transition to Armed state.
+
+Fixes: 5e2d6764a729 ("IB/hfi1: Verify port data VLs credits on transition to Armed")
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Alex Estrin <alex.estrin@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/chip.c | 26 ++++++++++++++++++++++----
+ 1 file changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c
+index 9f78bb07744c7..4a0b7c0034771 100644
+--- a/drivers/infiniband/hw/hfi1/chip.c
++++ b/drivers/infiniband/hw/hfi1/chip.c
+@@ -10552,12 +10552,29 @@ void set_link_down_reason(struct hfi1_pportdata *ppd, u8 lcl_reason,
+ }
+ }
+
+-/*
+- * Verify if BCT for data VLs is non-zero.
++/**
++ * data_vls_operational() - Verify if data VL BCT credits and MTU
++ * are both set.
++ * @ppd: pointer to hfi1_pportdata structure
++ *
++ * Return: true - Ok, false -otherwise.
+ */
+ static inline bool data_vls_operational(struct hfi1_pportdata *ppd)
+ {
+- return !!ppd->actual_vls_operational;
++ int i;
++ u64 reg;
++
++ if (!ppd->actual_vls_operational)
++ return false;
++
++ for (i = 0; i < ppd->vls_supported; i++) {
++ reg = read_csr(ppd->dd, SEND_CM_CREDIT_VL + (8 * i));
++ if ((reg && !ppd->dd->vld[i].mtu) ||
++ (!reg && ppd->dd->vld[i].mtu))
++ return false;
++ }
++
++ return true;
+ }
+
+ /*
+@@ -10662,7 +10679,8 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state)
+
+ if (!data_vls_operational(ppd)) {
+ dd_dev_err(dd,
+- "%s: data VLs not operational\n", __func__);
++ "%s: Invalid data VL credits or mtu\n",
++ __func__);
+ ret = -EINVAL;
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 8fc9e3a018a8fc073bc0614f7118755b1d00e349 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 12:22:11 +0200
+Subject: IB/iser: Fix dma_nents type definition
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit c1545f1a200f4adc4ef8dd534bf33e2f1aa22c2f ]
+
+The retured value from ib_dma_map_sg saved in dma_nents variable. To avoid
+future mismatch between types, define dma_nents as an integer instead of
+unsigned.
+
+Fixes: 57b26497fabe ("IB/iser: Pass the correct number of entries for dma mapped SGL")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Israel Rukshin <israelr@mellanox.com>
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iscsi_iser.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
+index c1ae4aeae2f90..46dfc6ae9d1c1 100644
+--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
+@@ -197,7 +197,7 @@ struct iser_data_buf {
+ struct scatterlist *sg;
+ int size;
+ unsigned long data_len;
+- unsigned int dma_nents;
++ int dma_nents;
+ };
+
+ /* fwd declarations */
+--
+2.20.1
+
--- /dev/null
+From ca1b75264925d3792c00252eb7beb0473a85d9af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Jan 2019 15:45:45 +0000
+Subject: IB/iser: Pass the correct number of entries for dma mapped SGL
+
+From: Israel Rukshin <israelr@mellanox.com>
+
+[ Upstream commit 57b26497fabe1b9379b59fbc7e35e608e114df16 ]
+
+ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may
+change the number of entries and the lengths of each entry.
+
+Code that touches dma_address is iterating over the 'dma mapped SGL' and
+must use dma_nents which returned from ib_dma_map_sg().
+
+ib_sg_to_pages() and ib_map_mr_sg() are using dma_address so they must use
+dma_nents.
+
+Fixes: 39405885005a ("IB/iser: Port to new fast registration API")
+Fixes: bfe066e256d5 ("IB/iser: Reuse ib_sg_to_pages")
+Signed-off-by: Israel Rukshin <israelr@mellanox.com>
+Reviewed-by: Max Gurtovoy <maxg@mellanox.com>
+Acked-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/iser/iser_memory.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
+index 322209d5ff582..19883169e7b76 100644
+--- a/drivers/infiniband/ulp/iser/iser_memory.c
++++ b/drivers/infiniband/ulp/iser/iser_memory.c
+@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task,
+ page_vec->npages = 0;
+ page_vec->fake_mr.page_size = SIZE_4K;
+ plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg,
+- mem->size, NULL, iser_set_page);
+- if (unlikely(plen < mem->size)) {
++ mem->dma_nents, NULL, iser_set_page);
++ if (unlikely(plen < mem->dma_nents)) {
+ iser_err("page vec too short to hold this SG\n");
+ iser_data_buf_dump(mem, device->ib_device);
+ iser_dump_page_vec(page_vec);
+@@ -450,10 +450,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
+
+ ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
+
+- n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K);
+- if (unlikely(n != mem->size)) {
++ n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K);
++ if (unlikely(n != mem->dma_nents)) {
+ iser_err("failed to map sg (%d/%d)\n",
+- n, mem->size);
++ n, mem->dma_nents);
+ return n < 0 ? n : -EINVAL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From b71144ffcc7800283139c268fc9a6231c160ab23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 08:38:30 +0300
+Subject: IB/mlx5: Add missing XRC options to QP optional params mask
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ]
+
+The QP transition optional parameters for the various transition for XRC
+QPs are identical to those for RC QPs.
+
+Many of the XRC QP transition optional parameter bits are missing from the
+QP optional mask table. These omissions caused failures when doing XRC QP
+state transitions.
+
+For example, when trying to change the response timer of an XRC receive QP
+via the RTS2RTS transition, the new timer value was ignored because
+MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask
+for XRC qps for the RTS2RTS transition.
+
+Fix this by adding the missing XRC optional parameters for all QP
+transitions to the opt_mask table.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 5a7dcb5afe6e3..84c962820aa2a 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -2357,6 +2357,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX |
+ MLX5_QP_OPTPAR_Q_KEY |
+ MLX5_QP_OPTPAR_PRI_PORT,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_PKEY_INDEX |
++ MLX5_QP_OPTPAR_PRI_PORT,
+ },
+ [MLX5_QP_STATE_RTR] = {
+ [MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
+@@ -2390,6 +2395,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ MLX5_QP_OPTPAR_RWE |
+ MLX5_QP_OPTPAR_PM_STATE,
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
++ MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_PM_STATE |
++ MLX5_QP_OPTPAR_RNR_TIMEOUT,
+ },
+ },
+ [MLX5_QP_STATE_RTS] = {
+@@ -2406,6 +2417,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY |
+ MLX5_QP_OPTPAR_SRQN |
+ MLX5_QP_OPTPAR_CQN_RCV,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_RNR_TIMEOUT |
++ MLX5_QP_OPTPAR_PM_STATE |
++ MLX5_QP_OPTPAR_ALT_ADDR_PATH,
+ },
+ },
+ [MLX5_QP_STATE_SQER] = {
+@@ -2417,6 +2434,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ MLX5_QP_OPTPAR_RWE |
+ MLX5_QP_OPTPAR_RAE |
+ MLX5_QP_OPTPAR_RRE,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RNR_TIMEOUT |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RRE,
+ },
+ },
+ };
+--
+2.20.1
+
--- /dev/null
+From c5705ced3108d70b48b1838508b95c5159f595eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 9 Dec 2018 15:53:49 +0200
+Subject: IB/rxe: Fix incorrect cache cleanup in error flow
+
+From: Yuval Shaia <yuval.shaia@oracle.com>
+
+[ Upstream commit 6db21d8986e14e2e86573a3b055b05296188bd2c ]
+
+Array iterator stays at the same slot, fix it.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_pool.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c
+index b4a8acc7bb7d6..0e2425f282335 100644
+--- a/drivers/infiniband/sw/rxe/rxe_pool.c
++++ b/drivers/infiniband/sw/rxe/rxe_pool.c
+@@ -112,6 +112,18 @@ static inline struct kmem_cache *pool_cache(struct rxe_pool *pool)
+ return rxe_type_info[pool->type].cache;
+ }
+
++static void rxe_cache_clean(size_t cnt)
++{
++ int i;
++ struct rxe_type_info *type;
++
++ for (i = 0; i < cnt; i++) {
++ type = &rxe_type_info[i];
++ kmem_cache_destroy(type->cache);
++ type->cache = NULL;
++ }
++}
++
+ int rxe_cache_init(void)
+ {
+ int err;
+@@ -136,24 +148,14 @@ int rxe_cache_init(void)
+ return 0;
+
+ err1:
+- while (--i >= 0) {
+- kmem_cache_destroy(type->cache);
+- type->cache = NULL;
+- }
++ rxe_cache_clean(i);
+
+ return err;
+ }
+
+ void rxe_cache_exit(void)
+ {
+- int i;
+- struct rxe_type_info *type;
+-
+- for (i = 0; i < RXE_NUM_TYPES; i++) {
+- type = &rxe_type_info[i];
+- kmem_cache_destroy(type->cache);
+- type->cache = NULL;
+- }
++ rxe_cache_clean(RXE_NUM_TYPES);
+ }
+
+ static int rxe_pool_init_index(struct rxe_pool *pool, u32 max, u32 min)
+--
+2.20.1
+
--- /dev/null
+From cb0dde6168798056cb69e0558202530b74b6c221 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Sep 2018 01:57:42 -0400
+Subject: IB/rxe: replace kvfree with vfree
+
+From: Zhu Yanjun <yanjun.zhu@oracle.com>
+
+[ Upstream commit 721ad7e643f7002efa398838693f90284ea216d1 ]
+
+The buf is allocated by vmalloc_user in the function rxe_queue_init.
+So it is better to free it by vfree.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/sw/rxe/rxe_cq.c | 4 ++--
+ drivers/infiniband/sw/rxe/rxe_qp.c | 5 +++--
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c
+index c4aabf78dc90f..f6e036ded046e 100644
+--- a/drivers/infiniband/sw/rxe/rxe_cq.c
++++ b/drivers/infiniband/sw/rxe/rxe_cq.c
+@@ -30,7 +30,7 @@
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+-
++#include <linux/vmalloc.h>
+ #include "rxe.h"
+ #include "rxe_loc.h"
+ #include "rxe_queue.h"
+@@ -97,7 +97,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe,
+ err = do_mmap_info(rxe, udata, false, context, cq->queue->buf,
+ cq->queue->buf_size, &cq->queue->ip);
+ if (err) {
+- kvfree(cq->queue->buf);
++ vfree(cq->queue->buf);
+ kfree(cq->queue);
+ return err;
+ }
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index aeea994b04c43..25055a68a2c07 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -34,6 +34,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/delay.h>
+ #include <linux/sched.h>
++#include <linux/vmalloc.h>
+
+ #include "rxe.h"
+ #include "rxe_loc.h"
+@@ -255,7 +256,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ qp->sq.queue->buf_size, &qp->sq.queue->ip);
+
+ if (err) {
+- kvfree(qp->sq.queue->buf);
++ vfree(qp->sq.queue->buf);
+ kfree(qp->sq.queue);
+ return err;
+ }
+@@ -308,7 +309,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,
+ qp->rq.queue->buf_size,
+ &qp->rq.queue->ip);
+ if (err) {
+- kvfree(qp->rq.queue->buf);
++ vfree(qp->rq.queue->buf);
+ kfree(qp->rq.queue);
+ return err;
+ }
+--
+2.20.1
+
--- /dev/null
+From ac1a4652a5cbf93430c9b81c77e840ea1d5ba0e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:54 +0200
+Subject: IB/usnic: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Acked-by: Parvi Kaustubhi <pkaustub@cisco.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+index fdfa25059723d..2602c7375d585 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -423,7 +423,7 @@ struct net_device *usnic_get_netdev(struct ib_device *device, u8 port_num)
+ int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+ u16 *pkey)
+ {
+- if (index > 1)
++ if (index > 0)
+ return -EINVAL;
+
+ *pkey = 0xffff;
+--
+2.20.1
+
--- /dev/null
+From 1e00025ff4639e42623af18190edaf8ec1430896 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 12:58:46 +0100
+Subject: iio: dac: ad5380: fix incorrect assignment to val
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e18768ef1214c0a8048327918a182cabe09f9d ]
+
+Currently the pointer val is being incorrectly incremented
+instead of the value pointed to by val. Fix this by adding
+in the missing * indirection operator.
+
+Addresses-Coverity: ("Unused value")
+Fixes: c03f2c536818 ("staging:iio:dac: Add AD5380 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/ad5380.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
+index 97d2c5111f438..8bf7fc626a9d4 100644
+--- a/drivers/iio/dac/ad5380.c
++++ b/drivers/iio/dac/ad5380.c
+@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
+ if (ret)
+ return ret;
+ *val >>= chan->scan_type.shift;
+- val -= (1 << chan->scan_type.realbits) / 2;
++ *val -= (1 << chan->scan_type.realbits) / 2;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ *val = 2 * st->vref;
+--
+2.20.1
+
--- /dev/null
+From c510681f12e525e49b6e5cb1c8e4bc1c5140390b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 16:56:48 -0700
+Subject: inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]
+
+Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.
+
+inet_frags_fini() is dismantling a kmem_cache, that might be needed
+later when unregister_pernet_subsys() eventually has to remove
+frags queues from hash tables and free them.
+
+This fixes potential use-after-free, and is a prereq for the following patch.
+
+Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ieee802154/6lowpan/reassembly.c | 2 +-
+ net/ipv6/reassembly.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
+index ec7a5da561290..e873a6a007f2a 100644
+--- a/net/ieee802154/6lowpan/reassembly.c
++++ b/net/ieee802154/6lowpan/reassembly.c
+@@ -634,7 +634,7 @@ err_sysctl:
+
+ void lowpan_net_frag_exit(void)
+ {
+- inet_frags_fini(&lowpan_frags);
+ lowpan_frags_sysctl_unregister();
+ unregister_pernet_subsys(&lowpan_frags_ops);
++ inet_frags_fini(&lowpan_frags);
+ }
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index fe797b29ca89d..6dea6e92e6863 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -593,8 +593,8 @@ err_protocol:
+
+ void ipv6_frag_exit(void)
+ {
+- inet_frags_fini(&ip6_frags);
+ ip6_frags_sysctl_unregister();
+ unregister_pernet_subsys(&ip6_frags_ops);
+ inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
++ inet_frags_fini(&ip6_frags);
+ }
+--
+2.20.1
+
--- /dev/null
+From 75736a3a0489bd3cc1a98540e2f55f17ad620cd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:38:30 -0800
+Subject: Input: nomadik-ske-keypad - fix a loop timeout test
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ]
+
+The loop exits with "timeout" set to -1 not to 0.
+
+Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
+index 8567ee47761e1..ae3b045570740 100644
+--- a/drivers/input/keyboard/nomadik-ske-keypad.c
++++ b/drivers/input/keyboard/nomadik-ske-keypad.c
+@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
+ while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
+ cpu_relax();
+
+- if (!timeout)
++ if (timeout == -1)
+ return -EINVAL;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 1048252ef119dcf3576ba444ce436741bbdd4b5a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jun 2019 14:52:03 -0700
+Subject: iommu/amd: Make iommu_disable safer
+
+From: Kevin Mitchell <kevmitch@arista.com>
+
+[ Upstream commit 3ddbe913e55516d3e2165d43d4d5570761769878 ]
+
+Make it safe to call iommu_disable during early init error conditions
+before mmio_base is set, but after the struct amd_iommu has been added
+to the amd_iommu_list. For example, this happens if firmware fails to
+fill in mmio_phys in the ACPI table leading to a NULL pointer
+dereference in iommu_feature_disable.
+
+Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine')
+Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 6a3cf4d0bd5e3..4d2920988d607 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -420,6 +420,9 @@ static void iommu_enable(struct amd_iommu *iommu)
+
+ static void iommu_disable(struct amd_iommu *iommu)
+ {
++ if (!iommu->mmio_base)
++ return;
++
+ /* Disable command buffer */
+ iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
+
+--
+2.20.1
+
--- /dev/null
+From 2ba153c74c0a7cf7b412b765341a05fb45004bed Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 19:49:21 +0200
+Subject: iommu/amd: Wait for completion of IOTLB flush in attach_device
+
+From: Filippo Sironi <sironi@amazon.de>
+
+[ Upstream commit 0b15e02f0cc4fb34a9160de7ba6db3a4013dc1b7 ]
+
+To make sure the domain tlb flush completes before the
+function returns, explicitly wait for its completion.
+
+Signed-off-by: Filippo Sironi <sironi@amazon.de>
+Fixes: 42a49f965a8d ("amd-iommu: flush domain tlb when attaching a new device")
+[joro: Added commit message and fixes tag]
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index d09c24825734e..778f167be2d35 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2160,6 +2160,8 @@ skip_ats_check:
+ */
+ domain_flush_tlb_pde(domain);
+
++ domain_flush_complete(domain);
++
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3b88dbca9213639d36d3e0926f069bf1b03c4ed6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 24 Aug 2019 11:01:50 +0800
+Subject: iommu/mediatek: Fix iova_to_phys PA start for 4GB mode
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+[ Upstream commit 76ce65464fcd2c21db84391572b7938b716aceb0 ]
+
+In M4U 4GB mode, the physical address is remapped as below:
+
+CPU Physical address:
+
+====================
+
+0 1G 2G 3G 4G 5G
+|---A---|---B---|---C---|---D---|---E---|
++--I/O--+------------Memory-------------+
+
+IOMMU output physical address:
+ =============================
+
+ 4G 5G 6G 7G 8G
+ |---E---|---B---|---C---|---D---|
+ +------------Memory-------------+
+
+The Region 'A'(I/O) can not be mapped by M4U; For Region 'B'/'C'/'D', the
+bit32 of the CPU physical address always is needed to set, and for Region
+'E', the CPU physical address keep as is. something looks like this:
+CPU PA -> M4U OUTPUT PA
+0x4000_0000 0x1_4000_0000 (Add bit32)
+0x8000_0000 0x1_8000_0000 ...
+0xc000_0000 0x1_c000_0000 ...
+0x1_0000_0000 0x1_0000_0000 (No change)
+
+Additionally, the iommu consumers always use the CPU phyiscal address.
+
+The PA in the iova_to_phys that is got from v7s always is u32, But
+from the CPU point of view, PA only need add BIT(32) when PA < 0x4000_0000.
+
+Fixes: 30e2fccf9512 ("iommu/mediatek: Enlarge the validate PA range
+for 4GB mode")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/mtk_iommu.c | 26 +++++++++++++++++++++++++-
+ 1 file changed, 25 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
+index c30f627004315..0f99e95a1a739 100644
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -115,6 +115,30 @@ struct mtk_iommu_domain {
+
+ static struct iommu_ops mtk_iommu_ops;
+
++/*
++ * In M4U 4GB mode, the physical address is remapped as below:
++ *
++ * CPU Physical address:
++ * ====================
++ *
++ * 0 1G 2G 3G 4G 5G
++ * |---A---|---B---|---C---|---D---|---E---|
++ * +--I/O--+------------Memory-------------+
++ *
++ * IOMMU output physical address:
++ * =============================
++ *
++ * 4G 5G 6G 7G 8G
++ * |---E---|---B---|---C---|---D---|
++ * +------------Memory-------------+
++ *
++ * The Region 'A'(I/O) can NOT be mapped by M4U; For Region 'B'/'C'/'D', the
++ * bit32 of the CPU physical address always is needed to set, and for Region
++ * 'E', the CPU physical address keep as is.
++ * Additionally, The iommu consumers always use the CPU phyiscal address.
++ */
++#define MTK_IOMMU_4GB_MODE_REMAP_BASE 0x40000000
++
+ static LIST_HEAD(m4ulist); /* List all the M4U HWs */
+
+ #define for_each_m4u(data) list_for_each_entry(data, &m4ulist, list)
+@@ -404,7 +428,7 @@ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain,
+ pa = dom->iop->iova_to_phys(dom->iop, iova);
+ spin_unlock_irqrestore(&dom->pgtlock, flags);
+
+- if (data->enable_4GB)
++ if (data->enable_4GB && pa < MTK_IOMMU_4GB_MODE_REMAP_BASE)
+ pa |= BIT_ULL(32);
+
+ return pa;
+--
+2.20.1
+
--- /dev/null
+From 326270914a88e50390809ad02caa95fe37978762 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 15:27:35 +0800
+Subject: iommu: Use right function to get group for device
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 57274ea25736496ee019a5c40479855b21888839 ]
+
+The iommu_group_get_for_dev() will allocate a group for a
+device if it isn't in any group. This isn't the use case
+in iommu_request_dm_for_dev(). Let's use iommu_group_get()
+instead.
+
+Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 4b761678a18bb..2c48a9d6d91e9 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -1856,9 +1856,9 @@ int iommu_request_dm_for_dev(struct device *dev)
+ int ret;
+
+ /* Device must already be in a group before calling this function */
+- group = iommu_group_get_for_dev(dev);
+- if (IS_ERR(group))
+- return PTR_ERR(group);
++ group = iommu_group_get(dev);
++ if (!group)
++ return -EINVAL;
+
+ mutex_lock(&group->mutex);
+
+--
+2.20.1
+
--- /dev/null
+From 0c97da230c08fe8cdcdb510e1b1ff43d53a95807 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 3 Jun 2019 08:53:31 +0200
+Subject: iommu/vt-d: Duplicate iommu_resv_region objects per device list
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 5f64ce5411b467f1cfea6c63e2494c22b773582b ]
+
+intel_iommu_get_resv_regions() aims to return the list of
+reserved regions accessible by a given @device. However several
+devices can access the same reserved memory region and when
+building the list it is not safe to use a single iommu_resv_region
+object, whose container is the RMRR. This iommu_resv_region must
+be duplicated per device reserved region list.
+
+Let's remove the struct iommu_resv_region from the RMRR unit
+and allocate the iommu_resv_region directly in
+intel_iommu_get_resv_regions(). We hold the dmar_global_lock instead
+of the rcu-lock to allow sleeping.
+
+Fixes: 0659b8dc45a6 ("iommu/vt-d: Implement reserved region get/put callbacks")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 34 +++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 4fbd183d973ab..b48666849dbed 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -442,7 +442,6 @@ struct dmar_rmrr_unit {
+ u64 end_address; /* reserved end address */
+ struct dmar_dev_scope *devices; /* target devices */
+ int devices_cnt; /* target device count */
+- struct iommu_resv_region *resv; /* reserved region handle */
+ };
+
+ struct dmar_atsr_unit {
+@@ -4171,7 +4170,6 @@ static inline void init_iommu_pm_ops(void) {}
+ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ {
+ struct acpi_dmar_reserved_memory *rmrr;
+- int prot = DMA_PTE_READ|DMA_PTE_WRITE;
+ struct dmar_rmrr_unit *rmrru;
+ size_t length;
+
+@@ -4185,22 +4183,16 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ rmrru->end_address = rmrr->end_address;
+
+ length = rmrr->end_address - rmrr->base_address + 1;
+- rmrru->resv = iommu_alloc_resv_region(rmrr->base_address, length, prot,
+- IOMMU_RESV_DIRECT);
+- if (!rmrru->resv)
+- goto free_rmrru;
+
+ rmrru->devices = dmar_alloc_dev_scope((void *)(rmrr + 1),
+ ((void *)rmrr) + rmrr->header.length,
+ &rmrru->devices_cnt);
+ if (rmrru->devices_cnt && rmrru->devices == NULL)
+- goto free_all;
++ goto free_rmrru;
+
+ list_add(&rmrru->list, &dmar_rmrr_units);
+
+ return 0;
+-free_all:
+- kfree(rmrru->resv);
+ free_rmrru:
+ kfree(rmrru);
+ out:
+@@ -4418,7 +4410,6 @@ static void intel_iommu_free_dmars(void)
+ list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) {
+ list_del(&rmrru->list);
+ dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt);
+- kfree(rmrru->resv);
+ kfree(rmrru);
+ }
+
+@@ -5186,22 +5177,33 @@ static void intel_iommu_remove_device(struct device *dev)
+ static void intel_iommu_get_resv_regions(struct device *device,
+ struct list_head *head)
+ {
++ int prot = DMA_PTE_READ | DMA_PTE_WRITE;
+ struct iommu_resv_region *reg;
+ struct dmar_rmrr_unit *rmrr;
+ struct device *i_dev;
+ int i;
+
+- rcu_read_lock();
++ down_read(&dmar_global_lock);
+ for_each_rmrr_units(rmrr) {
+ for_each_active_dev_scope(rmrr->devices, rmrr->devices_cnt,
+ i, i_dev) {
++ struct iommu_resv_region *resv;
++ size_t length;
++
+ if (i_dev != device)
+ continue;
+
+- list_add_tail(&rmrr->resv->list, head);
++ length = rmrr->end_address - rmrr->base_address + 1;
++ resv = iommu_alloc_resv_region(rmrr->base_address,
++ length, prot,
++ IOMMU_RESV_DIRECT);
++ if (!resv)
++ break;
++
++ list_add_tail(&resv->list, head);
+ }
+ }
+- rcu_read_unlock();
++ up_read(&dmar_global_lock);
+
+ reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
+ IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
+@@ -5216,10 +5218,8 @@ static void intel_iommu_put_resv_regions(struct device *dev,
+ {
+ struct iommu_resv_region *entry, *next;
+
+- list_for_each_entry_safe(entry, next, head, list) {
+- if (entry->type == IOMMU_RESV_MSI)
+- kfree(entry);
+- }
++ list_for_each_entry_safe(entry, next, head, list)
++ kfree(entry);
+ }
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+--
+2.20.1
+
--- /dev/null
+From dad2a5679eedc44e38d8b5dc96e0a2c6a6934558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 09:34:26 +0800
+Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ]
+
+The kernel parameter igfx_off is used by users to disable
+DMA remapping for the Intel integrated graphic device. It
+was designed for bare metal cases where a dedicated IOMMU
+is used for graphic. This doesn't apply to virtual IOMMU
+case where an include-all IOMMU is used. This makes the
+kernel parameter work with virtual IOMMU as well.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 523d0889c2a4e..4fbd183d973ab 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3361,9 +3361,12 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_ALL;
+
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+- iommu_identity_mapping |= IDENTMAP_GFX;
++ dmar_map_gfx = 0;
+ #endif
+
++ if (!dmar_map_gfx)
++ iommu_identity_mapping |= IDENTMAP_GFX;
++
+ check_tylersburg_isoch();
+
+ if (iommu_identity_mapping) {
+--
+2.20.1
+
--- /dev/null
+From 48adaae8cc442bc4b9d4ebd1b77db30a34fdf0e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2019 22:01:03 +0800
+Subject: irqchip/gic-v3-its: fix some definitions of inner cacheability
+ attributes
+
+From: Hongbo Yao <yaohongbo@huawei.com>
+
+[ Upstream commit 0f29456d08042134aff6e562d07a6365c841c4ad ]
+
+Some definitions of Inner Cacheability attibutes need to be corrected.
+
+Fixes: 8c828a535e29f ("irqchip/gicv3-its: Restore all cacheability attributes")
+Signed-off-by: Hongbo Yao <yaohongbo@huawei.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/irqchip/arm-gic-v3.h | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 845ff8c51564c..0fe1fdedb8a19 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -152,7 +152,7 @@
+ #define GICR_PROPBASER_nCnB GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nCnB)
+ #define GICR_PROPBASER_nC GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nC)
+ #define GICR_PROPBASER_RaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
+-#define GICR_PROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt)
++#define GICR_PROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWb)
+ #define GICR_PROPBASER_WaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWt)
+ #define GICR_PROPBASER_WaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWb)
+ #define GICR_PROPBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWaWt)
+@@ -179,7 +179,7 @@
+ #define GICR_PENDBASER_nCnB GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nCnB)
+ #define GICR_PENDBASER_nC GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nC)
+ #define GICR_PENDBASER_RaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
+-#define GICR_PENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt)
++#define GICR_PENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWb)
+ #define GICR_PENDBASER_WaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWt)
+ #define GICR_PENDBASER_WaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWb)
+ #define GICR_PENDBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWaWt)
+@@ -238,7 +238,7 @@
+ #define GICR_VPROPBASER_nCnB GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nCnB)
+ #define GICR_VPROPBASER_nC GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nC)
+ #define GICR_VPROPBASER_RaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
+-#define GICR_VPROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt)
++#define GICR_VPROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWb)
+ #define GICR_VPROPBASER_WaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWt)
+ #define GICR_VPROPBASER_WaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWb)
+ #define GICR_VPROPBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWaWt)
+@@ -264,7 +264,7 @@
+ #define GICR_VPENDBASER_nCnB GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nCnB)
+ #define GICR_VPENDBASER_nC GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nC)
+ #define GICR_VPENDBASER_RaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
+-#define GICR_VPENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt)
++#define GICR_VPENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWb)
+ #define GICR_VPENDBASER_WaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWt)
+ #define GICR_VPENDBASER_WaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWb)
+ #define GICR_VPENDBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWaWt)
+@@ -337,7 +337,7 @@
+ #define GITS_CBASER_nCnB GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nCnB)
+ #define GITS_CBASER_nC GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nC)
+ #define GITS_CBASER_RaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
+-#define GITS_CBASER_RaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt)
++#define GITS_CBASER_RaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWb)
+ #define GITS_CBASER_WaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWt)
+ #define GITS_CBASER_WaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWb)
+ #define GITS_CBASER_RaWaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWaWt)
+@@ -361,7 +361,7 @@
+ #define GITS_BASER_nCnB GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nCnB)
+ #define GITS_BASER_nC GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nC)
+ #define GITS_BASER_RaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
+-#define GITS_BASER_RaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt)
++#define GITS_BASER_RaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWb)
+ #define GITS_BASER_WaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWt)
+ #define GITS_BASER_WaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWb)
+ #define GITS_BASER_RaWaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWaWt)
+--
+2.20.1
+
--- /dev/null
+From a7118888441517b136ec15a803c398fba2d705ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2019 23:14:56 +0000
+Subject: irqdomain: Add the missing assignment of domain->fwnode for named
+ fwnode
+
+From: Dexuan Cui <decui@microsoft.com>
+
+[ Upstream commit 711419e504ebd68c8f03656616829c8ad7829389 ]
+
+Recently device pass-through stops working for Linux VM running on Hyper-V.
+
+git-bisect shows the regression is caused by the recent commit
+467a3bb97432 ("PCI: hv: Allocate a named fwnode ..."), but the root cause
+is that the commit d59f6617eef0 forgets to set the domain->fwnode for
+IRQCHIP_FWNODE_NAMED*, and as a result:
+
+1. The domain->fwnode remains to be NULL.
+
+2. irq_find_matching_fwspec() returns NULL since "h->fwnode == fwnode" is
+false, and pci_set_bus_msi_domain() sets the Hyper-V PCI root bus's
+msi_domain to NULL.
+
+3. When the device is added onto the root bus, the device's dev->msi_domain
+is set to NULL in pci_set_msi_domain().
+
+4. When a device driver tries to enable MSI-X, pci_msi_setup_msi_irqs()
+calls arch_setup_msi_irqs(), which uses the native MSI chip (i.e.
+arch/x86/kernel/apic/msi.c: pci_msi_controller) to set up the irqs, but
+actually pci_msi_setup_msi_irqs() is supposed to call
+msi_domain_alloc_irqs() with the hbus->irq_domain, which is created in
+hv_pcie_init_irq_domain() and is associated with the Hyper-V chip
+hv_msi_irq_chip. Consequently, the irq line is not properly set up, and
+the device driver can not receive any interrupt.
+
+Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only")
+Fixes: 467a3bb97432 ("PCI: hv: Allocate a named fwnode instead of an address-based one")
+Reported-by: Lili Deng <v-lide@microsoft.com>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/r/PU1P153MB01694D9AF625AC335C600C5FBFBE0@PU1P153MB0169.APCP153.PROD.OUTLOOK.COM
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/irq/irqdomain.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
+index ac4644e92b499..0f0e7975a3093 100644
+--- a/kernel/irq/irqdomain.c
++++ b/kernel/irq/irqdomain.c
+@@ -147,6 +147,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size,
+ switch (fwid->type) {
+ case IRQCHIP_FWNODE_NAMED:
+ case IRQCHIP_FWNODE_NAMED_ID:
++ domain->fwnode = fwnode;
+ domain->name = kstrdup(fwid->name, GFP_KERNEL);
+ if (!domain->name) {
+ kfree(domain);
+--
+2.20.1
+
--- /dev/null
+From 0b0b4e474a8120ace95d52fdc93cb5d19b0c1ba1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 12:44:53 -0800
+Subject: iw_cxgb4: use tos when finding ipv6 routes
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit c8a7eb554a83214c3d8ee5cb322da8c72810d2dc ]
+
+When IPv6 support was added, the correct tos was not passed to
+cxgb_find_route6(). This potentially results in the wrong route entry.
+
+Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 942403e42dd0f..7eb1cc1b1aa04 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2147,7 +2147,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep)
+ laddr6->sin6_addr.s6_addr,
+ raddr6->sin6_addr.s6_addr,
+ laddr6->sin6_port,
+- raddr6->sin6_port, 0,
++ raddr6->sin6_port,
++ ep->com.cm_id->tos,
+ raddr6->sin6_scope_id);
+ iptype = 6;
+ ra = (__u8 *)&raddr6->sin6_addr;
+@@ -3298,7 +3299,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+ laddr6->sin6_addr.s6_addr,
+ raddr6->sin6_addr.s6_addr,
+ laddr6->sin6_port,
+- raddr6->sin6_port, 0,
++ raddr6->sin6_port, cm_id->tos,
+ raddr6->sin6_scope_id);
+ }
+ if (!ep->dst) {
+--
+2.20.1
+
--- /dev/null
+From a146a6a50ee308615230c93bef8f89e9aa3484a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 12:44:41 -0800
+Subject: iw_cxgb4: use tos when importing the endpoint
+
+From: Steve Wise <swise@opengridcomputing.com>
+
+[ Upstream commit cb3ba0bde881f0cb7e3945d2a266901e2bd18c92 ]
+
+import_ep() is passed the correct tos, but doesn't use it correctly.
+
+Fixes: ac8e4c69a021 ("cxgb4/iw_cxgb4: TOS support")
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 3668cc71b47e2..942403e42dd0f 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2056,7 +2056,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
+ } else {
+ pdev = get_real_dev(n->dev);
+ ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
+- n, pdev, 0);
++ n, pdev, rt_tos2priority(tos));
+ if (!ep->l2t)
+ goto out;
+ ep->mtu = dst_mtu(dst);
+--
+2.20.1
+
--- /dev/null
+From e50b3c5d44ec48bb4c4b7d912fb3b67ac4f9fa9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 21 Oct 2018 18:27:26 +0300
+Subject: iwlwifi: mvm: avoid possible access out of array.
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+[ Upstream commit b0d795a9ae558209656b18930c2b4def5f8fdfb8 ]
+
+The value in txq_id can be out of array scope,
+validate it before accessing the array.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index 0cfdbaa2af3a7..684c0f65a0528 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -2417,7 +2417,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ struct iwl_mvm_tid_data *tid_data;
+ u16 normalized_ssn;
+- int txq_id;
++ u16 txq_id;
+ int ret;
+
+ if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT))
+@@ -2452,17 +2452,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+ */
+ txq_id = mvmsta->tid_data[tid].txq_id;
+ if (txq_id == IWL_MVM_INVALID_QUEUE) {
+- txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
+- IWL_MVM_DQA_MIN_DATA_QUEUE,
+- IWL_MVM_DQA_MAX_DATA_QUEUE);
+- if (txq_id < 0) {
+- ret = txq_id;
++ ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id,
++ IWL_MVM_DQA_MIN_DATA_QUEUE,
++ IWL_MVM_DQA_MAX_DATA_QUEUE);
++ if (ret < 0) {
+ IWL_ERR(mvm, "Failed to allocate agg queue\n");
+ goto release_locks;
+ }
+
++ txq_id = ret;
++
+ /* TXQ hasn't yet been enabled, so mark it only as reserved */
+ mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED;
++ } else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) {
++ ret = -ENXIO;
++ IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n",
++ tid, IWL_MAX_HW_QUEUES - 1);
++ goto out;
++
+ } else if (unlikely(mvm->queue_info[txq_id].status ==
+ IWL_MVM_QUEUE_SHARED)) {
+ ret = -ENXIO;
+--
+2.20.1
+
--- /dev/null
+From d2197322582bf0aa1d3bccd34cc2876f8ed60b62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Nov 2018 09:51:56 +0100
+Subject: iwlwifi: mvm: fix A-MPDU reference assignment
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 1f7698abedeeb3fef3cbcf78e16f925df675a179 ]
+
+The current code assigns the reference, and then goes to increment
+it if the toggle bit has changed. That way, we get
+
+Toggle 0 0 0 0 1 1 1 1
+ID 1 1 1 1 1 2 2 2
+
+Fix that by assigning the post-toggle ID to get
+
+Toggle 0 0 0 0 1 1 1 1
+ID 1 1 1 1 2 2 2 2
+
+Reported-by: Danny Alexander <danny.alexander@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Fixes: fbe4112791b8 ("iwlwifi: mvm: update mpdu metadata API")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+index 7fb8bbaf21420..1a12e829e98b0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+@@ -871,12 +871,12 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
+ bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE;
+
+ rx_status->flag |= RX_FLAG_AMPDU_DETAILS;
+- rx_status->ampdu_reference = mvm->ampdu_ref;
+ /* toggle is switched whenever new aggregation starts */
+ if (toggle_bit != mvm->ampdu_toggle) {
+ mvm->ampdu_ref++;
+ mvm->ampdu_toggle = toggle_bit;
+ }
++ rx_status->ampdu_reference = mvm->ampdu_ref;
+ }
+
+ rcu_read_lock();
+--
+2.20.1
+
--- /dev/null
+From da8c2589feef6c0902d6da77b3e53420870e003a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 09:45:11 +0200
+Subject: iwlwifi: mvm: fix RSS config command
+
+From: Sara Sharon <sara.sharon@intel.com>
+
+[ Upstream commit 608dce95db10b8ee1a26dbce3f60204bb69812a5 ]
+
+The hash mask is a bitmap, so we should use BIT() on
+the enum values.
+
+Signed-off-by: Sara Sharon <sara.sharon@intel.com>
+Fixes: 43413a975d06 ("iwlwifi: mvm: support rss queues configuration command")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 78228f870f8f5..754dcc1c1f400 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -107,12 +107,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
+ int i;
+ struct iwl_rss_config_cmd cmd = {
+ .flags = cpu_to_le32(IWL_RSS_ENABLE),
+- .hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP |
+- IWL_RSS_HASH_TYPE_IPV4_UDP |
+- IWL_RSS_HASH_TYPE_IPV4_PAYLOAD |
+- IWL_RSS_HASH_TYPE_IPV6_TCP |
+- IWL_RSS_HASH_TYPE_IPV6_UDP |
+- IWL_RSS_HASH_TYPE_IPV6_PAYLOAD,
++ .hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) |
++ BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) |
++ BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD),
+ };
+
+ if (mvm->trans->num_rx_queues == 1)
+--
+2.20.1
+
--- /dev/null
+From 8302105db137b89c420cda8516fedcdd6a36f8fe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 04:03:49 +0000
+Subject: ixgbe: sync the first fragment unconditionally
+
+From: Firo Yang <firo.yang@suse.com>
+
+[ Upstream commit e7ba676c6188d394a0133fc4b9bcd7ee50d54b7f ]
+
+In Xen environment, if Xen-swiotlb is enabled, ixgbe driver
+could possibly allocate a page, DMA memory buffer, for the first
+fragment which is not suitable for Xen-swiotlb to do DMA operations.
+Xen-swiotlb have to internally allocate another page for doing DMA
+operations. This mechanism requires syncing the data from the internal
+page to the page which ixgbe sends to upper network stack. However,
+since commit f3213d932173 ("ixgbe: Update driver to make use of DMA
+attributes in Rx path"), the unmap operation is performed with
+DMA_ATTR_SKIP_CPU_SYNC. As a result, the sync is not performed.
+Since the sync isn't performed, the upper network stack could receive
+a incomplete network packet. By incomplete, it means the linear data
+on the first fragment(between skb->head and skb->end) is invalid. So
+we have to copy the data from the internal xen-swiotlb page to the page
+which ixgbe sends to upper network stack through the sync operation.
+
+More details from Alexander Duyck:
+Specifically since we are mapping the frame with
+DMA_ATTR_SKIP_CPU_SYNC we have to unmap with that as well. As a result
+a sync is not performed on an unmap and must be done manually as we
+skipped it for the first frag. As such we need to always sync before
+possibly performing a page unmap operation.
+
+Fixes: f3213d932173 ("ixgbe: Update driver to make use of DMA attributes in Rx path")
+Signed-off-by: Firo Yang <firo.yang@suse.com>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 0edfd199937d5..e4c1e6345edd0 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -1871,13 +1871,7 @@ static void ixgbe_pull_tail(struct ixgbe_ring *rx_ring,
+ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
+ struct sk_buff *skb)
+ {
+- /* if the page was released unmap it, else just sync our portion */
+- if (unlikely(IXGBE_CB(skb)->page_released)) {
+- dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
+- ixgbe_rx_pg_size(rx_ring),
+- DMA_FROM_DEVICE,
+- IXGBE_RX_DMA_ATTR);
+- } else if (ring_uses_build_skb(rx_ring)) {
++ if (ring_uses_build_skb(rx_ring)) {
+ unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK;
+
+ dma_sync_single_range_for_cpu(rx_ring->dev,
+@@ -1894,6 +1888,14 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring,
+ skb_frag_size(frag),
+ DMA_FROM_DEVICE);
+ }
++
++ /* If the page was released, just unmap it. */
++ if (unlikely(IXGBE_CB(skb)->page_released)) {
++ dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma,
++ ixgbe_rx_pg_size(rx_ring),
++ DMA_FROM_DEVICE,
++ IXGBE_RX_DMA_ATTR);
++ }
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 3d0997dc56b879553ebf08a605777eed0130509c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 15:19:16 +0100
+Subject: jfs: fix bogus variable self-initialization
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ]
+
+A statement was originally added in 2006 to shut up a gcc warning,
+now but now clang warns about it:
+
+fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization
+ [-Werror,-Wuninitialized]
+ pxd_t pxd = pxd; /* truncated extent of xad */
+ ~~~ ^~~
+
+Modern versions of gcc are fine without the silly assignment, so just
+drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9.
+
+Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index 4d973524c8879..224ef034004b7 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+ * header ?
+ */
+ if (tlck->type & tlckTRUNCATE) {
+- /* This odd declaration suppresses a bogus gcc warning */
+- pxd_t pxd = pxd; /* truncated extent of xad */
++ pxd_t pxd; /* truncated extent of xad */
+ int twm;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 975a50d929f37fb9c93b46ce8f3e33ce09fe348d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Jan 2019 16:19:00 +0900
+Subject: kbuild: mark prepare0 as PHONY to fix external module build
+
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+[ Upstream commit e00d8880481497474792d28c14479a9fb6752046 ]
+
+Commit c3ff2a5193fa ("powerpc/32: add stack protector support")
+caused kernel panic on PowerPC when an external module is used with
+CONFIG_STACKPROTECTOR because the 'prepare' target was not executed
+for the external module build.
+
+Commit e07db28eea38 ("kbuild: fix single target build for external
+module") turned it into a build error because the 'prepare' target is
+now executed but the 'prepare0' target is missing for the external
+module build.
+
+External module on arm/arm64 with CONFIG_STACKPROTECTOR_PER_TASK is
+also broken in the same way.
+
+Move 'PHONY += prepare0' to the common place. GNU Make is fine with
+missing rule for phony targets. I also removed the comment which is
+wrong irrespective of this commit.
+
+I minimize the change so it can be easily backported to 4.20.x
+
+To fix v4.20, please backport e07db28eea38 ("kbuild: fix single target
+build for external module"), and then this commit.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=201891
+Fixes: e07db28eea38 ("kbuild: fix single target build for external module")
+Fixes: c3ff2a5193fa ("powerpc/32: add stack protector support")
+Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries")
+Fixes: 0a1213fa7432 ("arm64: enable per-task stack canaries")
+Cc: linux-stable <stable@vger.kernel.org> # v4.20
+Reported-by: Samuel Holland <samuel@sholland.org>
+Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index 3e8eaabf2bcbd..b538e6170f730 100644
+--- a/Makefile
++++ b/Makefile
+@@ -971,6 +971,7 @@ ifdef CONFIG_STACK_VALIDATION
+ endif
+ endif
+
++PHONY += prepare0
+
+ ifeq ($(KBUILD_EXTMOD),)
+ core-y += kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/
+@@ -1065,8 +1066,7 @@ include/config/kernel.release: include/config/auto.conf FORCE
+ # archprepare is used in arch Makefiles and when processed asm symlink,
+ # version.h and scripts_basic is processed / created.
+
+-# Listed in dependency order
+-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3
++PHONY += prepare archprepare prepare1 prepare2 prepare3
+
+ # prepare3 is used to check if we are building in a separate output directory,
+ # and if so do:
+--
+2.20.1
+
--- /dev/null
+From 3e99eca411344d0aca75149d8018b073311559a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 15:50:18 +0300
+Subject: kdb: do a sanity check on the cpu in kdb_per_cpu()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ]
+
+The "whichcpu" comes from argv[3]. The cpu_online() macro looks up the
+cpu in a bitmap of online cpus, but if the value is too high then it
+could read beyond the end of the bitmap and possibly Oops.
+
+Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/debug/kdb/kdb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 993db6b2348e7..15d902daeef6c 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2634,7 +2634,7 @@ static int kdb_per_cpu(int argc, const char **argv)
+ diag = kdbgetularg(argv[3], &whichcpu);
+ if (diag)
+ return diag;
+- if (!cpu_online(whichcpu)) {
++ if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
+ kdb_printf("cpu %ld is not online\n", whichcpu);
+ return KDB_BADCPUNUM;
+ }
+--
+2.20.1
+
--- /dev/null
+From bad8b5fb9421969da6760451a54d8f3152e51ecd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Feb 2019 16:20:37 +0000
+Subject: keys: Timestamp new keys
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 ]
+
+Set the timestamp on new keys rather than leaving it unset.
+
+Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: James Morris <james.morris@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/keys/key.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 87172f99f73e0..17244f5f54c69 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ key->gid = gid;
+ key->perm = perm;
+ key->restrict_link = restrict_link;
++ key->last_used_at = ktime_get_real_seconds();
+
+ if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
+ key->flags |= 1 << KEY_FLAG_IN_QUOTA;
+--
+2.20.1
+
--- /dev/null
+From 6190b5109419a19da003f120666174d268af0be8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Feb 2019 15:37:45 +1100
+Subject: KVM: PPC: Release all hardware TCE tables attached to a group
+
+From: Alexey Kardashevskiy <aik@ozlabs.ru>
+
+[ Upstream commit a67614cc05a5052b265ea48196dab2fce11f5f2e ]
+
+The SPAPR TCE KVM device references all hardware IOMMU tables assigned to
+some IOMMU group to ensure that in-kernel KVM acceleration of H_PUT_TCE
+can work. The tables are references when an IOMMU group gets registered
+with the VFIO KVM device by the KVM_DEV_VFIO_GROUP_ADD ioctl;
+KVM_DEV_VFIO_GROUP_DEL calls into the dereferencing code
+in kvm_spapr_tce_release_iommu_group() which walks through the list of
+LIOBNs, finds a matching IOMMU table and calls kref_put() when found.
+
+However that code stops after the very first successful derefencing
+leaving other tables referenced till the SPAPR TCE KVM device is destroyed
+which normally happens on guest reboot or termination so if we do hotplug
+and unplug in a loop, we are leaking IOMMU tables here.
+
+This removes a premature return to let kvm_spapr_tce_release_iommu_group()
+find and dereference all attached tables.
+
+Fixes: 121f80ba68f ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO")
+Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kvm/book3s_64_vio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c
+index 5e44462960213..ef6a58838e7ce 100644
+--- a/arch/powerpc/kvm/book3s_64_vio.c
++++ b/arch/powerpc/kvm/book3s_64_vio.c
+@@ -134,7 +134,6 @@ extern void kvm_spapr_tce_release_iommu_group(struct kvm *kvm,
+ continue;
+
+ kref_put(&stit->kref, kvm_spapr_tce_liobn_put);
+- return;
+ }
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From c2079220abc48913aa84cb6441babe4e1e30b10c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 22:44:04 +0800
+Subject: l2tp: Fix possible NULL pointer dereference
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 638a3a1e349ddf5b82f222ff5cb3b4f266e7c278 ]
+
+BUG: unable to handle kernel NULL pointer dereference at 0000000000000128
+PGD 0 P4D 0
+Oops: 0000 [#1
+CPU: 0 PID: 5697 Comm: modprobe Tainted: G W 5.1.0-rc7+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
+RIP: 0010:__lock_acquire+0x53/0x10b0
+Code: 8b 1c 25 40 5e 01 00 4c 8b 6d 10 45 85 e4 0f 84 bd 06 00 00 44 8b 1d 7c d2 09 02 49 89 fe 41 89 d2 45 85 db 0f 84 47 02 00 00 <48> 81 3f a0 05 70 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f 86 3a
+RSP: 0018:ffffc90001c07a28 EFLAGS: 00010002
+RAX: 0000000000000000 RBX: ffff88822f038440 RCX: 0000000000000000
+RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000128
+RBP: ffffc90001c07a88 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
+R13: 0000000000000000 R14: 0000000000000128 R15: 0000000000000000
+FS: 00007fead0811540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000128 CR3: 00000002310da000 CR4: 00000000000006f0
+Call Trace:
+ ? __lock_acquire+0x24e/0x10b0
+ lock_acquire+0xdf/0x230
+ ? flush_workqueue+0x71/0x530
+ flush_workqueue+0x97/0x530
+ ? flush_workqueue+0x71/0x530
+ l2tp_exit_net+0x170/0x2b0 [l2tp_core
+ ? l2tp_exit_net+0x93/0x2b0 [l2tp_core
+ ops_exit_list.isra.6+0x36/0x60
+ unregister_pernet_operations+0xb8/0x110
+ unregister_pernet_device+0x25/0x40
+ l2tp_init+0x55/0x1000 [l2tp_core
+ ? 0xffffffffa018d000
+ do_one_initcall+0x6c/0x3cc
+ ? do_init_module+0x22/0x1f1
+ ? rcu_read_lock_sched_held+0x97/0xb0
+ ? kmem_cache_alloc_trace+0x325/0x3b0
+ do_init_module+0x5b/0x1f1
+ load_module+0x1db1/0x2690
+ ? m_show+0x1d0/0x1d0
+ __do_sys_finit_module+0xc5/0xd0
+ __x64_sys_finit_module+0x15/0x20
+ do_syscall_64+0x6b/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+RIP: 0033:0x7fead031a839
+Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48
+RSP: 002b:00007ffe8d9acca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+RAX: ffffffffffffffda RBX: 0000560078398b80 RCX: 00007fead031a839
+RDX: 0000000000000000 RSI: 000056007659dc2e RDI: 0000000000000003
+RBP: 000056007659dc2e R08: 0000000000000000 R09: 0000560078398b80
+R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
+R13: 00005600783a04a0 R14: 0000000000040000 R15: 0000560078398b80
+Modules linked in: l2tp_core(+) e1000 ip_tables ipv6 [last unloaded: l2tp_core
+CR2: 0000000000000128
+---[ end trace 8322b2b8bf83f8e1
+
+If alloc_workqueue fails in l2tp_init, l2tp_net_ops
+is unregistered on failure path. Then l2tp_exit_net
+is called which will flush NULL workqueue, this patch
+add a NULL check to fix it.
+
+Fixes: 67e04c29ec0d ("l2tp: unregister l2tp_net_ops on failure path")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/l2tp/l2tp_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index e494f04819e9c..b9be0360ab94b 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1892,7 +1892,8 @@ static __net_exit void l2tp_exit_net(struct net *net)
+ }
+ rcu_read_unlock_bh();
+
+- flush_workqueue(l2tp_wq);
++ if (l2tp_wq)
++ flush_workqueue(l2tp_wq);
+ rcu_barrier();
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 99c31162ee4d268fb69be4e6c3bd7fe9cbeade99 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 22:42:18 +0800
+Subject: libertas_tf: Use correct channel range in lbtf_geo_init
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 ]
+
+It seems we should use 'range' instead of 'priv->range'
+in lbtf_geo_init(), because 'range' is the corret one
+related to current regioncode.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/marvell/libertas_tf/cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/marvell/libertas_tf/cmd.c b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+index 909ac3685010f..2b193f1257a5a 100644
+--- a/drivers/net/wireless/marvell/libertas_tf/cmd.c
++++ b/drivers/net/wireless/marvell/libertas_tf/cmd.c
+@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
+ break;
+ }
+
+- for (ch = priv->range.start; ch < priv->range.end; ch++)
++ for (ch = range->start; ch < range->end; ch++)
+ priv->channels[CHAN_TO_IDX(ch)].flags = 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 545b134508eb7d3d64b5579268bc49fcc6b0c48b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 May 2019 20:37:59 +0200
+Subject: lightnvm: pblk: fix lock order in pblk_rb_tear_down_check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Igor Konopko <igor.j.konopko@intel.com>
+
+[ Upstream commit 486b5aac85f6ec0b2df3e82a6a629d5eb7804db5 ]
+
+In pblk_rb_tear_down_check() the spinlock functions are not
+called in proper order.
+
+Fixes: a4bd217 ("lightnvm: physical block device (pblk) target")
+Signed-off-by: Igor Konopko <igor.j.konopko@intel.com>
+Reviewed-by: Javier González <javier@javigon.com>
+Reviewed-by: Hans Holmberg <hans.holmberg@cnexlabs.com>
+Signed-off-by: Matias Bjørling <mb@lightnvm.io>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/lightnvm/pblk-rb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c
+index c0dd17a821709..73de2deaba673 100644
+--- a/drivers/lightnvm/pblk-rb.c
++++ b/drivers/lightnvm/pblk-rb.c
+@@ -825,8 +825,8 @@ int pblk_rb_tear_down_check(struct pblk_rb *rb)
+ }
+
+ out:
+- spin_unlock(&rb->w_lock);
+ spin_unlock_irq(&rb->s_lock);
++ spin_unlock(&rb->w_lock);
+
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0de46079c91165b015a1bb86d5919899d5d26b26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:26 -0700
+Subject: llc: fix another potential sk_buff leak in llc_ui_sendmsg()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ]
+
+All callers of llc_conn_state_process() except llc_build_and_send_pkt()
+(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always
+consumes a reference to the skb. Fix this caller to do the same.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/af_llc.c | 34 ++++++++++++++++++++--------------
+ net/llc/llc_conn.c | 2 ++
+ net/llc/llc_if.c | 12 ++++++++----
+ 3 files changed, 30 insertions(+), 18 deletions(-)
+
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index 2e472d5c3ea41..d552e88197133 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -113,22 +113,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
+ *
+ * Send data via reliable llc2 connection.
+ * Returns 0 upon success, non-zero if action did not succeed.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
+ {
+ struct llc_sock* llc = llc_sk(sk);
+- int rc = 0;
+
+ if (unlikely(llc_data_accept_state(llc->state) ||
+ llc->remote_busy_flag ||
+ llc->p_flag)) {
+ long timeout = sock_sndtimeo(sk, noblock);
++ int rc;
+
+ rc = llc_ui_wait_for_busy_core(sk, timeout);
++ if (rc) {
++ kfree_skb(skb);
++ return rc;
++ }
+ }
+- if (unlikely(!rc))
+- rc = llc_build_and_send_pkt(sk, skb);
+- return rc;
++ return llc_build_and_send_pkt(sk, skb);
+ }
+
+ static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
+@@ -900,7 +904,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
+ int flags = msg->msg_flags;
+ int noblock = flags & MSG_DONTWAIT;
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
+ size_t size = 0;
+ int rc = -EINVAL, copied = 0, hdrlen;
+
+@@ -909,10 +913,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ lock_sock(sk);
+ if (addr) {
+ if (msg->msg_namelen < sizeof(*addr))
+- goto release;
++ goto out;
+ } else {
+ if (llc_ui_addr_null(&llc->addr))
+- goto release;
++ goto out;
+ addr = &llc->addr;
+ }
+ /* must bind connection to sap if user hasn't done it. */
+@@ -920,7 +924,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ /* bind to sap with null dev, exclusive. */
+ rc = llc_ui_autobind(sock, addr);
+ if (rc)
+- goto release;
++ goto out;
+ }
+ hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
+ size = hdrlen + len;
+@@ -929,12 +933,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ copied = size - hdrlen;
+ rc = -EINVAL;
+ if (copied < 0)
+- goto release;
++ goto out;
+ release_sock(sk);
+ skb = sock_alloc_send_skb(sk, size, noblock, &rc);
+ lock_sock(sk);
+ if (!skb)
+- goto release;
++ goto out;
+ skb->dev = llc->dev;
+ skb->protocol = llc_proto_type(addr->sllc_arphrd);
+ skb_reserve(skb, hdrlen);
+@@ -944,29 +948,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
+ llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ if (addr->sllc_test) {
+ llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ if (addr->sllc_xid) {
+ llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ rc = -ENOPROTOOPT;
+ if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
+ goto out;
+ rc = llc_ui_send_data(sk, skb, noblock);
++ skb = NULL;
+ out:
+- if (rc) {
+- kfree_skb(skb);
+-release:
++ kfree_skb(skb);
++ if (rc)
+ dprintk("%s: failed sending from %02X to %02X: %d\n",
+ __func__, llc->laddr.lsap, llc->daddr.lsap, rc);
+- }
+ release_sock(sk);
+ return rc ? : copied;
+ }
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 444c13e752a08..7340f23e16de3 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
+ * (executing it's actions and changing state), upper layer will be
+ * indicated or confirmed, if needed. Returns 0 for success, 1 for
+ * failure. The socket lock has to be held before calling this function.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ {
+diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
+index 6daf391b3e847..fc4d2bd8816f5 100644
+--- a/net/llc/llc_if.c
++++ b/net/llc/llc_if.c
+@@ -38,6 +38,8 @@
+ * closed and -EBUSY when sending data is not permitted in this state or
+ * LLC has send an I pdu with p bit set to 1 and is waiting for it's
+ * response.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ struct llc_sock *llc = llc_sk(sk);
+
+ if (unlikely(llc->state == LLC_CONN_STATE_ADM))
+- goto out;
++ goto out_free;
+ rc = -EBUSY;
+ if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
+ llc->p_flag)) {
+ llc->failed_data_req = 1;
+- goto out;
++ goto out_free;
+ }
+ ev = llc_conn_ev(skb);
+ ev->type = LLC_CONN_EV_TYPE_PRIM;
+ ev->prim = LLC_DATA_PRIM;
+ ev->prim_type = LLC_PRIM_TYPE_REQ;
+ skb->dev = llc->dev;
+- rc = llc_conn_state_process(sk, skb);
+-out:
++ return llc_conn_state_process(sk, skb);
++
++out_free:
++ kfree_skb(skb);
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From bc02bfa5c80ccbcab85b86f2bf39aa27fb9b17f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:27 -0700
+Subject: llc: fix sk_buff refcounting in llc_conn_state_process()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 36453c852816f19947ca482a595dffdd2efa4965 ]
+
+If llc_conn_state_process() sees that llc_conn_service() put the skb on
+a list, it will drop one fewer references to it. This is wrong because
+the current behavior is that llc_conn_service() never consumes a
+reference to the skb.
+
+The code also makes the number of skb references being dropped
+conditional on which of ind_prim and cfm_prim are nonzero, yet neither
+of these affects how many references are *acquired*. So there is extra
+code that tries to fix this up by sometimes taking another reference.
+
+Remove the unnecessary/broken refcounting logic and instead just add an
+skb_get() before the only two places where an extra reference is
+actually consumed.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/llc_conn.c | 33 ++++++---------------------------
+ 1 file changed, 6 insertions(+), 27 deletions(-)
+
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 7340f23e16de3..7fbc682aff043 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -64,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ struct llc_sock *llc = llc_sk(skb->sk);
+ struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+
+- /*
+- * We have to hold the skb, because llc_conn_service will kfree it in
+- * the sending path and we need to look at the skb->cb, where we encode
+- * llc_conn_state_ev.
+- */
+- skb_get(skb);
+ ev->ind_prim = ev->cfm_prim = 0;
+ /*
+ * Send event to state machine
+@@ -77,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ rc = llc_conn_service(skb->sk, skb);
+ if (unlikely(rc != 0)) {
+ printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
+- goto out_kfree_skb;
+- }
+-
+- if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
+- /* indicate or confirm not required */
+- if (!skb->next)
+- goto out_kfree_skb;
+ goto out_skb_put;
+ }
+
+- if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
+- skb_get(skb);
+-
+ switch (ev->ind_prim) {
+ case LLC_DATA_PRIM:
++ skb_get(skb);
+ llc_save_primitive(sk, skb, LLC_DATA_PRIM);
+ if (unlikely(sock_queue_rcv_skb(sk, skb))) {
+ /*
+@@ -108,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ * skb->sk pointing to the newly created struct sock in
+ * llc_conn_handler. -acme
+ */
++ skb_get(skb);
+ skb_queue_tail(&sk->sk_receive_queue, skb);
+ sk->sk_state_change(sk);
+ break;
+@@ -123,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ sk->sk_state_change(sk);
+ }
+ }
+- kfree_skb(skb);
+ sock_put(sk);
+ break;
+ case LLC_RESET_PRIM:
+@@ -132,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ * RESET is not being notified to upper layers for now
+ */
+ printk(KERN_INFO "%s: received a reset ind!\n", __func__);
+- kfree_skb(skb);
+ break;
+ default:
+- if (ev->ind_prim) {
++ if (ev->ind_prim)
+ printk(KERN_INFO "%s: received unknown %d prim!\n",
+ __func__, ev->ind_prim);
+- kfree_skb(skb);
+- }
+ /* No indication */
+ break;
+ }
+@@ -181,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ printk(KERN_INFO "%s: received a reset conf!\n", __func__);
+ break;
+ default:
+- if (ev->cfm_prim) {
++ if (ev->cfm_prim)
+ printk(KERN_INFO "%s: received unknown %d prim!\n",
+ __func__, ev->cfm_prim);
+- break;
+- }
+- goto out_skb_put; /* No confirmation */
++ /* No confirmation */
++ break;
+ }
+-out_kfree_skb:
+- kfree_skb(skb);
+ out_skb_put:
+ kfree_skb(skb);
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 93c94b74f9afae24c53e0e8665ba959b44c1b76b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: Call timer_interrupt() with interrupts disabled
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 1efdd4bd254311498123a15fa0acd565f454da97 ]
+
+Some platforms execute their timer handler with the interrupt priority
+level set below 6. That means the handler could be interrupted by another
+driver and this could lead to re-entry of the timer core.
+
+Avoid this by use of local_irq_save/restore for timer interrupt dispatch.
+This provides mutual exclusion around the timer interrupt flag access
+which is needed later in this series for the clocksource conversion.
+
+Reported-by: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1811131407120.2697@nanos.tec.linutronix.de
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/amiga/cia.c | 9 +++++++++
+ arch/m68k/atari/ataints.c | 4 ++--
+ arch/m68k/atari/time.c | 15 ++++++++++++++-
+ arch/m68k/bvme6000/config.c | 20 ++++++++++----------
+ arch/m68k/hp300/time.c | 10 ++++++++--
+ arch/m68k/mac/via.c | 17 +++++++++++++++++
+ arch/m68k/mvme147/config.c | 18 ++++++++++--------
+ arch/m68k/mvme16x/config.c | 21 +++++++++++----------
+ arch/m68k/q40/q40ints.c | 19 +++++++++++--------
+ arch/m68k/sun3/sun3ints.c | 3 +++
+ arch/m68k/sun3x/time.c | 16 ++++++++++------
+ 11 files changed, 105 insertions(+), 47 deletions(-)
+
+diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
+index 2081b8cd5591c..b9aee983e6f4c 100644
+--- a/arch/m68k/amiga/cia.c
++++ b/arch/m68k/amiga/cia.c
+@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
+ struct ciabase *base = dev_id;
+ int mach_irq;
+ unsigned char ints;
++ unsigned long flags;
+
++ /* Interrupts get disabled while the timer irq flag is cleared and
++ * the timer interrupt serviced.
++ */
+ mach_irq = base->cia_irq;
++ local_irq_save(flags);
+ ints = cia_set_irq(base, CIA_ICR_ALL);
+ amiga_custom.intreq = base->int_mask;
++ if (ints & 1)
++ generic_handle_irq(mach_irq);
++ local_irq_restore(flags);
++ mach_irq++, ints >>= 1;
+ for (; ints; mach_irq++, ints >>= 1) {
+ if (ints & 1)
+ generic_handle_irq(mach_irq);
+diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
+index 3d2b63bedf058..56f02ea2c248d 100644
+--- a/arch/m68k/atari/ataints.c
++++ b/arch/m68k/atari/ataints.c
+@@ -142,7 +142,7 @@ struct mfptimerbase {
+ .name = "MFP Timer D"
+ };
+
+-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
++static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
+ {
+ struct mfptimerbase *base = dev_id;
+ int mach_irq;
+@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
+ st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
+
+ /* request timer D dispatch handler */
+- if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
++ if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
+ stmfp_base.name, &stmfp_base))
+ pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
+
+diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
+index c549b48174ec8..972181c1fe4b7 100644
+--- a/arch/m68k/atari/time.c
++++ b/arch/m68k/atari/time.c
+@@ -24,6 +24,18 @@
+ DEFINE_SPINLOCK(rtc_lock);
+ EXPORT_SYMBOL_GPL(rtc_lock);
+
++static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
++{
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
++}
++
+ void __init
+ atari_sched_init(irq_handler_t timer_routine)
+ {
+@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
+ /* start timer C, div = 1:100 */
+ st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
+ /* install interrupt service routine for MFP Timer C */
+- if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
++ if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
++ timer_routine))
+ pr_err("Couldn't register timer interrupt\n");
+ }
+
+diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
+index 2cfff47650407..0e602c32b246f 100644
+--- a/arch/m68k/bvme6000/config.c
++++ b/arch/m68k/bvme6000/config.c
+@@ -45,11 +45,6 @@ extern int bvme6000_set_clock_mmss (unsigned long);
+ extern void bvme6000_reset (void);
+ void bvme6000_set_vectors (void);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+
+ int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -159,12 +154,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
+
+ static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+ volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
+- unsigned char msr = rtc->msr & 0xc0;
++ unsigned char msr;
+
++ local_irq_save(flags);
++ msr = rtc->msr & 0xc0;
+ rtc->msr = msr | 0x20; /* Ack the interrupt */
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
+
+- return tick_handler(irq, dev_id);
++ return IRQ_HANDLED;
+ }
+
+ /*
+@@ -183,9 +184,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
+
+ rtc->msr = 0; /* Ensure timer registers accessible */
+
+- tick_handler = timer_routine;
+- if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
+- "timer", bvme6000_timer_int))
++ if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
++ timer_routine))
+ panic ("Couldn't register timer int");
+
+ rtc->t1cr_omr = 0x04; /* Mode 2, ext clk */
+diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
+index 289d928a46cbe..d30b03ea93a27 100644
+--- a/arch/m68k/hp300/time.c
++++ b/arch/m68k/hp300/time.c
+@@ -38,13 +38,19 @@
+
+ static irqreturn_t hp300_tick(int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+ unsigned long tmp;
+- irq_handler_t vector = dev_id;
++
++ local_irq_save(flags);
+ in_8(CLOCKBASE + CLKSR);
+ asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
+ /* Turn off the network and SCSI leds */
+ blinken_leds(0, 0xe0);
+- return vector(irq, NULL);
++ return IRQ_HANDLED;
+ }
+
+ u32 hp300_gettimeoffset(void)
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index 7334245abf26f..863806e6775a8 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -398,6 +398,8 @@ void via_nubus_irq_shutdown(int irq)
+ * via6522.c :-), disable/pending masks added.
+ */
+
++#define VIA_TIMER_1_INT BIT(6)
++
+ void via1_irq(struct irq_desc *desc)
+ {
+ int irq_num;
+@@ -407,6 +409,21 @@ void via1_irq(struct irq_desc *desc)
+ if (!events)
+ return;
+
++ irq_num = IRQ_MAC_TIMER_1;
++ irq_bit = VIA_TIMER_1_INT;
++ if (events & irq_bit) {
++ unsigned long flags;
++
++ local_irq_save(flags);
++ via1[vIFR] = irq_bit;
++ generic_handle_irq(irq_num);
++ local_irq_restore(flags);
++
++ events &= ~irq_bit;
++ if (!events)
++ return;
++ }
++
+ irq_num = VIA1_SOURCE_BASE;
+ irq_bit = 1;
+ do {
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index 8778612d1f312..78ae803c833e1 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -46,11 +46,6 @@ extern void mvme147_reset (void);
+
+ static int bcd2int (unsigned char b);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme147_process_int() */
+-
+-irq_handler_t tick_handler;
+-
+
+ int __init mvme147_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -106,16 +101,23 @@ void __init config_mvme147(void)
+
+ static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
+ m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
+ m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
+- return tick_handler(irq, dev_id);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
+ }
+
+
+ void mvme147_sched_init (irq_handler_t timer_routine)
+ {
+- tick_handler = timer_routine;
+- if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
++ if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
++ timer_routine))
+ pr_err("Couldn't register timer interrupt\n");
+
+ /* Init the clock with a value */
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index 6fa06d4d16bf0..3116dd576bb3c 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -51,11 +51,6 @@ extern void mvme16x_reset (void);
+
+ int bcd2int (unsigned char b);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+
+ unsigned short mvme16x_config;
+ EXPORT_SYMBOL(mvme16x_config);
+@@ -354,8 +349,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
+
+ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
+ {
+- *(volatile unsigned char *)0xfff4201b |= 8;
+- return tick_handler(irq, dev_id);
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ *(volatile unsigned char *)0xfff4201b |= 8;
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
+ }
+
+ void mvme16x_sched_init (irq_handler_t timer_routine)
+@@ -363,14 +365,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
+ uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
+ int irq;
+
+- tick_handler = timer_routine;
+ /* Using PCCchip2 or MC2 chip tick timer 1 */
+ *(volatile unsigned long *)0xfff42008 = 0;
+ *(volatile unsigned long *)0xfff42004 = 10000; /* 10ms */
+ *(volatile unsigned char *)0xfff42017 |= 3;
+ *(volatile unsigned char *)0xfff4201b = 0x16;
+- if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
+- "timer", mvme16x_timer_int))
++ if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
++ timer_routine))
+ panic ("Couldn't register timer int");
+
+ if (brdno == 0x0162 || brdno == 0x172)
+diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
+index 3e7603202977e..1c696906c159f 100644
+--- a/arch/m68k/q40/q40ints.c
++++ b/arch/m68k/q40/q40ints.c
+@@ -127,10 +127,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
+ sound_ticks = ticks << 1;
+ }
+
+-static irq_handler_t q40_timer_routine;
+-
+-static irqreturn_t q40_timer_int (int irq, void * dev)
++static irqreturn_t q40_timer_int(int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++
+ ql_ticks = ql_ticks ? 0 : 1;
+ if (sound_ticks) {
+ unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
+@@ -139,8 +139,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
+ *DAC_RIGHT=sval;
+ }
+
+- if (!ql_ticks)
+- q40_timer_routine(irq, dev);
++ if (!ql_ticks) {
++ unsigned long flags;
++
++ local_irq_save(flags);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++ }
+ return IRQ_HANDLED;
+ }
+
+@@ -148,11 +153,9 @@ void q40_sched_init (irq_handler_t timer_routine)
+ {
+ int timer_irq;
+
+- q40_timer_routine = timer_routine;
+ timer_irq = Q40_IRQ_FRAME;
+
+- if (request_irq(timer_irq, q40_timer_int, 0,
+- "timer", q40_timer_int))
++ if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
+ panic("Couldn't register timer int");
+
+ master_outb(-1, FRAME_CLEAR_REG);
+diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
+index 6bbca30c91884..a5824abb4a39c 100644
+--- a/arch/m68k/sun3/sun3ints.c
++++ b/arch/m68k/sun3/sun3ints.c
+@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
+
+ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ {
++ unsigned long flags;
+ unsigned int cnt;
+
++ local_irq_save(flags);
+ #ifdef CONFIG_SUN3
+ intersil_clear();
+ #endif
+@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ cnt = kstat_irqs_cpu(irq, 0);
+ if (!(cnt % 20))
+ sun3_leds(led_pattern[cnt % 160 / 20]);
++ local_irq_restore(flags);
+ return IRQ_HANDLED;
+ }
+
+diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
+index 7a2c53d9f779a..48b43903253e4 100644
+--- a/arch/m68k/sun3x/time.c
++++ b/arch/m68k/sun3x/time.c
+@@ -78,15 +78,19 @@ u32 sun3x_gettimeoffset(void)
+ }
+
+ #if 0
+-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
++static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
+ {
+- void (*vector)(int, void *, struct pt_regs *) = dev_id;
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+
+- /* Clear the pending interrupt - pulse the enable line low */
+- disable_irq(5);
+- enable_irq(5);
++ local_irq_save(flags);
++ /* Clear the pending interrupt - pulse the enable line low */
++ disable_irq(5);
++ enable_irq(5);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
+
+- vector(irq, NULL, regs);
++ return IRQ_HANDLED;
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From c8e32ed8496da6ff7246919c0a8a367ea0c99de6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: mac: Fix VIA timer counter accesses
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ]
+
+This resolves some bugs that affect VIA timer counter accesses.
+Avoid lost interrupts caused by reading the counter low byte register.
+Make allowance for the fact that the counter will be decremented to
+0xFFFF before being reloaded.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/mac/via.c | 102 +++++++++++++++++++++++---------------------
+ 1 file changed, 53 insertions(+), 49 deletions(-)
+
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index 9f59a662ace57..7334245abf26f 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -54,16 +54,6 @@ static __u8 rbv_clear;
+
+ static int gIER,gIFR,gBufA,gBufB;
+
+-/*
+- * Timer defs.
+- */
+-
+-#define TICK_SIZE 10000
+-#define MAC_CLOCK_TICK (783300/HZ) /* ticks per HZ */
+-#define MAC_CLOCK_LOW (MAC_CLOCK_TICK&0xFF)
+-#define MAC_CLOCK_HIGH (MAC_CLOCK_TICK>>8)
+-
+-
+ /*
+ * On Macs with a genuine VIA chip there is no way to mask an individual slot
+ * interrupt. This limitation also seems to apply to VIA clone logic cores in
+@@ -278,22 +268,6 @@ void __init via_init(void)
+ }
+ }
+
+-/*
+- * Start the 100 Hz clock
+- */
+-
+-void __init via_init_clock(irq_handler_t func)
+-{
+- via1[vACR] |= 0x40;
+- via1[vT1LL] = MAC_CLOCK_LOW;
+- via1[vT1LH] = MAC_CLOCK_HIGH;
+- via1[vT1CL] = MAC_CLOCK_LOW;
+- via1[vT1CH] = MAC_CLOCK_HIGH;
+-
+- if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
+- pr_err("Couldn't register %s interrupt\n", "timer");
+-}
+-
+ /*
+ * Debugging dump, used in various places to see what's going on.
+ */
+@@ -321,29 +295,6 @@ void via_debug_dump(void)
+ }
+ }
+
+-/*
+- * This is always executed with interrupts disabled.
+- *
+- * TBI: get time offset between scheduling timer ticks
+- */
+-
+-u32 mac_gettimeoffset(void)
+-{
+- unsigned long ticks, offset = 0;
+-
+- /* read VIA1 timer 2 current value */
+- ticks = via1[vT1CL] | (via1[vT1CH] << 8);
+- /* The probability of underflow is less than 2% */
+- if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
+- /* Check for pending timer interrupt in VIA1 IFR */
+- if (via1[vIFR] & 0x40) offset = TICK_SIZE;
+-
+- ticks = MAC_CLOCK_TICK - ticks;
+- ticks = ticks * 10000L / MAC_CLOCK_TICK;
+-
+- return (ticks + offset) * 1000;
+-}
+-
+ /*
+ * Flush the L2 cache on Macs that have it by flipping
+ * the system into 24-bit mode for an instant.
+@@ -612,3 +563,56 @@ int via2_scsi_drq_pending(void)
+ return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
+ }
+ EXPORT_SYMBOL(via2_scsi_drq_pending);
++
++/* timer and clock source */
++
++#define VIA_CLOCK_FREQ 783360 /* VIA "phase 2" clock in Hz */
++#define VIA_TIMER_INTERVAL (1000000 / HZ) /* microseconds per jiffy */
++#define VIA_TIMER_CYCLES (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
++
++#define VIA_TC (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
++#define VIA_TC_LOW (VIA_TC & 0xFF)
++#define VIA_TC_HIGH (VIA_TC >> 8)
++
++void __init via_init_clock(irq_handler_t timer_routine)
++{
++ if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
++ pr_err("Couldn't register %s interrupt\n", "timer");
++ return;
++ }
++
++ via1[vT1LL] = VIA_TC_LOW;
++ via1[vT1LH] = VIA_TC_HIGH;
++ via1[vT1CL] = VIA_TC_LOW;
++ via1[vT1CH] = VIA_TC_HIGH;
++ via1[vACR] |= 0x40;
++}
++
++u32 mac_gettimeoffset(void)
++{
++ unsigned long flags;
++ u8 count_high;
++ u16 count, offset = 0;
++
++ /*
++ * Timer counter wrap-around is detected with the timer interrupt flag
++ * but reading the counter low byte (vT1CL) would reset the flag.
++ * Also, accessing both counter registers is essentially a data race.
++ * These problems are avoided by ignoring the low byte. Clock accuracy
++ * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
++ * reduced by avoiding slow VIA register accesses.
++ */
++
++ local_irq_save(flags);
++ count_high = via1[vT1CH];
++ if (count_high == 0xFF)
++ count_high = 0;
++ if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
++ offset = VIA_TIMER_CYCLES;
++ local_irq_restore(flags);
++
++ count = count_high << 8;
++ count = VIA_TIMER_CYCLES - count + offset;
++
++ return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
++}
+--
+2.20.1
+
--- /dev/null
+From 1102956911f8e502f65467f3ecf8ecf976beb8c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 15:37:05 +0300
+Subject: mac80211: accept deauth frames in IBSS mode
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 95697f9907bfe3eab0ef20265a766b22e27dde64 ]
+
+We can process deauth frames and all, but we drop them very
+early in the RX path today - this could never have worked.
+
+Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 4a6b3c7b35e37..31000622376df 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3227,9 +3227,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
+ case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+ /* process for all: mesh, mlme, ibss */
+ break;
++ case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
++ if (is_multicast_ether_addr(mgmt->da) &&
++ !is_broadcast_ether_addr(mgmt->da))
++ return RX_DROP_MONITOR;
++
++ /* process only for station/IBSS */
++ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
++ sdata->vif.type != NL80211_IFTYPE_ADHOC)
++ return RX_DROP_MONITOR;
++ break;
+ case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+ case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+- case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+ case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+ if (is_multicast_ether_addr(mgmt->da) &&
+ !is_broadcast_ether_addr(mgmt->da))
+--
+2.20.1
+
--- /dev/null
+From d02e6b81d798ccaa0792587b76e04f30798bc9fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 11:54:46 +0200
+Subject: mac80211: minstrel_ht: fix per-group max throughput rate
+ initialization
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 56dd918ff06e3ee24d8067e93ed12b2a39e71394 ]
+
+The group number needs to be multiplied by the number of rates per group
+to get the full rate index
+
+Fixes: 5935839ad735 ("mac80211: improve minstrel_ht rate sorting by throughput & probability")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20190820095449.45255-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rc80211_minstrel_ht.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index e57811e4b91f6..7ba4272642c9f 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -529,7 +529,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+
+ /* (re)Initialize group rate indexes */
+ for(j = 0; j < MAX_THR_RATES; j++)
+- tmp_group_tp_rate[j] = group;
++ tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
+
+ for (i = 0; i < MCS_GROUP_RATES; i++) {
+ if (!(mi->supported[group] & BIT(i)))
+--
+2.20.1
+
--- /dev/null
+From f68bae24b22ca00d0f22e840bd59b9589c8cb062 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 08:37:45 -0300
+Subject: media: atmel: atmel-isi: fix timeout value for stop streaming
+
+From: Alexandre Kroupski <alexandre.kroupski@ingenico.com>
+
+[ Upstream commit 623fd246bb40234fe68dd4e7c1f1f081f9c45a3d ]
+
+In case of sensor malfunction, stop streaming timeout takes much longer
+than expected. This is due to conversion of time to jiffies: milliseconds
+multiplied with HZ (ticks/second) gives out a value of jiffies with 10^3
+greater. We need to also divide by 10^3 to obtain the right jiffies value.
+In other words FRAME_INTERVAL_MILLI_SEC must be in seconds in order to
+multiply by HZ and get the right jiffies value to add to the current
+jiffies for the timeout expire time.
+
+Fixes: 195ebc43bf76 ("[media] V4L: at91: add Atmel Image Sensor Interface (ISI) support")
+Signed-off-by: Alexandre Kroupski <alexandre.kroupski@ingenico.com>
+Reviewed-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/atmel/atmel-isi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c
+index 891fa2505efa0..2f962a3418f63 100644
+--- a/drivers/media/platform/atmel/atmel-isi.c
++++ b/drivers/media/platform/atmel/atmel-isi.c
+@@ -496,7 +496,7 @@ static void stop_streaming(struct vb2_queue *vq)
+ spin_unlock_irq(&isi->irqlock);
+
+ if (!isi->enable_preview_path) {
+- timeout = jiffies + FRAME_INTERVAL_MILLI_SEC * HZ;
++ timeout = jiffies + (FRAME_INTERVAL_MILLI_SEC * HZ) / 1000;
+ /* Wait until the end of the current frame. */
+ while ((isi_readl(isi, ISI_STATUS) & ISI_CTRL_CDC) &&
+ time_before(jiffies, timeout))
+--
+2.20.1
+
--- /dev/null
+From b310d516df5ffa6d24a09ffee3c4f23fb6dc0371 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:37:02 -0500
+Subject: media: cx18: update *pos correctly in cx18_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ]
+
+We should be updating *pos. The current code is a no-op.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx18/cx18-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index 98467b2089fa8..099d59b992c1b 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+
+ CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 969e3bd09b1fcca554745b5694403ca6134cb712 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 22:52:23 -0500
+Subject: media: cx23885: check allocation return
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ]
+
+Checking of kmalloc() seems to have been committed - as
+cx23885_dvb_register() is checking for != 0 return, returning
+-ENOMEM should be fine here. While at it address the coccicheck
+suggestion to move to kmemdup rather than using kmalloc+memcpy.
+
+Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index e795ddeb7fe28..60f122edaefb3 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1460,8 +1460,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ if (fe0->dvb.frontend != NULL) {
+ struct i2c_adapter *tun_i2c;
+
+- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++ if (!fe0->dvb.frontend->sec_priv)
++ return -ENOMEM;
+ tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From 82625f754091cfc06ffa358c6cfcb0729e7f9fd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 10:34:22 -0400
+Subject: media: davinci-isif: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ]
+
+clang warns about a possible variable use that gcc never
+complained about:
+
+drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
+ [-Werror,-Wuninitialized]
+ dm365_vpss_set_pg_frame_size(frame_size);
+ ^~~~~~~~~~
+drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
+ struct vpss_pg_frame_size frame_size;
+ ^
+1 error generated.
+
+There is no initialization for this variable at all, and there
+has never been one in the mainline kernel, so we really should
+not put that stack data into an mmio register.
+
+On the other hand, I suspect that gcc checks the condition
+more closely and notices that the global
+isif_cfg.bayer.config_params.test_pat_gen flag is initialized
+to zero and never written to from any code path, so anything
+depending on it can be eliminated.
+
+To shut up the clang warning, just remove the dead code manually,
+it has probably never been used because any attempt to do so
+would have resulted in undefined behavior.
+
+Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/isif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 90d0f13283ae9..12065ad1ac457 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -886,9 +886,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+- struct vpss_pg_frame_size frame_size;
+ u32 modeset = 0, ccdcfg = 0;
+- struct vpss_sync_pol sync;
+
+ dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+
+@@ -976,13 +974,6 @@ static int isif_config_ycbcr(void)
+ /* two fields are interleaved in memory */
+ regw(0x00000249, SDOFST);
+
+- /* Setup test pattern if enabled */
+- if (isif_cfg.bayer.config_params.test_pat_gen) {
+- sync.ccdpg_hdpol = params->hd_pol;
+- sync.ccdpg_vdpol = params->vd_pol;
+- dm365_vpss_set_sync_pol(sync);
+- dm365_vpss_set_pg_frame_size(frame_size);
+- }
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e37fc79ae3c40c5894ae8222c5495fe0ab8b58b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:46:27 -0400
+Subject: media: davinci/vpbe: array underflow in vpbe_enum_outputs()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]
+
+In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
+the problem is that "temp_index" can be negative. This patch changes
+the types to unsigned to address this array underflow bug.
+
+Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe.c | 2 +-
+ include/media/davinci/vpbe.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
+index 1d3c13e369044..915af9ca47111 100644
+--- a/drivers/media/platform/davinci/vpbe.c
++++ b/drivers/media/platform/davinci/vpbe.c
+@@ -126,7 +126,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
+ struct v4l2_output *output)
+ {
+ struct vpbe_config *cfg = vpbe_dev->cfg;
+- int temp_index = output->index;
++ unsigned int temp_index = output->index;
+
+ if (temp_index >= cfg->num_outputs)
+ return -EINVAL;
+diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
+index 79a566d7defd0..180a05e914979 100644
+--- a/include/media/davinci/vpbe.h
++++ b/include/media/davinci/vpbe.h
+@@ -92,7 +92,7 @@ struct vpbe_config {
+ struct encoder_config_info *ext_encoders;
+ /* amplifier information goes here */
+ struct amp_config_info *amp;
+- int num_outputs;
++ unsigned int num_outputs;
+ /* Order is venc outputs followed by LCD and then external encoders */
+ struct vpbe_output *outputs;
+ };
+--
+2.20.1
+
--- /dev/null
+From 4093cd24dec7b290bc7930e433f4997eb28296d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:36:41 -0500
+Subject: media: ivtv: update *pos correctly in ivtv_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ]
+
+We had intended to update *pos, but the current code is a no-op.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index c9bd018e53de6..e2b19c3eaa876 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+
+ IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0c6ab2e220239ab9fdacfcc744d2a93629b2d1c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2019 05:01:57 -0400
+Subject: media: omap_vout: potential buffer overflow in vidioc_dqbuf()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ]
+
+The "b->index" is a u32 the comes from the user in the ioctl. It hasn't
+been checked. We aren't supposed to use it but we're instead supposed
+to use the value that gets written to it when we call videobuf_dqbuf().
+
+The videobuf_dqbuf() first memsets it to zero and then re-initializes it
+inside the videobuf_status() function. It's this final value which we
+want.
+
+Hans Verkuil pointed out that we need to check the return from
+videobuf_dqbuf(). I ended up doing a little cleanup related to that as
+well.
+
+Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap/omap_vout.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
+index 4d29860d27b42..18604b608ab2e 100644
+--- a/drivers/media/platform/omap/omap_vout.c
++++ b/drivers/media/platform/omap/omap_vout.c
+@@ -1527,23 +1527,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
+ unsigned long size;
+ struct videobuf_buffer *vb;
+
+- vb = q->bufs[b->index];
+-
+ if (!vout->streaming)
+ return -EINVAL;
+
+- if (file->f_flags & O_NONBLOCK)
+- /* Call videobuf_dqbuf for non blocking mode */
+- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
+- else
+- /* Call videobuf_dqbuf for blocking mode */
+- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
++ ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
++ if (ret)
++ return ret;
++
++ vb = q->bufs[b->index];
+
+ addr = (unsigned long) vout->buf_phy_addr[vb->i];
+ size = (unsigned long) vb->size;
+ dma_unmap_single(vout->vid_dev->v4l2_dev.dev, addr,
+ size, DMA_TO_DEVICE);
+- return ret;
++ return 0;
+ }
+
+ static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
+--
+2.20.1
+
--- /dev/null
+From 2e678de6a8e511673dacd6c6db361991cc82781e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 10:01:32 -0400
+Subject: media: ov2659: fix unbalanced mutex_lock/unlock
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ]
+
+Avoid returning with mutex locked.
+
+Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
+
+Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2659.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index 44b0584eb8a6c..e7768ed1ff9c2 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1136,7 +1136,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ *mf = fmt->format;
+ #else
+- return -ENOTTY;
++ ret = -ENOTTY;
+ #endif
+ } else {
+ s64 val;
+--
+2.20.1
+
--- /dev/null
+From 579098d17d2768581dafbd3db5901cbfc5f9611c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jan 2019 13:00:41 -0500
+Subject: media: s5p-jpeg: Correct step and max values for
+ V4L2_CID_JPEG_RESTART_INTERVAL
+
+From: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ]
+
+This commit corrects max and step values for v4l2 control for
+V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1.
+It was found by using v4l2-compliance tool and checking result of
+VIDIOC_QUERY_EXT_CTRL/QUERYMENU test.
+Previously it was complaining that step was bigger than difference
+between max and min.
+
+Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support")
+
+Signed-off-by: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+index 4568e68e15fa6..85a5e33600c03 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+@@ -2005,7 +2005,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
+
+ v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
+ V4L2_CID_JPEG_RESTART_INTERVAL,
+- 0, 3, 0xffff, 0);
++ 0, 0xffff, 1, 0);
+ if (ctx->jpeg->variant->version == SJPEG_S5P)
+ mask = ~0x06; /* 422, 420 */
+ }
+--
+2.20.1
+
--- /dev/null
+From ee84efbaba20d40e4aade04816a7146f7ae64c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Mar 2019 22:01:24 -0400
+Subject: media: tw5864: Fix possible NULL pointer dereference in
+ tw5864_handle_frame
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ]
+
+'vb' null check should be done before dereferencing it in
+tw5864_handle_frame, otherwise a NULL pointer dereference
+may occur.
+
+Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index e7bd2b8484e3d..ee1230440b397 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
+ input->vb = NULL;
+ spin_unlock_irqrestore(&input->slock, flags);
+
+- v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+-
+ if (!vb) { /* Gone because of disabling */
+ dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
+ return;
+ }
+
++ v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
++
+ /*
+ * Check for space.
+ * Mind the overhead of startcode emulation prevention.
+--
+2.20.1
+
--- /dev/null
+From b5b047df2f06b320fccb202982d4956531b9597e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 10:55:15 -0400
+Subject: media: vivid: fix incorrect assignment operation when setting video
+ mode
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c ]
+
+The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a
+bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment,
+otherwise the previous clearing of the FB_VMODE_MASK bits of
+var->vmode makes no sense and is redundant.
+
+Addresses-Coverity: ("Unused value")
+Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-osd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
+index bdc380b14e0c4..a95b7c56569e3 100644
+--- a/drivers/media/platform/vivid/vivid-osd.c
++++ b/drivers/media/platform/vivid/vivid-osd.c
+@@ -167,7 +167,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
+ var->nonstd = 0;
+
+ var->vmode &= ~FB_VMODE_MASK;
+- var->vmode = FB_VMODE_NONINTERLACED;
++ var->vmode |= FB_VMODE_NONINTERLACED;
+
+ /* Dummy values */
+ var->hsync_len = 24;
+--
+2.20.1
+
--- /dev/null
+From 40d1aca0ec59c47e89980883c88055d74c3dd9b6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2019 02:27:43 -0500
+Subject: media: wl128x: Fix an error code in fm_download_firmware()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ]
+
+We forgot to set "ret" on this error path.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 26895ae42fcf4..2d20d908e2803 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1271,8 +1271,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+
+ switch (action->type) {
+ case ACTION_SEND_COMMAND: /* Send */
+- if (fmc_send_cmd(fmdev, 0, 0, action->data,
+- action->size, NULL, NULL))
++ ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++ action->size, NULL, NULL);
++ if (ret)
+ goto rel_fw;
+
+ cmd_cnt++;
+--
+2.20.1
+
--- /dev/null
+From 606faaa4eafe5d7c0a98142c4e30dbf41a453ac6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 15:56:31 +0300
+Subject: mfd: intel-lpss: Release IDA resources
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 02f36911c1b41fcd8779fa0c135aab0554333fa5 ]
+
+ida instances allocate some internal memory for ->free_bitmap
+in addition to the base 'struct ida'. Use ida_destroy() to release
+that memory at module_exit().
+
+Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
+index b5c4f8f974aa7..9ed573e232c00 100644
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -541,6 +541,7 @@ module_init(intel_lpss_init);
+
+ static void __exit intel_lpss_exit(void)
+ {
++ ida_destroy(&intel_lpss_devid_ida);
+ debugfs_remove(intel_lpss_debugfs);
+ }
+ module_exit(intel_lpss_exit);
+--
+2.20.1
+
--- /dev/null
+From 5d95e60ad3d5e141f38e81fcd11f6f1c1c677b87 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 11:24:09 +0200
+Subject: mic: avoid statically declaring a 'struct device'.
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bc83f79bd2119230888fb8574639d5a51b38f903 ]
+
+Generally, declaring a platform device as a static variable is
+a bad idea and can cause all kinds of problems, in particular
+with the DMA configuration and lifetime rules.
+
+A specific problem we hit here is from a bug in clang that warns
+about certain (otherwise valid) macros when used in static variables:
+
+drivers/misc/mic/card/mic_x100.c:285:27: warning: shift count >= width of type [-Wshift-count-overflow]
+static u64 mic_dma_mask = DMA_BIT_MASK(64);
+ ^~~~~~~~~~~~~~~~
+include/linux/dma-mapping.h:141:54: note: expanded from macro 'DMA_BIT_MASK'
+ #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+ ^ ~~~
+
+A slightly better way here is to create the platform device dynamically
+and set the dma mask in the probe function.
+This avoids the warning and some other problems, but is still not ideal
+because the device creation should really be separated from the driver,
+and the fact that the device has no parent means we have to force
+the dma mask rather than having it set up from the bus that the device
+is actually on.
+
+Fixes: dd8d8d44df64 ("misc: mic: MIC card driver specific changes to enable SCIF")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190712092426.872625-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mic/card/mic_x100.c | 28 ++++++++++++----------------
+ 1 file changed, 12 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
+index b9f0710ffa6b0..4007adc666f37 100644
+--- a/drivers/misc/mic/card/mic_x100.c
++++ b/drivers/misc/mic/card/mic_x100.c
+@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
+ mdrv->dev = &pdev->dev;
+ snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
+
++ /* FIXME: use dma_set_mask_and_coherent() and check result */
++ dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++
+ mdev->mmio.pa = MIC_X100_MMIO_BASE;
+ mdev->mmio.len = MIC_X100_MMIO_LEN;
+ mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
+@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
+ mic_remove(pdev);
+ }
+
+-static u64 mic_dma_mask = DMA_BIT_MASK(64);
+-
+-static struct platform_device mic_platform_dev = {
+- .name = mic_driver_name,
+- .id = 0,
+- .num_resources = 0,
+- .dev = {
+- .dma_mask = &mic_dma_mask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
+- },
+-};
+-
+ static struct platform_driver __refdata mic_platform_driver = {
+ .probe = mic_probe,
+ .remove = mic_remove,
+@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
+ },
+ };
+
++static struct platform_device *mic_platform_dev;
++
+ static int __init mic_init(void)
+ {
+ int ret;
+@@ -328,9 +321,12 @@ static int __init mic_init(void)
+
+ request_module("mic_x100_dma");
+ mic_init_card_debugfs();
+- ret = platform_device_register(&mic_platform_dev);
++
++ mic_platform_dev = platform_device_register_simple(mic_driver_name,
++ 0, NULL, 0);
++ ret = PTR_ERR_OR_ZERO(mic_platform_dev);
+ if (ret) {
+- pr_err("platform_device_register ret %d\n", ret);
++ pr_err("platform_device_register_full ret %d\n", ret);
+ goto cleanup_debugfs;
+ }
+ ret = platform_driver_register(&mic_platform_driver);
+@@ -341,7 +337,7 @@ static int __init mic_init(void)
+ return ret;
+
+ device_unregister:
+- platform_device_unregister(&mic_platform_dev);
++ platform_device_unregister(mic_platform_dev);
+ cleanup_debugfs:
+ mic_exit_card_debugfs();
+ done:
+@@ -351,7 +347,7 @@ done:
+ static void __exit mic_exit(void)
+ {
+ platform_driver_unregister(&mic_platform_driver);
+- platform_device_unregister(&mic_platform_dev);
++ platform_device_unregister(mic_platform_dev);
+ mic_exit_card_debugfs();
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 236d4279c4defca5ba9c7fe74ed48df87b86b00e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 14:10:12 -0700
+Subject: mips: avoid explicit UB in assignment of mips_io_port_base
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 12051b318bc3ce5b42d6d786191008284b067d83 ]
+
+The code in question is modifying a variable declared const through
+pointer manipulation. Such code is explicitly undefined behavior, and
+is the lone issue preventing malta_defconfig from booting when built
+with Clang:
+
+If an attempt is made to modify an object defined with a const-qualified
+type through use of an lvalue with non-const-qualified type, the
+behavior is undefined.
+
+LLVM is removing such assignments. A simple fix is to not declare
+variables const that you plan on modifying. Limiting the scope would be
+a better method of preventing unwanted writes to such a variable.
+
+Further, the code in question mentions "compiler bugs" without any links
+to bug reports, so it is difficult to know if the issue is resolved in
+GCC. The patch was authored in 2006, which would have been GCC 4.0.3 or
+4.1.1. The minimal supported version of GCC in the Linux kernel is
+currently 4.6.
+
+For what its worth, there was UB before the commit in question, it just
+added a barrier and got lucky IRT codegen. I don't think there's any
+actual compiler bugs related, just runtime bugs due to UB.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/610
+Fixes: 966f4406d903 ("[MIPS] Work around bad code generation for <asm/io.h>.")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Debugged-by: Nathan Chancellor <natechancellor@gmail.com>
+Suggested-by: Eli Friedman <efriedma@quicinc.com>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: Maciej W. Rozycki <macro@linux-mips.org>
+Cc: Hassan Naveed <hnaveed@wavecomp.com>
+Cc: Stephen Kitt <steve@sk2.org>
+Cc: Serge Semin <fancer.lancer@gmail.com>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/io.h | 14 ++------------
+ arch/mips/kernel/setup.c | 2 +-
+ 2 files changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
+index 57b34257be2bf..98eb15b0524c4 100644
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -60,21 +60,11 @@
+ * instruction, so the lower 16 bits must be zero. Should be true on
+ * on any sane architecture; generic code does not use this assumption.
+ */
+-extern const unsigned long mips_io_port_base;
++extern unsigned long mips_io_port_base;
+
+-/*
+- * Gcc will generate code to load the value of mips_io_port_base after each
+- * function call which may be fairly wasteful in some cases. So we don't
+- * play quite by the book. We tell gcc mips_io_port_base is a long variable
+- * which solves the code generation issue. Now we need to violate the
+- * aliasing rules a little to make initialization possible and finally we
+- * will need the barrier() to fight side effects of the aliasing chat.
+- * This trickery will eventually collapse under gcc's optimizer. Oh well.
+- */
+ static inline void set_io_port_base(unsigned long base)
+ {
+- * (unsigned long *) &mips_io_port_base = base;
+- barrier();
++ mips_io_port_base = base;
+ }
+
+ /*
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 795caa763da32..05ed4ed411c73 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -75,7 +75,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
+ * mips_io_port_base is the begin of the address space to which x86 style
+ * I/O ports are mapped.
+ */
+-const unsigned long mips_io_port_base = -1;
++unsigned long mips_io_port_base = -1;
+ EXPORT_SYMBOL(mips_io_port_base);
+
+ static struct resource code_resource = { .name = "Kernel code", };
+--
+2.20.1
+
--- /dev/null
+From e237e76098c816eda6be08537c1ff457204cf298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 30 Dec 2018 12:55:09 +0100
+Subject: MIPS: BCM63XX: drop unused and broken DSP platform device
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+[ Upstream commit 682fee802843b332f9c51ffc8e062de5ff773f2e ]
+
+Trying to register the DSP platform device results in a null pointer
+access:
+
+[ 0.124184] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 804e305c, ra == 804e6f20
+[ 0.135208] Oops[#1]:
+[ 0.137514] CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.87
+...
+[ 0.197117] epc : 804e305c bcm63xx_dsp_register+0x80/0xa4
+[ 0.202838] ra : 804e6f20 board_register_devices+0x258/0x390
+...
+
+This happens because it tries to copy the passed platform data over the
+platform_device's unpopulated platform_data.
+
+Since this code has been broken since its submission, no driver was ever
+submitted for it, and apparently nobody was using it, just remove it
+instead of trying to fix it.
+
+Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.")
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/bcm63xx/Makefile | 6 +-
+ arch/mips/bcm63xx/boards/board_bcm963xx.c | 20 -------
+ arch/mips/bcm63xx/dev-dsp.c | 56 -------------------
+ .../asm/mach-bcm63xx/bcm63xx_dev_dsp.h | 14 -----
+ .../include/asm/mach-bcm63xx/board_bcm963xx.h | 5 --
+ 5 files changed, 3 insertions(+), 98 deletions(-)
+ delete mode 100644 arch/mips/bcm63xx/dev-dsp.c
+ delete mode 100644 arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
+
+diff --git a/arch/mips/bcm63xx/Makefile b/arch/mips/bcm63xx/Makefile
+index c69f297fc1df3..d89651e538f64 100644
+--- a/arch/mips/bcm63xx/Makefile
++++ b/arch/mips/bcm63xx/Makefile
+@@ -1,8 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y += clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
+- setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+- dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+- dev-wdt.o dev-usb-usbd.o
++ setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
++ dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
++ dev-usb-usbd.o
+ obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+
+ obj-y += boards/
+diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c
+index b2097c0d2ed78..36ec3dc2c999a 100644
+--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
++++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
+@@ -23,7 +23,6 @@
+ #include <bcm63xx_nvram.h>
+ #include <bcm63xx_dev_pci.h>
+ #include <bcm63xx_dev_enet.h>
+-#include <bcm63xx_dev_dsp.h>
+ #include <bcm63xx_dev_flash.h>
+ #include <bcm63xx_dev_hsspi.h>
+ #include <bcm63xx_dev_pcmcia.h>
+@@ -289,14 +288,6 @@ static struct board_info __initdata board_96348gw_10 = {
+ .has_pccard = 1,
+ .has_ehci0 = 1,
+
+- .has_dsp = 1,
+- .dsp = {
+- .gpio_rst = 6,
+- .gpio_int = 34,
+- .cs = 2,
+- .ext_irq = 2,
+- },
+-
+ .leds = {
+ {
+ .name = "adsl-fail",
+@@ -401,14 +392,6 @@ static struct board_info __initdata board_96348gw = {
+
+ .has_ohci0 = 1,
+
+- .has_dsp = 1,
+- .dsp = {
+- .gpio_rst = 6,
+- .gpio_int = 34,
+- .ext_irq = 2,
+- .cs = 2,
+- },
+-
+ .leds = {
+ {
+ .name = "adsl-fail",
+@@ -898,9 +881,6 @@ int __init board_register_devices(void)
+ if (board.has_usbd)
+ bcm63xx_usbd_register(&board.usbd);
+
+- if (board.has_dsp)
+- bcm63xx_dsp_register(&board.dsp);
+-
+ /* Generate MAC address for WLAN and register our SPROM,
+ * do this after registering enet devices
+ */
+diff --git a/arch/mips/bcm63xx/dev-dsp.c b/arch/mips/bcm63xx/dev-dsp.c
+deleted file mode 100644
+index 5bb5b154c9bd3..0000000000000
+--- a/arch/mips/bcm63xx/dev-dsp.c
++++ /dev/null
+@@ -1,56 +0,0 @@
+-/*
+- * Broadcom BCM63xx VoIP DSP registration
+- *
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License. See the file "COPYING" in the main directory of this archive
+- * for more details.
+- *
+- * Copyright (C) 2009 Florian Fainelli <florian@openwrt.org>
+- */
+-
+-#include <linux/init.h>
+-#include <linux/kernel.h>
+-#include <linux/platform_device.h>
+-
+-#include <bcm63xx_cpu.h>
+-#include <bcm63xx_dev_dsp.h>
+-#include <bcm63xx_regs.h>
+-#include <bcm63xx_io.h>
+-
+-static struct resource voip_dsp_resources[] = {
+- {
+- .start = -1, /* filled at runtime */
+- .end = -1, /* filled at runtime */
+- .flags = IORESOURCE_MEM,
+- },
+- {
+- .start = -1, /* filled at runtime */
+- .flags = IORESOURCE_IRQ,
+- },
+-};
+-
+-static struct platform_device bcm63xx_voip_dsp_device = {
+- .name = "bcm63xx-voip-dsp",
+- .id = -1,
+- .num_resources = ARRAY_SIZE(voip_dsp_resources),
+- .resource = voip_dsp_resources,
+-};
+-
+-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd)
+-{
+- struct bcm63xx_dsp_platform_data *dpd;
+- u32 val;
+-
+- /* Get the memory window */
+- val = bcm_mpi_readl(MPI_CSBASE_REG(pd->cs - 1));
+- val &= MPI_CSBASE_BASE_MASK;
+- voip_dsp_resources[0].start = val;
+- voip_dsp_resources[0].end = val + 0xFFFFFFF;
+- voip_dsp_resources[1].start = pd->ext_irq;
+-
+- /* copy given platform data */
+- dpd = bcm63xx_voip_dsp_device.dev.platform_data;
+- memcpy(dpd, pd, sizeof (*pd));
+-
+- return platform_device_register(&bcm63xx_voip_dsp_device);
+-}
+diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
+deleted file mode 100644
+index 4e4970787371a..0000000000000
+--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h
++++ /dev/null
+@@ -1,14 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
+-#ifndef __BCM63XX_DSP_H
+-#define __BCM63XX_DSP_H
+-
+-struct bcm63xx_dsp_platform_data {
+- unsigned gpio_rst;
+- unsigned gpio_int;
+- unsigned cs;
+- unsigned ext_irq;
+-};
+-
+-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd);
+-
+-#endif /* __BCM63XX_DSP_H */
+diff --git a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+index 5e5b1bc4a3247..830f53f28e3f7 100644
+--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
++++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+@@ -7,7 +7,6 @@
+ #include <linux/leds.h>
+ #include <bcm63xx_dev_enet.h>
+ #include <bcm63xx_dev_usb_usbd.h>
+-#include <bcm63xx_dev_dsp.h>
+
+ /*
+ * flash mapping
+@@ -31,7 +30,6 @@ struct board_info {
+ unsigned int has_ohci0:1;
+ unsigned int has_ehci0:1;
+ unsigned int has_usbd:1;
+- unsigned int has_dsp:1;
+ unsigned int has_uart0:1;
+ unsigned int has_uart1:1;
+
+@@ -43,9 +41,6 @@ struct board_info {
+ /* USB config */
+ struct bcm63xx_usbd_platform_data usbd;
+
+- /* DSP config */
+- struct bcm63xx_dsp_platform_data dsp;
+-
+ /* GPIO LEDs */
+ struct gpio_led leds[5];
+
+--
+2.20.1
+
--- /dev/null
+From 8b3f7b3e61d3de2c66f96e0161dc4572f461e244 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:33:50 +0800
+Subject: MIPS: Loongson: Fix return value of loongson_hwmon_init
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit dece3c2a320b0a6d891da6ff774ab763969b6860 ]
+
+When call function hwmon_device_register failed, use the actual
+return value instead of always -ENOMEM.
+
+Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mips/cpu_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
+index 322de58eebaf5..02484ae9a1165 100644
+--- a/drivers/platform/mips/cpu_hwmon.c
++++ b/drivers/platform/mips/cpu_hwmon.c
+@@ -158,7 +158,7 @@ static int __init loongson_hwmon_init(void)
+
+ cpu_hwmon_dev = hwmon_device_register(NULL);
+ if (IS_ERR(cpu_hwmon_dev)) {
+- ret = -ENOMEM;
++ ret = PTR_ERR(cpu_hwmon_dev);
+ pr_err("hwmon_device_register fail!\n");
+ goto fail_hwmon_device_register;
+ }
+--
+2.20.1
+
--- /dev/null
+From 09ab5da6194716977ff309e226492ac91a4cf3d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 May 2019 09:15:17 -0700
+Subject: misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ]
+
+Clang warns:
+
+drivers/misc/sgi-xp/xpc_partition.c:73:14: warning: variable 'buf' is
+uninitialized when used within its own initialization [-Wuninitialized]
+ void *buf = buf;
+ ~~~ ^~~
+1 warning generated.
+
+Arnd's explanation during review:
+
+ /*
+ * Returns the physical address of the partition's reserved page through
+ * an iterative number of calls.
+ *
+ * On first call, 'cookie' and 'len' should be set to 0, and 'addr'
+ * set to the nasid of the partition whose reserved page's address is
+ * being sought.
+ * On subsequent calls, pass the values, that were passed back on the
+ * previous call.
+ *
+ * While the return status equals SALRET_MORE_PASSES, keep calling
+ * this function after first copying 'len' bytes starting at 'addr'
+ * into 'buf'. Once the return status equals SALRET_OK, 'addr' will
+ * be the physical address of the partition's reserved page. If the
+ * return status equals neither of these, an error as occurred.
+ */
+ static inline s64
+ sn_partition_reserved_page_pa(u64 buf, u64 *cookie, u64 *addr, u64 *len)
+
+ so *len is set to zero on the first call and tells the bios how many
+ bytes are accessible at 'buf', and it does get updated by the BIOS to
+ tell us how many bytes it needs, and then we allocate that and try again.
+
+Fixes: 279290294662 ("[IA64-SGI] cleanup the way XPC locates the reserved page")
+Link: https://github.com/ClangBuiltLinux/linux/issues/466
+Suggested-by: Stephen Hines <srhines@google.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/sgi-xp/xpc_partition.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
+index 6956f7e7d4392..ca5f0102daef4 100644
+--- a/drivers/misc/sgi-xp/xpc_partition.c
++++ b/drivers/misc/sgi-xp/xpc_partition.c
+@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
+ unsigned long rp_pa = nasid; /* seed with nasid */
+ size_t len = 0;
+ size_t buf_len = 0;
+- void *buf = buf;
++ void *buf = NULL;
+ void *buf_base = NULL;
+ enum xp_retval (*get_partition_rsvd_page_pa)
+ (void *, u64 *, unsigned long *, size_t *) =
+--
+2.20.1
+
--- /dev/null
+From 5751fef2b10c3a9115fa2e06bd5e032b4d4e5f19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Oct 2018 09:56:42 +0000
+Subject: mlxsw: reg: QEEC: Add minimum shaper fields
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit 8b931821aa04823e2e5df0ae93937baabbd23286 ]
+
+Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable
+configuration of minimum shaper.
+
+Increase the QEEC length to 0x20 as well: that's the length that the
+register has had for a long time now, but with the configurations that
+mlxsw typically exercises, the firmware tolerated 0x1C-sized packets.
+With mise=true however, FW rejects packets unless they have the full
+required length.
+
+Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/reg.h | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+index 8ab7a4f98a07c..e7974ba064324 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -2452,7 +2452,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port,
+ * Configures the ETS elements.
+ */
+ #define MLXSW_REG_QEEC_ID 0x400D
+-#define MLXSW_REG_QEEC_LEN 0x1C
++#define MLXSW_REG_QEEC_LEN 0x20
+
+ MLXSW_REG_DEFINE(qeec, MLXSW_REG_QEEC_ID, MLXSW_REG_QEEC_LEN);
+
+@@ -2494,6 +2494,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8);
+ */
+ MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8);
+
++/* reg_qeec_mise
++ * Min shaper configuration enable. Enables configuration of the min
++ * shaper on this ETS element
++ * 0 - Disable
++ * 1 - Enable
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1);
++
+ enum {
+ MLXSW_REG_QEEC_BYTES_MODE,
+ MLXSW_REG_QEEC_PACKETS_MODE,
+@@ -2510,6 +2519,17 @@ enum {
+ */
+ MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1);
+
++/* The smallest permitted min shaper rate. */
++#define MLXSW_REG_QEEC_MIS_MIN 200000 /* Kbps */
++
++/* reg_qeec_min_shaper_rate
++ * Min shaper information rate.
++ * For CPU port, can only be configured for port hierarchy.
++ * When in bytes mode, value is specified in units of 1000bps.
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28);
++
+ /* reg_qeec_mase
+ * Max shaper configuration enable. Enables configuration of the max
+ * shaper on this ETS element.
+--
+2.20.1
+
--- /dev/null
+From 9a34605b2da8baa740be93be73d03a7ff0b1cee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2019 16:28:37 +0800
+Subject: mmc: core: fix possible use after free of host
+
+From: Pan Bian <bianpan2016@163.com>
+
+[ Upstream commit 8e1943af2986db42bee2b8dddf49a36cdb2e9219 ]
+
+In the function mmc_alloc_host, the function put_device is called to
+release allocated resources when mmc_gpio_alloc fails. Finally, the
+function pointed by host->class_dev.class->dev_release (i.e.,
+mmc_host_classdev_release) is used to release resources including the
+host structure. However, after put_device, host is used and released
+again. Resulting in a use-after-free bug.
+
+Fixes: 1ed217194488 ("mmc: core: fix error path in mmc_host_alloc")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/host.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
+index ad88deb2e8f3b..3740fb0052a49 100644
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -376,8 +376,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+
+ if (mmc_gpio_alloc(host)) {
+ put_device(&host->class_dev);
+- ida_simple_remove(&mmc_host_ida, host->index);
+- kfree(host);
+ return NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 82caf3ffeed988fa9fa949286658c5874da1364b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 11:30:43 +0100
+Subject: mmc: core: fix wl1251 sdio quirks
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 16568b4a4f0c34bd35cfadac63303c7af7812764 ]
+
+wl1251 and wl1271 have different vendor id and device id.
+So we need to handle both with sdio quirks.
+
+Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/quirks.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index 5153577754f02..09897abb79ed6 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -119,7 +119,14 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
+ END_FIXUP
+ };
+
++
+ static const struct mmc_fixup sdio_fixup_methods[] = {
++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++ add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
++
++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++ add_quirk, MMC_QUIRK_DISABLE_CD),
++
+ SDIO_FIXUP(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271,
+ add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
+
+--
+2.20.1
+
--- /dev/null
+From 93742d47dbe8b9cbc4c7b3567251094f6eb54eec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 23 Dec 2018 21:59:18 +0100
+Subject: mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 1e20186e706da8446f9435f2924cd65ab1397e73 ]
+
+We need to handle mmc_of_parse() errors during probe otherwise the
+MMC driver could start without proper initialization (e.g. power sequence).
+
+Fixes: 476bf3d62d5c ("mmc: sdhci-brcmstb: Add driver for Broadcom BRCMSTB SoCs")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/host/sdhci-brcmstb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c
+index 552bddc5096ce..1cd10356fc14f 100644
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -55,7 +55,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev)
+ }
+
+ sdhci_get_of_property(pdev);
+- mmc_of_parse(host->mmc);
++ res = mmc_of_parse(host->mmc);
++ if (res)
++ goto err;
+
+ /*
+ * Supply the existing CAPS, but clear the UHS modes. This
+--
+2.20.1
+
--- /dev/null
+From 1dc5bf363a07b1e9a1000419133eeb6313ce66cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 11:30:42 +0100
+Subject: mmc: sdio: fix wl1251 vendor id
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit e5db673e7fe2f971ec82039a28dc0811c2100e87 ]
+
+v4.11-rc1 did introduce a patch series that rearranged the
+sdio quirks into a header file. Unfortunately this did forget
+to handle SDIO_VENDOR_ID_TI differently between wl1251 and
+wl1271 with the result that although the wl1251 was found on
+the sdio bus, the firmware did not load any more and there was
+no interface registration.
+
+This patch defines separate constants to be used by sdio quirks
+and drivers.
+
+Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mmc/sdio_ids.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
+index 0a7abe8a407ff..68bbbd9edc08e 100644
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -67,6 +67,8 @@
+
+ #define SDIO_VENDOR_ID_TI 0x0097
+ #define SDIO_DEVICE_ID_TI_WL1271 0x4076
++#define SDIO_VENDOR_ID_TI_WL1251 0x104c
++#define SDIO_DEVICE_ID_TI_WL1251 0x9066
+
+ #define SDIO_VENDOR_ID_STE 0x0020
+ #define SDIO_DEVICE_ID_STE_CW1200 0x2280
+--
+2.20.1
+
--- /dev/null
+From fba9b0e2b51f291c97655f7c7fbf573b55d6ed40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Jun 2019 11:49:41 +0100
+Subject: mpls: fix warning with multi-label encap
+
+From: George Wilkie <gwilkie@vyatta.att-mail.com>
+
+[ Upstream commit 2f3f7d1fa0d1039b24a55d127ed190f196fc3e79 ]
+
+If you configure a route with multiple labels, e.g.
+ ip route add 10.10.3.0/24 encap mpls 16/100 via 10.10.2.2 dev ens4
+A warning is logged:
+ kernel: [ 130.561819] netlink: 'ip': attribute type 1 has an invalid
+ length.
+
+This happens because mpls_iptunnel_policy has set the type of
+MPLS_IPTUNNEL_DST to fixed size NLA_U32.
+Change it to a minimum size.
+nla_get_labels() does the remaining validation.
+
+Fixes: e3e4712ec096 ("mpls: ip tunnel support")
+Signed-off-by: George Wilkie <gwilkie@vyatta.att-mail.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mpls/mpls_iptunnel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c
+index 6e558a419f603..6c01166f972b9 100644
+--- a/net/mpls/mpls_iptunnel.c
++++ b/net/mpls/mpls_iptunnel.c
+@@ -28,7 +28,7 @@
+ #include "internal.h"
+
+ static const struct nla_policy mpls_iptunnel_policy[MPLS_IPTUNNEL_MAX + 1] = {
+- [MPLS_IPTUNNEL_DST] = { .type = NLA_U32 },
++ [MPLS_IPTUNNEL_DST] = { .len = sizeof(u32) },
+ [MPLS_IPTUNNEL_TTL] = { .type = NLA_U8 },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From f69738a4eb0ab2d0f6119baec3759a50e34e8c6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 14:51:20 -0700
+Subject: net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 60b173ca3d1cd1782bd0096dc17298ec242f6fb1 ]
+
+reqsk_queue_empty() is called from inet_csk_listen_poll() while
+other cpus might write ->rskq_accept_head value.
+
+Use {READ|WRITE}_ONCE() to avoid compiler tricks
+and potential KCSAN splats.
+
+Fixes: fff1f3001cc5 ("tcp: add a spinlock to protect struct request_sock_queue")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/pvcalls-back.c | 2 +-
+ include/net/request_sock.h | 4 ++--
+ net/ipv4/inet_connection_sock.c | 2 +-
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index abd6dbc29ac28..58be15c27b6d6 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -792,7 +792,7 @@ static int pvcalls_back_poll(struct xenbus_device *dev,
+ mappass->reqcopy = *req;
+ icsk = inet_csk(mappass->sock->sk);
+ queue = &icsk->icsk_accept_queue;
+- data = queue->rskq_accept_head != NULL;
++ data = READ_ONCE(queue->rskq_accept_head) != NULL;
+ if (data) {
+ mappass->reqcopy.cmd = 0;
+ ret = 0;
+diff --git a/include/net/request_sock.h b/include/net/request_sock.h
+index 23e22054aa60d..04aa2c7d35c4e 100644
+--- a/include/net/request_sock.h
++++ b/include/net/request_sock.h
+@@ -181,7 +181,7 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
+
+ static inline bool reqsk_queue_empty(const struct request_sock_queue *queue)
+ {
+- return queue->rskq_accept_head == NULL;
++ return READ_ONCE(queue->rskq_accept_head) == NULL;
+ }
+
+ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue *queue,
+@@ -193,7 +193,7 @@ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue
+ req = queue->rskq_accept_head;
+ if (req) {
+ sk_acceptq_removed(parent);
+- queue->rskq_accept_head = req->dl_next;
++ WRITE_ONCE(queue->rskq_accept_head, req->dl_next);
+ if (queue->rskq_accept_head == NULL)
+ queue->rskq_accept_tail = NULL;
+ }
+diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
+index f7224c4fc30fe..da55ce62fe50b 100644
+--- a/net/ipv4/inet_connection_sock.c
++++ b/net/ipv4/inet_connection_sock.c
+@@ -936,7 +936,7 @@ struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
+ req->sk = child;
+ req->dl_next = NULL;
+ if (queue->rskq_accept_head == NULL)
+- queue->rskq_accept_head = req;
++ WRITE_ONCE(queue->rskq_accept_head, req);
+ else
+ queue->rskq_accept_tail->dl_next = req;
+ queue->rskq_accept_tail = req;
+--
+2.20.1
+
--- /dev/null
+From 204705c0aad82a3abc796f109ff85bd0b8311cd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 20:43:01 +0200
+Subject: net/af_iucv: always register net_device notifier
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 06996c1d4088a0d5f3e7789d7f96b4653cc947cc ]
+
+Even when running as VM guest (ie pr_iucv != NULL), af_iucv can still
+open HiperTransport-based connections. For robust operation these
+connections require the af_iucv_netdev_notifier, so register it
+unconditionally.
+
+Also handle any error that register_netdevice_notifier() returns.
+
+Fixes: 9fbd87d41392 ("af_iucv: handle netdev events")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/iucv/af_iucv.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index ca98276c27097..7a9cbc9502d9c 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -2446,6 +2446,13 @@ out:
+ return err;
+ }
+
++static void afiucv_iucv_exit(void)
++{
++ device_unregister(af_iucv_dev);
++ driver_unregister(&af_iucv_driver);
++ pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++}
++
+ static int __init afiucv_init(void)
+ {
+ int err;
+@@ -2479,11 +2486,18 @@ static int __init afiucv_init(void)
+ err = afiucv_iucv_init();
+ if (err)
+ goto out_sock;
+- } else
+- register_netdevice_notifier(&afiucv_netdev_notifier);
++ }
++
++ err = register_netdevice_notifier(&afiucv_netdev_notifier);
++ if (err)
++ goto out_notifier;
++
+ dev_add_pack(&iucv_packet_type);
+ return 0;
+
++out_notifier:
++ if (pr_iucv)
++ afiucv_iucv_exit();
+ out_sock:
+ sock_unregister(PF_IUCV);
+ out_proto:
+@@ -2497,12 +2511,11 @@ out:
+ static void __exit afiucv_exit(void)
+ {
+ if (pr_iucv) {
+- device_unregister(af_iucv_dev);
+- driver_unregister(&af_iucv_driver);
+- pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++ afiucv_iucv_exit();
+ symbol_put(iucv_if);
+- } else
+- unregister_netdevice_notifier(&afiucv_netdev_notifier);
++ }
++
++ unregister_netdevice_notifier(&afiucv_netdev_notifier);
+ dev_remove_pack(&iucv_packet_type);
+ sock_unregister(PF_IUCV);
+ proto_unregister(&iucv_proto);
+--
+2.20.1
+
--- /dev/null
+From ddba1d640d6bc47f242bd5ea4619ea5653623715 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:54:30 +0300
+Subject: net: aquantia: Fix aq_vec_isr_legacy() return value
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 31aefe14bc9f56566041303d733fda511d3a1c3e ]
+
+The irqreturn_t type is an enum or an unsigned int in GCC. That
+creates to problems because it can't detect if the
+self->aq_hw_ops->hw_irq_read() call fails and at the end the function
+always returns IRQ_HANDLED.
+
+drivers/net/ethernet/aquantia/atlantic/aq_vec.c:316 aq_vec_isr_legacy() warn: unsigned 'err' is never less than zero.
+drivers/net/ethernet/aquantia/atlantic/aq_vec.c:329 aq_vec_isr_legacy() warn: always true condition '(err >= 0) => (0-u32max >= 0)'
+
+Fixes: 970a2e9864b0 ("net: ethernet: aquantia: Vector operations")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+index 5fecc9a099ef7..bb2894a333f20 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
+@@ -310,15 +310,13 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
+ {
+ struct aq_vec_s *self = private;
+ u64 irq_mask = 0U;
+- irqreturn_t err = 0;
++ int err;
+
+- if (!self) {
+- err = -EINVAL;
+- goto err_exit;
+- }
++ if (!self)
++ return IRQ_NONE;
+ err = self->aq_hw_ops->hw_irq_read(self->aq_hw, &irq_mask);
+ if (err < 0)
+- goto err_exit;
++ return IRQ_NONE;
+
+ if (irq_mask) {
+ self->aq_hw_ops->hw_irq_disable(self->aq_hw,
+@@ -326,11 +324,10 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private)
+ napi_schedule(&self->napi);
+ } else {
+ self->aq_hw_ops->hw_irq_enable(self->aq_hw, 1U);
+- err = IRQ_NONE;
++ return IRQ_NONE;
+ }
+
+-err_exit:
+- return err >= 0 ? IRQ_HANDLED : IRQ_NONE;
++ return IRQ_HANDLED;
+ }
+
+ cpumask_t *aq_vec_get_affinity_mask(struct aq_vec_s *self)
+--
+2.20.1
+
--- /dev/null
+From 0373587b8161f809ce436271ee5395fe39dff2f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Feb 2019 12:10:09 +0000
+Subject: net: aquantia: fixed instack structure overflow
+
+From: Igor Russkikh <Igor.Russkikh@aquantia.com>
+
+[ Upstream commit 8006e3730b6e900319411e35cee85b4513d298df ]
+
+This is a real stack undercorruption found by kasan build.
+
+The issue did no harm normally because it only overflowed
+2 bytes after `bitary` array which on most architectures
+were mapped into `err` local.
+
+Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.")
+Signed-off-by: Nikita Danilov <nikita.danilov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 4 ++--
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+index b0abd187cead9..b83ee74d28391 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -182,8 +182,8 @@ static int hw_atl_a0_hw_rss_set(struct aq_hw_s *self,
+ u32 i = 0U;
+ u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ int err = 0;
+- u16 bitary[(HW_ATL_A0_RSS_REDIRECTION_MAX *
+- HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
++ u16 bitary[1 + (HW_ATL_A0_RSS_REDIRECTION_MAX *
++ HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
+
+ memset(bitary, 0, sizeof(bitary));
+
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+index 236325f48ec9b..1c1bb074f6645 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -183,8 +183,8 @@ static int hw_atl_b0_hw_rss_set(struct aq_hw_s *self,
+ u32 i = 0U;
+ u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ int err = 0;
+- u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX *
+- HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
++ u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX *
++ HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
+
+ memset(bitary, 0, sizeof(bitary));
+
+--
+2.20.1
+
--- /dev/null
+From 1057fa51c97781ec6427eab36527274cd48c2ed0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 12:55:53 -0700
+Subject: net: avoid possible false sharing in sk_leave_memory_pressure()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 503978aca46124cd714703e180b9c8292ba50ba7 ]
+
+As mentioned in https://github.com/google/ktsan/wiki/READ_ONCE-and-WRITE_ONCE#it-may-improve-performance
+a C compiler can legally transform :
+
+if (memory_pressure && *memory_pressure)
+ *memory_pressure = 0;
+
+to :
+
+if (memory_pressure)
+ *memory_pressure = 0;
+
+Fixes: 0604475119de ("tcp: add TCPMemoryPressuresChrono counter")
+Fixes: 180d8cd942ce ("foundations of per-cgroup memory pressure controlling.")
+Fixes: 3ab224be6d69 ("[NET] CORE: Introducing new memory accounting interface.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 90ccbbf9e6b00..03ca2f638eb4a 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -2165,8 +2165,8 @@ static void sk_leave_memory_pressure(struct sock *sk)
+ } else {
+ unsigned long *memory_pressure = sk->sk_prot->memory_pressure;
+
+- if (memory_pressure && *memory_pressure)
+- *memory_pressure = 0;
++ if (memory_pressure && READ_ONCE(*memory_pressure))
++ WRITE_ONCE(*memory_pressure, 0);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5b49e00509e2dac20ac78b4ee7f25cc141eead78 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:59:11 +0300
+Subject: net: axienet: fix a signedness bug in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 73e211e11be86715d66bd3c9d38b3c34b05fca9a ]
+
+The "lp->phy_mode" is an enum but in this context GCC treats it as an
+unsigned int so the error handling is never triggered.
+
+Fixes: ee06b1728b95 ("net: axienet: add support for standard phy-mode binding")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 9ccd08a051f6a..1152d74433f6e 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1574,7 +1574,7 @@ static int axienet_probe(struct platform_device *pdev)
+ }
+ } else {
+ lp->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+- if (lp->phy_mode < 0) {
++ if ((int)lp->phy_mode < 0) {
+ ret = -EINVAL;
+ goto free_netdev;
+ }
+--
+2.20.1
+
--- /dev/null
+From 32c13f1bc6593b21703442651efda355736ffab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:56:04 +0300
+Subject: net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 25a584955f020d6ec499c513923fb220f3112d2b ]
+
+The "priv->phy_interface" variable is an enum and in this context GCC
+will treat it as unsigned so the error handling will never be
+triggered.
+
+Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 79018fea7be24..69b2f99b0c19d 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -2116,7 +2116,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+
+ priv->phy_interface = of_get_phy_mode(dn);
+ /* Default to GMII interface mode */
+- if (priv->phy_interface < 0)
++ if ((int)priv->phy_interface < 0)
+ priv->phy_interface = PHY_INTERFACE_MODE_GMII;
+
+ /* In the case of a fixed PHY, the DT node associated
+--
+2.20.1
+
--- /dev/null
+From fe926b90dd4696a670417cefe30a0dcbdaad95b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 12:29:43 +0530
+Subject: net: dsa: qca8k: Enable delay for RGMII_ID mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vinod Koul <vkoul@kernel.org>
+
+[ Upstream commit a968b5e9d5879f9535d6099505f9e14abcafb623 ]
+
+RGMII_ID specifies that we should have internal delay, so resurrect the
+delay addition routine but under the RGMII_ID mode.
+
+Fixes: 40269aa9f40a ("net: dsa: qca8k: disable delay for RGMII mode")
+Tested-by: Michal Vokáč <michal.vokac@ysoft.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca8k.c | 12 ++++++++++++
+ drivers/net/dsa/qca8k.h | 1 +
+ 2 files changed, 13 insertions(+)
+
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index 8e49974ffa0ed..8ee59b20b47a3 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -459,6 +459,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode)
+ qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
+ QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
+ break;
++ case PHY_INTERFACE_MODE_RGMII_ID:
++ /* RGMII_ID needs internal delay. This is enabled through
++ * PORT5_PAD_CTRL for all ports, rather than individual port
++ * registers
++ */
++ qca8k_write(priv, reg,
++ QCA8K_PORT_PAD_RGMII_EN |
++ QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) |
++ QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY));
++ qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL,
++ QCA8K_PORT_PAD_RGMII_RX_DELAY_EN);
++ break;
+ case PHY_INTERFACE_MODE_SGMII:
+ qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN);
+ break;
+diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h
+index 613fe5c50236c..d146e54c8a6c6 100644
+--- a/drivers/net/dsa/qca8k.h
++++ b/drivers/net/dsa/qca8k.h
+@@ -40,6 +40,7 @@
+ ((0x8 + (x & 0x3)) << 22)
+ #define QCA8K_PORT_PAD_RGMII_RX_DELAY(x) \
+ ((0x10 + (x & 0x3)) << 20)
++#define QCA8K_MAX_DELAY 3
+ #define QCA8K_PORT_PAD_RGMII_RX_DELAY_EN BIT(24)
+ #define QCA8K_PORT_PAD_SGMII_EN BIT(7)
+ #define QCA8K_REG_MODULE_EN 0x030
+--
+2.20.1
+
--- /dev/null
+From c39ad6cdf0432ce82afbea8b72f6f98ba0d07ea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:09 +0300
+Subject: net: ena: fix ena_com_fill_hash_function() implementation
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit 11bd7a00c0d8ffe33d1e926f8e789b4aea787186 ]
+
+ena_com_fill_hash_function() didn't configure the rss->hash_func.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Netanel Belgazal <netanel@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 011b54c541aae..10e6053f66712 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2087,6 +2087,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,
+ return -EINVAL;
+ }
+
++ rss->hash_func = func;
+ rc = ena_com_set_hash_function(ena_dev);
+
+ /* Restore the old function */
+--
+2.20.1
+
--- /dev/null
+From eb69162aceab202597d995ace7585e952816eb84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:05 +0300
+Subject: net: ena: fix: Free napi resources when ena_up() fails
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit b287cdbd1cedfc9606682c6e02b58d00ff3a33ae ]
+
+ena_up() calls ena_init_napi() but does not call ena_del_napi() in
+case of failure. This causes a segmentation fault upon rmmod when
+netif_napi_del() is called. Fix this bug by calling ena_del_napi()
+before returning error from ena_up().
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index d22b138c2b096..518ff393a026b 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1796,6 +1796,7 @@ err_setup_rx:
+ err_setup_tx:
+ ena_free_io_irq(adapter);
+ err_req_irq:
++ ena_del_napi(adapter);
+
+ return rc;
+ }
+--
+2.20.1
+
--- /dev/null
+From 74d73121396dcea493644ae9c18f37390989e168 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:06 +0300
+Subject: net: ena: fix incorrect test of supported hash function
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8 ]
+
+ena_com_set_hash_function() tests if a hash function is supported
+by the device before setting it.
+The test returns the opposite result than needed.
+Reverse the condition to return the correct value.
+Also use the BIT macro instead of inline shift.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c
+index 1a4ffc5d3da4e..011b54c541aae 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2002,7 +2002,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev)
+ if (unlikely(ret))
+ return ret;
+
+- if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
++ if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
+ pr_err("Func hash %d isn't supported by device, abort\n",
+ rss->hash_func);
+ return -EOPNOTSUPP;
+--
+2.20.1
+
--- /dev/null
+From cfed26a28aeda9601d9da57148a4386ff09c60c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 16:47:03 +0300
+Subject: net: ena: fix swapped parameters when calling
+ ena_com_indirect_table_fill_entry
+
+From: Sameeh Jubran <sameehj@amazon.com>
+
+[ Upstream commit 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9 ]
+
+second parameter should be the index of the table rather than the value.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Saeed Bshara <saeedb@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+index 967020fb26ee1..a2f02c23fe141 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -694,8 +694,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,
+ if (indir) {
+ for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
+ rc = ena_com_indirect_table_fill_entry(ena_dev,
+- ENA_IO_RXQ_IDX(indir[i]),
+- i);
++ i,
++ ENA_IO_RXQ_IDX(indir[i]));
+ if (unlikely(rc)) {
+ netif_err(adapter, drv, netdev,
+ "Cannot fill indirect table (index is too large)\n");
+--
+2.20.1
+
--- /dev/null
+From d370fce419e2809c96d7bd9f0dfb558a13293fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:05:54 +0300
+Subject: net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 231042181dc9d6122c6faba64e99ccb25f13cc6c ]
+
+The "gmac->phy_mode" variable is an enum and in this context GCC will
+treat it as an unsigned int so the error handling will never be
+triggered.
+
+Fixes: b1c17215d718 ("stmmac: add ipq806x glue layer")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 866444b6c82fa..11a4a81b0397c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -203,7 +203,7 @@ static int ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
+ struct device *dev = &gmac->pdev->dev;
+
+ gmac->phy_mode = of_get_phy_mode(dev->of_node);
+- if (gmac->phy_mode < 0) {
++ if ((int)gmac->phy_mode < 0) {
+ dev_err(dev, "missing phy mode property\n");
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From ab4b854a582da89e874fc9add73672656f177313 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:55:32 +0300
+Subject: net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 002dfe8085255b7bf1e0758c3d195c5412d35be9 ]
+
+The "priv->phy_mode" variable is an enum and in this context GCC will
+treat it as unsigned to the error handling will never trigger.
+
+Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index aab6fb10af94a..6adf6831d120a 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -1202,7 +1202,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
+ goto err_free_mdio;
+
+ priv->phy_mode = of_get_phy_mode(node);
+- if (priv->phy_mode < 0) {
++ if ((int)priv->phy_mode < 0) {
+ netdev_err(ndev, "not find phy-mode\n");
+ ret = -EINVAL;
+ goto err_mdiobus;
+--
+2.20.1
+
--- /dev/null
+From b3bf29d92f3d0a2d5bcf76afbb3f0b23f14b7edf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Apr 2019 21:48:39 +0800
+Subject: net: hns3: fix for vport->bw_limit overflow problem
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 2566f10676ba996b745e138f54f3e2f974311692 ]
+
+When setting vport->bw_limit to hdev->tm_info.pg_info[0].bw_limit
+in hclge_tm_vport_tc_info_update, vport->bw_limit can be as big as
+HCLGE_ETHER_MAX_RATE (100000), which can not fit into u16 (65535).
+
+So this patch fixes it by using u32 for vport->bw_limit.
+
+Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+index 9fcfd93954245..a4c5e72d6012a 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h
+@@ -480,7 +480,7 @@ struct hclge_vport {
+ u16 alloc_rss_size;
+
+ u16 qs_offset;
+- u16 bw_limit; /* VSI BW Limit (0 = disabled) */
++ u32 bw_limit; /* VSI BW Limit (0 = disabled) */
+ u8 dwrr;
+
+ int vport_id;
+--
+2.20.1
+
--- /dev/null
+From d3d1d2a46bf41c5ab12548c9fd2203efc9cd655c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 14:40:13 +0300
+Subject: net/mlx5: Fix mlx5_ifc_query_lag_out_bits
+
+From: Mark Zhang <markz@mellanox.com>
+
+[ Upstream commit ea77388b02270b0af8dc57f668f311235ea068f0 ]
+
+Remove the "reserved_at_40" field to match the device specification.
+
+Fixes: 84df61ebc69b ("net/mlx5: Add HW interfaces used by LAG")
+Signed-off-by: Mark Zhang <markz@mellanox.com>
+Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/mlx5_ifc.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 1d793d86d55fa..6ffa181598e61 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -8671,8 +8671,6 @@ struct mlx5_ifc_query_lag_out_bits {
+
+ u8 syndrome[0x20];
+
+- u8 reserved_at_40[0x40];
+-
+ struct mlx5_ifc_lagc_bits ctx;
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 5b1d33c6463bf4ee207e9d3146228dd963d22934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 19:21:21 +0200
+Subject: net/mlx5: Take lock with IRQs disabled to avoid deadlock
+
+From: Moni Shoua <monis@mellanox.com>
+
+[ Upstream commit 33814e5d127e21f53b52e17b0722c1b57d4f4d29 ]
+
+The lock in qp_table might be taken from process context or from
+interrupt context. This may lead to a deadlock unless it is taken with
+IRQs disabled.
+
+Discovered by lockdep
+
+================================
+WARNING: inconsistent lock state
+4.20.0-rc6
+--------------------------------
+inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W}
+
+python/12572 [HC1[1]:SC0[0]:HE0:SE1] takes:
+00000000052a4df4 (&(&table->lock)->rlock#2){?.+.}, /0x50 [mlx5_core]
+{HARDIRQ-ON-W} state was registered at:
+ _raw_spin_lock+0x33/0x70
+ mlx5_get_rsc+0x1a/0x50 [mlx5_core]
+ mlx5_ib_eqe_pf_action+0x493/0x1be0 [mlx5_ib]
+ process_one_work+0x90c/0x1820
+ worker_thread+0x87/0xbb0
+ kthread+0x320/0x3e0
+ ret_from_fork+0x24/0x30
+irq event stamp: 103928
+hardirqs last enabled at (103927): [] nk+0x1a/0x1c
+hardirqs last disabled at (103928): [] unk+0x1a/0x1c
+softirqs last enabled at (103924): [] tcp_sendmsg+0x31/0x40
+softirqs last disabled at (103922): [] 80
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&(&table->lock)->rlock#2);
+
+ lock(&(&table->lock)->rlock#2);
+
+ *** DEADLOCK ***
+
+Fixes: 032080ab43ac ("IB/mlx5: Lock QP during page fault handling")
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/qp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+index 5f091c6ea049d..b92d5690287b5 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *mlx5_get_rsc(struct mlx5_core_dev *dev,
+ {
+ struct mlx5_qp_table *table = &dev->priv.qp_table;
+ struct mlx5_core_rsc_common *common;
++ unsigned long flags;
+
+- spin_lock(&table->lock);
++ spin_lock_irqsave(&table->lock, flags);
+
+ common = radix_tree_lookup(&table->tree, rsn);
+ if (common)
+ atomic_inc(&common->refcount);
+
+- spin_unlock(&table->lock);
++ spin_unlock_irqrestore(&table->lock, flags);
+
+ if (!common) {
+ mlx5_core_warn(dev, "Async event for bogus resource 0x%x\n",
+--
+2.20.1
+
--- /dev/null
+From 68d9e2b5af08920c0655b8b4a739e39b05910c03 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:11:49 -0800
+Subject: net: neigh: use long type to store jiffies delta
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ]
+
+A difference of two unsigned long needs long storage.
+
+Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 16ac50b1b9a71..567e431813e59 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1877,8 +1877,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
+ goto nla_put_failure;
+ {
+ unsigned long now = jiffies;
+- unsigned int flush_delta = now - tbl->last_flush;
+- unsigned int rand_delta = now - tbl->last_rand;
++ long flush_delta = now - tbl->last_flush;
++ long rand_delta = now - tbl->last_rand;
+ struct neigh_hash_table *nht;
+ struct ndt_config ndc = {
+ .ndtc_key_len = tbl->key_len,
+--
+2.20.1
+
--- /dev/null
+From ba1967fd23e3c8f87fc875eb3e01fcb8c78cd7cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 09:16:58 -0700
+Subject: net: netem: correct the parent's backlog when corrupted packet was
+ dropped
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit e0ad032e144731a5928f2d75e91c2064ba1a764c ]
+
+If packet corruption failed we jump to finish_segs and return
+NET_XMIT_SUCCESS. Seeing success will make the parent qdisc
+increment its backlog, that's incorrect - we need to return
+NET_XMIT_DROP.
+
+Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 64c3cfa357363..328b043edf074 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -603,6 +603,8 @@ finish_segs:
+ }
+ /* Parent qdiscs accounted for 1 skb of size @prev_len */
+ qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
++ } else if (!skb) {
++ return NET_XMIT_DROP;
+ }
+ return NET_XMIT_SUCCESS;
+ }
+--
+2.20.1
+
--- /dev/null
+From 55f96ebf3b5cf556269c108699c767706db0a458 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Jun 2019 11:11:10 -0700
+Subject: net: netem: fix backlog accounting for corrupted GSO frames
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit 177b8007463c4f36c9a2c7ce7aa9875a4cad9bd5 ]
+
+When GSO frame has to be corrupted netem uses skb_gso_segment()
+to produce the list of frames, and re-enqueues the segments one
+by one. The backlog length has to be adjusted to account for
+new frames.
+
+The current calculation is incorrect, leading to wrong backlog
+lengths in the parent qdisc (both bytes and packets), and
+incorrect packet backlog count in netem itself.
+
+Parent backlog goes negative, netem's packet backlog counts
+all non-first segments twice (thus remaining non-zero even
+after qdisc is emptied).
+
+Move the variables used to count the adjustment into local
+scope to make 100% sure they aren't used at any stage in
+backports.
+
+Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index 6266121a03f9a..ede0a24e67eb8 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -431,8 +431,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ struct netem_skb_cb *cb;
+ struct sk_buff *skb2;
+ struct sk_buff *segs = NULL;
+- unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb);
+- int nb = 0;
++ unsigned int prev_len = qdisc_pkt_len(skb);
+ int count = 1;
+ int rc = NET_XMIT_SUCCESS;
+ int rc_drop = NET_XMIT_DROP;
+@@ -489,6 +488,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ segs = netem_segment(skb, sch, to_free);
+ if (!segs)
+ return rc_drop;
++ qdisc_skb_cb(segs)->pkt_len = segs->len;
+ } else {
+ segs = skb;
+ }
+@@ -579,6 +579,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+
+ finish_segs:
+ if (segs) {
++ unsigned int len, last_len;
++ int nb = 0;
++
++ len = skb->len;
++
+ while (segs) {
+ skb2 = segs->next;
+ segs->next = NULL;
+@@ -594,9 +599,7 @@ finish_segs:
+ }
+ segs = skb2;
+ }
+- sch->q.qlen += nb;
+- if (nb > 1)
+- qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len);
++ qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
+ }
+ return NET_XMIT_SUCCESS;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3cfaf9973874637b1762ef4c1f22429e1cb2c2cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Oct 2019 09:16:57 -0700
+Subject: net: netem: fix error path for corrupted GSO frames
+
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+
+[ Upstream commit a7fa12d15855904aff1716e1fc723c03ba38c5cc ]
+
+To corrupt a GSO frame we first perform segmentation. We then
+proceed using the first segment instead of the full GSO skb and
+requeue the rest of the segments as separate packets.
+
+If there are any issues with processing the first segment we
+still want to process the rest, therefore we jump to the
+finish_segs label.
+
+Commit 177b8007463c ("net: netem: fix backlog accounting for
+corrupted GSO frames") started using the pointer to the first
+segment in the "rest of segments processing", but as mentioned
+above the first segment may had already been freed at this point.
+
+Backlog corrections for parent qdiscs have to be adjusted.
+
+Fixes: 177b8007463c ("net: netem: fix backlog accounting for corrupted GSO frames")
+Reported-by: kbuild test robot <lkp@intel.com>
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reported-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_netem.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index ede0a24e67eb8..64c3cfa357363 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -504,6 +504,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ if (skb->ip_summed == CHECKSUM_PARTIAL &&
+ skb_checksum_help(skb)) {
+ qdisc_drop(skb, sch, to_free);
++ skb = NULL;
+ goto finish_segs;
+ }
+
+@@ -580,9 +581,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+ finish_segs:
+ if (segs) {
+ unsigned int len, last_len;
+- int nb = 0;
++ int nb;
+
+- len = skb->len;
++ len = skb ? skb->len : 0;
++ nb = skb ? 1 : 0;
+
+ while (segs) {
+ skb2 = segs->next;
+@@ -599,7 +601,8 @@ finish_segs:
+ }
+ segs = skb2;
+ }
+- qdisc_tree_reduce_backlog(sch, -nb, prev_len - len);
++ /* Parent qdiscs accounted for 1 skb of size @prev_len */
++ qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
+ }
+ return NET_XMIT_SUCCESS;
+ }
+--
+2.20.1
+
--- /dev/null
+From cd771c71159b9d4cbf25d6f62e0093e5916b5d24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jul 2019 12:23:41 +0800
+Subject: net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ]
+
+The phy_dn variable is still being used in of_phy_connect() after the
+of_node_put() call, which may result in use-after-free.
+
+Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index 49591d9c2e1b9..c9b4ac9d3330a 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+
+ dn = pci_device_to_OF_node(mac->pdev);
+ phy_dn = of_parse_phandle(dn, "phy-handle", 0);
+- of_node_put(phy_dn);
+
+ mac->link = 0;
+ mac->speed = 0;
+@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+ phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
+ PHY_INTERFACE_MODE_SGMII);
+
++ of_node_put(phy_dn);
+ if (!phydev) {
+ printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From 3a3588630311f2db550b727ad59acc4a22205143 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Nov 2018 09:02:41 +0000
+Subject: net: phy: Fix not to call phy_resume() if PHY is not attached
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a ]
+
+This patch fixes an issue that mdio_bus_phy_resume() doesn't call
+phy_resume() if the PHY is not attached.
+
+Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_device.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index a98c227a4c2eb..99dae55cd334b 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list);
+ static DEFINE_MUTEX(phy_fixup_lock);
+
+ #ifdef CONFIG_PM
+-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend)
+ {
+ struct device_driver *drv = phydev->mdio.dev.driver;
+ struct phy_driver *phydrv = to_phy_driver(drv);
+@@ -88,10 +88,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
+ /* PHY not attached? May suspend if the PHY has not already been
+ * suspended as part of a prior call to phy_disconnect() ->
+ * phy_detach() -> phy_suspend() because the parent netdev might be the
+- * MDIO bus driver and clock gated at this point.
++ * MDIO bus driver and clock gated at this point. Also may resume if
++ * PHY is not attached.
+ */
+ if (!netdev)
+- return !phydev->suspended;
++ return suspend ? !phydev->suspended : phydev->suspended;
+
+ /* Don't suspend PHY if the attached netdev parent may wakeup.
+ * The parent may point to a PCI device, as in tg3 driver.
+@@ -121,7 +122,7 @@ static int mdio_bus_phy_suspend(struct device *dev)
+ if (phydev->attached_dev && phydev->adjust_link)
+ phy_stop_machine(phydev);
+
+- if (!mdio_bus_phy_may_suspend(phydev))
++ if (!mdio_bus_phy_may_suspend(phydev, true))
+ return 0;
+
+ return phy_suspend(phydev);
+@@ -132,7 +133,7 @@ static int mdio_bus_phy_resume(struct device *dev)
+ struct phy_device *phydev = to_phy_device(dev);
+ int ret;
+
+- if (!mdio_bus_phy_may_suspend(phydev))
++ if (!mdio_bus_phy_may_suspend(phydev, false))
+ goto no_resume;
+
+ ret = phy_resume(phydev);
+--
+2.20.1
+
--- /dev/null
+From f2c005d94173c3601c22e15bf6652b46389870fa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 21:45:29 -0800
+Subject: net: phy: fixed_phy: Fix fixed_phy not checking GPIO
+
+From: Moritz Fischer <mdf@kernel.org>
+
+[ Upstream commit 8f289805616e81f7c1690931aa8a586c76f4fa88 ]
+
+Fix fixed_phy not checking GPIO if no link_update callback
+is registered.
+
+In the original version all users registered a link_update
+callback so the issue was masked.
+
+Fixes: a5597008dbc2 ("phy: fixed_phy: Add gpio to determine link up/down.")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/fixed_phy.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
+index eb51672106811..3ab2eb677a599 100644
+--- a/drivers/net/phy/fixed_phy.c
++++ b/drivers/net/phy/fixed_phy.c
+@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num)
+ do {
+ s = read_seqcount_begin(&fp->seqcount);
+ /* Issue callback if user registered it. */
+- if (fp->link_update) {
++ if (fp->link_update)
+ fp->link_update(fp->phydev->attached_dev,
+ &fp->status);
+- fixed_phy_update(fp);
+- }
++ /* Check the GPIO for change in status */
++ fixed_phy_update(fp);
+ state = fp->status;
+ } while (read_seqcount_retry(&fp->seqcount, s));
+
+--
+2.20.1
+
--- /dev/null
+From d9099cf3efd3aee5e6e50b0d7e77102866b5daf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 18:29:13 +0100
+Subject: net: qca_spi: Move reset_count to struct qcaspi
+
+From: Stefan Wahren <stefan.wahren@in-tech.com>
+
+[ Upstream commit bc19c32904e36548335b35fdce6ce734e20afc0a ]
+
+The reset counter is specific for every QCA700x chip. So move this
+into the private driver struct. Otherwise we get unpredictable reset
+behavior in setups with multiple QCA700x chips.
+
+Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000)
+Signed-off-by: Stefan Wahren <stefan.wahren@in-tech.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 9 ++++-----
+ drivers/net/ethernet/qualcomm/qca_spi.h | 1 +
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 275fc6f154a71..1c87178fc4858 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -475,7 +475,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+ u16 signature = 0;
+ u16 spi_config;
+ u16 wrbuf_space = 0;
+- static u16 reset_count;
+
+ if (event == QCASPI_EVENT_CPUON) {
+ /* Read signature twice, if not valid
+@@ -528,13 +527,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+
+ qca->sync = QCASPI_SYNC_RESET;
+ qca->stats.trig_reset++;
+- reset_count = 0;
++ qca->reset_count = 0;
+ break;
+ case QCASPI_SYNC_RESET:
+- reset_count++;
++ qca->reset_count++;
+ netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
+- reset_count);
+- if (reset_count >= QCASPI_RESET_TIMEOUT) {
++ qca->reset_count);
++ if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
+ /* reset did not seem to take place, try again */
+ qca->sync = QCASPI_SYNC_UNKNOWN;
+ qca->stats.reset_timeout++;
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
+index fc0e98726b361..719c41227f221 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.h
++++ b/drivers/net/ethernet/qualcomm/qca_spi.h
+@@ -92,6 +92,7 @@ struct qcaspi {
+
+ unsigned int intr_req;
+ unsigned int intr_svc;
++ u16 reset_count;
+
+ #ifdef CONFIG_DEBUG_FS
+ struct dentry *device_root;
+--
+2.20.1
+
--- /dev/null
+From a72e1267f4a00d56de84d2b8a925b468aeaf2ee9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Jul 2019 12:15:50 -0700
+Subject: net/rds: Add a few missing rds_stat_names entries
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit 55c70ca00c982fbc0df4c4d3e31747fb73f4ddb5 ]
+
+In a previous commit, fields were added to "struct rds_statistics"
+but array "rds_stat_names" was not updated accordingly.
+
+Please note the inconsistent naming of the string representations
+that is done in the name of compatibility
+with the Oracle internal code-base.
+
+s_recv_bytes_added_to_socket -> "recv_bytes_added_to_sock"
+s_recv_bytes_removed_from_socket -> "recv_bytes_freed_fromsock"
+
+Fixes: 192a798f5299 ("RDS: add stat for socket recv memory usage")
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/stats.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/rds/stats.c b/net/rds/stats.c
+index 73be187d389ed..6bbab4d74c4fe 100644
+--- a/net/rds/stats.c
++++ b/net/rds/stats.c
+@@ -76,6 +76,8 @@ static const char *const rds_stat_names[] = {
+ "cong_update_received",
+ "cong_send_error",
+ "cong_send_blocked",
++ "recv_bytes_added_to_sock",
++ "recv_bytes_freed_fromsock",
+ };
+
+ void rds_stats_info_copy(struct rds_info_iterator *iter,
+--
+2.20.1
+
--- /dev/null
+From 7f0b53a30283bbe63dbe25fc5666e3fe3512a374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 13:49:41 -0700
+Subject: net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit 05a82481a3024b94db00b8c816bb3d526b5209e0 ]
+
+All entries in 'rds_ib_stat_names' are stringified versions
+of the corresponding "struct rds_ib_statistics" element
+without the "s_"-prefix.
+
+Fix entry 'ib_evt_handler_call' to do the same.
+
+Fixes: f4f943c958a2 ("RDS: IB: ack more receive completions to improve performance")
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/ib_stats.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
+index 9252ad1263359..ac46d8961b61a 100644
+--- a/net/rds/ib_stats.c
++++ b/net/rds/ib_stats.c
+@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
+ static const char *const rds_ib_stat_names[] = {
+ "ib_connect_raced",
+ "ib_listen_closed_stale",
+- "s_ib_evt_handler_call",
++ "ib_evt_handler_call",
+ "ib_tasklet_call",
+ "ib_tx_cq_event",
+ "ib_tx_ring_full",
+--
+2.20.1
+
--- /dev/null
+From 3e2f3c40917f9f0aa37bf3ec1d613fddfc6678ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2019 02:43:18 -0500
+Subject: net: sh_eth: fix a missing check of of_get_phy_mode
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ]
+
+of_get_phy_mode may fail and return a negative error code;
+the fix checks the return value of of_get_phy_mode and
+returns NULL of it fails.
+
+Fixes: b356e978e92f ("sh_eth: add device tree support")
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 9b1906a65e113..25f3b2ad26e9c 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3046,12 +3046,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
+ struct device_node *np = dev->of_node;
+ struct sh_eth_plat_data *pdata;
+ const char *mac_addr;
++ int ret;
+
+ pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
+ if (!pdata)
+ return NULL;
+
+- pdata->phy_interface = of_get_phy_mode(np);
++ ret = of_get_phy_mode(np);
++ if (ret < 0)
++ return NULL;
++ pdata->phy_interface = ret;
+
+ mac_addr = of_get_mac_address(np);
+ if (mac_addr)
+--
+2.20.1
+
--- /dev/null
+From 87f0a5eea1ffb8577f597f70faae54697a8a9309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 09:36:23 +0800
+Subject: net: sonic: replace dev_kfree_skb in sonic_send_packet
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 49f6c90bf6805948b597eabb499e500a47cf24be ]
+
+sonic_send_packet will be processed in irq or non-irq
+context, so it would better use dev_kfree_skb_any
+instead of dev_kfree_skb.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 11f472fd5d477..a051dddcbd768 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -222,7 +222,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ if (!laddr) {
+ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+- dev_kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 28758ab8b6cf42fe56785ba8f5004a4ca41b2ad9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 09:57:12 +0800
+Subject: net: sonic: return NETDEV_TX_OK if failed to map buffer
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 ]
+
+NETDEV_TX_BUSY really should only be used by drivers that call
+netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
+failed to map tx DMA buffer, it might trigger an infinite loop.
+This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
+printk to pr_err_ratelimited.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 23821540ab078..11f472fd5d477 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -221,9 +221,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+
+ laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ if (!laddr) {
+- printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
++ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+ dev_kfree_skb(skb);
+- return NETDEV_TX_BUSY;
++ return NETDEV_TX_OK;
+ }
+
+ sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
+--
+2.20.1
+
--- /dev/null
+From 3b2080f55d3c1049e9ba213cd421446261c15a5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:58:22 +0300
+Subject: net: stmmac: dwmac-meson8b: Fix signedness bug in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f10210517a2f37feea2edf85eb34c98977265c16 ]
+
+The "dwmac->phy_mode" is an enum and in this context GCC treats it as
+an unsigned int so the error handling is never triggered.
+
+Fixes: 566e82516253 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+index 8be4b32544ef8..d71d3c1c85eed 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c
+@@ -285,7 +285,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev)
+
+ dwmac->pdev = pdev;
+ dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node);
+- if (dwmac->phy_mode < 0) {
++ if ((int)dwmac->phy_mode < 0) {
+ dev_err(&pdev->dev, "missing phy-mode property\n");
+ ret = -EINVAL;
+ goto err_remove_config_dt;
+--
+2.20.1
+
--- /dev/null
+From 630ca9d2c2f29e07549885f3e02c35e3cd114c92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 17:43:04 +0200
+Subject: net: stmmac: fix length of PTP clock's name string
+
+From: Antonio Borneo <antonio.borneo@st.com>
+
+[ Upstream commit 5da202c88f8c355ad79bc2e8eb582e6d433060e7 ]
+
+The field "name" in struct ptp_clock_info has a fixed size of 16
+chars and is used as zero terminated string by clock_name_show()
+in drivers/ptp/ptp_sysfs.c
+The current initialization value requires 17 chars to fit also the
+null termination, and this causes overflow to the next bytes in
+the struct when the string is read as null terminated:
+ hexdump -C /sys/class/ptp/ptp0/clock_name
+ 00000000 73 74 6d 6d 61 63 5f 70 74 70 5f 63 6c 6f 63 6b |stmmac_ptp_clock|
+ 00000010 a0 ac b9 03 0a |.....|
+where the extra 4 bytes (excluding the newline) after the string
+represent the integer 0x03b9aca0 = 62500000 assigned to the field
+"max_adj" that follows "name" in the same struct.
+
+There is no strict requirement for the "name" content and in the
+comment in ptp_clock_kernel.h it's reported it should just be 'A
+short "friendly name" to identify the clock'.
+Replace it with "stmmac ptp".
+
+Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
+Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+index e471a903c6543..1c1d6a9428229 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+@@ -154,7 +154,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
+ /* structure describing a PTP hardware clock */
+ static const struct ptp_clock_info stmmac_ptp_clock_ops = {
+ .owner = THIS_MODULE,
+- .name = "stmmac_ptp_clock",
++ .name = "stmmac ptp",
+ .max_adj = 62500000,
+ .n_alarm = 0,
+ .n_ext_ts = 0,
+--
+2.20.1
+
--- /dev/null
+From cc44dfaa42d912d8476e5005102056365eaf0992 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 13:08:56 +0200
+Subject: net: stmmac: gmac4+: Not all Unicast addresses may be available
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 25683bab09a70542b9f8e3e28f79b3369e56701f ]
+
+Some setups may not have all Unicast addresses filters available. Check
+the number of available filters before trying to setup it.
+
+Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 8445af580cb69..e5566c121525d 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -438,7 +438,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ }
+
+ /* Handle multiple unicast addresses */
+- if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) {
++ if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
+ /* Switch to promiscuous mode if more than 128 addrs
+ * are required
+ */
+--
+2.20.1
+
--- /dev/null
+From 1d2c2080c7ea5bd59f1e61f179cd0c12e674d1d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 May 2019 18:47:33 +0200
+Subject: netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last
+ rule
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]
+
+If userspace provides a rule blob with trailing data after last target,
+we trigger a splat, then convert ruleset to 64bit format (with trailing
+data), then pass that to do_replace_finish() which then returns -EINVAL.
+
+Erroring out right away avoids the splat plus unneeded translation and
+error unwind.
+
+Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebtables.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 35a670ec90775..a1834ad7422ce 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2164,7 +2164,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
+ if (ret < 0)
+ return ret;
+
+- WARN_ON(size_remaining);
++ if (size_remaining)
++ return -EINVAL;
++
+ return state->buf_kern_offset;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From b5bd4dce039967d6fecada86d45d7034eeee7974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Feb 2019 14:13:41 +0100
+Subject: netfilter: nft_set_hash: fix lookups with fixed size hash on big
+ endian
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 3b02b0adc242a72b5e46019b6a9e4f84823592f6 ]
+
+Call jhash_1word() for the 4-bytes key case from the insertion and
+deactivation path, otherwise big endian arch set lookups fail.
+
+Fixes: 446a8268b7f5 ("netfilter: nft_set_hash: add lookup variant for fixed size hashtable")
+Reported-by: Florian Westphal <fw@strlen.de>
+Tested-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_set_hash.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
+index 33aa2ac3a62ef..73f8f99b1193b 100644
+--- a/net/netfilter/nft_set_hash.c
++++ b/net/netfilter/nft_set_hash.c
+@@ -442,6 +442,23 @@ static bool nft_hash_lookup_fast(const struct net *net,
+ return false;
+ }
+
++static u32 nft_jhash(const struct nft_set *set, const struct nft_hash *priv,
++ const struct nft_set_ext *ext)
++{
++ const struct nft_data *key = nft_set_ext_key(ext);
++ u32 hash, k1;
++
++ if (set->klen == 4) {
++ k1 = *(u32 *)key;
++ hash = jhash_1word(k1, priv->seed);
++ } else {
++ hash = jhash(key, set->klen, priv->seed);
++ }
++ hash = reciprocal_scale(hash, priv->buckets);
++
++ return hash;
++}
++
+ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
+ const struct nft_set_elem *elem,
+ struct nft_set_ext **ext)
+@@ -451,8 +468,7 @@ static int nft_hash_insert(const struct net *net, const struct nft_set *set,
+ u8 genmask = nft_genmask_next(net);
+ u32 hash;
+
+- hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
+- hash = reciprocal_scale(hash, priv->buckets);
++ hash = nft_jhash(set, priv, &this->ext);
+ hlist_for_each_entry(he, &priv->table[hash], node) {
+ if (!memcmp(nft_set_ext_key(&this->ext),
+ nft_set_ext_key(&he->ext), set->klen) &&
+@@ -491,8 +507,7 @@ static void *nft_hash_deactivate(const struct net *net,
+ u8 genmask = nft_genmask_next(net);
+ u32 hash;
+
+- hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed);
+- hash = reciprocal_scale(hash, priv->buckets);
++ hash = nft_jhash(set, priv, &this->ext);
+ hlist_for_each_entry(he, &priv->table[hash], node) {
+ if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val,
+ set->klen) ||
+--
+2.20.1
+
--- /dev/null
+From 350f79ed774666affb2ff5a81a640df8f277f4cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 May 2019 11:47:30 -0700
+Subject: netvsc: unshare skb in VF rx handler
+
+From: Stephen Hemminger <stephen@networkplumber.org>
+
+[ Upstream commit 996ed04741467f6d1552440c92988b132a9487ec ]
+
+The netvsc VF skb handler should make sure that skb is not
+shared. Similar logic already exists in bonding and team device
+drivers.
+
+This is not an issue in practice because the VF devicex
+does not send up shared skb's. But the netvsc driver
+should do the right thing if it did.
+
+Fixes: 0c195567a8f6 ("netvsc: transparent VF management")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc_drv.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index a89de5752a8c2..9e48855f64074 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -1840,6 +1840,12 @@ static rx_handler_result_t netvsc_vf_handle_frame(struct sk_buff **pskb)
+ struct netvsc_vf_pcpu_stats *pcpu_stats
+ = this_cpu_ptr(ndev_ctx->vf_stats);
+
++ skb = skb_share_check(skb, GFP_ATOMIC);
++ if (unlikely(!skb))
++ return RX_HANDLER_CONSUMED;
++
++ *pskb = skb;
++
+ skb->dev = ndev;
+
+ u64_stats_update_begin(&pcpu_stats->syncp);
+--
+2.20.1
+
--- /dev/null
+From e4f3e6ebca204377e68a085f25f8484ba3f5a467 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Apr 2019 13:59:02 -0400
+Subject: NFS: Don't interrupt file writeout due to fatal errors
+
+From: Trond Myklebust <trondmy@gmail.com>
+
+[ Upstream commit 14bebe3c90b326d2a0df78aed5e9de090c71d878 ]
+
+When flushing out dirty pages, the fact that we may hit fatal errors
+is not a reason to stop writeback. Those errors are reported through
+fsync(), not through the flush mechanism.
+
+Fixes: a6598813a4c5b ("NFS: Don't write back further requests if there...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/write.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/write.c b/fs/nfs/write.c
+index 01b9d9341b541..ed3f5afc4ff7f 100644
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -643,7 +643,7 @@ out:
+ return ret;
+ out_launder:
+ nfs_write_error_remove_page(req);
+- return ret;
++ return 0;
+ }
+
+ static int nfs_do_writepage(struct page *page, struct writeback_control *wbc,
+--
+2.20.1
+
--- /dev/null
+From 43d4fbb583a7be2e3ee2dd8d0b03504e8904cb63 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Feb 2019 14:51:25 -0500
+Subject: NFS: Fix a soft lockup in the delegation recovery code
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 6f9449be53f3ce383caed797708b332ede8d952c ]
+
+Fix a soft lockup when NFS client delegation recovery is attempted
+but the inode is in the process of being freed. When the
+igrab(inode) call fails, and we have to restart the recovery process,
+we need to ensure that we won't attempt to recover the same delegation
+again.
+
+Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 20 ++++++++++++--------
+ fs/nfs/delegation.h | 1 +
+ 2 files changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 04d57e11577e0..09b3bcb86d328 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -234,6 +234,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation
+ spin_lock(&delegation->lock);
+ if (delegation->inode != NULL)
+ inode = igrab(delegation->inode);
++ if (!inode)
++ set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags);
+ spin_unlock(&delegation->lock);
+ return inode;
+ }
+@@ -863,10 +865,11 @@ restart:
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ list_for_each_entry_rcu(delegation, &server->delegations,
+ super_list) {
+- if (test_bit(NFS_DELEGATION_RETURNING,
+- &delegation->flags))
+- continue;
+- if (test_bit(NFS_DELEGATION_NEED_RECLAIM,
++ if (test_bit(NFS_DELEGATION_INODE_FREEING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_RETURNING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_NEED_RECLAIM,
+ &delegation->flags) == 0)
+ continue;
+ if (!nfs_sb_active(server->super))
+@@ -971,10 +974,11 @@ restart:
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+ list_for_each_entry_rcu(delegation, &server->delegations,
+ super_list) {
+- if (test_bit(NFS_DELEGATION_RETURNING,
+- &delegation->flags))
+- continue;
+- if (test_bit(NFS_DELEGATION_TEST_EXPIRED,
++ if (test_bit(NFS_DELEGATION_INODE_FREEING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_RETURNING,
++ &delegation->flags) ||
++ test_bit(NFS_DELEGATION_TEST_EXPIRED,
+ &delegation->flags) == 0)
+ continue;
+ if (!nfs_sb_active(server->super))
+diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h
+index df41d16dc6ab4..510c9edcc712d 100644
+--- a/fs/nfs/delegation.h
++++ b/fs/nfs/delegation.h
+@@ -34,6 +34,7 @@ enum {
+ NFS_DELEGATION_RETURNING,
+ NFS_DELEGATION_REVOKED,
+ NFS_DELEGATION_TEST_EXPIRED,
++ NFS_DELEGATION_INODE_FREEING,
+ };
+
+ int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res);
+--
+2.20.1
+
--- /dev/null
+From 6492e47b2934e078a4a833dc9db8aa7110e8a186 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 14:20:27 -0500
+Subject: NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 5085607d209102b37b169bc94d0aa39566a9842a ]
+
+If a bulk layout recall or a metadata server reboot coincides with a
+umount, then holding a reference to an inode is unsafe unless we
+also hold a reference to the super block.
+
+Fixes: fd9a8d7160937 ("NFSv4.1: Fix bulk recall and destroy of layouts")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
+ fs/nfs/pnfs.h | 1 +
+ 2 files changed, 24 insertions(+), 10 deletions(-)
+
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index ec04cce31814b..83abf3dd73511 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -725,22 +725,35 @@ static int
+ pnfs_layout_bulk_destroy_byserver_locked(struct nfs_client *clp,
+ struct nfs_server *server,
+ struct list_head *layout_list)
++ __must_hold(&clp->cl_lock)
++ __must_hold(RCU)
+ {
+ struct pnfs_layout_hdr *lo, *next;
+ struct inode *inode;
+
+ list_for_each_entry_safe(lo, next, &server->layouts, plh_layouts) {
+- if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags))
++ if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
++ test_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags) ||
++ !list_empty(&lo->plh_bulk_destroy))
+ continue;
++ /* If the sb is being destroyed, just bail */
++ if (!nfs_sb_active(server->super))
++ break;
+ inode = igrab(lo->plh_inode);
+- if (inode == NULL)
+- continue;
+- list_del_init(&lo->plh_layouts);
+- if (pnfs_layout_add_bulk_destroy_list(inode, layout_list))
+- continue;
+- rcu_read_unlock();
+- spin_unlock(&clp->cl_lock);
+- iput(inode);
++ if (inode != NULL) {
++ list_del_init(&lo->plh_layouts);
++ if (pnfs_layout_add_bulk_destroy_list(inode,
++ layout_list))
++ continue;
++ rcu_read_unlock();
++ spin_unlock(&clp->cl_lock);
++ iput(inode);
++ } else {
++ rcu_read_unlock();
++ spin_unlock(&clp->cl_lock);
++ set_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags);
++ }
++ nfs_sb_deactive(server->super);
+ spin_lock(&clp->cl_lock);
+ rcu_read_lock();
+ return -EAGAIN;
+@@ -778,7 +791,7 @@ pnfs_layout_free_bulk_destroy_list(struct list_head *layout_list,
+ /* Free all lsegs that are attached to commit buckets */
+ nfs_commit_inode(inode, 0);
+ pnfs_put_layout_hdr(lo);
+- iput(inode);
++ nfs_iput_and_deactive(inode);
+ }
+ return ret;
+ }
+diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
+index 87f144f14d1e0..965d657086c8b 100644
+--- a/fs/nfs/pnfs.h
++++ b/fs/nfs/pnfs.h
+@@ -99,6 +99,7 @@ enum {
+ NFS_LAYOUT_RETURN_REQUESTED, /* Return this layout ASAP */
+ NFS_LAYOUT_INVALID_STID, /* layout stateid id is invalid */
+ NFS_LAYOUT_FIRST_LAYOUTGET, /* Serialize first layoutget */
++ NFS_LAYOUT_INODE_FREEING, /* The inode is being freed */
+ };
+
+ enum layoutdriver_policy_flags {
+--
+2.20.1
+
--- /dev/null
+From 1ea667c4b05d5b0ecc110e5f2ddac6b15a0644b5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Feb 2019 11:19:46 -0500
+Subject: NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE()
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+[ Upstream commit 108bb4afd351d65826648a47f11fa3104e250d9b ]
+
+If the attempt to instantiate the mirror's layout DS pointer failed,
+then that pointer may hold a value of type ERR_PTR(), so we need
+to check that before we dereference it.
+
+Fixes: 65990d1afbd2d ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/flexfilelayout/flexfilelayout.h | 32 +++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
+index d6515f1584f3c..d78ec99b6c4ca 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.h
++++ b/fs/nfs/flexfilelayout/flexfilelayout.h
+@@ -131,16 +131,6 @@ FF_LAYOUT_LSEG(struct pnfs_layout_segment *lseg)
+ generic_hdr);
+ }
+
+-static inline struct nfs4_deviceid_node *
+-FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
+-{
+- if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt ||
+- FF_LAYOUT_LSEG(lseg)->mirror_array[idx] == NULL ||
+- FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds == NULL)
+- return NULL;
+- return &FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds->id_node;
+-}
+-
+ static inline struct nfs4_ff_layout_ds *
+ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
+ {
+@@ -150,9 +140,25 @@ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node)
+ static inline struct nfs4_ff_layout_mirror *
+ FF_LAYOUT_COMP(struct pnfs_layout_segment *lseg, u32 idx)
+ {
+- if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt)
+- return NULL;
+- return FF_LAYOUT_LSEG(lseg)->mirror_array[idx];
++ struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg);
++
++ if (idx < fls->mirror_array_cnt)
++ return fls->mirror_array[idx];
++ return NULL;
++}
++
++static inline struct nfs4_deviceid_node *
++FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx)
++{
++ struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, idx);
++
++ if (mirror != NULL) {
++ struct nfs4_ff_layout_ds *mirror_ds = mirror->mirror_ds;
++
++ if (!IS_ERR_OR_NULL(mirror_ds))
++ return &mirror_ds->id_node;
++ }
++ return NULL;
+ }
+
+ static inline u32
+--
+2.20.1
+
--- /dev/null
+From 97d70151f22aeed556a8bbd17b498eec3e5b8ffe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 10:36:10 +0800
+Subject: nios2: ksyms: Add missing symbol exports
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ]
+
+Building nios2:allmodconfig fails as follows (each symbol is only listed
+once).
+
+ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined!
+ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined!
+ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined!
+ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined!
+ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined!
+ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined!
+
+The problem is seen with gcc 7.3.0.
+
+Export the missing symbols.
+
+Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
+index bf2f55d10a4d8..4e704046a150c 100644
+--- a/arch/nios2/kernel/nios2_ksyms.c
++++ b/arch/nios2/kernel/nios2_ksyms.c
+@@ -9,12 +9,20 @@
+ #include <linux/export.h>
+ #include <linux/string.h>
+
++#include <asm/cacheflush.h>
++#include <asm/pgtable.h>
++
+ /* string functions */
+
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memmove);
+
++/* memory management */
++
++EXPORT_SYMBOL(empty_zero_page);
++EXPORT_SYMBOL(flush_icache_range);
++
+ /*
+ * libgcc functions - functions that are used internally by the
+ * compiler... (prototypes are not correct though, but that
+@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
+ DECLARE_EXPORT(__umoddi3);
+ DECLARE_EXPORT(__umodsi3);
+ DECLARE_EXPORT(__muldi3);
++DECLARE_EXPORT(__ucmpdi2);
++DECLARE_EXPORT(__lshrdi3);
++DECLARE_EXPORT(__ashldi3);
++DECLARE_EXPORT(__ashrdi3);
+--
+2.20.1
+
--- /dev/null
+From 6f8259bae64f389983861a288a3d41b7814bb6bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Aug 2018 17:13:06 -0500
+Subject: NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+[ Upstream commit 1b7619828d0c341612f58683e73f279c37e70bbc ]
+
+Both devm_kcalloc() and devm_kzalloc() return NULL on error. They
+never return error pointers.
+
+The use of IS_ERR_OR_NULL is currently applied to the wrong
+context.
+
+Fix this by replacing IS_ERR_OR_NULL with regular NULL checks.
+
+Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Jon Mason <jdmason@kudzu.us>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ntb/hw/idt/ntb_hw_idt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c
+index d44d7ef38fe88..b68e2cad74cc7 100644
+--- a/drivers/ntb/hw/idt/ntb_hw_idt.c
++++ b/drivers/ntb/hw/idt/ntb_hw_idt.c
+@@ -1105,9 +1105,9 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port,
+ }
+
+ /* Allocate memory for memory window descriptors */
+- ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt,
+- sizeof(*ret_mws), GFP_KERNEL);
+- if (IS_ERR_OR_NULL(ret_mws))
++ ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws),
++ GFP_KERNEL);
++ if (!ret_mws)
+ return ERR_PTR(-ENOMEM);
+
+ /* Copy the info of detected memory windows */
+@@ -2393,7 +2393,7 @@ static struct idt_ntb_dev *idt_create_dev(struct pci_dev *pdev,
+
+ /* Allocate memory for the IDT PCIe-device descriptor */
+ ndev = devm_kzalloc(&pdev->dev, sizeof(*ndev), GFP_KERNEL);
+- if (IS_ERR_OR_NULL(ndev)) {
++ if (!ndev) {
+ dev_err(&pdev->dev, "Memory allocation failed for descriptor");
+ return ERR_PTR(-ENOMEM);
+ }
+--
+2.20.1
+
--- /dev/null
+From b36839c78f293608b17a64d8b84f020aacc574fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 13:57:29 +0200
+Subject: nvme: retain split access workaround for capability reads
+
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+[ Upstream commit 3a8ecc935efabdad106b5e06d07b150c394b4465 ]
+
+Commit 7fd8930f26be4
+
+ "nvme: add a common helper to read Identify Controller data"
+
+has re-introduced an issue that we have attempted to work around in the
+past, in commit a310acd7a7ea ("NVMe: use split lo_hi_{read,write}q").
+
+The problem is that some PCIe NVMe controllers do not implement 64-bit
+outbound accesses correctly, which is why the commit above switched
+to using lo_hi_[read|write]q for all 64-bit BAR accesses occuring in
+the code.
+
+In the mean time, the NVMe subsystem has been refactored, and now calls
+into the PCIe support layer for NVMe via a .reg_read64() method, which
+fails to use lo_hi_readq(), and thus reintroduces the problem that the
+workaround above aimed to address.
+
+Given that, at the moment, .reg_read64() is only used to read the
+capability register [which is known to tolerate split reads], let's
+switch .reg_read64() to lo_hi_readq() as well.
+
+This fixes a boot issue on some ARM boxes with NVMe behind a Synopsys
+DesignWare PCIe host controller.
+
+Fixes: 7fd8930f26be4 ("nvme: add a common helper to read Identify Controller data")
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index cd11cced36781..3788c053a0b19 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2274,7 +2274,7 @@ static int nvme_pci_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val)
+
+ static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val)
+ {
+- *val = readq(to_nvme_dev(ctrl)->bar + off);
++ *val = lo_hi_readq(to_nvme_dev(ctrl)->bar + off);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 40725f9e6e1644c3db438a3130e5fc8e25c2b28e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Jun 2019 11:27:29 +0100
+Subject: nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing
+
+From: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+
+[ Upstream commit 0493c4792b4eb260441e57f52cc11a9ded48b5a7 ]
+
+The i.MX6 and i.MX8 both have a bit-field spanning bits 27:22 called the
+WAIT field.
+
+The WAIT field according to the documentation for both parts "specifies
+time interval between auto read and write access in one time program. It is
+given in number of ipg_clk periods."
+
+This patch ensures that the relevant field is read and written back to the
+timing register.
+
+Fixes: 0642bac7da42 ("nvmem: imx-ocotp: add write support")
+
+Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
+Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/imx-ocotp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c
+index 193ca8fd350a4..0c8c3b9bb6a7a 100644
+--- a/drivers/nvmem/imx-ocotp.c
++++ b/drivers/nvmem/imx-ocotp.c
+@@ -199,7 +199,8 @@ static int imx_ocotp_write(void *context, unsigned int offset, void *val,
+ strobe_prog = clk_rate / (1000000000 / 10000) + 2 * (DEF_RELAX + 1) - 1;
+ strobe_read = clk_rate / (1000000000 / 40) + 2 * (DEF_RELAX + 1) - 1;
+
+- timing = strobe_prog & 0x00000FFF;
++ timing = readl(priv->base + IMX_OCOTP_ADDR_TIMING) & 0x0FC00000;
++ timing |= strobe_prog & 0x00000FFF;
+ timing |= (relax << 12) & 0x0000F000;
+ timing |= (strobe_read << 16) & 0x003F0000;
+
+--
+2.20.1
+
--- /dev/null
+From a3af5d28c0eb9fc57f30f31888e720c159492213 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:01:00 +0300
+Subject: of: mdio: Fix a signedness bug in of_phy_get_and_connect()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit d7eb651212fdbafa82d485d8e76095ac3b14c193 ]
+
+The "iface" variable is an enum and in this context GCC treats it as
+an unsigned int so the error handling is never triggered.
+
+Fixes: b78624125304 ("of_mdio: Abstract a general interface for phy connect")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/of/of_mdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
+index 8c1819230ed23..fe26697d3bd72 100644
+--- a/drivers/of/of_mdio.c
++++ b/drivers/of/of_mdio.c
+@@ -358,7 +358,7 @@ struct phy_device *of_phy_get_and_connect(struct net_device *dev,
+ struct phy_device *phy;
+
+ iface = of_get_phy_mode(np);
+- if (iface < 0)
++ if ((int)iface < 0)
+ return NULL;
+
+ phy_np = of_parse_phandle(np, "phy-handle", 0);
+--
+2.20.1
+
--- /dev/null
+From 4aeb4a3180238ba8ecc8d7a3b4b03f1a1caac239 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 05:07:46 -0800
+Subject: packet: fix data-race in fanout_flow_is_huge()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]
+
+KCSAN reported the following data-race [1]
+
+Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.
+
+Since the report hinted about multiple cpus using the history
+concurrently, I added a test avoiding writing on it if the
+victim slot already contains the desired value.
+
+[1]
+
+BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover
+
+read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1:
+ fanout_flow_is_huge net/packet/af_packet.c:1303 [inline]
+ fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0:
+ fanout_flow_is_huge net/packet/af_packet.c:1306 [inline]
+ fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index e788f9c7c3984..46b7fac82775c 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1337,15 +1337,21 @@ static void packet_sock_destruct(struct sock *sk)
+
+ static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
+ {
+- u32 rxhash;
++ u32 *history = po->rollover->history;
++ u32 victim, rxhash;
+ int i, count = 0;
+
+ rxhash = skb_get_hash(skb);
+ for (i = 0; i < ROLLOVER_HLEN; i++)
+- if (po->rollover->history[i] == rxhash)
++ if (READ_ONCE(history[i]) == rxhash)
+ count++;
+
+- po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
++ victim = prandom_u32() % ROLLOVER_HLEN;
++
++ /* Avoid dirtying the cache line if possible */
++ if (READ_ONCE(history[victim]) != rxhash)
++ WRITE_ONCE(history[victim], rxhash);
++
+ return count > (ROLLOVER_HLEN >> 1);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5c43c85ee84499f3c6a4a9b2e5674e5f95c7f11b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:46:55 -0400
+Subject: packet: in recvmsg msg_name return at least sizeof sockaddr_ll
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]
+
+Packet send checks that msg_name is at least sizeof sockaddr_ll.
+Packet recv must return at least this length, so that its output
+can be passed unmodified to packet send.
+
+This ceased to be true since adding support for lladdr longer than
+sll_addr. Since, the return value uses true address length.
+
+Always return at least sizeof sockaddr_ll, even if address length
+is shorter. Zero the padding bytes.
+
+Change v1->v2: do not overwrite zeroed padding again. use copy_len.
+
+Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
+Suggested-by: David Laight <David.Laight@aculab.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 4e1058159b082..e788f9c7c3984 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3407,20 +3407,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (msg->msg_name) {
++ int copy_len;
++
+ /* If the address length field is there to be filled
+ * in, we fill it in now.
+ */
+ if (sock->type == SOCK_PACKET) {
+ __sockaddr_check_size(sizeof(struct sockaddr_pkt));
+ msg->msg_namelen = sizeof(struct sockaddr_pkt);
++ copy_len = msg->msg_namelen;
+ } else {
+ struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+
+ msg->msg_namelen = sll->sll_halen +
+ offsetof(struct sockaddr_ll, sll_addr);
++ copy_len = msg->msg_namelen;
++ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
++ memset(msg->msg_name +
++ offsetof(struct sockaddr_ll, sll_addr),
++ 0, sizeof(sll->sll_addr));
++ msg->msg_namelen = sizeof(struct sockaddr_ll);
++ }
+ }
+- memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
+- msg->msg_namelen);
++ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+ if (pkt_sk(sk)->auxdata) {
+--
+2.20.1
+
--- /dev/null
+From d68981a2bc7e056429a737fd28fdd843dbb9dd45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 18:47:15 -0700
+Subject: Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 ]
+
+Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made
+the kfifo code round the number of elements up. That was good for
+__kfifo_alloc(), but it's actually wrong for __kfifo_init().
+
+The difference? __kfifo_alloc() will allocate the rounded-up number of
+elements, but __kfifo_init() uses an allocation done by the caller. We
+can't just say "use more elements than the caller allocated", and have
+to round down.
+
+The good news? All the normal cases will be using power-of-two arrays
+anyway, and most users of kfifo's don't use kfifo_init() at all, but one
+of the helper macros to declare a KFIFO that enforce the proper
+power-of-two behavior. But it looks like at least ibmvscsis might be
+affected.
+
+The bad news? Will Deacon refers to an old thread and points points out
+that the memory ordering in kfifo's is questionable. See
+
+ https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/
+
+for more.
+
+Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()")
+Reported-by: laokz <laokz@foxmail.com>
+Cc: Stefani Seibold <stefani@seibold.net>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg KH <greg@kroah.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kfifo.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kfifo.c b/lib/kfifo.c
+index 90ba1eb1df06e..a94227c555510 100644
+--- a/lib/kfifo.c
++++ b/lib/kfifo.c
+@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
+ {
+ size /= esize;
+
+- size = roundup_pow_of_two(size);
++ if (!is_power_of_2(size))
++ size = rounddown_pow_of_two(size);
+
+ fifo->in = 0;
+ fifo->out = 0;
+--
+2.20.1
+
--- /dev/null
+From b3ddf545e206c7042212b61fc9e6f779f4bd9ea6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 17:04:00 +0800
+Subject: PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit 726dabfde6aa35a4f1508e235ae37edbbf9fbc65 ]
+
+Functions copying from/to IO addresses should use the
+memcpy_fromio()/memcpy_toio() API rather than plain memcpy().
+
+Fix the issue detected through the sparse tool.
+
+Fixes: 349e7a85b25f ("PCI: endpoint: functions: Add an EP function to test PCI")
+Suggested-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+[lorenzo.pieralisi@arm.com: updated log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+CC: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+CC: Bjorn Helgaas <bhelgaas@google.com>
+CC: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+CC: Niklas Cassel <niklas.cassel@axis.com>
+CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+CC: Cyrille Pitchen <cyrille.pitchen@free-electrons.com>
+CC: linux-pci@vger.kernel.org
+CC: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/endpoint/functions/pci-epf-test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c
+index f9308c2f22e67..c2541a772abc8 100644
+--- a/drivers/pci/endpoint/functions/pci-epf-test.c
++++ b/drivers/pci/endpoint/functions/pci-epf-test.c
+@@ -177,7 +177,7 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test)
+ goto err_map_addr;
+ }
+
+- memcpy(buf, src_addr, reg->size);
++ memcpy_fromio(buf, src_addr, reg->size);
+
+ crc32 = crc32_le(~0, buf, reg->size);
+ if (crc32 != reg->checksum)
+@@ -231,7 +231,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test)
+ get_random_bytes(buf, reg->size);
+ reg->checksum = crc32_le(~0, buf, reg->size);
+
+- memcpy(dst_addr, buf, reg->size);
++ memcpy_toio(dst_addr, buf, reg->size);
+
+ /*
+ * wait 1ms inorder for the write to complete. Without this delay L3
+--
+2.20.1
+
--- /dev/null
+From 1e3034811a0c50a952a455bb01cf06f484ab23e4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Aug 2018 10:22:58 -0700
+Subject: PCI: iproc: Remove PAXC slot check to allow VF support
+
+From: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+
+[ Upstream commit 4da6b4480766e5bc9c4d7bc14bf1d0939a1a5fa7 ]
+
+Fix previous incorrect logic that limits PAXC slot number to zero only.
+In order for SRIOV/VF to work, we need to allow the slot number to be
+greater than zero.
+
+Fixes: 46560388c476c ("PCI: iproc: Allow multiple devices except on PAXC")
+Signed-off-by: Jitendra Bhivare <jitendra.bhivare@broadcom.com>
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/host/pcie-iproc.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
+index c0ecc9f35667f..8f8dac0155d63 100644
+--- a/drivers/pci/host/pcie-iproc.c
++++ b/drivers/pci/host/pcie-iproc.c
+@@ -573,14 +573,6 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct iproc_pcie *pcie,
+ return (pcie->base + offset);
+ }
+
+- /*
+- * PAXC is connected to an internally emulated EP within the SoC. It
+- * allows only one device.
+- */
+- if (pcie->ep_is_internal)
+- if (slot > 0)
+- return NULL;
+-
+ return iproc_pcie_map_ep_cfg_reg(pcie, busno, slot, fn, where);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8984dcf2ede2f48df34cd584ae0ac04b3c66d7f9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2019 11:08:50 +0200
+Subject: PCI: PM: Avoid possible suspend-to-idle issue
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit d491f2b75237ef37d8867830ab7fad8d9659e853 ]
+
+If a PCI driver leaves the device handled by it in D0 and calls
+pci_save_state() on the device in its ->suspend() or ->suspend_late()
+callback, it can expect the device to stay in D0 over the whole
+s2idle cycle. However, that may not be the case if there is a
+spurious wakeup while the system is suspended, because in that case
+pci_pm_suspend_noirq() will run again after pci_pm_resume_noirq()
+which calls pci_restore_state(), via pci_pm_default_resume_early(),
+so state_saved is cleared and the second iteration of
+pci_pm_suspend_noirq() will invoke pci_prepare_to_sleep() which
+may change the power state of the device.
+
+To avoid that, add a new internal flag, skip_bus_pm, that will be set
+by pci_pm_suspend_noirq() when it runs for the first time during the
+given system suspend-resume cycle if the state of the device has
+been saved already and the device is still in D0. Setting that flag
+will cause the next iterations of pci_pm_suspend_noirq() to set
+state_saved for pci_pm_resume_noirq(), so that it always restores the
+device state from the originally saved data, and avoid calling
+pci_prepare_to_sleep() for the device.
+
+Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci-driver.c | 17 ++++++++++++++++-
+ include/linux/pci.h | 1 +
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
+index 522e59274b5d0..1589a147c5364 100644
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -728,6 +728,8 @@ static int pci_pm_suspend(struct device *dev)
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+ const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
+
++ pci_dev->skip_bus_pm = false;
++
+ if (pci_has_legacy_pm_support(pci_dev))
+ return pci_legacy_suspend(dev, PMSG_SUSPEND);
+
+@@ -801,7 +803,20 @@ static int pci_pm_suspend_noirq(struct device *dev)
+ }
+ }
+
+- if (!pci_dev->state_saved) {
++ if (pci_dev->skip_bus_pm) {
++ /*
++ * The function is running for the second time in a row without
++ * going through full resume, which is possible only during
++ * suspend-to-idle in a spurious wakeup case. Moreover, the
++ * device was originally left in D0, so its power state should
++ * not be changed here and the device register values saved
++ * originally should be restored on resume again.
++ */
++ pci_dev->state_saved = true;
++ } else if (pci_dev->state_saved) {
++ if (pci_dev->current_state == PCI_D0)
++ pci_dev->skip_bus_pm = true;
++ } else {
+ pci_save_state(pci_dev);
+ if (pci_power_manageable(pci_dev))
+ pci_prepare_to_sleep(pci_dev);
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 59f4d10568c65..430f3c335446e 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -346,6 +346,7 @@ struct pci_dev {
+ D3cold, not set for devices
+ powered on/off by the
+ corresponding bridge */
++ unsigned int skip_bus_pm:1; /* Internal: Skip bus-level PM */
+ unsigned int ignore_hotplug:1; /* Ignore hotplug events */
+ unsigned int hotplug_user_indicators:1; /* SlotCtl indicators
+ controlled exclusively by
+--
+2.20.1
+
--- /dev/null
+From 0522d2c6700ef0633797483312ca9058480970e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Oct 2018 15:49:26 +0100
+Subject: pcrypt: use format specifier in kobject_add
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ]
+
+Passing string 'name' as the format specifier is potentially hazardous
+because name could (although very unlikely to) have a format specifier
+embedded in it causing issues when parsing the non-existent arguments
+to these. Follow best practice by using the "%s" format string for
+the string 'name'.
+
+Cleans up clang warning:
+crypto/pcrypt.c:397:40: warning: format string is not a string literal
+(potentially insecure) [-Wformat-security]
+
+Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/pcrypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index f8ec3d4ba4a80..a5718c0a3dc4e 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
+ int ret;
+
+ pinst->kobj.kset = pcrypt_kset;
+- ret = kobject_add(&pinst->kobj, NULL, name);
++ ret = kobject_add(&pinst->kobj, NULL, "%s", name);
+ if (!ret)
+ kobject_uevent(&pinst->kobj, KOBJ_ADD);
+
+--
+2.20.1
+
--- /dev/null
+From dfaf02c546e2c53e9d54cfbf6488907483a18fb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 09:59:53 +0530
+Subject: perf/ioctl: Add check for the sample_period value
+
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+
+[ Upstream commit 913a90bc5a3a06b1f04c337320e9aeee2328dd77 ]
+
+perf_event_open() limits the sample_period to 63 bits. See:
+
+ 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
+
+Make ioctl() consistent with it.
+
+Also on PowerPC, negative sample_period could cause a recursive
+PMIs leading to a hang (reported when running perf-fuzzer).
+
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: acme@kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: maddy@linux.vnet.ibm.com
+Cc: mpe@ellerman.id.au
+Fixes: 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits")
+Link: https://lkml.kernel.org/r/20190604042953.914-1-ravi.bangoria@linux.ibm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/events/core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index ea4f3f7a0c6f3..2ac73b4cb8a93 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4762,6 +4762,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
+ if (perf_event_check_period(event, value))
+ return -EINVAL;
+
++ if (!event->attr.freq && (value & (1ULL << 63)))
++ return -EINVAL;
++
+ event_function_call(event, __perf_event_period, &value);
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 95c68aed9bfcb56508ee791f1d77f67fa2b10b8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 10:22:27 +0530
+Subject: pinctrl: iproc-gpio: Fix incorrect pinconf configurations
+
+From: Li Jin <li.jin@broadcom.com>
+
+[ Upstream commit 398a1f50e3c731586182fd52b834103b0aa2f826 ]
+
+Fix drive strength for AON/CRMU controller; fix pull-up/down setting
+for CCM/CDRU controller.
+
+Fixes: 616043d58a89 ("pinctrl: Rename gpio driver from cygnus to iproc")
+Signed-off-by: Li Jin <li.jin@broadcom.com>
+Link: https://lore.kernel.org/r/1567054348-19685-2-git-send-email-srinath.mannam@broadcom.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 96 +++++++++++++++++++-----
+ 1 file changed, 77 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+index 85a8c97d9dfed..5fe419e468ecc 100644
+--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
++++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c
+@@ -54,8 +54,12 @@
+ /* drive strength control for ASIU GPIO */
+ #define IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET 0x58
+
+-/* drive strength control for CCM/CRMU (AON) GPIO */
+-#define IPROC_GPIO_DRV0_CTRL_OFFSET 0x00
++/* pinconf for CCM GPIO */
++#define IPROC_GPIO_PULL_DN_OFFSET 0x10
++#define IPROC_GPIO_PULL_UP_OFFSET 0x14
++
++/* pinconf for CRMU(aon) GPIO and CCM GPIO*/
++#define IPROC_GPIO_DRV_CTRL_OFFSET 0x00
+
+ #define GPIO_BANK_SIZE 0x200
+ #define NGPIOS_PER_BANK 32
+@@ -76,6 +80,12 @@ enum iproc_pinconf_param {
+ IPROC_PINCON_MAX,
+ };
+
++enum iproc_pinconf_ctrl_type {
++ IOCTRL_TYPE_AON = 1,
++ IOCTRL_TYPE_CDRU,
++ IOCTRL_TYPE_INVALID,
++};
++
+ /*
+ * Iproc GPIO core
+ *
+@@ -100,6 +110,7 @@ struct iproc_gpio {
+
+ void __iomem *base;
+ void __iomem *io_ctrl;
++ enum iproc_pinconf_ctrl_type io_ctrl_type;
+
+ raw_spinlock_t lock;
+
+@@ -461,20 +472,44 @@ static const struct pinctrl_ops iproc_pctrl_ops = {
+ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
+ bool disable, bool pull_up)
+ {
++ void __iomem *base;
+ unsigned long flags;
++ unsigned int shift;
++ u32 val_1, val_2;
+
+ raw_spin_lock_irqsave(&chip->lock, flags);
+-
+- if (disable) {
+- iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, false);
++ if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
++ base = chip->io_ctrl;
++ shift = IPROC_GPIO_SHIFT(gpio);
++
++ val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET);
++ val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET);
++ if (disable) {
++ /* no pull-up or pull-down */
++ val_1 &= ~BIT(shift);
++ val_2 &= ~BIT(shift);
++ } else if (pull_up) {
++ val_1 |= BIT(shift);
++ val_2 &= ~BIT(shift);
++ } else {
++ val_1 &= ~BIT(shift);
++ val_2 |= BIT(shift);
++ }
++ writel(val_1, base + IPROC_GPIO_PULL_UP_OFFSET);
++ writel(val_2, base + IPROC_GPIO_PULL_DN_OFFSET);
+ } else {
+- iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
+- pull_up);
+- iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, true);
++ if (disable) {
++ iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
++ false);
++ } else {
++ iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio,
++ pull_up);
++ iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio,
++ true);
++ }
+ }
+
+ raw_spin_unlock_irqrestore(&chip->lock, flags);
+-
+ dev_dbg(chip->dev, "gpio:%u set pullup:%d\n", gpio, pull_up);
+
+ return 0;
+@@ -483,14 +518,35 @@ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio,
+ static void iproc_gpio_get_pull(struct iproc_gpio *chip, unsigned gpio,
+ bool *disable, bool *pull_up)
+ {
++ void __iomem *base;
+ unsigned long flags;
++ unsigned int shift;
++ u32 val_1, val_2;
+
+ raw_spin_lock_irqsave(&chip->lock, flags);
+- *disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
+- *pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
++ if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) {
++ base = chip->io_ctrl;
++ shift = IPROC_GPIO_SHIFT(gpio);
++
++ val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET) & BIT(shift);
++ val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET) & BIT(shift);
++
++ *pull_up = val_1 ? true : false;
++ *disable = (val_1 | val_2) ? false : true;
++
++ } else {
++ *disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio);
++ *pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio);
++ }
+ raw_spin_unlock_irqrestore(&chip->lock, flags);
+ }
+
++#define DRV_STRENGTH_OFFSET(gpio, bit, type) ((type) == IOCTRL_TYPE_AON ? \
++ ((2 - (bit)) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
++ ((type) == IOCTRL_TYPE_CDRU) ? \
++ ((bit) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \
++ ((bit) * 4 + IPROC_GPIO_REG(gpio, IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET)))
++
+ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+ unsigned strength)
+ {
+@@ -505,11 +561,8 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+
+ if (chip->io_ctrl) {
+ base = chip->io_ctrl;
+- offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
+ } else {
+ base = chip->base;
+- offset = IPROC_GPIO_REG(gpio,
+- IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
+ }
+
+ shift = IPROC_GPIO_SHIFT(gpio);
+@@ -520,11 +573,11 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio,
+ raw_spin_lock_irqsave(&chip->lock, flags);
+ strength = (strength / 2) - 1;
+ for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
++ offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
+ val = readl(base + offset);
+ val &= ~BIT(shift);
+ val |= ((strength >> i) & 0x1) << shift;
+ writel(val, base + offset);
+- offset += 4;
+ }
+ raw_spin_unlock_irqrestore(&chip->lock, flags);
+
+@@ -541,11 +594,8 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
+
+ if (chip->io_ctrl) {
+ base = chip->io_ctrl;
+- offset = IPROC_GPIO_DRV0_CTRL_OFFSET;
+ } else {
+ base = chip->base;
+- offset = IPROC_GPIO_REG(gpio,
+- IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET);
+ }
+
+ shift = IPROC_GPIO_SHIFT(gpio);
+@@ -553,10 +603,10 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio,
+ raw_spin_lock_irqsave(&chip->lock, flags);
+ *strength = 0;
+ for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) {
++ offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type);
+ val = readl(base + offset) & BIT(shift);
+ val >>= shift;
+ *strength += (val << i);
+- offset += 4;
+ }
+
+ /* convert to mA */
+@@ -734,6 +784,7 @@ static int iproc_gpio_probe(struct platform_device *pdev)
+ u32 ngpios, pinconf_disable_mask = 0;
+ int irq, ret;
+ bool no_pinconf = false;
++ enum iproc_pinconf_ctrl_type io_ctrl_type = IOCTRL_TYPE_INVALID;
+
+ /* NSP does not support drive strength config */
+ if (of_device_is_compatible(dev->of_node, "brcm,iproc-nsp-gpio"))
+@@ -764,8 +815,15 @@ static int iproc_gpio_probe(struct platform_device *pdev)
+ dev_err(dev, "unable to map I/O memory\n");
+ return PTR_ERR(chip->io_ctrl);
+ }
++ if (of_device_is_compatible(dev->of_node,
++ "brcm,cygnus-ccm-gpio"))
++ io_ctrl_type = IOCTRL_TYPE_CDRU;
++ else
++ io_ctrl_type = IOCTRL_TYPE_AON;
+ }
+
++ chip->io_ctrl_type = io_ctrl_type;
++
+ if (of_property_read_u32(dev->of_node, "ngpios", &ngpios)) {
+ dev_err(&pdev->dev, "missing ngpios DT property\n");
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From 11bf51cd1e2efeba28d3996c2e4a2b0d59b1809c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jan 2019 13:04:52 +0100
+Subject: pinctrl: sh-pfc: emev2: Add missing pinmux functions
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ]
+
+The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present,
+but no pinmux functions refer to them, hence they can not be selected.
+
+Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+index 1cbbe04d7df65..eafd8edbcbe95 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
++++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
+ "dtv_b",
+ };
+
++static const char * const err_rst_reqb_groups[] = {
++ "err_rst_reqb",
++};
++
++static const char * const ext_clki_groups[] = {
++ "ext_clki",
++};
++
+ static const char * const iic0_groups[] = {
+ "iic0",
+ };
+@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
+ "yuv3",
+ };
+
++static const char * const lowpwr_groups[] = {
++ "lowpwr",
++};
++
+ static const char * const ntsc_groups[] = {
+ "ntsc_clk",
+ "ntsc_data",
+@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
+ "pwm1",
+ };
+
++static const char * const ref_clko_groups[] = {
++ "ref_clko",
++};
++
+ static const char * const sd_groups[] = {
+ "sd_cki",
+ };
+@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
+ SH_PFC_FUNCTION(cam),
+ SH_PFC_FUNCTION(cf),
+ SH_PFC_FUNCTION(dtv),
++ SH_PFC_FUNCTION(err_rst_reqb),
++ SH_PFC_FUNCTION(ext_clki),
+ SH_PFC_FUNCTION(iic0),
+ SH_PFC_FUNCTION(iic1),
+ SH_PFC_FUNCTION(jtag),
+ SH_PFC_FUNCTION(lcd),
++ SH_PFC_FUNCTION(lowpwr),
+ SH_PFC_FUNCTION(ntsc),
+ SH_PFC_FUNCTION(pwm0),
+ SH_PFC_FUNCTION(pwm1),
++ SH_PFC_FUNCTION(ref_clko),
+ SH_PFC_FUNCTION(sd),
+ SH_PFC_FUNCTION(sdi0),
+ SH_PFC_FUNCTION(sdi1),
+--
+2.20.1
+
--- /dev/null
+From a4d2e0803a8c367ba0113e02b8c0766265386aeb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:00:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ]
+
+The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers,
+but the lcd0_data24_1_mux[] array lacks the corresponding pin marks.
+
+Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index d8077065636e3..e9739dbcb356e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
+ LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
+ LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
+ LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
++ LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
+ LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
+ LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
+ LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
+--
+2.20.1
+
--- /dev/null
+From 9940a24a270c7a4aef103a0c03e117219b8797ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 10:57:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ]
+
+The gether_gmii_mux[] array contains the REF125CK pin mark, but the
+gether_gmii_pins[] array lacks the corresponding pin number.
+
+Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index 35f436bcb8491..d8077065636e3 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = {
+ */
+ 185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
+ 171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
+- 205, 163, 206, 207,
++ 205, 163, 206, 207, 158,
+ };
+ static const unsigned int gether_gmii_mux[] = {
+ ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
+--
+2.20.1
+
--- /dev/null
+From 72a3dd693f622b896c1217007c58054ed418c46f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 17:07:43 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ]
+
+The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a
+typo, thus the group cannot be selected.
+
+Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index d34982ea66bf1..e4774b2200405 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -5209,7 +5209,7 @@ static const char * const scifb2_groups[] = {
+ "scifb2_data_b",
+ "scifb2_clk_b",
+ "scifb2_ctrl_b",
+- "scifb0_data_c",
++ "scifb2_data_c",
+ "scifb2_clk_c",
+ "scifb2_data_d",
+ };
+--
+2.20.1
+
--- /dev/null
+From 5d2da31f373a95626c84369dfb482733eb91436b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:05:57 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ]
+
+The qspi_data4_b_mux[] array contains pin marks for the clock and chip
+select pins. The qspi_data4_b_pins[] array rightfully does not contain
+the corresponding pin numbers, as the control pins are provided by a
+separate group (qspi_ctrl_b).
+
+Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index c01ef02d326b7..8600ba82f59c3 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -3220,8 +3220,7 @@ static const unsigned int qspi_data4_b_pins[] = {
+ RCAR_GP_PIN(6, 4),
+ };
+ static const unsigned int qspi_data4_b_mux[] = {
+- SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
+- IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
++ MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
+ };
+ /* - SCIF0 ------------------------------------------------------------------ */
+ static const unsigned int scif0_data_pins[] = {
+--
+2.20.1
+
--- /dev/null
+From 704d16730f3ebe2d2a798040c3e28ac49c09c17c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:12:20 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ]
+
+The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of
+the color components. The vin1_b_data18_pins[] array rightfully does
+not include the corresponding pin numbers, as RGB18 is subset of RGB24,
+containing only the 6 MSB bits of each component.
+
+Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 8600ba82f59c3..d34982ea66bf1 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -4348,17 +4348,14 @@ static const unsigned int vin1_b_data18_pins[] = {
+ };
+ static const unsigned int vin1_b_data18_mux[] = {
+ /* B */
+- VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
+ VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
+ VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
+ VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
+ /* G */
+- VI1_G0_B_MARK, VI1_G1_B_MARK,
+ VI1_G2_B_MARK, VI1_G3_B_MARK,
+ VI1_G4_B_MARK, VI1_G5_B_MARK,
+ VI1_G6_B_MARK, VI1_G7_B_MARK,
+ /* R */
+- VI1_R0_B_MARK, VI1_R1_B_MARK,
+ VI1_R2_B_MARK, VI1_R3_B_MARK,
+ VI1_R4_B_MARK, VI1_R5_B_MARK,
+ VI1_R6_B_MARK, VI1_R7_B_MARK,
+--
+2.20.1
+
--- /dev/null
+From 797e5951af0e79a312943c561f98347e25558600 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 17:14:07 +0100
+Subject: pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit b9fd50488b4939ce5b3a026d29e752e17c2d1800 ]
+
+The vin1_data18_b pin group itself is present, but it is not listed in
+the VIN1 pin group array, and thus cannot be selected.
+
+Fixes: 7dd74bb1f058786e ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+index cc3597f66605a..46c41ca6ea38b 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c
+@@ -1916,6 +1916,7 @@ static const char * const vin1_groups[] = {
+ "vin1_data8",
+ "vin1_data24_b",
+ "vin1_data20_b",
++ "vin1_data18_b",
+ "vin1_data16_b",
+ "vin1_sync",
+ "vin1_field",
+--
+2.20.1
+
--- /dev/null
+From a650aa27b53c68dda2cc036a484b8e505dbb07dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:21:16 +0100
+Subject: pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ]
+
+The Peripheral Function Select Register 9 contains 12 fields, but the
+variable field descriptor contains a 13th bogus field of 3 bits.
+
+Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+index a0ed220071f5f..93bdd3e8fb670 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+@@ -4742,7 +4742,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
+ },
+ { PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
+- 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
++ 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
+ /* IP9_31 [1] */
+ 0, 0,
+ /* IP9_30_28 [3] */
+--
+2.20.1
+
--- /dev/null
+From 80a34dafb71836cd7552d5c251e7aabf41a83264 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 13:59:42 +0100
+Subject: pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit e28dc3f09c9d2555a9bd982f0847988591052226 ]
+
+While the SEL_PWM[0-3] fields in the Module Select Register 0 support 4
+possible configurations per PWM pin, only the first 3 are valid.
+
+Replace the invalid and unused configurations for SEL_PWM[0-3]_3 by
+dummies.
+
+Fixes: 794a6711764658a1 ("pinctrl: sh-pfc: Initial R8A77995 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a77995.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+index 4f5ee1d7317d3..36421df1b3260 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c
+@@ -391,10 +391,10 @@ FM(IP12_31_28) IP12_31_28 \
+ #define MOD_SEL0_27 FM(SEL_MSIOF3_0) FM(SEL_MSIOF3_1)
+ #define MOD_SEL0_26 FM(SEL_HSCIF3_0) FM(SEL_HSCIF3_1)
+ #define MOD_SEL0_25 FM(SEL_SCIF4_0) FM(SEL_SCIF4_1)
+-#define MOD_SEL0_24_23 FM(SEL_PWM0_0) FM(SEL_PWM0_1) FM(SEL_PWM0_2) FM(SEL_PWM0_3)
+-#define MOD_SEL0_22_21 FM(SEL_PWM1_0) FM(SEL_PWM1_1) FM(SEL_PWM1_2) FM(SEL_PWM1_3)
+-#define MOD_SEL0_20_19 FM(SEL_PWM2_0) FM(SEL_PWM2_1) FM(SEL_PWM2_2) FM(SEL_PWM2_3)
+-#define MOD_SEL0_18_17 FM(SEL_PWM3_0) FM(SEL_PWM3_1) FM(SEL_PWM3_2) FM(SEL_PWM3_3)
++#define MOD_SEL0_24_23 FM(SEL_PWM0_0) FM(SEL_PWM0_1) FM(SEL_PWM0_2) F_(0, 0)
++#define MOD_SEL0_22_21 FM(SEL_PWM1_0) FM(SEL_PWM1_1) FM(SEL_PWM1_2) F_(0, 0)
++#define MOD_SEL0_20_19 FM(SEL_PWM2_0) FM(SEL_PWM2_1) FM(SEL_PWM2_2) F_(0, 0)
++#define MOD_SEL0_18_17 FM(SEL_PWM3_0) FM(SEL_PWM3_1) FM(SEL_PWM3_2) F_(0, 0)
+ #define MOD_SEL0_15 FM(SEL_IRQ_0_0) FM(SEL_IRQ_0_1)
+ #define MOD_SEL0_14 FM(SEL_IRQ_1_0) FM(SEL_IRQ_1_1)
+ #define MOD_SEL0_13 FM(SEL_IRQ_2_0) FM(SEL_IRQ_2_1)
+--
+2.20.1
+
--- /dev/null
+From 656d61b714de6b0c04ea08456155aa9830d4c913 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:27:56 +0100
+Subject: pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ]
+
+The Port C I/O Register 0 contains 7 reserved bits, but the descriptor
+contains only dummy configuration values for 6 reserved bits, thus
+breaking the configuration of all subsequent fields in the register.
+
+Fix this by adding the two missing configuration values.
+
+Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index a50d22bef1f44..cfdb4fc177c3e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
+- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PC8_IN, PC8_OUT,
+ PC7_IN, PC7_OUT,
+ PC6_IN, PC6_OUT,
+--
+2.20.1
+
--- /dev/null
+From bc3a83803c0ea2ea620d58a4dcb8b3d929c5530e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:20:14 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ]
+
+The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the
+tpu4_to3_pins[] array lacks the corresponding pin number.
+
+Add the missing pin number, for non-GPIO pin F26.
+
+Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index d25e6f674d0ab..f8fbedb46585d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = {
+ };
+ static const unsigned int tpu4_to3_pins[] = {
+ /* TO */
++ PIN_NUMBER(6, 26),
+ };
+ static const unsigned int tpu4_to3_mux[] = {
+ TPU4TO3_MARK,
+--
+2.20.1
+
--- /dev/null
+From 7de338420e0cfab20a323613f07b13e9ad36b129 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 16:51:21 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ]
+
+There are two pin groups for the FSIC SPDIF signal, but the FSIC pin
+group array lists only one, and it refers to a nonexistent group.
+
+Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index f8fbedb46585d..6dca760f9f280 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -3367,7 +3367,8 @@ static const char * const fsic_groups[] = {
+ "fsic_sclk_out",
+ "fsic_data_in",
+ "fsic_data_out",
+- "fsic_spdif",
++ "fsic_spdif_0",
++ "fsic_spdif_1",
+ };
+
+ static const char * const fsid_groups[] = {
+--
+2.20.1
+
--- /dev/null
+From 80e5ae129916e13bcf28b8487f8b293f1fd8d7c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:42:16 +0100
+Subject: pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ]
+
+The Peripheral Function Select Register 11 contains 3 reserved bits and
+15 variable-width fields, but the variable field descriptor does not
+contain the 3-bit field IP11[25:23].
+
+Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 3eccc9b3ca84a..05ccb27f77818 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2237,7 +2237,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_LCD_DATA15_B, 0, 0, 0 }
+ },
+ { PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
+- 3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
++ 3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+ /* IP11_31_29 [3] */
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ /* IP11_28 [1] */
+--
+2.20.1
+
--- /dev/null
+From a787339332f6ffc061184879deb0d8125a88c2cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:32:34 +0100
+Subject: pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ]
+
+The IP10[5:3] field in Peripheral Function Select Register 10 has a
+width of 3 bits, i.e. it allows programming one out of 8 different
+configurations.
+However, 9 values are provided instead of 8, overflowing into the
+subsequent field in the register, and thus breaking the configuration of
+the latter.
+
+Fix this by dropping a bogus zero value.
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index 05ccb27f77818..c691e5e9d9dea 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2231,7 +2231,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+- FN_LCD_DON_B, 0, 0, 0,
++ FN_LCD_DON_B, 0, 0,
+ /* IP10_2_0 [3] */
+ FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
+ FN_LCD_DATA15_B, 0, 0, 0 }
+--
+2.20.1
+
--- /dev/null
+From 7915361a29c3c0a55abc206947e57590a44cf7ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 00:17:12 +0000
+Subject: platform/x86: alienware-wmi: fix kfree on potentially uninitialized
+ pointer
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 98e2630284ab741804bd0713e932e725466f2f84 ]
+
+Currently the kfree of output.pointer can be potentially freeing
+an uninitalized pointer in the case where out_data is NULL. Fix this
+by reworking the case where out_data is not-null to perform the
+ACPI status check and also the kfree of outpoint.pointer in one block
+and hence ensuring the pointer is only freed when it has been used.
+
+Also replace the if (ptr != NULL) idiom with just if (ptr).
+
+Fixes: ff0e9f26288d ("platform/x86: alienware-wmi: Correct a memory leak")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/alienware-wmi.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index e335b18da20fc..cbd84e2e3bd47 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -505,23 +505,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
+
+ input.length = (acpi_size) sizeof(*in_args);
+ input.pointer = in_args;
+- if (out_data != NULL) {
++ if (out_data) {
+ output.length = ACPI_ALLOCATE_BUFFER;
+ output.pointer = NULL;
+ status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
+ command, &input, &output);
+- } else
++ if (ACPI_SUCCESS(status)) {
++ obj = (union acpi_object *)output.pointer;
++ if (obj && obj->type == ACPI_TYPE_INTEGER)
++ *out_data = (u32)obj->integer.value;
++ }
++ kfree(output.pointer);
++ } else {
+ status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0,
+ command, &input, NULL);
+-
+- if (ACPI_SUCCESS(status) && out_data != NULL) {
+- obj = (union acpi_object *)output.pointer;
+- if (obj && obj->type == ACPI_TYPE_INTEGER)
+- *out_data = (u32) obj->integer.value;
+ }
+- kfree(output.pointer);
+ return status;
+-
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From aee8efdf72d88cb35680ab20b2be5cfc2a5b01ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 12:44:18 +0300
+Subject: platform/x86: alienware-wmi: printing the wrong error code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ]
+
+The "out_data" variable is uninitialized at the point. Originally, this
+used to print "status" instead and that seems like the correct thing to
+print.
+
+Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/alienware-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index cbd84e2e3bd47..2c82188f8486c 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -570,7 +570,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ return scnprintf(buf, PAGE_SIZE,
+ "input [gpu] unknown\n");
+ }
+- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 376ed8e9836b8ee6a3efaf6fca12705500702e73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 16:14:24 +0100
+Subject: platform/x86: wmi: fix potential null pointer dereference
+
+From: Mattias Jacobsson <2pi@mok.nu>
+
+[ Upstream commit c355ec651a8941864549f2586f969d0eb7bf499a ]
+
+In the function wmi_dev_match() the variable id is dereferenced without
+first performing a NULL check. The variable can for example be NULL if
+a WMI driver is registered without specifying the id_table field in
+struct wmi_driver.
+
+Add a NULL check and return that the driver can't handle the device if
+the variable is NULL.
+
+Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver")
+Signed-off-by: Mattias Jacobsson <2pi@mok.nu>
+Signed-off-by: Darren Hart (VMware) <dvhart@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/wmi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
+index 7f8fa42a10840..a56e997816b23 100644
+--- a/drivers/platform/x86/wmi.c
++++ b/drivers/platform/x86/wmi.c
+@@ -748,6 +748,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver)
+ struct wmi_block *wblock = dev_to_wblock(dev);
+ const struct wmi_device_id *id = wmi_driver->id_table;
+
++ if (id == NULL)
++ return 0;
++
+ while (id->guid_string) {
+ uuid_le driver_guid;
+
+--
+2.20.1
+
--- /dev/null
+From 70844dd7a26268c0bea18dbfa598f36e072ba4d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 13:03:48 +0200
+Subject: PM: sleep: Fix possible overflow in pm_system_cancel_wakeup()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+[ Upstream commit 2933954b71f10d392764f95eec0f0aa2d103054b ]
+
+It is not actually guaranteed that pm_abort_suspend will be
+nonzero when pm_system_cancel_wakeup() is called which may lead to
+subtle issues, so make it use atomic_dec_if_positive() instead of
+atomic_dec() for the safety sake.
+
+Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle")
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/power/wakeup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
+index df53e2b3296b4..877b2a1767a5a 100644
+--- a/drivers/base/power/wakeup.c
++++ b/drivers/base/power/wakeup.c
+@@ -877,7 +877,7 @@ EXPORT_SYMBOL_GPL(pm_system_wakeup);
+
+ void pm_system_cancel_wakeup(void)
+ {
+- atomic_dec(&pm_abort_suspend);
++ atomic_dec_if_positive(&pm_abort_suspend);
+ }
+
+ void pm_wakeup_clear(bool reset)
+--
+2.20.1
+
--- /dev/null
+From 108fd339e9e7ec388b1ecbcb5773f1f10b08ca24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 14:33:30 -0700
+Subject: power: supply: Init device wakeup after device_add()
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 8288022284859acbcc3cf1a073a1e2692d6c2543 ]
+
+We may want to use the device pointer in device_init_wakeup() with
+functions that expect the device to already be added with device_add().
+For example, if we were to link the device initializing wakeup to
+something in sysfs such as a class for wakeups we'll run into an error.
+It looks like this code was written with the assumption that the device
+would be added before initializing wakeup due to the order of operations
+in power_supply_unregister().
+
+Let's change the order of operations so we don't run into problems here.
+
+Fixes: 948dcf966228 ("power_supply: Prevent suspend until power supply events are processed")
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Tri Vo <trong@android.com>
+Cc: Kalesh Singh <kaleshsingh@google.com>
+Cc: Ravi Chandra Sadineni <ravisadineni@chromium.org>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/power_supply_core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index 3226faebe0a08..0f1a0efd5926c 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -891,14 +891,14 @@ __power_supply_register(struct device *parent,
+ }
+
+ spin_lock_init(&psy->changed_lock);
+- rc = device_init_wakeup(dev, ws);
+- if (rc)
+- goto wakeup_init_failed;
+-
+ rc = device_add(dev);
+ if (rc)
+ goto device_add_failed;
+
++ rc = device_init_wakeup(dev, ws);
++ if (rc)
++ goto wakeup_init_failed;
++
+ rc = psy_register_thermal(psy);
+ if (rc)
+ goto register_thermal_failed;
+@@ -935,8 +935,8 @@ register_cooler_failed:
+ psy_unregister_thermal(psy);
+ register_thermal_failed:
+ device_del(dev);
+-device_add_failed:
+ wakeup_init_failed:
++device_add_failed:
+ check_supplies_failed:
+ dev_set_name_failed:
+ put_device(dev);
+--
+2.20.1
+
--- /dev/null
+From 367966b12fbd73efdba2fddcefb8f63ce507d86a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 11:20:01 +1100
+Subject: powerpc/64s: Fix logic when handling unknown CPU features
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 8cfaf106918a8c13abb24c641556172afbb9545c ]
+
+In cpufeatures_process_feature(), if a provided CPU feature is unknown and
+enable_unknown is false, we erroneously print that the feature is being
+enabled and return true, even though no feature has been enabled, and
+may also set feature bits based on the last entry in the match table.
+
+Fix this so that we only set feature bits from the match table if we have
+actually enabled a feature from that table, and when failing to enable an
+unknown feature, always print the "not enabling" message and return false.
+
+Coincidentally, some older gccs (<GCC 7), when invoked with
+-fsanitize-coverage=trace-pc, cause a spurious uninitialised variable
+warning in this function:
+
+ arch/powerpc/kernel/dt_cpu_ftrs.c: In function ‘cpufeatures_process_feature’:
+ arch/powerpc/kernel/dt_cpu_ftrs.c:686:7: warning: ‘m’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+ if (m->cpu_ftr_bit_mask)
+
+An upcoming patch will enable support for kcov, which requires this option.
+This patch avoids the warning.
+
+Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features")
+Reported-by: Segher Boessenkool <segher@kernel.crashing.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+[ajd: add commit message]
+Signed-off-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/dt_cpu_ftrs.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c
+index 2357df60de952..7ed2b1b6643cc 100644
+--- a/arch/powerpc/kernel/dt_cpu_ftrs.c
++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c
+@@ -705,8 +705,10 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
+ m = &dt_cpu_feature_match_table[i];
+ if (!strcmp(f->name, m->name)) {
+ known = true;
+- if (m->enable(f))
++ if (m->enable(f)) {
++ cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
+ break;
++ }
+
+ pr_info("not enabling: %s (disabled or unsupported by kernel)\n",
+ f->name);
+@@ -714,17 +716,12 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f)
+ }
+ }
+
+- if (!known && enable_unknown) {
+- if (!feat_try_enable_unknown(f)) {
+- pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
+- f->name);
+- return false;
+- }
++ if (!known && (!enable_unknown || !feat_try_enable_unknown(f))) {
++ pr_info("not enabling: %s (unknown and unsupported by kernel)\n",
++ f->name);
++ return false;
+ }
+
+- if (m->cpu_ftr_bit_mask)
+- cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask;
+-
+ if (known)
+ pr_debug("enabling: %s\n", f->name);
+ else
+--
+2.20.1
+
--- /dev/null
+From b7c9163ccb40733fc9512a1a5bf6d564041c7999 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 23:45:04 -0500
+Subject: powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit d4aa219a074a5abaf95a756b9f0d190b5c03a945 ]
+
+Allow external callers to force the cacheinfo code to release all its
+references to cache nodes, e.g. before processing device tree updates
+post-migration, and to rebuild the hierarchy afterward.
+
+CPU online/offline must be blocked by callers; enforce this.
+
+Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/cacheinfo.c | 21 +++++++++++++++++++++
+ arch/powerpc/kernel/cacheinfo.h | 4 ++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index a8f20e5928e13..9edb454301336 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -865,4 +865,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
+ if (cache)
+ cache_cpu_clear(cache, cpu_id);
+ }
++
++void cacheinfo_teardown(void)
++{
++ unsigned int cpu;
++
++ lockdep_assert_cpus_held();
++
++ for_each_online_cpu(cpu)
++ cacheinfo_cpu_offline(cpu);
++}
++
++void cacheinfo_rebuild(void)
++{
++ unsigned int cpu;
++
++ lockdep_assert_cpus_held();
++
++ for_each_online_cpu(cpu)
++ cacheinfo_cpu_online(cpu);
++}
++
+ #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
+diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
+index 955f5e999f1b8..52bd3fc6642da 100644
+--- a/arch/powerpc/kernel/cacheinfo.h
++++ b/arch/powerpc/kernel/cacheinfo.h
+@@ -6,4 +6,8 @@
+ extern void cacheinfo_cpu_online(unsigned int cpu_id);
+ extern void cacheinfo_cpu_offline(unsigned int cpu_id);
+
++/* Allow migration/suspend to tear down and rebuild the hierarchy. */
++extern void cacheinfo_teardown(void);
++extern void cacheinfo_rebuild(void);
++
+ #endif /* _PPC_CACHEINFO_H */
+--
+2.20.1
+
--- /dev/null
+From 38f07a07c25be6fe84adf5b6557aa42c3fbe56e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Sep 2018 09:26:03 +0000
+Subject: powerpc/kgdb: add kgdb_arch_set/remove_breakpoint()
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit fb978ca207743badfe7efd9eebe68bcbb4969f79 ]
+
+Generic implementation fails to remove breakpoints after init
+when CONFIG_STRICT_KERNEL_RWX is selected:
+
+[ 13.251285] KGDB: BP remove failed: c001c338
+[ 13.259587] kgdbts: ERROR PUT: end of test buffer on 'do_fork_test' line 8 expected OK got $E14#aa
+[ 13.268969] KGDB: re-enter exception: ALL breakpoints killed
+[ 13.275099] CPU: 0 PID: 1 Comm: init Not tainted 4.18.0-g82bbb913ffd8 #860
+[ 13.282836] Call Trace:
+[ 13.285313] [c60e1ba0] [c0080ef0] kgdb_handle_exception+0x6f4/0x720 (unreliable)
+[ 13.292618] [c60e1c30] [c000e97c] kgdb_handle_breakpoint+0x3c/0x98
+[ 13.298709] [c60e1c40] [c000af54] program_check_exception+0x104/0x700
+[ 13.305083] [c60e1c60] [c000e45c] ret_from_except_full+0x0/0x4
+[ 13.310845] [c60e1d20] [c02a22ac] run_simple_test+0x2b4/0x2d4
+[ 13.316532] [c60e1d30] [c0081698] put_packet+0xb8/0x158
+[ 13.321694] [c60e1d60] [c00820b4] gdb_serial_stub+0x230/0xc4c
+[ 13.327374] [c60e1dc0] [c0080af8] kgdb_handle_exception+0x2fc/0x720
+[ 13.333573] [c60e1e50] [c000e928] kgdb_singlestep+0xb4/0xcc
+[ 13.339068] [c60e1e70] [c000ae1c] single_step_exception+0x90/0xac
+[ 13.345100] [c60e1e80] [c000e45c] ret_from_except_full+0x0/0x4
+[ 13.350865] [c60e1f40] [c000e11c] ret_from_syscall+0x0/0x38
+[ 13.356346] Kernel panic - not syncing: Recursive entry to debugger
+
+This patch creates powerpc specific version of
+kgdb_arch_set_breakpoint() and kgdb_arch_remove_breakpoint()
+using patch_instruction()
+
+Fixes: 1e0fc9d1eb2b ("powerpc/Kconfig: Enable STRICT_KERNEL_RWX for some configs")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/include/asm/kgdb.h | 5 +++-
+ arch/powerpc/kernel/kgdb.c | 43 +++++++++++++++++++++++++++------
+ 2 files changed, 39 insertions(+), 9 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/kgdb.h b/arch/powerpc/include/asm/kgdb.h
+index 9db24e77b9f4b..a9e098a3b881f 100644
+--- a/arch/powerpc/include/asm/kgdb.h
++++ b/arch/powerpc/include/asm/kgdb.h
+@@ -26,9 +26,12 @@
+ #define BREAK_INSTR_SIZE 4
+ #define BUFMAX ((NUMREGBYTES * 2) + 512)
+ #define OUTBUFMAX ((NUMREGBYTES * 2) + 512)
++
++#define BREAK_INSTR 0x7d821008 /* twge r2, r2 */
++
+ static inline void arch_kgdb_breakpoint(void)
+ {
+- asm(".long 0x7d821008"); /* twge r2, r2 */
++ asm(stringify_in_c(.long BREAK_INSTR));
+ }
+ #define CACHE_FLUSH_IS_SAFE 1
+ #define DBG_MAX_REG_NUM 70
+diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c
+index 35e240a0a4087..59c578f865aa6 100644
+--- a/arch/powerpc/kernel/kgdb.c
++++ b/arch/powerpc/kernel/kgdb.c
+@@ -24,6 +24,7 @@
+ #include <asm/processor.h>
+ #include <asm/machdep.h>
+ #include <asm/debug.h>
++#include <asm/code-patching.h>
+ #include <linux/slab.h>
+
+ /*
+@@ -144,7 +145,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
+ if (kgdb_handle_exception(1, SIGTRAP, 0, regs) != 0)
+ return 0;
+
+- if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
++ if (*(u32 *)regs->nip == BREAK_INSTR)
+ regs->nip += BREAK_INSTR_SIZE;
+
+ return 1;
+@@ -441,16 +442,42 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code,
+ return -1;
+ }
+
++int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt)
++{
++ int err;
++ unsigned int instr;
++ unsigned int *addr = (unsigned int *)bpt->bpt_addr;
++
++ err = probe_kernel_address(addr, instr);
++ if (err)
++ return err;
++
++ err = patch_instruction(addr, BREAK_INSTR);
++ if (err)
++ return -EFAULT;
++
++ *(unsigned int *)bpt->saved_instr = instr;
++
++ return 0;
++}
++
++int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt)
++{
++ int err;
++ unsigned int instr = *(unsigned int *)bpt->saved_instr;
++ unsigned int *addr = (unsigned int *)bpt->bpt_addr;
++
++ err = patch_instruction(addr, instr);
++ if (err)
++ return -EFAULT;
++
++ return 0;
++}
++
+ /*
+ * Global data
+ */
+-struct kgdb_arch arch_kgdb_ops = {
+-#ifdef __LITTLE_ENDIAN__
+- .gdb_bpt_instr = {0x08, 0x10, 0x82, 0x7d},
+-#else
+- .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
+-#endif
+-};
++struct kgdb_arch arch_kgdb_ops;
+
+ static int kgdb_not_implemented(struct pt_regs *regs)
+ {
+--
+2.20.1
+
--- /dev/null
+From 85ec0dcf6b294175f15e9efb2d034743040a377e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 13 Feb 2019 10:29:49 +1100
+Subject: powerpc/mm: Check secondary hash page table
+
+From: Rashmica Gupta <rashmica.g@gmail.com>
+
+[ Upstream commit 790845e2f12709d273d08ea7a2af7c2593689519 ]
+
+We were always calling base_hpte_find() with primary = true,
+even when we wanted to check the secondary table.
+
+mpe: I broke this when refactoring Rashmica's original patch.
+
+Fixes: 1515ab932156 ("powerpc/mm: Dump hash table")
+Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/dump_hashpagetable.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/dump_hashpagetable.c b/arch/powerpc/mm/dump_hashpagetable.c
+index 5c4c93dcff190..f666d74f05f51 100644
+--- a/arch/powerpc/mm/dump_hashpagetable.c
++++ b/arch/powerpc/mm/dump_hashpagetable.c
+@@ -343,7 +343,7 @@ static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize)
+
+ /* Look in secondary table */
+ if (slot == -1)
+- slot = base_hpte_find(ea, psize, true, &v, &r);
++ slot = base_hpte_find(ea, psize, false, &v, &r);
+
+ /* No entry found */
+ if (slot == -1)
+--
+2.20.1
+
--- /dev/null
+From cb9ec7810231a86f2691c4f43242c8b66778c037 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 23:45:06 -0500
+Subject: powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit e610a466d16a086e321f0bd421e2fc75cff28605 ]
+
+It's common for the platform to replace the cache device nodes after a
+migration. Since the cacheinfo code is never informed about this, it
+never drops its references to the source system's cache nodes, causing
+it to wind up in an inconsistent state resulting in warnings and oopses
+as soon as CPU online/offline occurs after the migration, e.g.
+
+ cache for /cpus/l3-cache@3113(Unified) refers to cache for /cpus/l2-cache@200d(Unified)
+ WARNING: CPU: 15 PID: 86 at arch/powerpc/kernel/cacheinfo.c:176 release_cache+0x1bc/0x1d0
+ [...]
+ NIP release_cache+0x1bc/0x1d0
+ LR release_cache+0x1b8/0x1d0
+ Call Trace:
+ release_cache+0x1b8/0x1d0 (unreliable)
+ cacheinfo_cpu_offline+0x1c4/0x2c0
+ unregister_cpu_online+0x1b8/0x260
+ cpuhp_invoke_callback+0x114/0xf40
+ cpuhp_thread_fun+0x270/0x310
+ smpboot_thread_fn+0x2c8/0x390
+ kthread+0x1b8/0x1c0
+ ret_from_kernel_thread+0x5c/0x68
+
+Using device tree notifiers won't work since we want to rebuild the
+hierarchy only after all the removals and additions have occurred and
+the device tree is in a consistent state. Call cacheinfo_teardown()
+before processing device tree updates, and rebuild the hierarchy
+afterward.
+
+Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/platforms/pseries/mobility.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 9739a055e5f7b..2d3668acb6ef5 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -23,6 +23,7 @@
+ #include <asm/machdep.h>
+ #include <asm/rtas.h>
+ #include "pseries.h"
++#include "../../kernel/cacheinfo.h"
+
+ static struct kobject *mobility_kobj;
+
+@@ -359,11 +360,20 @@ void post_mobility_fixup(void)
+ */
+ cpus_read_lock();
+
++ /*
++ * It's common for the destination firmware to replace cache
++ * nodes. Release all of the cacheinfo hierarchy's references
++ * before updating the device tree.
++ */
++ cacheinfo_teardown();
++
+ rc = pseries_devicetree_update(MIGRATION_SCOPE);
+ if (rc)
+ printk(KERN_ERR "Post-mobility device tree update "
+ "failed: %d\n", rc);
+
++ cacheinfo_rebuild();
++
+ cpus_read_unlock();
+
+ /* Possibly switch to a new RFI flush type */
+--
+2.20.1
+
--- /dev/null
+From 5001f7c96d779d110f8b25797ec30fea5624cfd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 04:24:37 +0000
+Subject: powerpc: vdso: Make vdso32 installation conditional in vdso_install
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ]
+
+The 32-bit vDSO is not needed and not normally built for 64-bit
+little-endian configurations. However, the vdso_install target still
+builds and installs it. Add the same config condition as is normally
+used for the build.
+
+Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 0f04c878113ef..9c78ef2982572 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -385,7 +385,9 @@ vdso_install:
+ ifeq ($(CONFIG_PPC64),y)
+ $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
+ endif
++ifdef CONFIG_VDSO32
+ $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
++endif
+
+ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+--
+2.20.1
+
--- /dev/null
+From 5b0dfbc0dce0a871ac56cec1f6f6c57513556c82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Oct 2018 12:12:28 +0200
+Subject: pwm: lpss: Release runtime-pm reference from the driver's remove
+ callback
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 42885551cedb45961879d2fc3dc3c4dc545cc23e ]
+
+For each pwm output which gets enabled through pwm_lpss_apply(), we do a
+pm_runtime_get_sync().
+
+This commit adds pm_runtime_put() calls to pwm_lpss_remove() to balance
+these when the driver gets removed with some of the outputs still enabled.
+
+Fixes: f080be27d7d9 ("pwm: lpss: Add support for runtime PM")
+Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-lpss.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
+index 1e69c1c9ec096..7a4a6406cf69a 100644
+--- a/drivers/pwm/pwm-lpss.c
++++ b/drivers/pwm/pwm-lpss.c
+@@ -216,6 +216,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe);
+
+ int pwm_lpss_remove(struct pwm_lpss_chip *lpwm)
+ {
++ int i;
++
++ for (i = 0; i < lpwm->info->npwm; i++) {
++ if (pwm_is_enabled(&lpwm->chip.pwms[i]))
++ pm_runtime_put(lpwm->chip.dev);
++ }
+ return pwmchip_remove(&lpwm->chip);
+ }
+ EXPORT_SYMBOL_GPL(pwm_lpss_remove);
+--
+2.20.1
+
--- /dev/null
+From 3ca533c2831060b935f0c0650d12e5023aa3f374 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 20:18:16 +0200
+Subject: pwm: meson: Consider 128 a valid pre-divider
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 51496e4446875726d50a5617a6e0e0dabbc2e6da ]
+
+The pre-divider allows configuring longer PWM periods compared to using
+the input clock directly. The pre-divider is 7 bit wide, meaning it's
+maximum value is 128 (the register value is off-by-one: 0x7f or 127).
+
+Change the loop to also allow for the maximum possible value to be
+considered valid.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-meson.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index 9b79cbc7a7152..9551f896dd6f3 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -188,7 +188,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ do_div(fin_ps, fin_freq);
+
+ /* Calc pre_div with the period */
+- for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
++ for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
+ cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
+ fin_ps * (pre_div + 1));
+ dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
+@@ -197,7 +197,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ break;
+ }
+
+- if (pre_div == MISC_CLK_DIV_MASK) {
++ if (pre_div > MISC_CLK_DIV_MASK) {
+ dev_err(meson->chip.dev, "unable to get period pre_div\n");
+ return -EINVAL;
+ }
+--
+2.20.1
+
--- /dev/null
+From a7688515439384d033afefc0cf57647a8275f881 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Apr 2019 20:18:17 +0200
+Subject: pwm: meson: Don't disable PWM when setting duty repeatedly
+
+From: Bichao Zheng <bichao.zheng@amlogic.com>
+
+[ Upstream commit a279345807e1e0ae79567a52cfdd9d30c9174a3c ]
+
+There is an abnormally low about 20ms,when setting duty repeatedly.
+Because setting the duty will disable PWM and then enable. Delete
+this operation now.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
+[ Dropped code instead of hiding it behind a comment ]
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-meson.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index 9551f896dd6f3..3d2c36963a4fc 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -325,11 +325,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (state->period != channel->state.period ||
+ state->duty_cycle != channel->state.duty_cycle ||
+ state->polarity != channel->state.polarity) {
+- if (channel->state.enabled) {
+- meson_pwm_disable(meson, pwm->hwpwm);
+- channel->state.enabled = false;
+- }
+-
+ if (state->polarity != channel->state.polarity) {
+ if (state->polarity == PWM_POLARITY_NORMAL)
+ meson->inverter_mask |= BIT(pwm->hwpwm);
+--
+2.20.1
+
--- /dev/null
+From 5e2d58984b84fb3152299fb725ff4839bbafc5a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Jun 2019 11:29:40 +0300
+Subject: qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state
+
+From: Michal Kalderon <michal.kalderon@marvell.com>
+
+[ Upstream commit 6117561e1bb30b2fe7f51e1961f34dbedd0bec8a ]
+
+Destroy QP waits for it's ep object state to be set to CLOSED
+before proceeding. ep->state can be updated from a different
+context. Add smp_store_release/READ_ONCE to synchronize.
+
+Fixes: fc4c6065e661 ("qed: iWARP implement disconnect flows")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+index bb09f5a9846f6..38d0f62bf037a 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -509,7 +509,8 @@ int qed_iwarp_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp)
+
+ /* Make sure ep is closed before returning and freeing memory. */
+ if (ep) {
+- while (ep->state != QED_IWARP_EP_CLOSED && wait_count++ < 200)
++ while (READ_ONCE(ep->state) != QED_IWARP_EP_CLOSED &&
++ wait_count++ < 200)
+ msleep(100);
+
+ if (ep->state != QED_IWARP_EP_CLOSED)
+@@ -991,8 +992,6 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
+
+ params.ep_context = ep;
+
+- ep->state = QED_IWARP_EP_CLOSED;
+-
+ switch (fw_return_code) {
+ case RDMA_RETURN_OK:
+ ep->qp->max_rd_atomic_req = ep->cm_info.ord;
+@@ -1052,6 +1051,10 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn,
+ break;
+ }
+
++ if (fw_return_code != RDMA_RETURN_OK)
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ ep->event_cb(ep->cb_context, ¶ms);
+
+ /* on passive side, if there is no associated QP (REJECT) we need to
+@@ -2069,7 +2072,9 @@ void qed_iwarp_qp_in_error(struct qed_hwfn *p_hwfn,
+ params.status = (fw_return_code == IWARP_QP_IN_ERROR_GOOD_CLOSE) ?
+ 0 : -ECONNRESET;
+
+- ep->state = QED_IWARP_EP_CLOSED;
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ spin_lock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+ list_del(&ep->list_entry);
+ spin_unlock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+@@ -2157,7 +2162,8 @@ qed_iwarp_tcp_connect_unsuccessful(struct qed_hwfn *p_hwfn,
+ params.event = QED_IWARP_EVENT_ACTIVE_COMPLETE;
+ params.ep_context = ep;
+ params.cm_info = &ep->cm_info;
+- ep->state = QED_IWARP_EP_CLOSED;
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
+
+ switch (fw_return_code) {
+ case IWARP_CONN_ERROR_TCP_CONNECT_INVALID_PACKET:
+--
+2.20.1
+
--- /dev/null
+From 410bd2847e23081a07acf1dc55e8036932fc1529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 17:01:23 +0200
+Subject: qed: reduce maximum stack frame size
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 7c116e02a4a7575c8c62bfd2106e3e3ec8fb99dc ]
+
+clang warns about an overly large stack frame in one function
+when it decides to inline all __qed_get_vport_*() functions into
+__qed_get_vport_stats():
+
+drivers/net/ethernet/qlogic/qed/qed_l2.c:1889:13: error: stack frame size of 1128 bytes in function '_qed_get_vport_stats' [-Werror,-Wframe-larger-than=]
+
+Use a noinline_for_stack annotation to prevent clang from inlining
+these, which keeps the maximum stack usage at around half of that
+in the worst case, similar to what we get with gcc.
+
+Fixes: 86622ee75312 ("qed: Move statistics to L2 code")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 34 +++++++++++-------------
+ 1 file changed, 15 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+index 62cde3854a5cd..5d7adedac68d2 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -1629,10 +1629,9 @@ static void __qed_get_vport_pstats_addrlen(struct qed_hwfn *p_hwfn,
+ }
+ }
+
+-static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_pstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct eth_pstorm_per_queue_stat pstats;
+ u32 pstats_addr = 0, pstats_len = 0;
+@@ -1659,10 +1658,9 @@ static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn,
+ HILO_64_REGPAIR(pstats.error_drop_pkts);
+ }
+
+-static void __qed_get_vport_tstats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_tstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct tstorm_per_port_stat tstats;
+ u32 tstats_addr, tstats_len;
+@@ -1705,10 +1703,9 @@ static void __qed_get_vport_ustats_addrlen(struct qed_hwfn *p_hwfn,
+ }
+ }
+
+-static void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack
++void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct eth_ustorm_per_queue_stat ustats;
+ u32 ustats_addr = 0, ustats_len = 0;
+@@ -1747,10 +1744,9 @@ static void __qed_get_vport_mstats_addrlen(struct qed_hwfn *p_hwfn,
+ }
+ }
+
+-static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats,
+- u16 statistics_bin)
++static noinline_for_stack void
++__qed_get_vport_mstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats, u16 statistics_bin)
+ {
+ struct eth_mstorm_per_queue_stat mstats;
+ u32 mstats_addr = 0, mstats_len = 0;
+@@ -1776,9 +1772,9 @@ static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn,
+ HILO_64_REGPAIR(mstats.tpa_coalesced_bytes);
+ }
+
+-static void __qed_get_vport_port_stats(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt,
+- struct qed_eth_stats *p_stats)
++static noinline_for_stack void
++__qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ struct qed_eth_stats *p_stats)
+ {
+ struct qed_eth_stats_common *p_common = &p_stats->common;
+ struct port_stats port_stats;
+--
+2.20.1
+
--- /dev/null
+From 1de16cad50c0e6c8f9d7bb32b1cfe1eb9571048e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 2 Sep 2019 11:27:31 +0200
+Subject: RDMA/cma: Fix false error message
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Håkon Bugge <haakon.bugge@oracle.com>
+
+[ Upstream commit a6e4d254c19b541a58caced322111084b27a7788 ]
+
+In addr_handler(), assuming status == 0 and the device already has been
+acquired (id_priv->cma_dev != NULL), we get the following incorrect
+"error" message:
+
+RDMA CM: ADDR_ERROR: failed to resolve IP. status 0
+
+Fixes: 498683c6a7ee ("IB/cma: Add debug messages to error flows")
+Link: https://lore.kernel.org/r/20190902092731.1055757-1-haakon.bugge@oracle.com
+Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/core/cma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index fc4630e4acdd6..1614f6f3677c0 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -2789,7 +2789,7 @@ static void addr_handler(int status, struct sockaddr *src_addr,
+ if (status)
+ pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n",
+ status);
+- } else {
++ } else if (status) {
+ pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n", status);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From c9e2ea7f20e554ae4c6ed9044c088db316beed81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 19:47:51 +0800
+Subject: RDMA/hns: Fixs hw access invalid dma memory error
+
+From: Xi Wang <wangxi11@huawei.com>
+
+[ Upstream commit ec5bc2cc69b4fc494e04d10fc5226f6f9cf67c56 ]
+
+When smmu is enable, if execute the perftest command and then use 'kill
+-9' to exit, follow this operation repeatedly, the kernel will have a high
+probability to print the following smmu event:
+
+ arm-smmu-v3 arm-smmu-v3.1.auto: event 0x10 received:
+ arm-smmu-v3 arm-smmu-v3.1.auto: 0x00007d0000000010
+ arm-smmu-v3 arm-smmu-v3.1.auto: 0x0000020900000080
+ arm-smmu-v3 arm-smmu-v3.1.auto: 0x00000000f47cf000
+ arm-smmu-v3 arm-smmu-v3.1.auto: 0x00000000f47cf000
+
+This is because the hw will periodically refresh the qpc cache until the
+next reset.
+
+This patch fixed it by removing the action that release qpc memory in the
+'hns_roce_qp_free' function.
+
+Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
+Signed-off-by: Xi Wang <wangxi11@huawei.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_qp.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c
+index 3a37d26889df1..281e9987ffc83 100644
+--- a/drivers/infiniband/hw/hns/hns_roce_qp.c
++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c
+@@ -241,7 +241,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp)
+
+ if ((hr_qp->ibqp.qp_type) != IB_QPT_GSI) {
+ hns_roce_table_put(hr_dev, &qp_table->irrl_table, hr_qp->qpn);
+- hns_roce_table_put(hr_dev, &qp_table->qp_table, hr_qp->qpn);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8ddc2360d66aba1779e083dd22a593fd4d1a0865 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Jan 2019 20:27:18 +0530
+Subject: RDMA/iw_cxgb4: Fix the unchecked ep dereference
+
+From: Raju Rangoju <rajur@chelsio.com>
+
+[ Upstream commit 3352976c892301fd576a2e9ff0ac7337b2e2ca48 ]
+
+The patch 944661dd97f4: "RDMA/iw_cxgb4: atomically lookup ep and get a
+reference" from May 6, 2016, leads to the following Smatch complaint:
+
+ drivers/infiniband/hw/cxgb4/cm.c:2953 terminate()
+ error: we previously assumed 'ep' could be null (see line 2945)
+
+Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Raju Rangoju <rajur@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index bb36cdf82a8d6..3668cc71b47e2 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -2923,15 +2923,18 @@ static int terminate(struct c4iw_dev *dev, struct sk_buff *skb)
+ ep = get_ep_from_tid(dev, tid);
+ BUG_ON(!ep);
+
+- if (ep && ep->com.qp) {
+- pr_warn("TERM received tid %u qpid %u\n",
+- tid, ep->com.qp->wq.sq.qid);
+- attrs.next_state = C4IW_QP_STATE_TERMINATE;
+- c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
+- C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
++ if (ep) {
++ if (ep->com.qp) {
++ pr_warn("TERM received tid %u qpid %u\n", tid,
++ ep->com.qp->wq.sq.qid);
++ attrs.next_state = C4IW_QP_STATE_TERMINATE;
++ c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp,
++ C4IW_QP_ATTR_NEXT_STATE, &attrs, 1);
++ }
++
++ c4iw_put_ep(&ep->com);
+ } else
+ pr_warn("TERM received tid %u no ep/qp\n", tid);
+- c4iw_put_ep(&ep->com);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From daef0a04e3a7ff678d54d53a5e120f02047fa83d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:55 +0200
+Subject: RDMA/ocrdma: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+index 27d5e8d9f08d3..7683d13dad3d5 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -55,7 +55,7 @@
+
+ int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+- if (index > 1)
++ if (index > 0)
+ return -EINVAL;
+
+ *pkey = 0xffff;
+--
+2.20.1
+
--- /dev/null
+From 5ffb2c9635c478d800c30be4bb0f45dfd0419a6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 May 2019 12:33:20 +0300
+Subject: RDMA/qedr: Fix incorrect device rate.
+
+From: Sagiv Ozeri <sagiv.ozeri@marvell.com>
+
+[ Upstream commit 69054666df0a9b4e8331319f98b6b9a88bc3fcc4 ]
+
+Use the correct enum value introduced in commit 12113a35ada6 ("IB/core:
+Add HDR speed enum") Prior to this change a 50Gbps port would show 40Gbps.
+
+This patch also cleaned up the redundant redefiniton of ib speeds for
+qedr.
+
+Fixes: 12113a35ada6 ("IB/core: Add HDR speed enum")
+Signed-off-by: Sagiv Ozeri <sagiv.ozeri@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 8bfe9073da78c..6ae72accae3db 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -178,54 +178,47 @@ int qedr_query_device(struct ib_device *ibdev,
+ return 0;
+ }
+
+-#define QEDR_SPEED_SDR (1)
+-#define QEDR_SPEED_DDR (2)
+-#define QEDR_SPEED_QDR (4)
+-#define QEDR_SPEED_FDR10 (8)
+-#define QEDR_SPEED_FDR (16)
+-#define QEDR_SPEED_EDR (32)
+-
+ static inline void get_link_speed_and_width(int speed, u8 *ib_speed,
+ u8 *ib_width)
+ {
+ switch (speed) {
+ case 1000:
+- *ib_speed = QEDR_SPEED_SDR;
++ *ib_speed = IB_SPEED_SDR;
+ *ib_width = IB_WIDTH_1X;
+ break;
+ case 10000:
+- *ib_speed = QEDR_SPEED_QDR;
++ *ib_speed = IB_SPEED_QDR;
+ *ib_width = IB_WIDTH_1X;
+ break;
+
+ case 20000:
+- *ib_speed = QEDR_SPEED_DDR;
++ *ib_speed = IB_SPEED_DDR;
+ *ib_width = IB_WIDTH_4X;
+ break;
+
+ case 25000:
+- *ib_speed = QEDR_SPEED_EDR;
++ *ib_speed = IB_SPEED_EDR;
+ *ib_width = IB_WIDTH_1X;
+ break;
+
+ case 40000:
+- *ib_speed = QEDR_SPEED_QDR;
++ *ib_speed = IB_SPEED_QDR;
+ *ib_width = IB_WIDTH_4X;
+ break;
+
+ case 50000:
+- *ib_speed = QEDR_SPEED_QDR;
+- *ib_width = IB_WIDTH_4X;
++ *ib_speed = IB_SPEED_HDR;
++ *ib_width = IB_WIDTH_1X;
+ break;
+
+ case 100000:
+- *ib_speed = QEDR_SPEED_EDR;
++ *ib_speed = IB_SPEED_EDR;
+ *ib_width = IB_WIDTH_4X;
+ break;
+
+ default:
+ /* Unsupported */
+- *ib_speed = QEDR_SPEED_SDR;
++ *ib_speed = IB_SPEED_SDR;
+ *ib_width = IB_WIDTH_1X;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 3913c7e8169c615a41af5c318fccfb30a00945b9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:56 +0200
+Subject: RDMA/qedr: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit dbe30dae487e1a232158c24b432d45281c2805b7 ]
+
+The pkey table size is QEDR_ROCE_PKEY_TABLE_LEN, index should be tested
+for >= QEDR_ROCE_PKEY_TABLE_LEN instead of > QEDR_ROCE_PKEY_TABLE_LEN.
+
+Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qedr/verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c
+index 656e7c1a4449f..8bfe9073da78c 100644
+--- a/drivers/infiniband/hw/qedr/verbs.c
++++ b/drivers/infiniband/hw/qedr/verbs.c
+@@ -63,7 +63,7 @@ static inline int qedr_ib_copy_to_udata(struct ib_udata *udata, void *src,
+
+ int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+- if (index > QEDR_ROCE_PKEY_TABLE_LEN)
++ if (index >= QEDR_ROCE_PKEY_TABLE_LEN)
+ return -EINVAL;
+
+ *pkey = QEDR_ROCE_PKEY_DEFAULT;
+--
+2.20.1
+
--- /dev/null
+From 2211535df238bcc0f170cdb1f3b727e72f13999e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 22:43:46 +0200
+Subject: regulator: fixed: Default enable high on DT regulators
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 28be5f15df2ee6882b0a122693159c96a28203c7 ]
+
+commit efdfeb079cc3
+("regulator: fixed: Convert to use GPIO descriptor only")
+switched to use gpiod_get() to look up the regulator from the
+gpiolib core whether that is device tree or boardfile.
+
+This meant that we activate the code in
+a603a2b8d86e ("gpio: of: Add special quirk to parse regulator flags")
+which means the descriptors coming from the device tree already
+have the right inversion and open drain semantics set up from
+the gpiolib core.
+
+As the fixed regulator was inspected again we got the
+inverted inversion and things broke.
+
+Fix it by ignoring the config in the device tree for now: the
+later patches in the series will push all inversion handling
+over to the gpiolib core and set it up properly in the
+boardfiles for legacy devices, but I did not finish that
+for this kernel cycle.
+
+Fixes: commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only")
+Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reported-by: Fabio Estevam <festevam@gmail.com>
+Reported-by: John Stultz <john.stultz@linaro.org>
+Reported-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/fixed.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
+index 988a7472c2ab5..d68ff65a5adc9 100644
+--- a/drivers/regulator/fixed.c
++++ b/drivers/regulator/fixed.c
+@@ -84,9 +84,14 @@ of_get_fixed_voltage_config(struct device *dev,
+
+ of_property_read_u32(np, "startup-delay-us", &config->startup_delay);
+
+- config->enable_high = of_property_read_bool(np, "enable-active-high");
+- config->gpio_is_open_drain = of_property_read_bool(np,
+- "gpio-open-drain");
++ /*
++ * FIXME: we pulled active low/high and open drain handling into
++ * gpiolib so it will be handled there. Delete this in the second
++ * step when we also remove the custom inversion handling for all
++ * legacy boardfiles.
++ */
++ config->enable_high = 1;
++ config->gpio_is_open_drain = 0;
+
+ if (of_find_property(np, "vin-supply", NULL))
+ config->input_supply = "vin";
+--
+2.20.1
+
--- /dev/null
+From 1eebe8b7873e8ae54e4d50bf37539bdeaf82a29d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 14:16:40 +0800
+Subject: regulator: lp87565: Fix missing register for LP87565_BUCK_0
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit d1a6cbdf1e597917cb642c655512d91b71a35d22 ]
+
+LP87565_BUCK_0 is missed, fix it.
+
+Fixes: f0168a9bf ("regulator: lp87565: Add support for lp87565 PMIC regulators")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Reviewed-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/lp87565-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/lp87565-regulator.c b/drivers/regulator/lp87565-regulator.c
+index cfdbe294fb6af..32d4e6ec2e198 100644
+--- a/drivers/regulator/lp87565-regulator.c
++++ b/drivers/regulator/lp87565-regulator.c
+@@ -188,7 +188,7 @@ static int lp87565_regulator_probe(struct platform_device *pdev)
+ struct lp87565 *lp87565 = dev_get_drvdata(pdev->dev.parent);
+ struct regulator_config config = { };
+ struct regulator_dev *rdev;
+- int i, min_idx = LP87565_BUCK_1, max_idx = LP87565_BUCK_3;
++ int i, min_idx = LP87565_BUCK_0, max_idx = LP87565_BUCK_3;
+
+ platform_set_drvdata(pdev, lp87565);
+
+--
+2.20.1
+
--- /dev/null
+From a2372d11e95ffd7f64a0a3737bdc926c08914225 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:00 +0800
+Subject: regulator: pv88060: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 7cd415f875591bc66c5ecb49bf84ef97e80d7b0e ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: f307a7e9b7af ("regulator: pv88060: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88060-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c
+index a9446056435f9..1f2d8180506bc 100644
+--- a/drivers/regulator/pv88060-regulator.c
++++ b/drivers/regulator/pv88060-regulator.c
+@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min,
+ int i;
+
+ /* search for closest to maximum */
+- for (i = info->n_current_limits; i >= 0; i--) {
++ for (i = info->n_current_limits - 1; i >= 0; i--) {
+ if (min <= info->current_limits[i]
+ && max >= info->current_limits[i]) {
+ return regmap_update_bits(rdev->regmap,
+--
+2.20.1
+
--- /dev/null
+From 13454fcef34b0deaef67c8b27e3c66248515ce96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:01 +0800
+Subject: regulator: pv88080: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit 3c413f594c4f9df40061445667ca11a12bc8ee34 ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: 99cf3af5e2d5 ("regulator: pv88080: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88080-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c
+index 9a08cb2de501e..6770e4de20978 100644
+--- a/drivers/regulator/pv88080-regulator.c
++++ b/drivers/regulator/pv88080-regulator.c
+@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min,
+ int i;
+
+ /* search for closest to maximum */
+- for (i = info->n_current_limits; i >= 0; i--) {
++ for (i = info->n_current_limits - 1; i >= 0; i--) {
+ if (min <= info->current_limits[i]
+ && max >= info->current_limits[i]) {
+ return regmap_update_bits(rdev->regmap,
+--
+2.20.1
+
--- /dev/null
+From a427e5a35c7f30a61c1e87585d1e4488bfc2a1bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 18:00:02 +0800
+Subject: regulator: pv88090: Fix array out-of-bounds access
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit a5455c9159414748bed4678184bf69989a4f7ba3 ]
+
+Fix off-by-one while iterating current_limits array.
+The valid index should be 0 ~ n_current_limits -1.
+
+Fixes: c90456e36d9c ("regulator: pv88090: new regulator driver")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/pv88090-regulator.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c
+index 7a0c15957bd0b..2302b0df7630f 100644
+--- a/drivers/regulator/pv88090-regulator.c
++++ b/drivers/regulator/pv88090-regulator.c
+@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min,
+ int i;
+
+ /* search for closest to maximum */
+- for (i = info->n_current_limits; i >= 0; i--) {
++ for (i = info->n_current_limits - 1; i >= 0; i--) {
+ if (min <= info->current_limits[i]
+ && max >= info->current_limits[i]) {
+ return regmap_update_bits(rdev->regmap,
+--
+2.20.1
+
--- /dev/null
+From 13c3446c902045c02bd582e39d1ec5c63b6843fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Mar 2019 16:57:52 +0800
+Subject: regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit e69b394703e032e56a140172440ec4f9890b536d ]
+
+selector 0xB (1011) should be 2.6V rather than 2.7V, fit ix.
+
+Table 5-4. LDOA1 Output Voltage Options
+VID Bits VOUT VID Bits VOUT VID Bits VOUT VID Bits VOUT
+0000 1.35 0100 1.8 1000 2.3 1100 2.85
+0001 1.5 0101 1.9 1001 2.4 1101 3.0
+0010 1.6 0110 2.0 1010 2.5 1110 3.3
+0011 1.7 0111 2.1 1011 2.6 1111 Not Used
+
+Fixes: d2a2e729a666 ("regulator: tps65086: Add regulator driver for the TPS65086 PMIC")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/tps65086-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c
+index 45e96e1546900..5a5e9b5bf4bea 100644
+--- a/drivers/regulator/tps65086-regulator.c
++++ b/drivers/regulator/tps65086-regulator.c
+@@ -90,8 +90,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = {
+ static const struct regulator_linear_range tps65086_ldoa1_ranges[] = {
+ REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0),
+ REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000),
+- REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000),
+- REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000),
++ REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000),
++ REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000),
+ REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0),
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 59fe720ce405b40cc1bff40dc5267b8b13436d0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Feb 2019 21:16:51 +0800
+Subject: regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ]
+
+The wm831x_dcdc_ilim entries needs to be uA because it is used to compare
+with min_uA and max_uA.
+While at it also make the array const and change to use unsigned int.
+
+Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/wm831x-dcdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
+index 5a5bc4bb08d26..df591435d12a3 100644
+--- a/drivers/regulator/wm831x-dcdc.c
++++ b/drivers/regulator/wm831x-dcdc.c
+@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
+ }
+
+ /* Current limit options */
+-static u16 wm831x_dcdc_ilim[] = {
+- 125, 250, 375, 500, 625, 750, 875, 1000
++static const unsigned int wm831x_dcdc_ilim[] = {
++ 125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
+ };
+
+ static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
+--
+2.20.1
+
--- /dev/null
+From 0a846a7f0278e4f7c0bf414c4367c813d55973be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:08:11 +0000
+Subject: rtc: 88pm80x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")
+
+Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
+index 466bf7f9a285a..7da2a1fb50f89 100644
+--- a/drivers/rtc/rtc-88pm80x.c
++++ b/drivers/rtc/rtc-88pm80x.c
+@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ unsigned char buf[4];
+ unsigned long ticks, base, data;
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ int ret;
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+--
+2.20.1
+
--- /dev/null
+From dc1e611bd68c5194cef51c7a674b92954d89e7b1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 09:50:53 +0000
+Subject: rtc: 88pm860x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")
+
+Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index 166faae3a59cd..7d3e5168fcefc 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+--
+2.20.1
+
--- /dev/null
+From fbdb67466134aef56e6bd8578d41571339843cf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jan 2019 08:21:03 +0000
+Subject: rtc: cmos: ignore bogus century byte
+
+From: Eric Wong <e@80x24.org>
+
+[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]
+
+Older versions of Libreboot and Coreboot had an invalid value
+(`3' in my case) in the century byte affecting the GM45 in
+the Thinkpad X200. Not everybody's updated their firmwares,
+and Linux <= 4.2 was able to read the RTC without problems,
+so workaround this by ignoring invalid values.
+
+Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")
+
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
+Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
+Cc: linux-rtc@vger.kernel.org
+Signed-off-by: Eric Wong <e@80x24.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-mc146818-lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
+index 2f1772a358ca5..18a6f15e313d8 100644
+--- a/drivers/rtc/rtc-mc146818-lib.c
++++ b/drivers/rtc/rtc-mc146818-lib.c
+@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time)
+ time->tm_year += real_year - 72;
+ #endif
+
+- if (century)
++ if (century > 20)
+ time->tm_year += (century - 19) * 100;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 23622715301033a8ff46988f08ca7e1444c92319 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Jan 2019 15:35:58 +0100
+Subject: rtc: ds1307: rx8130: Fix alarm handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 3f929cad943380370b6db31fcb7a38d898d91089 ]
+
+When the EXTENSION.WADA bit is set, register 0x19 contains a bitmap of
+week days, not a day of month. As Linux only handles a single alarm
+without repetition using day of month is more flexible, so clear this
+bit. (Otherwise a value depending on time.tm_wday would have to be
+written to register 0x19.)
+
+Also optimize setting the AIE bit to use a single register write instead
+of a bulk write of three registers.
+
+Fixes: ee0981be7704 ("rtc: ds1307: Add support for Epson RX8130CE")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1307.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
+index e7d9215c9201b..8d45d93b1db67 100644
+--- a/drivers/rtc/rtc-ds1307.c
++++ b/drivers/rtc/rtc-ds1307.c
+@@ -733,8 +733,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+ if (ret < 0)
+ return ret;
+
+- ctl[0] &= ~RX8130_REG_EXTENSION_WADA;
+- ctl[1] |= RX8130_REG_FLAG_AF;
++ ctl[0] &= RX8130_REG_EXTENSION_WADA;
++ ctl[1] &= ~RX8130_REG_FLAG_AF;
+ ctl[2] &= ~RX8130_REG_CONTROL0_AIE;
+
+ ret = regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
+@@ -757,8 +757,7 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t)
+
+ ctl[2] |= RX8130_REG_CONTROL0_AIE;
+
+- return regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl,
+- sizeof(ctl));
++ return regmap_write(ds1307->regmap, RX8130_REG_CONTROL0, ctl[2]);
+ }
+
+ static int rx8130_alarm_irq_enable(struct device *dev, unsigned int enabled)
+--
+2.20.1
+
--- /dev/null
+From 947314277b23738fdc17636e77bcf41015f4b285 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Feb 2019 18:04:49 +0000
+Subject: rtc: ds1672: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#138801 ("Unintended sign extension")
+
+Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1672.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
+index 9caaccccaa575..b1ebca099b0df 100644
+--- a/drivers/rtc/rtc-ds1672.c
++++ b/drivers/rtc/rtc-ds1672.c
+@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+ "%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
+ __func__, buf[0], buf[1], buf[2], buf[3]);
+
+- time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+
+ rtc_time_to_tm(time, tm);
+
+--
+2.20.1
+
--- /dev/null
+From fb033393a13dfac545a7018c89d227df655f0ca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 15:19:34 +0200
+Subject: rtc: pcf2127: bugfix: read rtc disables watchdog
+
+From: Bruno Thomsen <bruno.thomsen@gmail.com>
+
+[ Upstream commit 7f43020e3bdb63d65661ed377682702f8b34d3ea ]
+
+The previous fix listed bulk read of registers as root cause of
+accendential disabling of watchdog, since the watchdog counter
+register (WD_VAL) was zeroed.
+
+Fixes: 3769a375ab83 rtc: pcf2127: bulk read only date and time registers.
+
+Tested with the same PCF2127 chip as Sean reveled root cause
+of WD_VAL register value zeroing was caused by reading CTRL2
+register which is one of the watchdog feature control registers.
+
+So the solution is to not read the first two control registers
+(CTRL1 and CTRL2) in pcf2127_rtc_read_time as they are not
+needed anyway. Size of local buf variable is kept to allow
+easy usage of register defines to improve readability of code.
+
+Debug trace line was updated after CTRL1 and CTRL2 are no longer
+read from the chip. Also replaced magic numbers in buf access
+with register defines.
+
+Signed-off-by: Bruno Thomsen <bruno.thomsen@gmail.com>
+Link: https://lore.kernel.org/r/20190822131936.18772-3-bruno.thomsen@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf2127.c | 32 ++++++++++++--------------------
+ 1 file changed, 12 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c
+index 9f1b14bf91aed..367e0f803440c 100644
+--- a/drivers/rtc/rtc-pcf2127.c
++++ b/drivers/rtc/rtc-pcf2127.c
+@@ -52,20 +52,14 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ struct pcf2127 *pcf2127 = dev_get_drvdata(dev);
+ unsigned char buf[10];
+ int ret;
+- int i;
+
+- for (i = 0; i <= PCF2127_REG_CTRL3; i++) {
+- ret = regmap_read(pcf2127->regmap, PCF2127_REG_CTRL1 + i,
+- (unsigned int *)(buf + i));
+- if (ret) {
+- dev_err(dev, "%s: read error\n", __func__);
+- return ret;
+- }
+- }
+-
+- ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_SC,
+- (buf + PCF2127_REG_SC),
+- ARRAY_SIZE(buf) - PCF2127_REG_SC);
++ /*
++ * Avoid reading CTRL2 register as it causes WD_VAL register
++ * value to reset to 0 which means watchdog is stopped.
++ */
++ ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_CTRL3,
++ (buf + PCF2127_REG_CTRL3),
++ ARRAY_SIZE(buf) - PCF2127_REG_CTRL3);
+ if (ret) {
+ dev_err(dev, "%s: read error\n", __func__);
+ return ret;
+@@ -86,14 +80,12 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ }
+
+ dev_dbg(dev,
+- "%s: raw data is cr1=%02x, cr2=%02x, cr3=%02x, "
+- "sec=%02x, min=%02x, hr=%02x, "
++ "%s: raw data is cr3=%02x, sec=%02x, min=%02x, hr=%02x, "
+ "mday=%02x, wday=%02x, mon=%02x, year=%02x\n",
+- __func__,
+- buf[0], buf[1], buf[2],
+- buf[3], buf[4], buf[5],
+- buf[6], buf[7], buf[8], buf[9]);
+-
++ __func__, buf[PCF2127_REG_CTRL3], buf[PCF2127_REG_SC],
++ buf[PCF2127_REG_MN], buf[PCF2127_REG_HR],
++ buf[PCF2127_REG_DM], buf[PCF2127_REG_DW],
++ buf[PCF2127_REG_MO], buf[PCF2127_REG_YR]);
+
+ tm->tm_sec = bcd2bin(buf[PCF2127_REG_SC] & 0x7F);
+ tm->tm_min = bcd2bin(buf[PCF2127_REG_MN] & 0x7F);
+--
+2.20.1
+
--- /dev/null
+From 3aa72f793900aad639041f9bfa7d2a058c5126ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 12:23:36 +0800
+Subject: rtc: pcf8563: Clear event flags and disable interrupts before
+ requesting irq
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3572e8aea3bf925dac1dbf86127657c39fe5c254 ]
+
+Besides the alarm, the PCF8563 also has a timer triggered interrupt.
+In cases where the previous system left the timer and interrupts on,
+or somehow the bits got enabled, the interrupt would keep triggering
+as the kernel doesn't know about it.
+
+Clear both the alarm and timer event flags, and disable the interrupts,
+before requesting the interrupt line.
+
+Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
+Fixes: a45d528aab8b ("rtc: pcf8563: clear expired alarm at boot time")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf8563.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index ef04472dde1d2..4d0b81f9805f8 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -563,7 +563,6 @@ static int pcf8563_probe(struct i2c_client *client,
+ struct pcf8563 *pcf8563;
+ int err;
+ unsigned char buf;
+- unsigned char alm_pending;
+
+ dev_dbg(&client->dev, "%s\n", __func__);
+
+@@ -587,13 +586,13 @@ static int pcf8563_probe(struct i2c_client *client,
+ return err;
+ }
+
+- err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
+- if (err) {
+- dev_err(&client->dev, "%s: read error\n", __func__);
++ /* Clear flags and disable interrupts */
++ buf = 0;
++ err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
++ if (err < 0) {
++ dev_err(&client->dev, "%s: write error\n", __func__);
+ return err;
+ }
+- if (alm_pending)
+- pcf8563_set_alarm_mode(client, 0);
+
+ pcf8563->rtc = devm_rtc_device_register(&client->dev,
+ pcf8563_driver.driver.name,
+--
+2.20.1
+
--- /dev/null
+From c7ed98475a4f37a77768a3ecd96166e7103713c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 12:23:35 +0800
+Subject: rtc: pcf8563: Fix interrupt trigger method
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 65f662cbf829834fa4d94190eb7691e5a9cb92d8 ]
+
+The PCF8563 datasheet says the interrupt line is active low and stays
+active until the events are cleared, i.e. a level trigger interrupt.
+
+Fix the flags used to request the interrupt.
+
+Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf8563.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index 8c836c51a508f..ef04472dde1d2 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -605,7 +605,7 @@ static int pcf8563_probe(struct i2c_client *client,
+ if (client->irq > 0) {
+ err = devm_request_threaded_irq(&client->dev, client->irq,
+ NULL, pcf8563_irq,
+- IRQF_SHARED|IRQF_ONESHOT|IRQF_TRIGGER_FALLING,
++ IRQF_SHARED | IRQF_ONESHOT | IRQF_TRIGGER_LOW,
+ pcf8563_driver.driver.name, client);
+ if (err) {
+ dev_err(&client->dev, "unable to request IRQ %d\n",
+--
+2.20.1
+
--- /dev/null
+From 06f85130aa3994e9a6feb37756d63cd4a33d3e83 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:31:02 +0000
+Subject: rtc: pm8xxx: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#1309693 ("Unintended sign extension")
+
+Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pm8xxx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
+index fac835530671f..a1b4b0ed1f196 100644
+--- a/drivers/rtc/rtc-pm8xxx.c
++++ b/drivers/rtc/rtc-pm8xxx.c
+@@ -186,7 +186,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ }
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, tm);
+
+@@ -267,7 +268,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ return rc;
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, &alarm->time);
+
+--
+2.20.1
+
--- /dev/null
+From 7f7820566269d4620e6c15c9be22d06e698642da Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 15:55:28 +0100
+Subject: rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Howells <dhowells@redhat.com>
+
+[ Upstream commit 3427beb6375d04e9627c67343872e79341a684ea ]
+
+With gcc 4.1:
+
+ net/rxrpc/output.c: In function ‘rxrpc_send_data_packet’:
+ net/rxrpc/output.c:338: warning: ‘ret’ may be used uninitialized in this function
+
+Indeed, if the first jump to the send_fragmentable label is made, and
+the address family is not handled in the switch() statement, ret will be
+used uninitialized.
+
+Fix this by BUG()'ing as is done in other places in rxrpc where internal
+support for future address families will need adding. It should not be
+possible to reach this normally as the address families are checked
+up-front.
+
+Fixes: 5a924b8951f835b5 ("rxrpc: Don't store the rxrpc header in the Tx queue sk_buffs")
+Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/output.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
+index 5b67cb5d47f0e..edddbacf33bc8 100644
+--- a/net/rxrpc/output.c
++++ b/net/rxrpc/output.c
+@@ -404,6 +404,9 @@ send_fragmentable:
+ }
+ break;
+ #endif
++
++ default:
++ BUG();
+ }
+
+ up_write(&conn->params.local->defrag_sem);
+--
+2.20.1
+
--- /dev/null
+From 90ebd0ac75b9c1a304f71b6021c22b4f323ce432 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 14:13:40 -0700
+Subject: scsi: fnic: fix msix interrupt allocation
+
+From: Govindarajulu Varadarajan <gvaradar@cisco.com>
+
+[ Upstream commit 3ec24fb4c035e9cbb2f02a48640a09aa913442a2 ]
+
+pci_alloc_irq_vectors() returns number of vectors allocated. Fix the check
+for error condition.
+
+Fixes: cca678dfbad49 ("scsi: fnic: switch to pci_alloc_irq_vectors")
+Link: https://lore.kernel.org/r/20190827211340.1095-1-gvaradar@cisco.com
+Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
+Acked-by: Satish Kharat <satishkh@cisco.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_isr.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/fnic/fnic_isr.c b/drivers/scsi/fnic/fnic_isr.c
+index 4e3a50202e8c5..d28088218c364 100644
+--- a/drivers/scsi/fnic/fnic_isr.c
++++ b/drivers/scsi/fnic/fnic_isr.c
+@@ -254,7 +254,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
+ int vecs = n + m + o + 1;
+
+ if (pci_alloc_irq_vectors(fnic->pdev, vecs, vecs,
+- PCI_IRQ_MSIX) < 0) {
++ PCI_IRQ_MSIX) == vecs) {
+ fnic->rq_count = n;
+ fnic->raw_wq_count = m;
+ fnic->wq_copy_count = o;
+@@ -280,7 +280,7 @@ int fnic_set_intr_mode(struct fnic *fnic)
+ fnic->wq_copy_count >= 1 &&
+ fnic->cq_count >= 3 &&
+ fnic->intr_count >= 1 &&
+- pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) < 0) {
++ pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) == 1) {
+ fnic->rq_count = 1;
+ fnic->raw_wq_count = 1;
+ fnic->wq_copy_count = 1;
+--
+2.20.1
+
--- /dev/null
+From 3da1c5e255d1358bb0f98729905a0375e37796e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 10:18:35 +0100
+Subject: scsi: libfc: fix null pointer dereference on a null lport
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ]
+
+Currently if lport is null then the null lport pointer is dereference when
+printing out debug via the FC_LPORT_DB macro. Fix this by using the more
+generic FC_LIBFC_DBG debug macro instead that does not use lport.
+
+Addresses-Coverity: ("Dereference after null check")
+Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_exch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 42bcf7f3a0f90..6ba257cbc6d94 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -2603,7 +2603,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
+
+ /* lport lock ? */
+ if (!lport || lport->state == LPORT_ST_DISABLED) {
+- FC_LPORT_DBG(lport, "Receiving frames for an lport that "
++ FC_LIBFC_DBG("Receiving frames for an lport that "
+ "has not been initialized correctly\n");
+ fc_frame_free(fp);
+ return;
+--
+2.20.1
+
--- /dev/null
+From 58619cef8495083bddb9c985dd931319768e0f8a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 06:46:28 -0800
+Subject: scsi: megaraid_sas: reduce module load time
+
+From: Steve Sistare <steven.sistare@oracle.com>
+
+[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]
+
+megaraid_sas takes 1+ seconds to load while waiting for firmware:
+
+[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+This is due to the following loop in megasas_transition_to_ready(), which
+waits a minimum of 1 second, even though the FW becomes ready in tens of
+millisecs:
+
+ /*
+ * The cur_state should not last for more than max_wait secs
+ */
+ for (i = 0; i < max_wait; i++) {
+ ...
+ msleep(1000);
+ ...
+ dev_info(&instance->pdev->dev, "FW now in Ready state\n");
+
+This is a regression, caused by a change of the msleep granularity from 1
+to 1000 due to concern about waiting too long on systems with coarse
+jiffies.
+
+To fix, increase iterations and use msleep(20), which results in:
+
+[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")
+Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 577513649afbe..6abad63b127af 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3823,12 +3823,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
+ /*
+ * The cur_state should not last for more than max_wait secs
+ */
+- for (i = 0; i < max_wait; i++) {
++ for (i = 0; i < max_wait * 50; i++) {
+ curr_abs_state = instance->instancet->
+ read_fw_status_reg(instance->reg_set);
+
+ if (abs_state == curr_abs_state) {
+- msleep(1000);
++ msleep(20);
+ } else
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 675b4ffaf93f4f5c9dd9ad55aa7a5067a8eee7ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2019 14:44:42 -0700
+Subject: scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit a861b49273578e255426a499842cf7f465456351 ]
+
+The "(&ctio->u.status1.sense_data)[i]" where i >= 0 expressions in
+qlt_send_resp_ctio() are probably typos and should have been
+"(&ctio->u.status1.sense_data[4 * i])" instead. Instead of only fixing
+these typos, modify the code for storing sense data such that it becomes
+easy to read. This patch fixes a Coverity complaint about accessing an
+array outside its bounds.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <gmalavali@marvell.com>
+Fixes: be25152c0d9e ("qla2xxx: Improve T10-DIF/PI handling in driver.") # v4.11.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 1000422ef4f8a..21011c5fddebe 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -2122,14 +2122,14 @@ void qlt_send_resp_ctio(struct qla_qpair *qpair, struct qla_tgt_cmd *cmd,
+ ctio->u.status1.scsi_status |=
+ cpu_to_le16(SS_RESIDUAL_UNDER);
+
+- /* Response code and sense key */
+- put_unaligned_le32(((0x70 << 24) | (sense_key << 8)),
+- (&ctio->u.status1.sense_data)[0]);
++ /* Fixed format sense data. */
++ ctio->u.status1.sense_data[0] = 0x70;
++ ctio->u.status1.sense_data[2] = sense_key;
+ /* Additional sense length */
+- put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]);
++ ctio->u.status1.sense_data[7] = 0xa;
+ /* ASC and ASCQ */
+- put_unaligned_le32(((asc << 24) | (ascq << 16)),
+- (&ctio->u.status1.sense_data)[3]);
++ ctio->u.status1.sense_data[12] = asc;
++ ctio->u.status1.sense_data[13] = ascq;
+
+ /* Memory Barrier */
+ wmb();
+--
+2.20.1
+
--- /dev/null
+From 8d25f1aab292560f1f0e6c9e8841c9d0f07b6fdf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 17 Apr 2019 14:44:11 -0700
+Subject: scsi: qla2xxx: Fix a format specifier
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 19ce192cd718e02f880197c0983404ca48236807 ]
+
+Since mcmd->sess->port_name is eight bytes long, use %8phC to format that
+port name instead of %phC.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <gmalavali@marvell.com>
+Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery") # v4.11.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 55227d20496a0..1000422ef4f8a 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -2179,7 +2179,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
+ mcmd->orig_iocb.imm_ntfy.u.isp24.status_subcode ==
+ ELS_TPRLO) {
+ ql_dbg(ql_dbg_disc, vha, 0x2106,
+- "TM response logo %phC status %#x state %#x",
++ "TM response logo %8phC status %#x state %#x",
+ mcmd->sess->port_name, mcmd->fc_tm_rsp,
+ mcmd->flags);
+ qlt_schedule_sess_for_deletion_lock(mcmd->sess);
+--
+2.20.1
+
--- /dev/null
+From def9c80773c18647fdf5ab81556ded4f47409e45 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2019 12:44:46 -0700
+Subject: scsi: qla2xxx: Unregister chrdev if module initialization fails
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ]
+
+If module initialization fails after the character device has been
+registered, unregister the character device. Additionally, avoid
+duplicating error path code.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
+Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++-------------
+ 1 file changed, 21 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 5617bb18c2335..5f9d4dbc4a98e 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -6714,8 +6714,7 @@ qla2x00_module_init(void)
+ /* Initialize target kmem_cache and mem_pools */
+ ret = qlt_init();
+ if (ret < 0) {
+- kmem_cache_destroy(srb_cachep);
+- return ret;
++ goto destroy_cache;
+ } else if (ret > 0) {
+ /*
+ * If initiator mode is explictly disabled by qlt_init(),
+@@ -6736,11 +6735,10 @@ qla2x00_module_init(void)
+ qla2xxx_transport_template =
+ fc_attach_transport(&qla2xxx_transport_functions);
+ if (!qla2xxx_transport_template) {
+- kmem_cache_destroy(srb_cachep);
+ ql_log(ql_log_fatal, NULL, 0x0002,
+ "fc_attach_transport failed...Failing load!.\n");
+- qlt_exit();
+- return -ENODEV;
++ ret = -ENODEV;
++ goto qlt_exit;
+ }
+
+ apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
+@@ -6752,27 +6750,37 @@ qla2x00_module_init(void)
+ qla2xxx_transport_vport_template =
+ fc_attach_transport(&qla2xxx_transport_vport_functions);
+ if (!qla2xxx_transport_vport_template) {
+- kmem_cache_destroy(srb_cachep);
+- qlt_exit();
+- fc_release_transport(qla2xxx_transport_template);
+ ql_log(ql_log_fatal, NULL, 0x0004,
+ "fc_attach_transport vport failed...Failing load!.\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto unreg_chrdev;
+ }
+ ql_log(ql_log_info, NULL, 0x0005,
+ "QLogic Fibre Channel HBA Driver: %s.\n",
+ qla2x00_version_str);
+ ret = pci_register_driver(&qla2xxx_pci_driver);
+ if (ret) {
+- kmem_cache_destroy(srb_cachep);
+- qlt_exit();
+- fc_release_transport(qla2xxx_transport_template);
+- fc_release_transport(qla2xxx_transport_vport_template);
+ ql_log(ql_log_fatal, NULL, 0x0006,
+ "pci_register_driver failed...ret=%d Failing load!.\n",
+ ret);
++ goto release_vport_transport;
+ }
+ return ret;
++
++release_vport_transport:
++ fc_release_transport(qla2xxx_transport_vport_template);
++
++unreg_chrdev:
++ if (apidev_major >= 0)
++ unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
++ fc_release_transport(qla2xxx_transport_template);
++
++qlt_exit:
++ qlt_exit();
++
++destroy_cache:
++ kmem_cache_destroy(srb_cachep);
++ return ret;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From dc1daaf43f15a19dc7e25b33d3771aa0e9f27ac7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Apr 2019 12:58:05 -0700
+Subject: scsi: target/core: Fix a race condition in the LUN lookup code
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 63f7479439c95bcd49b7dd4af809862c316c71a3 ]
+
+The rcu_dereference(deve->se_lun) expression occurs twice in the LUN lookup
+functions. Since these expressions are not serialized against deve->se_lun
+assignments each of these expressions may yield a different result. Avoid
+that the wrong LUN pointer is stored in se_cmd by reading deve->se_lun only
+once.
+
+Cc: Mike Christie <mchristi@redhat.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Nicholas Bellinger <nab@linux-iscsi.org>
+Fixes: 29a05deebf6c ("target: Convert se_node_acl->device_list[] to RCU hlist") # v4.10
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/target/target_core_device.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
+index 92b52d2314b53..cebef8e5a43d1 100644
+--- a/drivers/target/target_core_device.c
++++ b/drivers/target/target_core_device.c
+@@ -85,7 +85,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ goto out_unlock;
+ }
+
+- se_cmd->se_lun = rcu_dereference(deve->se_lun);
++ se_cmd->se_lun = se_lun;
+ se_cmd->pr_res_key = deve->pr_res_key;
+ se_cmd->orig_fe_lun = unpacked_lun;
+ se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+@@ -176,7 +176,7 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun)
+ goto out_unlock;
+ }
+
+- se_cmd->se_lun = rcu_dereference(deve->se_lun);
++ se_cmd->se_lun = se_lun;
+ se_cmd->pr_res_key = deve->pr_res_key;
+ se_cmd->orig_fe_lun = unpacked_lun;
+ se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD;
+--
+2.20.1
+
--- /dev/null
+From 29ffd9af3bb8ae4cdf72bc88f3824ebdca59944e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 8 Apr 2019 10:13:44 -0700
+Subject: selftests/ipc: Fix msgque compiler warnings
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit a147faa96f832f76e772b1e448e94ea84c774081 ]
+
+This fixes the various compiler warnings when building the msgque
+selftest. The primary change is using sys/msg.h instead of linux/msg.h
+directly to gain the API declarations.
+
+Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ipc/msgque.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
+index ee9382bdfadc8..c5587844fbb8c 100644
+--- a/tools/testing/selftests/ipc/msgque.c
++++ b/tools/testing/selftests/ipc/msgque.c
+@@ -1,9 +1,10 @@
+ // SPDX-License-Identifier: GPL-2.0
++#define _GNU_SOURCE
+ #include <stdlib.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <errno.h>
+-#include <linux/msg.h>
++#include <sys/msg.h>
+ #include <fcntl.h>
+
+ #include "../kselftest.h"
+@@ -73,7 +74,7 @@ int restore_queue(struct msgque_data *msgque)
+ return 0;
+
+ destroy:
+- if (msgctl(id, IPC_RMID, 0))
++ if (msgctl(id, IPC_RMID, NULL))
+ printf("Failed to destroy queue: %d\n", -errno);
+ return ret;
+ }
+@@ -120,7 +121,7 @@ int check_and_destroy_queue(struct msgque_data *msgque)
+
+ ret = 0;
+ err:
+- if (msgctl(msgque->msq_id, IPC_RMID, 0)) {
++ if (msgctl(msgque->msq_id, IPC_RMID, NULL)) {
+ printf("Failed to destroy queue: %d\n", -errno);
+ return -errno;
+ }
+@@ -129,7 +130,7 @@ err:
+
+ int dump_queue(struct msgque_data *msgque)
+ {
+- struct msqid64_ds ds;
++ struct msqid_ds ds;
+ int kern_id;
+ int i, ret;
+
+@@ -246,7 +247,7 @@ int main(int argc, char **argv)
+ return ksft_exit_pass();
+
+ err_destroy:
+- if (msgctl(msgque.msq_id, IPC_RMID, 0)) {
++ if (msgctl(msgque.msq_id, IPC_RMID, NULL)) {
+ printf("Failed to destroy queue: %d\n", -errno);
+ return ksft_exit_fail();
+ }
+--
+2.20.1
+
--- /dev/null
+From cf5a53d8b515af6a1c9df3686a9b50a5ffa9991b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:45 +0200
+Subject: serial: stm32: Add support of TC bit status check
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 64c32eab660386f9904bb295a104c9c425e9f8b2 ]
+
+Adds a check on the Transmission Complete bit status before closing the
+com port. Prevents the port closure before the end of the transmission.
+TC poll loop is moved from stm32_tx_dma_complete to stm32_shutdown
+routine, in order to check TC before shutdown in both dma and
+PIO tx modes.
+TC clear is added in stm32_transmit_char routine, in order to be cleared
+before transmitting in both dma and PIO tx modes.
+
+Fixes: 3489187204eb ("serial: stm32: adding dma support")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++-----------------
+ 1 file changed, 15 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index a1e31913bcf9a..2384f786b76d1 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -180,21 +180,6 @@ static void stm32_tx_dma_complete(void *arg)
+ struct uart_port *port = arg;
+ struct stm32_port *stm32port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32port->info->ofs;
+- unsigned int isr;
+- int ret;
+-
+- ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr,
+- isr,
+- (isr & USART_SR_TC),
+- 10, 100000);
+-
+- if (ret)
+- dev_err(port->dev, "terminal count not set\n");
+-
+- if (ofs->icr == UNDEF_REG)
+- stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+- else
+- stm32_set_bits(port, ofs->icr, USART_CR_TC);
+
+ stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT);
+ stm32port->tx_dma_busy = false;
+@@ -286,7 +271,6 @@ static void stm32_transmit_chars_dma(struct uart_port *port)
+ /* Issue pending DMA TX requests */
+ dma_async_issue_pending(stm32port->tx_ch);
+
+- stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+ stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT);
+
+ xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);
+@@ -315,6 +299,11 @@ static void stm32_transmit_chars(struct uart_port *port)
+ return;
+ }
+
++ if (ofs->icr == UNDEF_REG)
++ stm32_clr_bits(port, ofs->isr, USART_SR_TC);
++ else
++ stm32_set_bits(port, ofs->icr, USART_ICR_TCCF);
++
+ if (stm32_port->tx_ch)
+ stm32_transmit_chars_dma(port);
+ else
+@@ -491,12 +480,21 @@ static void stm32_shutdown(struct uart_port *port)
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+ struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+- u32 val;
++ u32 val, isr;
++ int ret;
+
+ val = USART_CR1_TXEIE | USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
+ val |= BIT(cfg->uart_enable_bit);
+ if (stm32_port->fifoen)
+ val |= USART_CR1_FIFOEN;
++
++ ret = readl_relaxed_poll_timeout(port->membase + ofs->isr,
++ isr, (isr & USART_SR_TC),
++ 10, 100000);
++
++ if (ret)
++ dev_err(port->dev, "transmission complete not set\n");
++
+ stm32_clr_bits(port, ofs->cr1, val);
+
+ dev_pm_clear_wake_irq(port->dev);
+--
+2.20.1
+
--- /dev/null
+From 884351c1f7b9a0745586f55043cc48308d1155f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 09:10:49 +0100
+Subject: serial: stm32: fix clearing interrupt error flags
+
+From: Fabrice Gasnier <fabrice.gasnier@st.com>
+
+[ Upstream commit 1250ed7114a977cdc2a67a0c09d6cdda63970eb9 ]
+
+The interrupt clear flag register is a "write 1 to clear" register.
+So, only writing ones allows to clear flags:
+- Replace buggy stm32_clr_bits() by a simple write to clear error flags
+- Replace useless read/modify/write stm32_set_bits() routine by a
+ simple write to clear TC (transfer complete) flag.
+
+Fixes: 4f01d833fdcd ("serial: stm32: fix rx error handling")
+Signed-off-by: Fabrice Gasnier <fabrice.gasnier@st.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/1574323849-1909-1-git-send-email-fabrice.gasnier@st.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index f8f3f8fafd9f0..1e854e1851fbb 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -132,8 +132,8 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
+ * cleared by the sequence [read SR - read DR].
+ */
+ if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
+- stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF |
+- USART_ICR_PECF | USART_ICR_FECF);
++ writel_relaxed(sr & USART_SR_ERR_MASK,
++ port->membase + ofs->icr);
+
+ c = stm32_get_char(port, &sr, &stm32_port->last_res);
+ port->icount.rx++;
+@@ -302,7 +302,7 @@ static void stm32_transmit_chars(struct uart_port *port)
+ if (ofs->icr == UNDEF_REG)
+ stm32_clr_bits(port, ofs->isr, USART_SR_TC);
+ else
+- stm32_set_bits(port, ofs->icr, USART_ICR_TCCF);
++ writel_relaxed(USART_ICR_TCCF, port->membase + ofs->icr);
+
+ if (stm32_port->tx_ch)
+ stm32_transmit_chars_dma(port);
+--
+2.20.1
+
--- /dev/null
+From 73049368ed8b10ceab693dc294bcd8fea754638c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:42 +0200
+Subject: serial: stm32: fix rx error handling
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 4f01d833fdcdd6f9b85d9e5d5d7568eb683626a7 ]
+
+- Fixes parity and framing error bit by clearing parity and framing error
+ flag. The current implementation doesn't clear the error bits when an
+ error is detected.
+- Fixes the incorrect name of framing error clearing flag in header file.
+- Fixes misalignement between data frame and errors status. The status
+ read for "n" frame was the status of "n+1" frame".
+- Fixes break detection was not triggered by the expected register.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 54 +++++++++++++++++++++-----------
+ drivers/tty/serial/stm32-usart.h | 10 ++----
+ 2 files changed, 37 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 03a583264d9ec..c435900773723 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -118,35 +118,51 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded)
+
+ while (stm32_pending_rx(port, &sr, &stm32_port->last_res, threaded)) {
+ sr |= USART_SR_DUMMY_RX;
+- c = stm32_get_char(port, &sr, &stm32_port->last_res);
+ flag = TTY_NORMAL;
+- port->icount.rx++;
+
++ /*
++ * Status bits has to be cleared before reading the RDR:
++ * In FIFO mode, reading the RDR will pop the next data
++ * (if any) along with its status bits into the SR.
++ * Not doing so leads to misalignement between RDR and SR,
++ * and clear status bits of the next rx data.
++ *
++ * Clear errors flags for stm32f7 and stm32h7 compatible
++ * devices. On stm32f4 compatible devices, the error bit is
++ * cleared by the sequence [read SR - read DR].
++ */
++ if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG)
++ stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF |
++ USART_ICR_PECF | USART_ICR_FECF);
++
++ c = stm32_get_char(port, &sr, &stm32_port->last_res);
++ port->icount.rx++;
+ if (sr & USART_SR_ERR_MASK) {
+- if (sr & USART_SR_LBD) {
+- port->icount.brk++;
+- if (uart_handle_break(port))
+- continue;
+- } else if (sr & USART_SR_ORE) {
+- if (ofs->icr != UNDEF_REG)
+- writel_relaxed(USART_ICR_ORECF,
+- port->membase +
+- ofs->icr);
++ if (sr & USART_SR_ORE) {
+ port->icount.overrun++;
+ } else if (sr & USART_SR_PE) {
+ port->icount.parity++;
+ } else if (sr & USART_SR_FE) {
+- port->icount.frame++;
++ /* Break detection if character is null */
++ if (!c) {
++ port->icount.brk++;
++ if (uart_handle_break(port))
++ continue;
++ } else {
++ port->icount.frame++;
++ }
+ }
+
+ sr &= port->read_status_mask;
+
+- if (sr & USART_SR_LBD)
+- flag = TTY_BREAK;
+- else if (sr & USART_SR_PE)
++ if (sr & USART_SR_PE) {
+ flag = TTY_PARITY;
+- else if (sr & USART_SR_FE)
+- flag = TTY_FRAME;
++ } else if (sr & USART_SR_FE) {
++ if (!c)
++ flag = TTY_BREAK;
++ else
++ flag = TTY_FRAME;
++ }
+ }
+
+ if (uart_handle_sysrq_char(port, c))
+@@ -569,14 +585,14 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios,
+ if (termios->c_iflag & INPCK)
+ port->read_status_mask |= USART_SR_PE | USART_SR_FE;
+ if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK))
+- port->read_status_mask |= USART_SR_LBD;
++ port->read_status_mask |= USART_SR_FE;
+
+ /* Characters to ignore */
+ port->ignore_status_mask = 0;
+ if (termios->c_iflag & IGNPAR)
+ port->ignore_status_mask = USART_SR_PE | USART_SR_FE;
+ if (termios->c_iflag & IGNBRK) {
+- port->ignore_status_mask |= USART_SR_LBD;
++ port->ignore_status_mask |= USART_SR_FE;
+ /*
+ * If we're ignoring parity and break indicators,
+ * ignore overruns too (for real raw support).
+diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h
+index ffc0c5285e511..9d087881913aa 100644
+--- a/drivers/tty/serial/stm32-usart.h
++++ b/drivers/tty/serial/stm32-usart.h
+@@ -108,7 +108,6 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_SR_RXNE BIT(5)
+ #define USART_SR_TC BIT(6)
+ #define USART_SR_TXE BIT(7)
+-#define USART_SR_LBD BIT(8)
+ #define USART_SR_CTSIF BIT(9)
+ #define USART_SR_CTS BIT(10) /* F7 */
+ #define USART_SR_RTOF BIT(11) /* F7 */
+@@ -120,8 +119,7 @@ struct stm32_usart_info stm32h7_info = {
+ #define USART_SR_SBKF BIT(18) /* F7 */
+ #define USART_SR_WUF BIT(20) /* H7 */
+ #define USART_SR_TEACK BIT(21) /* F7 */
+-#define USART_SR_ERR_MASK (USART_SR_LBD | USART_SR_ORE | \
+- USART_SR_FE | USART_SR_PE)
++#define USART_SR_ERR_MASK (USART_SR_ORE | USART_SR_FE | USART_SR_PE)
+ /* Dummy bits */
+ #define USART_SR_DUMMY_RX BIT(16)
+
+@@ -166,8 +164,6 @@ struct stm32_usart_info stm32h7_info = {
+ /* USART_CR2 */
+ #define USART_CR2_ADD_MASK GENMASK(3, 0) /* F4 */
+ #define USART_CR2_ADDM7 BIT(4) /* F7 */
+-#define USART_CR2_LBDL BIT(5)
+-#define USART_CR2_LBDIE BIT(6)
+ #define USART_CR2_LBCL BIT(8)
+ #define USART_CR2_CPHA BIT(9)
+ #define USART_CR2_CPOL BIT(10)
+@@ -224,12 +220,10 @@ struct stm32_usart_info stm32h7_info = {
+
+ /* USART_ICR */
+ #define USART_ICR_PECF BIT(0) /* F7 */
+-#define USART_ICR_FFECF BIT(1) /* F7 */
+-#define USART_ICR_NCF BIT(2) /* F7 */
++#define USART_ICR_FECF BIT(1) /* F7 */
+ #define USART_ICR_ORECF BIT(3) /* F7 */
+ #define USART_ICR_IDLECF BIT(4) /* F7 */
+ #define USART_ICR_TCCF BIT(6) /* F7 */
+-#define USART_ICR_LBDCF BIT(8) /* F7 */
+ #define USART_ICR_CTSCF BIT(9) /* F7 */
+ #define USART_ICR_RTOCF BIT(11) /* F7 */
+ #define USART_ICR_EOBCF BIT(12) /* F7 */
+--
+2.20.1
+
--- /dev/null
+From 45b18b9c311cf2803c867f97578a56912bd6887c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:44 +0200
+Subject: serial: stm32: fix transmit_chars when tx is stopped
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit b83b957c91f68e53f0dc596e129e8305761f2a32 ]
+
+Disables the tx irq when the transmission is ended and updates stop_tx
+conditions for code cleanup.
+
+Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index c435900773723..a1e31913bcf9a 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -310,13 +310,8 @@ static void stm32_transmit_chars(struct uart_port *port)
+ return;
+ }
+
+- if (uart_tx_stopped(port)) {
+- stm32_stop_tx(port);
+- return;
+- }
+-
+- if (uart_circ_empty(xmit)) {
+- stm32_stop_tx(port);
++ if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
++ stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ return;
+ }
+
+@@ -329,7 +324,7 @@ static void stm32_transmit_chars(struct uart_port *port)
+ uart_write_wakeup(port);
+
+ if (uart_circ_empty(xmit))
+- stm32_stop_tx(port);
++ stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE);
+ }
+
+ static irqreturn_t stm32_interrupt(int irq, void *ptr)
+--
+2.20.1
+
--- /dev/null
+From 527448fc28b9f8e9fd2afef788d70335afdd8158 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 17:45:46 +0200
+Subject: serial: stm32: fix wakeup source initialization
+
+From: Erwan Le Ray <erwan.leray@st.com>
+
+[ Upstream commit 5297f274e8b61ceb9676cba6649d3de9d03387ad ]
+
+Fixes dedicated_irq_wakeup issue and deactivated uart as wakeup source by
+default.
+
+Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism")
+Signed-off-by: Erwan Le Ray <erwan.leray@st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/stm32-usart.c | 28 +++++++++++++++-------------
+ 1 file changed, 15 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c
+index 2384f786b76d1..f8f3f8fafd9f0 100644
+--- a/drivers/tty/serial/stm32-usart.c
++++ b/drivers/tty/serial/stm32-usart.c
+@@ -447,7 +447,6 @@ static int stm32_startup(struct uart_port *port)
+ {
+ struct stm32_port *stm32_port = to_stm32_port(port);
+ struct stm32_usart_offsets *ofs = &stm32_port->info->ofs;
+- struct stm32_usart_config *cfg = &stm32_port->info->cfg;
+ const char *name = to_platform_device(port->dev)->name;
+ u32 val;
+ int ret;
+@@ -458,15 +457,6 @@ static int stm32_startup(struct uart_port *port)
+ if (ret)
+ return ret;
+
+- if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
+- ret = dev_pm_set_dedicated_wake_irq(port->dev,
+- stm32_port->wakeirq);
+- if (ret) {
+- free_irq(port->irq, port);
+- return ret;
+- }
+- }
+-
+ val = USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE;
+ if (stm32_port->fifoen)
+ val |= USART_CR1_FIFOEN;
+@@ -497,7 +487,6 @@ static void stm32_shutdown(struct uart_port *port)
+
+ stm32_clr_bits(port, ofs->cr1, val);
+
+- dev_pm_clear_wake_irq(port->dev);
+ free_irq(port->irq, port);
+ }
+
+@@ -904,11 +893,18 @@ static int stm32_serial_probe(struct platform_device *pdev)
+ ret = device_init_wakeup(&pdev->dev, true);
+ if (ret)
+ goto err_uninit;
++
++ ret = dev_pm_set_dedicated_wake_irq(&pdev->dev,
++ stm32port->wakeirq);
++ if (ret)
++ goto err_nowup;
++
++ device_set_wakeup_enable(&pdev->dev, false);
+ }
+
+ ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port);
+ if (ret)
+- goto err_nowup;
++ goto err_wirq;
+
+ ret = stm32_of_dma_rx_probe(stm32port, pdev);
+ if (ret)
+@@ -922,6 +918,10 @@ static int stm32_serial_probe(struct platform_device *pdev)
+
+ return 0;
+
++err_wirq:
++ if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
++ dev_pm_clear_wake_irq(&pdev->dev);
++
+ err_nowup:
+ if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0)
+ device_init_wakeup(&pdev->dev, false);
+@@ -959,8 +959,10 @@ static int stm32_serial_remove(struct platform_device *pdev)
+ TX_BUF_L, stm32_port->tx_buf,
+ stm32_port->tx_dma_buf);
+
+- if (cfg->has_wakeup && stm32_port->wakeirq >= 0)
++ if (cfg->has_wakeup && stm32_port->wakeirq >= 0) {
++ dev_pm_clear_wake_irq(&pdev->dev);
+ device_init_wakeup(&pdev->dev, false);
++ }
+
+ clk_disable_unprepare(stm32_port->clk);
+
+--
+2.20.1
+
mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch
crypto-sun4i-ss-fix-big-endian-issues.patch
leds-tlc591xx-update-the-maximum-brightness.patch
+drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
+drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
+alsa-hda-fix-unused-variable-warning.patch
+apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch
+pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch
+drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch
+ib-rxe-replace-kvfree-with-vfree.patch
+ib-hfi1-add-mtu-check-for-operational-data-vls.patch
+regulator-fixed-default-enable-high-on-dt-regulators.patch
+alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
+staging-comedi-ni_mio_common-protect-register-write-.patch
+pwm-lpss-release-runtime-pm-reference-from-the-drive.patch
+powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch
+drm-sun4i-hdmi-fix-double-flag-assignation.patch
+mlxsw-reg-qeec-add-minimum-shaper-fields.patch
+ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch
+pcrypt-use-format-specifier-in-kobject_add.patch
+exportfs-fix-passing-zero-to-err_ptr-warning.patch
+drm-dp_mst-skip-validating-ports-during-destruction-.patch
+net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch
+ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch
+staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch
+switchtec-remove-immediate-status-check-after-submit.patch
+pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
+pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
+pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
+pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
+pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
+pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch
+pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
+pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
+vxlan-changelink-fix-handling-of-default-remotes.patch
+input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
+clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
+clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
+clk-socfpga-fix-refcount-leak.patch
+clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
+clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
+clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
+clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
+clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
+clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
+clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
+clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
+clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch
+clk-dove-fix-refcount-leak-in-dove_clk_init.patch
+mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch
+ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
+rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
+rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch
+drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch
+arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch
+spi-cadence-correct-initialisation-of-runtime-pm.patch
+rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch
+drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch
+media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
+kbuild-mark-prepare0-as-phony-to-fix-external-module.patch
+crypto-brcm-fix-some-set-but-not-used-warning.patch
+crypto-tgr192-fix-unaligned-memory-access.patch
+asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
+ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch
+rtc-cmos-ignore-bogus-century-byte.patch
+spi-topcliff_pch-fix-potential-null-dereference-on-a.patch
+clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch
+iwlwifi-mvm-avoid-possible-access-out-of-array.patch
+net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch
+iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch
+tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
+driver-uio-fix-possible-memory-leak-in-__uio_registe.patch
+driver-uio-fix-possible-use-after-free-in-__uio_regi.patch
+crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
+driver-core-do-not-resume-suppliers-under-device_lin.patch
+arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch
+arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch
+arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch
+arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch
+arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch
+iwlwifi-mvm-fix-rss-config-command.patch
+staging-most-cdev-add-missing-check-for-cdev_add-fai.patch
+rtc-ds1672-fix-unintended-sign-extension.patch
+thermal-mediatek-fix-register-index-error.patch
+net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch
+rtc-ds1307-rx8130-fix-alarm-handling.patch
+rtc-88pm860x-fix-unintended-sign-extension.patch
+rtc-88pm80x-fix-unintended-sign-extension.patch
+rtc-pm8xxx-fix-unintended-sign-extension.patch
+fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
+iw_cxgb4-use-tos-when-importing-the-endpoint.patch
+iw_cxgb4-use-tos-when-finding-ipv6-routes.patch
+drm-etnaviv-potential-null-dereference.patch
+pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
+pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
+pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch
+pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
+pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch
+usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch
+block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
+keys-timestamp-new-keys.patch
+vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
+hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch
+kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch
+staging-r8822be-check-kzalloc-return-or-bail.patch
+dmaengine-mv_xor-use-correct-device-for-dma-api.patch
+cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
+regulator-pv88060-fix-array-out-of-bounds-access.patch
+regulator-pv88080-fix-array-out-of-bounds-access.patch
+regulator-pv88090-fix-array-out-of-bounds-access.patch
+net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch
+drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
+drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
+asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
+fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
+staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch
+powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch
+nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch
+clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
+clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch
+platform-x86-wmi-fix-potential-null-pointer-derefere.patch
+nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch
+mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch
+arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
+arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch
+regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
+netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch
+nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch
+net-aquantia-fixed-instack-structure-overflow.patch
+powerpc-mm-check-secondary-hash-page-table.patch
+nios2-ksyms-add-missing-symbol-exports.patch
+x86-mm-remove-unused-variable-cpu.patch
+scsi-megaraid_sas-reduce-module-load-time.patch
+drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch
+xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
+net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
+regulator-lp87565-fix-missing-register-for-lp87565_b.patch
+media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
+media-cx18-update-pos-correctly-in-cx18_read_pos.patch
+media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
+media-cx23885-check-allocation-return.patch
+regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch
+jfs-fix-bogus-variable-self-initialization.patch
+tipc-tipc-clang-warning.patch
+m68k-mac-fix-via-timer-counter-accesses.patch
+arm64-dts-allwinner-a64-add-missing-pio-clocks.patch
+arm-omap2-fix-potentially-uninitialized-return-value.patch
+media-davinci-isif-avoid-uninitialized-variable-use.patch
+media-tw5864-fix-possible-null-pointer-dereference-i.patch
+spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
+spi-tegra114-fix-for-unpacked-mode-transfers.patch
+spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch
+spi-tegra114-flush-fifos.patch
+spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch
+soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
+spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
+ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
+scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
+scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch
+arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
+net-hns3-fix-for-vport-bw_limit-overflow-problem.patch
+hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
+platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch
+tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
+selftests-ipc-fix-msgque-compiler-warnings.patch
+powerpc-vdso-make-vdso32-installation-conditional-in.patch
+arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch
+media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
+6lowpan-off-by-one-handling-nexthdr.patch
+dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
+alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
+nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch
+irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch
+scsi-qla2xxx-fix-a-format-specifier.patch
+scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch
+packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
+asoc-fix-valid-stream-condition.patch
+usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch
+dwc2-gadget-fix-completed-transfer-size-calculation-.patch
+ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
+iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
+net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
+net-ena-fix-free-napi-resources-when-ena_up-fails.patch
+net-ena-fix-incorrect-test-of-supported-hash-functio.patch
+net-ena-fix-ena_com_fill_hash_function-implementatio.patch
+dmaengine-tegra210-adma-restore-channel-status.patch
+mmc-core-fix-possible-use-after-free-of-host.patch
+lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch
+afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch
+vfio-mdev-avoid-release-parent-reference-during-erro.patch
+vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch
+l2tp-fix-possible-null-pointer-dereference.patch
+media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
+media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
+platform-x86-alienware-wmi-printing-the-wrong-error-.patch
+crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch
+netfilter-ebtables-config_compat-reject-trailing-dat.patch
+pwm-meson-consider-128-a-valid-pre-divider.patch
+pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch
+arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
+kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
+backlight-lm3630a-return-0-on-success-in-update_stat.patch
+thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
+edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch
+arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch
+dmaengine-tegra210-adma-fix-crash-during-probe.patch
+arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch
+rdma-qedr-fix-incorrect-device-rate.patch
+spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
+crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch
+crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch
+serial-stm32-fix-rx-error-handling.patch
+serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch
+serial-stm32-add-support-of-tc-bit-status-check.patch
+serial-stm32-fix-wakeup-source-initialization.patch
+misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
+pci-pm-avoid-possible-suspend-to-idle-issue.patch
+iommu-use-right-function-to-get-group-for-device.patch
+signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
+inet-frags-call-inet_frags_fini-after-unregister_per.patch
+netvsc-unshare-skb-in-vf-rx-handler.patch
+cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch
+cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch
+media-vivid-fix-incorrect-assignment-operation-when-.patch
+mpls-fix-warning-with-multi-label-encap.patch
+iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch
+qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch
+powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
+powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch
+drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
+net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch
+net-af_iucv-always-register-net_device-notifier.patch
+asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
+rtc-pcf8563-fix-interrupt-trigger-method.patch
+rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
+drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
+perf-ioctl-add-check-for-the-sample_period-value.patch
+dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch
+clk-qcom-fix-wunused-const-variable.patch
+nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch
+bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch
+iommu-amd-make-iommu_disable-safer.patch
+mfd-intel-lpss-release-ida-resources.patch
+rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch
+devres-allow-const-resource-arguments.patch
+rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch
+net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
+scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
+clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch
+pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch
+libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
+qed-reduce-maximum-stack-frame-size.patch
+usb-host-xhci-hub-fix-extra-endianness-conversion.patch
+mic-avoid-statically-declaring-a-struct-device.patch
+x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
+crypto-ccp-reduce-maximum-stack-usage.patch
+alsa-aoa-onyx-always-initialize-register-read-value.patch
+tipc-reduce-risk-of-wakeup-queue-starvation.patch
+arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch
+net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch
+cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
+crypto-caam-free-resources-in-case-caam_rng-registra.patch
+ext4-set-error-return-correctly-when-ext4_htree_stor.patch
+asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
+asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
+asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
+net-rds-add-a-few-missing-rds_stat_names-entries.patch
+bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch
+signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
+asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch
+dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
+mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
+media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch
+rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch
+mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
+iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch
+ahci-do-not-export-local-variable-ahci_em_messages.patch
+partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
+hwmon-lm75-fix-write-operations-for-negative-tempera.patch
+power-supply-init-device-wakeup-after-device_add.patch
+x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
+staging-greybus-light-fix-a-couple-double-frees.patch
+irqdomain-add-the-missing-assignment-of-domain-fwnod.patch
+bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
+iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
+ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
+tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch
+net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
+scsi-fnic-fix-msix-interrupt-allocation.patch
+btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
+btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch
+btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch
+btrfs-use-correct-count-in-btrfs_file_write_iter.patch
+ixgbe-sync-the-first-fragment-unconditionally.patch
+hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
+net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
+pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch
+ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch
+rdma-cma-fix-false-error-message.patch
+net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
+iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
+net-aquantia-fix-aq_vec_isr_legacy-return-value.patch
+net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
+net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
+net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch
+net-axienet-fix-a-signedness-bug-in-probe.patch
+of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch
+net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
+nvme-retain-split-access-workaround-for-capability-r.patch
+net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch
+mac80211-accept-deauth-frames-in-ibss-mode.patch
+llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
+llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
+net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
+act_mirred-fix-mirred_init_module-error-handling.patch
+net-avoid-possible-false-sharing-in-sk_leave_memory_.patch
+net-add-read-write-_once-annotations-on-rskq_accept_.patch
+tcp-annotate-lockless-access-to-tcp_memory_pressure.patch
+drm-msm-dsi-implement-reset-correctly.patch
+dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
+net-netem-fix-error-path-for-corrupted-gso-frames.patch
+net-netem-correct-the-parent-s-backlog-when-corrupte.patch
+net-qca_spi-move-reset_count-to-struct-qcaspi.patch
+afs-fix-large-file-support.patch
+mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
+hv_netvsc-flag-software-created-hash-value.patch
+net-neigh-use-long-type-to-store-jiffies-delta.patch
+packet-fix-data-race-in-fanout_flow_is_huge.patch
+mmc-sdio-fix-wl1251-vendor-id.patch
+mmc-core-fix-wl1251-sdio-quirks.patch
+affs-fix-a-memory-leak-in-affs_remount.patch
+dmaengine-ti-edma-fix-missed-failure-handling.patch
+drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
+arm64-dts-juno-fix-uart-frequency.patch
+ib-iser-fix-dma_nents-type-definition.patch
+serial-stm32-fix-clearing-interrupt-error-flags.patch
+m68k-call-timer_interrupt-with-interrupts-disabled.patch
--- /dev/null
+From 096f2b518aabc4a5f4416919c7d8dcb66bf26dda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 12:33:54 -0500
+Subject: signal: Allow cifs and drbd to receive their terminating signals
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
+
+My recent to change to only use force_sig for a synchronous events
+wound up breaking signal reception cifs and drbd. I had overlooked
+the fact that by default kthreads start out with all signals set to
+SIG_IGN. So a change I thought was safe turned out to have made it
+impossible for those kernel thread to catch their signals.
+
+Reverting the work on force_sig is a bad idea because what the code
+was doing was very much a misuse of force_sig. As the way force_sig
+ultimately allowed the signal to happen was to change the signal
+handler to SIG_DFL. Which after the first signal will allow userspace
+to send signals to these kernel threads. At least for
+wake_ack_receiver in drbd that does not appear actively wrong.
+
+So correct this problem by adding allow_kernel_signal that will allow
+signals whose siginfo reports they were sent by the kernel through,
+but will not allow userspace generated signals, and update cifs and
+drbd to call allow_kernel_signal in an appropriate place so that their
+thread can receive this signal.
+
+Fixing things this way ensures that userspace won't be able to send
+signals and cause problems, that it is clear which signals the
+threads are expecting to receive, and it guarantees that nothing
+else in the system will be affected.
+
+This change was partly inspired by similar cifs and drbd patches that
+added allow_signal.
+
+Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
+Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
+Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 2 ++
+ fs/cifs/connect.c | 2 +-
+ include/linux/signal.h | 15 ++++++++++++++-
+ kernel/signal.c | 5 +++++
+ 4 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 7ea13b5497fdc..b998e3abca7ab 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -334,6 +334,8 @@ static int drbd_thread_setup(void *arg)
+ thi->name[0],
+ resource->name);
+
++ allow_kernel_signal(DRBD_SIGKILL);
++ allow_kernel_signal(SIGXCPU);
+ restart:
+ retval = thi->function(thi);
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index ed4a0352ea90e..f0b1279a7de66 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -921,7 +921,7 @@ cifs_demultiplex_thread(void *p)
+ mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+
+ set_freezable();
+- allow_signal(SIGKILL);
++ allow_kernel_signal(SIGKILL);
+ while (server->tcpStatus != CifsExiting) {
+ if (try_to_freeze())
+ continue;
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index 843bd62b1eadf..c4e3eb89a6229 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -268,6 +268,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
+ extern void exit_signals(struct task_struct *tsk);
+ extern void kernel_sigaction(int, __sighandler_t);
+
++#define SIG_KTHREAD ((__force __sighandler_t)2)
++#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
++
+ static inline void allow_signal(int sig)
+ {
+ /*
+@@ -275,7 +278,17 @@ static inline void allow_signal(int sig)
+ * know it'll be handled, so that they don't get converted to
+ * SIGKILL or just silently dropped.
+ */
+- kernel_sigaction(sig, (__force __sighandler_t)2);
++ kernel_sigaction(sig, SIG_KTHREAD);
++}
++
++static inline void allow_kernel_signal(int sig)
++{
++ /*
++ * Kernel threads handle their own signals. Let the signal code
++ * know signals sent by the kernel will be handled, so that they
++ * don't get silently dropped.
++ */
++ kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
+ }
+
+ static inline void disallow_signal(int sig)
+diff --git a/kernel/signal.c b/kernel/signal.c
+index c9b203875001e..8fee1f2eba2f9 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -85,6 +85,11 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return 1;
+
++ /* Only allow kernel generated signals to this kthread */
++ if (unlikely((t->flags & PF_KTHREAD) &&
++ (handler == SIG_KTHREAD_KERNEL) && !force))
++ return true;
++
+ return sig_handler_ignored(handler, sig);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 766b9b9896d7fb260f21d3850aa88ee23aaf8426 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2019 12:33:50 -0500
+Subject: signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of
+ force_sig
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 72abe3bcf0911d69b46c1e8bdb5612675e0ac42c ]
+
+The locking in force_sig_info is not prepared to deal with a task that
+exits or execs (as sighand may change). The is not a locking problem
+in force_sig as force_sig is only built to handle synchronous
+exceptions.
+
+Further the function force_sig_info changes the signal state if the
+signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
+delivery of the signal. The signal SIGKILL can not be ignored and can
+not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
+delivered.
+
+So using force_sig rather than send_sig for SIGKILL is confusing
+and pointless.
+
+Because it won't impact the sending of the signal and and because
+using force_sig is wrong, replace force_sig with send_sig.
+
+Cc: Namjae Jeon <namjae.jeon@samsung.com>
+Cc: Jeff Layton <jlayton@primarydata.com>
+Cc: Steve French <smfrench@gmail.com>
+Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
+Fixes: e7ddee9037e7 ("cifs: disable sharing session and tcon and add new TCP sharing code")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index f523a9ca9574f..51bbb1c0b71ae 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2320,7 +2320,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+
+ task = xchg(&server->tsk, NULL);
+ if (task)
+- force_sig(SIGKILL, task);
++ send_sig(SIGKILL, task, 1);
+ }
+
+ static struct TCP_Server_Info *
+--
+2.20.1
+
--- /dev/null
+From 19c164db920e5ecab0f800d8942a3f9c11aac9bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2019 17:18:41 +0300
+Subject: soc/fsl/qe: Fix an error code in qe_pin_request()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ]
+
+We forgot to set "err" on this error path.
+
+Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/gpio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c
+index 3b27075c21a7f..5cbc5ce5ac159 100644
+--- a/drivers/soc/fsl/qe/gpio.c
++++ b/drivers/soc/fsl/qe/gpio.c
+@@ -152,8 +152,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
+ if (err < 0)
+ goto err0;
+ gc = gpio_to_chip(err);
+- if (WARN_ON(!gc))
++ if (WARN_ON(!gc)) {
++ err = -ENODEV;
+ goto err0;
++ }
+
+ if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
+ pr_debug("%s: tried to get a non-qe pin\n", __func__);
+--
+2.20.1
+
--- /dev/null
+From 0023aa2d18602a841e9ebaa83750481704c6131b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 09:31:02 +0000
+Subject: spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
+
+From: Martin Sperl <kernel@martin.sperl.org>
+
+[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ]
+
+The original driver by default defines num_chipselects as -1.
+This actually allicates an array of 65535 entries in
+of_spi_register_master.
+
+There is a side-effect for buggy device trees that (contrary to
+dt-binding documentation) have no cs-gpio defined.
+
+This mode was never supported by the driver due to limitations
+of native cs and additional code complexity and is explicitly
+not stated to be implemented.
+
+To keep backwards compatibility with such buggy DTs we limit
+the number of chip_selects to 1, as for all practical purposes
+it is only ever realistic to use a single chip select in
+native cs mode without negative side-effects.
+
+Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index 5c89bbb05441b..e075712c501e8 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, master);
+ master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS);
+ master->bits_per_word_mask = SPI_BPW_MASK(8);
+- master->num_chipselect = -1;
++ /* even though the driver never officially supported native CS
++ * allow a single native CS for legacy DT support purposes when
++ * no cs-gpio is configured.
++ * Known limitations for native cs are:
++ * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
++ * whenever there is a transfer - this even includes SPI_NO_CS
++ * * SPI_CS_HIGH: is ignores - cs are always asserted low
++ * * cs_change: cs is deasserted after each spi_transfer
++ * * cs_delay_usec: cs is always deasserted one SCK cycle after
++ * a spi_transfer
++ */
++ master->num_chipselect = 1;
+ master->transfer_one = bcm2835aux_spi_transfer_one;
+ master->handle_err = bcm2835aux_spi_handle_err;
+ master->prepare_message = bcm2835aux_spi_prepare_message;
+--
+2.20.1
+
--- /dev/null
+From 9dc89c103aefd3ab47ffad4a37637420ac442176 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Jan 2019 18:08:09 +0000
+Subject: spi: cadence: Correct initialisation of runtime PM
+
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+
+[ Upstream commit 734882a8bf984c2ac8a57d8ac3ee53230bd0bed8 ]
+
+Currently the driver calls pm_runtime_put_autosuspend but without ever
+having done a pm_runtime_get, this causes the reference count in the pm
+runtime core to become -1. The bad reference count causes the core to
+sometimes suspend whilst an active SPI transfer is in progress.
+
+arizona spi0.1: SPI transfer timed out
+spi_master spi0: failed to transfer one message from queue
+
+The correct proceedure is to do all the initialisation that requires the
+hardware to be powered up before enabling the PM runtime, then enable
+the PM runtime having called pm_runtime_set_active to inform it that the
+hardware is currently powered up. The core will then power it down at
+it's leisure and no explicit pm_runtime_put is required.
+
+Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-cadence.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
+index 02bd1eba045b8..d08ad93d97a15 100644
+--- a/drivers/spi/spi-cadence.c
++++ b/drivers/spi/spi-cadence.c
+@@ -584,11 +584,6 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ goto clk_dis_apb;
+ }
+
+- pm_runtime_use_autosuspend(&pdev->dev);
+- pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+- pm_runtime_set_active(&pdev->dev);
+- pm_runtime_enable(&pdev->dev);
+-
+ ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs);
+ if (ret < 0)
+ master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS;
+@@ -603,8 +598,10 @@ static int cdns_spi_probe(struct platform_device *pdev)
+ /* SPI controller initializations */
+ cdns_spi_init_hw(xspi);
+
+- pm_runtime_mark_last_busy(&pdev->dev);
+- pm_runtime_put_autosuspend(&pdev->dev);
++ pm_runtime_set_active(&pdev->dev);
++ pm_runtime_enable(&pdev->dev);
++ pm_runtime_use_autosuspend(&pdev->dev);
++ pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq <= 0) {
+--
+2.20.1
+
--- /dev/null
+From f92be49d047d814fbf497afaf7ad1e6eb8b26d08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:00:36 +0000
+Subject: spi: spi-fsl-spi: call spi_finalize_current_message() at the end
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ]
+
+spi_finalize_current_message() shall be called once all
+actions are finished, otherwise the last actions might
+step over a newly started transfer.
+
+Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 8b79e36fab21c..cd784552de7f1 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -407,7 +407,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ }
+
+ m->status = status;
+- spi_finalize_current_message(master);
+
+ if (status || !cs_change) {
+ ndelay(nsecs);
+@@ -415,6 +414,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ }
+
+ fsl_spi_setup_transfer(spi, NULL);
++ spi_finalize_current_message(master);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3536b770494183bda695324e16d14200f0e63c6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:23 -0700
+Subject: spi: tegra114: clear packed bit for unpacked mode
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ]
+
+Fixes: Clear packed bit when not using packed mode.
+
+Packed bit is not cleared when not using packed mode. This results
+in transfer timeouts for the unpacked mode transfers followed by the
+packed mode transfers.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 2ad04796ef298..3a6b202dfffe0 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+
+ if (tspi->is_packed)
+ command1 |= SPI_PACKED;
++ else
++ command1 &= ~SPI_PACKED;
+
+ command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
+ tspi->cur_direction = 0;
+--
+2.20.1
+
--- /dev/null
+From 5eef684bd61fc331485da921d2a8278b1be7a351 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:29 -0700
+Subject: spi: tegra114: configure dma burst size to fifo trig level
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit f4ce428c41fb22e3ed55496dded94df44cb920fa ]
+
+Fixes: Configure DMA burst size to be same as SPI TX/RX trigger levels
+to avoid mismatch.
+
+SPI FIFO trigger levels are calculated based on the transfer length.
+So this patch moves DMA slave configuration to happen before start
+of DMAs.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 52 ++++++++++++++++++++++----------------
+ 1 file changed, 30 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 18dfbd57c61f2..84ff0c507f0b6 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -529,6 +529,8 @@ static int tegra_spi_start_dma_based_transfer(
+ u32 val;
+ unsigned int len;
+ int ret = 0;
++ u8 dma_burst;
++ struct dma_slave_config dma_sconfig = {0};
+
+ val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
+ tegra_spi_writel(tspi, val, SPI_DMA_BLK);
+@@ -540,12 +542,16 @@ static int tegra_spi_start_dma_based_transfer(
+ len = tspi->curr_dma_words * 4;
+
+ /* Set attention level based on length of transfer */
+- if (len & 0xF)
++ if (len & 0xF) {
+ val |= SPI_TX_TRIG_1 | SPI_RX_TRIG_1;
+- else if (((len) >> 4) & 0x1)
++ dma_burst = 1;
++ } else if (((len) >> 4) & 0x1) {
+ val |= SPI_TX_TRIG_4 | SPI_RX_TRIG_4;
+- else
++ dma_burst = 4;
++ } else {
+ val |= SPI_TX_TRIG_8 | SPI_RX_TRIG_8;
++ dma_burst = 8;
++ }
+
+ if (tspi->cur_direction & DATA_DIR_TX)
+ val |= SPI_IE_TX;
+@@ -556,7 +562,18 @@ static int tegra_spi_start_dma_based_transfer(
+ tegra_spi_writel(tspi, val, SPI_DMA_CTL);
+ tspi->dma_control_reg = val;
+
++ dma_sconfig.device_fc = true;
+ if (tspi->cur_direction & DATA_DIR_TX) {
++ dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
++ dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++ dma_sconfig.dst_maxburst = dma_burst;
++ ret = dmaengine_slave_config(tspi->tx_dma_chan, &dma_sconfig);
++ if (ret < 0) {
++ dev_err(tspi->dev,
++ "DMA slave config failed: %d\n", ret);
++ return ret;
++ }
++
+ tegra_spi_copy_client_txbuf_to_spi_txbuf(tspi, t);
+ ret = tegra_spi_start_tx_dma(tspi, len);
+ if (ret < 0) {
+@@ -567,6 +584,16 @@ static int tegra_spi_start_dma_based_transfer(
+ }
+
+ if (tspi->cur_direction & DATA_DIR_RX) {
++ dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
++ dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++ dma_sconfig.src_maxburst = dma_burst;
++ ret = dmaengine_slave_config(tspi->rx_dma_chan, &dma_sconfig);
++ if (ret < 0) {
++ dev_err(tspi->dev,
++ "DMA slave config failed: %d\n", ret);
++ return ret;
++ }
++
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+ tspi->dma_buf_size, DMA_FROM_DEVICE);
+@@ -626,7 +653,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ u32 *dma_buf;
+ dma_addr_t dma_phys;
+ int ret;
+- struct dma_slave_config dma_sconfig;
+
+ dma_chan = dma_request_slave_channel_reason(tspi->dev,
+ dma_to_memory ? "rx" : "tx");
+@@ -646,19 +672,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ return -ENOMEM;
+ }
+
+- if (dma_to_memory) {
+- dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO;
+- dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+- dma_sconfig.src_maxburst = 0;
+- } else {
+- dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO;
+- dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+- dma_sconfig.dst_maxburst = 0;
+- }
+-
+- ret = dmaengine_slave_config(dma_chan, &dma_sconfig);
+- if (ret)
+- goto scrub;
+ if (dma_to_memory) {
+ tspi->rx_dma_chan = dma_chan;
+ tspi->rx_dma_buf = dma_buf;
+@@ -669,11 +682,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi,
+ tspi->tx_dma_phys = dma_phys;
+ }
+ return 0;
+-
+-scrub:
+- dma_free_coherent(tspi->dev, tspi->dma_buf_size, dma_buf, dma_phys);
+- dma_release_channel(dma_chan);
+- return ret;
+ }
+
+ static void tegra_spi_deinit_dma_param(struct tegra_spi_data *tspi,
+--
+2.20.1
+
--- /dev/null
+From 241a99b4ed8401808d165bbdb9b253afbbc3613e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:24 -0700
+Subject: spi: tegra114: fix for unpacked mode transfers
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ]
+
+Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked
+mode when transfer length is not a multiple of requested bits per word.
+
+unpacked mode transfers fails when the transfer includes partial bytes in
+the last word.
+
+Total words to be written/read to/from FIFO is computed based on transfer
+length and bits per word. Unpacked mode includes 0 padding bytes for partial
+words to align with bits per word and these extra bytes are also accounted
+for calculating bytes left to transfer in the current driver.
+
+This causes extra bytes access of tx/rx buffers along with buffer index
+position crossing actual length where remain_len becomes negative and due to
+unsigned type, negative value is a 32 bit representation of signed value
+and transferred bytes never meets the actual transfer length resulting in
+transfer timeout and a hang.
+
+This patch fixes this with proper computation of the actual bytes to fill in
+FIFO during transmit and the actual bytes to read from FIFO during receive
+ignoring 0 padded bytes.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 36 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 3a6b202dfffe0..c6674b01e0fd6 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ }
++
++ tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+ } else {
++ unsigned int write_bytes;
+ max_n_32bit = min(tspi->curr_dma_words, tx_empty_count);
+ written_words = max_n_32bit;
+ nbytes = written_words * tspi->bytes_per_word;
++ if (nbytes > t->len - tspi->cur_pos)
++ nbytes = t->len - tspi->cur_pos;
++ write_bytes = nbytes;
+ for (count = 0; count < max_n_32bit; count++) {
+ u32 x = 0;
+
+@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ }
++
++ tspi->cur_tx_pos += write_bytes;
+ }
+- tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
++
+ return written_words;
+ }
+
+@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
+ for (i = 0; len && (i < 4); i++, len--)
+ *rx_buf++ = (x >> i*8) & 0xFF;
+ }
+- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ read_words += tspi->curr_dma_words;
++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++ u8 bytes_per_word = tspi->bytes_per_word;
++ unsigned int read_bytes;
+
++ len = rx_full_count * bytes_per_word;
++ if (len > t->len - tspi->cur_pos)
++ len = t->len - tspi->cur_pos;
++ read_bytes = len;
+ for (count = 0; count < rx_full_count; count++) {
+ u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
+
+- for (i = 0; (i < tspi->bytes_per_word); i++)
++ for (i = 0; len && (i < bytes_per_word); i++, len--)
+ *rx_buf++ = (x >> (i*8)) & 0xFF;
+ }
+- tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
+ read_words += rx_full_count;
++ tspi->cur_rx_pos += read_bytes;
+ }
++
+ return read_words;
+ }
+
+@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+
+ memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
++ tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ unsigned int i;
+ unsigned int count;
+ u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
+ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++ unsigned int write_bytes;
+
++ if (consume > t->len - tspi->cur_pos)
++ consume = t->len - tspi->cur_pos;
++ write_bytes = consume;
+ for (count = 0; count < tspi->curr_dma_words; count++) {
+ u32 x = 0;
+
+@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tspi->tx_dma_buf[count] = x;
+ }
++
++ tspi->cur_tx_pos += write_bytes;
+ }
+- tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
+@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
+ unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+
+ memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ unsigned int i;
+ unsigned int count;
+ unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
+ u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++ unsigned int read_bytes;
+
++ if (consume > t->len - tspi->cur_pos)
++ consume = t->len - tspi->cur_pos;
++ read_bytes = consume;
+ for (count = 0; count < tspi->curr_dma_words; count++) {
+ u32 x = tspi->rx_dma_buf[count] & rx_mask;
+
+- for (i = 0; (i < tspi->bytes_per_word); i++)
++ for (i = 0; consume && (i < tspi->bytes_per_word);
++ i++, consume--)
+ *rx_buf++ = (x >> (i*8)) & 0xFF;
+ }
++
++ tspi->cur_rx_pos += read_bytes;
+ }
+- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+--
+2.20.1
+
--- /dev/null
+From 5a56b3a28031aedb6a64bef8cbd7a2908c6e379d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:28 -0700
+Subject: spi: tegra114: flush fifos
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit c4fc9e5b28ff787e35137c2cc13316bb11d7657b ]
+
+Fixes: Flush TX and RX FIFOs before start of new transfer and on FIFO
+overflow or underrun errors.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 39 +++++++++++++++++++++++++++++---------
+ 1 file changed, 30 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 4878d5e00c669..18dfbd57c61f2 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -499,22 +499,37 @@ static int tegra_spi_start_rx_dma(struct tegra_spi_data *tspi, int len)
+ return 0;
+ }
+
+-static int tegra_spi_start_dma_based_transfer(
+- struct tegra_spi_data *tspi, struct spi_transfer *t)
++static int tegra_spi_flush_fifos(struct tegra_spi_data *tspi)
+ {
+- u32 val;
+- unsigned int len;
+- int ret = 0;
++ unsigned long timeout = jiffies + HZ;
+ u32 status;
+
+- /* Make sure that Rx and Tx fifo are empty */
+ status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
+ if ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
+- dev_err(tspi->dev, "Rx/Tx fifo are not empty status 0x%08x\n",
+- (unsigned)status);
+- return -EIO;
++ status |= SPI_RX_FIFO_FLUSH | SPI_TX_FIFO_FLUSH;
++ tegra_spi_writel(tspi, status, SPI_FIFO_STATUS);
++ while ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) {
++ status = tegra_spi_readl(tspi, SPI_FIFO_STATUS);
++ if (time_after(jiffies, timeout)) {
++ dev_err(tspi->dev,
++ "timeout waiting for fifo flush\n");
++ return -EIO;
++ }
++
++ udelay(1);
++ }
+ }
+
++ return 0;
++}
++
++static int tegra_spi_start_dma_based_transfer(
++ struct tegra_spi_data *tspi, struct spi_transfer *t)
++{
++ u32 val;
++ unsigned int len;
++ int ret = 0;
++
+ val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1);
+ tegra_spi_writel(tspi, val, SPI_DMA_BLK);
+
+@@ -779,6 +794,9 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+ dev_dbg(tspi->dev, "The def 0x%x and written 0x%x\n",
+ tspi->def_command1_reg, (unsigned)command1);
+
++ ret = tegra_spi_flush_fifos(tspi);
++ if (ret < 0)
++ return ret;
+ if (total_fifo_words > SPI_FIFO_DEPTH)
+ ret = tegra_spi_start_dma_based_transfer(tspi, t);
+ else
+@@ -876,6 +894,7 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
+ (tspi->cur_direction & DATA_DIR_RX))
+ dmaengine_terminate_all(tspi->rx_dma_chan);
+ ret = -EIO;
++ tegra_spi_flush_fifos(tspi);
+ reset_control_assert(tspi->rst);
+ udelay(2);
+ reset_control_deassert(tspi->rst);
+@@ -929,6 +948,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_spi_data *tspi)
+ tspi->status_reg);
+ dev_err(tspi->dev, "CpuXfer 0x%08x:0x%08x\n",
+ tspi->command1_reg, tspi->dma_control_reg);
++ tegra_spi_flush_fifos(tspi);
+ reset_control_assert(tspi->rst);
+ udelay(2);
+ reset_control_deassert(tspi->rst);
+@@ -1001,6 +1021,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra_spi_data *tspi)
+ tspi->status_reg);
+ dev_err(tspi->dev, "DmaXfer 0x%08x:0x%08x\n",
+ tspi->command1_reg, tspi->dma_control_reg);
++ tegra_spi_flush_fifos(tspi);
+ reset_control_assert(tspi->rst);
+ udelay(2);
+ reset_control_deassert(tspi->rst);
+--
+2.20.1
+
--- /dev/null
+From 5d8cc80bd37888d06391a9cf289d393cc5c2e7ab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:27 -0700
+Subject: spi: tegra114: terminate dma and reset on transfer timeout
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 32bd1a9551cae34e6889afa235c7afdfede9aeac ]
+
+Fixes: terminate DMA and perform controller reset on transfer timeout
+to clear the FIFO's and errors.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index c6674b01e0fd6..4878d5e00c669 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -869,7 +869,16 @@ static int tegra_spi_transfer_one_message(struct spi_master *master,
+ if (WARN_ON(ret == 0)) {
+ dev_err(tspi->dev,
+ "spi transfer timeout, err %d\n", ret);
++ if (tspi->is_curr_dma_xfer &&
++ (tspi->cur_direction & DATA_DIR_TX))
++ dmaengine_terminate_all(tspi->tx_dma_chan);
++ if (tspi->is_curr_dma_xfer &&
++ (tspi->cur_direction & DATA_DIR_RX))
++ dmaengine_terminate_all(tspi->rx_dma_chan);
+ ret = -EIO;
++ reset_control_assert(tspi->rst);
++ udelay(2);
++ reset_control_deassert(tspi->rst);
+ goto complete_xfer;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 292ee30d515d468be660835ae6a411724637f630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 20:00:22 +0800
+Subject: spi/topcliff_pch: Fix potential NULL dereference on allocation error
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit e902cdcb5112b89ee445588147964723fd69ffb4 ]
+
+In pch_spi_handle_dma, it doesn't check for NULL returns of kcalloc
+so it would result in an Oops.
+
+Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-topcliff-pch.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
+index 4389ab80c23e6..fa730a871d252 100644
+--- a/drivers/spi/spi-topcliff-pch.c
++++ b/drivers/spi/spi-topcliff-pch.c
+@@ -1008,6 +1008,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+
+ /* RX */
+ dma->sg_rx_p = kcalloc(num, sizeof(*dma->sg_rx_p), GFP_ATOMIC);
++ if (!dma->sg_rx_p)
++ return;
++
+ sg_init_table(dma->sg_rx_p, num); /* Initialize SG table */
+ /* offset, length setting */
+ sg = dma->sg_rx_p;
+@@ -1068,6 +1071,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
+ }
+
+ dma->sg_tx_p = kcalloc(num, sizeof(*dma->sg_tx_p), GFP_ATOMIC);
++ if (!dma->sg_tx_p)
++ return;
++
+ sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
+ /* offset, length setting */
+ sg = dma->sg_tx_p;
+--
+2.20.1
+
--- /dev/null
+From b518d1454564735c111ec4d369d4f402f677a59f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Dec 2018 19:28:51 +0100
+Subject: staging: bcm2835-camera: Abort probe if there is no camera
+
+From: Stefan Wahren <stefan.wahren@i2se.com>
+
+[ Upstream commit 7566f39dfdc11f8a97d5810c6e6295a88f97ef91 ]
+
+Abort the probing of the camera driver in case there isn't a camera
+actually connected to the Raspberry Pi. This solution also avoids a
+NULL ptr dereference of mmal instance on driver unload.
+
+Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.")
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../vc04_services/bcm2835-camera/bcm2835-camera.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+index 377da037f31c3..b521752d9aa01 100644
+--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c
+@@ -1849,6 +1849,12 @@ static int __init bm2835_mmal_init(void)
+ num_cameras = get_num_cameras(instance,
+ resolutions,
+ MAX_BCM2835_CAMERAS);
++
++ if (num_cameras < 1) {
++ ret = -ENODEV;
++ goto cleanup_mmal;
++ }
++
+ if (num_cameras > MAX_BCM2835_CAMERAS)
+ num_cameras = MAX_BCM2835_CAMERAS;
+
+@@ -1948,6 +1954,9 @@ cleanup_gdev:
+ pr_info("%s: error %d while loading driver\n",
+ BM2835_MMAL_MODULE_NAME, ret);
+
++cleanup_mmal:
++ vchiq_mmal_finalise(instance);
++
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 676ab3710714aaada96df2b55b195d0b8d3c7794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 14:54:16 -0600
+Subject: staging: comedi: ni_mio_common: protect register write overflow
+
+From: Spencer E. Olson <olsonse@umich.edu>
+
+[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]
+
+Fixes two problems introduced as early as
+commit 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code"):
+(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
+ not unduly overwritten on e-series devices. On e-series devices, the
+ first three of the last four bits are reserved. The last bit defines
+ the output selection of the RGOUT0 pin, otherwise known as
+ RTSI_Sub_Selection. For m-series devices, these last four bits are
+ indeed used as the output selection of the RTSI7 pin (and the
+ RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
+ RTSI_Trig_Direction register.
+(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
+ lines.
+
+This patch also cleans up the ni_get_rtsi_routing command for readability.
+
+Fixes: 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code")
+Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/comedi/drivers/ni_mio_common.c | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 36361bdf934ac..2f82dcb1fd062 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -4991,7 +4991,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
+ case NI_RTSI_OUTPUT_G_SRC0:
+ case NI_RTSI_OUTPUT_G_GATE0:
+ case NI_RTSI_OUTPUT_RGOUT0:
+- case NI_RTSI_OUTPUT_RTSI_BRD_0:
++ case NI_RTSI_OUTPUT_RTSI_BRD(0):
++ case NI_RTSI_OUTPUT_RTSI_BRD(1):
++ case NI_RTSI_OUTPUT_RTSI_BRD(2):
++ case NI_RTSI_OUTPUT_RTSI_BRD(3):
+ return 1;
+ case NI_RTSI_OUTPUT_RTSI_OSC:
+ return (devpriv->is_m_series) ? 1 : 0;
+@@ -5012,11 +5015,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
+ devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
+ NISTC_RTSI_TRIGA_OUT_REG);
+- } else if (chan < 8) {
++ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
+ devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
+ NISTC_RTSI_TRIGB_OUT_REG);
++ } else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ /* probably should never reach this, since the
++ * ni_valid_rtsi_output_source above errors out if chan is too
++ * high
++ */
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+ return 2;
+ }
+@@ -5032,12 +5042,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
+ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ return NISTC_RTSI_TRIG_TO_SRC(chan,
+ devpriv->rtsi_trig_b_output_reg);
+- } else {
+- if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
+- return NI_RTSI_OUTPUT_RTSI_OSC;
+- dev_err(dev->class_dev, "bug! should never get here?\n");
+- return 0;
++ } else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ return NI_RTSI_OUTPUT_RTSI_OSC;
+ }
++
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+
+ static int ni_rtsi_insn_config(struct comedi_device *dev,
+--
+2.20.1
+
--- /dev/null
+From 67578658cdf5d515da995180beebacceee5d3b22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Aug 2019 15:28:39 +0300
+Subject: staging: greybus: light: fix a couple double frees
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ]
+
+The problem is in gb_lights_request_handler(). If we get a request to
+change the config then we release the light with gb_lights_light_release()
+and re-allocated it. However, if the allocation fails part way through
+then we call gb_lights_light_release() again. This can lead to a couple
+different double frees where we haven't cleared out the original values:
+
+ gb_lights_light_v4l2_unregister(light);
+ ...
+ kfree(light->channels);
+ kfree(light->name);
+
+I also made a small change to how we set "light->channels_count = 0;".
+The original code handled this part fine and did not cause a use after
+free but it was sort of complicated to read.
+
+Fixes: 2870b52bae4c ("greybus: lights: add lights implementation")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
+Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/greybus/light.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
+index 0f538b8c3a076..4e7575147775d 100644
+--- a/drivers/staging/greybus/light.c
++++ b/drivers/staging/greybus/light.c
+@@ -1103,21 +1103,21 @@ static void gb_lights_channel_release(struct gb_channel *channel)
+ static void gb_lights_light_release(struct gb_light *light)
+ {
+ int i;
+- int count;
+
+ light->ready = false;
+
+- count = light->channels_count;
+-
+ if (light->has_flash)
+ gb_lights_light_v4l2_unregister(light);
++ light->has_flash = false;
+
+- for (i = 0; i < count; i++) {
++ for (i = 0; i < light->channels_count; i++)
+ gb_lights_channel_release(&light->channels[i]);
+- light->channels_count--;
+- }
++ light->channels_count = 0;
++
+ kfree(light->channels);
++ light->channels = NULL;
+ kfree(light->name);
++ light->name = NULL;
+ }
+
+ static void gb_lights_release(struct gb_lights *glights)
+--
+2.20.1
+
--- /dev/null
+From 58ed3ebdf548c0de8516b53470aa59c98283037b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Feb 2019 22:34:49 +0000
+Subject: staging: most: cdev: add missing check for cdev_add failure
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ]
+
+Currently the call to cdev_add is missing a check for failure. Fix this by
+checking for failure and exiting via a new error path that ensures the
+allocated comp_channel struct is kfree'd.
+
+Detected by CoverityScan, CID#1462359 ("Unchecked return value")
+
+Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/most/aim-cdev/cdev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/most/aim-cdev/cdev.c b/drivers/staging/most/aim-cdev/cdev.c
+index 1e5cbc893496a..d000b6ff8a7d2 100644
+--- a/drivers/staging/most/aim-cdev/cdev.c
++++ b/drivers/staging/most/aim-cdev/cdev.c
+@@ -455,7 +455,9 @@ static int aim_probe(struct most_interface *iface, int channel_id,
+ c->devno = MKDEV(major, current_minor);
+ cdev_init(&c->cdev, &channel_fops);
+ c->cdev.owner = THIS_MODULE;
+- cdev_add(&c->cdev, c->devno, 1);
++ retval = cdev_add(&c->cdev, c->devno, 1);
++ if (retval < 0)
++ goto err_free_c;
+ c->iface = iface;
+ c->cfg = cfg;
+ c->channel_id = channel_id;
+@@ -491,6 +493,7 @@ error_create_device:
+ list_del(&c->list);
+ error_alloc_kfifo:
+ cdev_del(&c->cdev);
++err_free_c:
+ kfree(c);
+ error_alloc_channel:
+ ida_simple_remove(&minor_id, current_minor);
+--
+2.20.1
+
--- /dev/null
+From cfeed8def9abd15408a1ad1f01984a3c1e163848 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 10:24:22 +0100
+Subject: staging: r8822be: check kzalloc return or bail
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit e4b08e16b7d9d030b6475ef48f94d734a39f3c81 ]
+
+The kzalloc() in halmac_parse_psd_data_88xx() can fail and return NULL
+so check the psd_set->data after allocation and if allocation failed
+return HALMAC_CMD_PROCESS_ERROR.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 938a0447f094 ("staging: r8822be: Add code for halmac sub-drive")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+index 544f638ed3efb..15091ee587dbf 100644
+--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
++++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+@@ -2492,8 +2492,11 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
+ segment_size = (u8)PSD_DATA_GET_SEGMENT_SIZE(c2h_buf);
+ psd_set->data_size = total_size;
+
+- if (!psd_set->data)
++ if (!psd_set->data) {
+ psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
++ if (!psd_set->data)
++ return HALMAC_CMD_PROCESS_ERROR;
++ }
+
+ if (segment_id == 0)
+ psd_set->segment_size = segment_size;
+--
+2.20.1
+
--- /dev/null
+From 9a9199fb5b4c9a7153fd10d8a7eb0111d4a195c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Feb 2019 22:25:24 -0700
+Subject: staging: rtlwifi: Use proper enum for return in
+ halmac_parse_psd_data_88xx
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit e8edc32d70a4e09160835792eb5d1af71a0eec14 ]
+
+Clang warns:
+
+drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c:2472:11:
+warning: implicit conversion from enumeration type 'enum
+halmac_cmd_process_status' to different enumeration type 'enum
+halmac_ret_status' [-Wenum-conversion]
+ return HALMAC_CMD_PROCESS_ERROR;
+ ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~
+1 warning generated.
+
+Fix this by using the proper enum for allocation failures,
+HALMAC_RET_MALLOC_FAIL, which is used in the rest of this file.
+
+Fixes: e4b08e16b7d9 ("staging: r8822be: check kzalloc return or bail")
+Link: https://github.com/ClangBuiltLinux/linux/issues/375
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Reviewed-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+index 15091ee587dbf..65edd14a1147a 100644
+--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
++++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c
+@@ -2495,7 +2495,7 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf,
+ if (!psd_set->data) {
+ psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL);
+ if (!psd_set->data)
+- return HALMAC_CMD_PROCESS_ERROR;
++ return HALMAC_RET_MALLOC_FAIL;
+ }
+
+ if (segment_id == 0)
+--
+2.20.1
+
--- /dev/null
+From 76cf2945c2e9765d78261b48a7eed108a7349b3d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Dec 2018 17:12:20 +0800
+Subject: switchtec: Remove immediate status check after submitting MRPC
+ command
+
+From: Kelvin Cao <kelvin.cao@microchip.com>
+
+[ Upstream commit 526180408b815aa7b96fd48bd23cdd33ef04e38e ]
+
+After submitting a Firmware Download MRPC command, Switchtec firmware will
+delay Management EP BAR MemRd TLP responses by more than 10ms. This is a
+firmware limitation. Delayed MemRd completions are a problem for systems
+with a low Completion Timeout (CTO).
+
+The current driver checks the MRPC status immediately after submitting an
+MRPC command, which results in a delayed MemRd completion that may cause a
+Completion Timeout.
+
+Remove the immediate status check and rely on the check after receiving an
+interrupt or timing out.
+
+This is only a software workaround to the READ issue and a proper fix of
+this should be done in firmware.
+
+Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver")
+Signed-off-by: Kelvin Cao <kelvin.cao@microchip.com>
+Signed-off-by: Wesley Sheng <wesley.sheng@microchip.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/switch/switchtec.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c
+index 0941555b84a52..73dba2739849b 100644
+--- a/drivers/pci/switch/switchtec.c
++++ b/drivers/pci/switch/switchtec.c
+@@ -399,10 +399,6 @@ static void mrpc_cmd_submit(struct switchtec_dev *stdev)
+ stuser->data, stuser->data_len);
+ iowrite32(stuser->cmd, &stdev->mmio_mrpc->cmd);
+
+- stuser->status = ioread32(&stdev->mmio_mrpc->status);
+- if (stuser->status != SWITCHTEC_MRPC_STATUS_INPROGRESS)
+- mrpc_complete_cmd(stdev);
+-
+ schedule_delayed_work(&stdev->mrpc_timeout,
+ msecs_to_jiffies(500));
+ }
+--
+2.20.1
+
--- /dev/null
+From 8be3a03bdee12d15139267363f81bff0346801a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:10:15 -0700
+Subject: tcp: annotate lockless access to tcp_memory_pressure
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 1f142c17d19a5618d5a633195a46f2c8be9bf232 ]
+
+tcp_memory_pressure is read without holding any lock,
+and its value could be changed on other cpus.
+
+Use READ_ONCE() to annotate these lockless reads.
+
+The write side is already using atomic ops.
+
+Fixes: b8da51ebb1aa ("tcp: introduce tcp_under_memory_pressure()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/tcp.h | 2 +-
+ net/ipv4/tcp.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 00d10f0e11949..c963023103149 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -289,7 +289,7 @@ static inline bool tcp_under_memory_pressure(const struct sock *sk)
+ mem_cgroup_under_socket_pressure(sk->sk_memcg))
+ return true;
+
+- return tcp_memory_pressure;
++ return READ_ONCE(tcp_memory_pressure);
+ }
+ /*
+ * The next routines deal with comparing 32 bit unsigned ints
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 8f07655718f34..db1eceda2359c 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -328,7 +328,7 @@ void tcp_enter_memory_pressure(struct sock *sk)
+ {
+ unsigned long val;
+
+- if (tcp_memory_pressure)
++ if (READ_ONCE(tcp_memory_pressure))
+ return;
+ val = jiffies;
+
+@@ -343,7 +343,7 @@ void tcp_leave_memory_pressure(struct sock *sk)
+ {
+ unsigned long val;
+
+- if (!tcp_memory_pressure)
++ if (!READ_ONCE(tcp_memory_pressure))
+ return;
+ val = xchg(&tcp_memory_pressure, 0);
+ if (val)
+--
+2.20.1
+
--- /dev/null
+From bb978f3442a408348838410a17fe413676d0e2aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 11:32:38 -0700
+Subject: thermal: cpu_cooling: Actually trace CPU load in
+ thermal_power_cpu_get_power
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ]
+
+The CPU load values passed to the thermal_power_cpu_get_power
+tracepoint are zero for all CPUs, unless, unless the
+thermal_power_cpu_limit tracepoint is enabled too:
+
+ irq/41-rockchip-98 [000] .... 290.972410: thermal_power_cpu_get_power:
+ cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815
+
+vs
+
+ irq/41-rockchip-96 [000] .... 95.773585: thermal_power_cpu_get_power:
+ cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959
+ irq/41-rockchip-96 [000] .... 95.773596: thermal_power_cpu_limit:
+ cpus=0000000f freq=408000 cdev_state=10 power=416
+
+There seems to be no good reason for omitting the CPU load information
+depending on another tracepoint. My guess is that the intention was to
+check whether thermal_power_cpu_get_power is (still) enabled, however
+'load_cpu != NULL' already indicates that it was at least enabled when
+cpufreq_get_requested_power() was entered, there seems little gain
+from omitting the assignment if the tracepoint was just disabled, so
+just remove the check.
+
+Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Javi Merino <javi.merino@kernel.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/cpu_cooling.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
+index 908a8014cf767..aed995ec2c909 100644
+--- a/drivers/thermal/cpu_cooling.c
++++ b/drivers/thermal/cpu_cooling.c
+@@ -514,7 +514,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
+ load = 0;
+
+ total_load += load;
+- if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
++ if (load_cpu)
+ load_cpu[i] = load;
+
+ i++;
+--
+2.20.1
+
--- /dev/null
+From 0b714ea36c92f4fafacdc6cd3d39e0d45e491c25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Feb 2019 15:38:07 +0800
+Subject: thermal: mediatek: fix register index error
+
+From: Michael Kao <michael.kao@mediatek.com>
+
+[ Upstream commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 ]
+
+The index of msr and adcpnp should match the sensor
+which belongs to the selected bank in the for loop.
+
+Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.")
+Signed-off-by: Michael Kao <michael.kao@mediatek.com>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/mtk_thermal.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c
+index 1e61c09153c9a..76b92083744c9 100644
+--- a/drivers/thermal/mtk_thermal.c
++++ b/drivers/thermal/mtk_thermal.c
+@@ -407,7 +407,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank)
+ u32 raw;
+
+ for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) {
+- raw = readl(mt->thermal_base + conf->msr[i]);
++ raw = readl(mt->thermal_base +
++ conf->msr[conf->bank_data[bank->id].sensors[i]]);
+
+ temp = raw_to_mcelsius(mt,
+ conf->bank_data[bank->id].sensors[i],
+@@ -544,7 +545,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num,
+
+ for (i = 0; i < conf->bank_data[num].num_sensors; i++)
+ writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]],
+- mt->thermal_base + conf->adcpnp[i]);
++ mt->thermal_base +
++ conf->adcpnp[conf->bank_data[num].sensors[i]]);
+
+ writel((1 << conf->bank_data[num].num_sensors) - 1,
+ mt->thermal_base + TEMP_MONCTL0);
+--
+2.20.1
+
--- /dev/null
+From 198f180d550d3e2981a59b920b6a5eef7d9eac24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jul 2019 16:23:18 +0200
+Subject: tipc: reduce risk of wakeup queue starvation
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 7c5b42055964f587e55bd87ef334c3a27e95d144 ]
+
+In commit 365ad353c256 ("tipc: reduce risk of user starvation during
+link congestion") we allowed senders to add exactly one list of extra
+buffers to the link backlog queues during link congestion (aka
+"oversubscription"). However, the criteria for when to stop adding
+wakeup messages to the input queue when the overload abates is
+inaccurate, and may cause starvation problems during very high load.
+
+Currently, we stop adding wakeup messages after 10 total failed attempts
+where we find that there is no space left in the backlog queue for a
+certain importance level. The counter for this is accumulated across all
+levels, which may lead the algorithm to leave the loop prematurely,
+although there may still be plenty of space available at some levels.
+The result is sometimes that messages near the wakeup queue tail are not
+added to the input queue as they should be.
+
+We now introduce a more exact algorithm, where we keep adding wakeup
+messages to a level as long as the backlog queue has free slots for
+the corresponding level, and stop at the moment there are no more such
+slots or when there are no more wakeup messages to dequeue.
+
+Fixes: 365ad35 ("tipc: reduce risk of user starvation during link congestion")
+Reported-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/link.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/net/tipc/link.c b/net/tipc/link.c
+index da749916faac4..82e4e0e152d16 100644
+--- a/net/tipc/link.c
++++ b/net/tipc/link.c
+@@ -811,18 +811,31 @@ static int link_schedule_user(struct tipc_link *l, struct tipc_msg *hdr)
+ */
+ void link_prepare_wakeup(struct tipc_link *l)
+ {
++ struct sk_buff_head *wakeupq = &l->wakeupq;
++ struct sk_buff_head *inputq = l->inputq;
+ struct sk_buff *skb, *tmp;
+- int imp, i = 0;
++ struct sk_buff_head tmpq;
++ int avail[5] = {0,};
++ int imp = 0;
++
++ __skb_queue_head_init(&tmpq);
+
+- skb_queue_walk_safe(&l->wakeupq, skb, tmp) {
++ for (; imp <= TIPC_SYSTEM_IMPORTANCE; imp++)
++ avail[imp] = l->backlog[imp].limit - l->backlog[imp].len;
++
++ skb_queue_walk_safe(wakeupq, skb, tmp) {
+ imp = TIPC_SKB_CB(skb)->chain_imp;
+- if (l->backlog[imp].len < l->backlog[imp].limit) {
+- skb_unlink(skb, &l->wakeupq);
+- skb_queue_tail(l->inputq, skb);
+- } else if (i++ > 10) {
+- break;
+- }
++ if (avail[imp] <= 0)
++ continue;
++ avail[imp]--;
++ __skb_unlink(skb, wakeupq);
++ __skb_queue_tail(&tmpq, skb);
+ }
++
++ spin_lock_bh(&inputq->lock);
++ skb_queue_splice_tail(&tmpq, inputq);
++ spin_unlock_bh(&inputq->lock);
++
+ }
+
+ void tipc_link_reset(struct tipc_link *l)
+--
+2.20.1
+
--- /dev/null
+From f94374d3b8f185e052732fc473ddd682bb93e4cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 13:10:09 +0800
+Subject: tipc: set sysctl_tipc_rmem and named_timeout right range
+
+From: Jie Liu <liujie165@huawei.com>
+
+[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ]
+
+We find that sysctl_tipc_rmem and named_timeout do not have the right minimum
+setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem.
+And named_timeout as a timeout setting should be not less than zero.
+
+Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf")
+Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue")
+Signed-off-by: Jie Liu <liujie165@huawei.com>
+Reported-by: Qiang Ning <ningqiang1@huawei.com>
+Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/sysctl.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
+index 1a779b1e85100..40f6d82083d7b 100644
+--- a/net/tipc/sysctl.c
++++ b/net/tipc/sysctl.c
+@@ -37,6 +37,8 @@
+
+ #include <linux/sysctl.h>
+
++static int zero;
++static int one = 1;
+ static struct ctl_table_header *tipc_ctl_hdr;
+
+ static struct ctl_table tipc_table[] = {
+@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
+ .data = &sysctl_tipc_rmem,
+ .maxlen = sizeof(sysctl_tipc_rmem),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "named_timeout",
+ .data = &sysctl_tipc_named_timeout,
+ .maxlen = sizeof(sysctl_tipc_named_timeout),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &zero,
+ },
+ {}
+ };
+--
+2.20.1
+
--- /dev/null
+From fcb471930c951e6427547cd4125f1842e26c64c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 15:03:51 +0100
+Subject: tipc: tipc clang warning
+
+From: Jon Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit 737889efe9713a0f20a75fd0de952841d9275e6b ]
+
+When checking the code with clang -Wsometimes-uninitialized we get the
+following warning:
+
+if (!tipc_link_is_establishing(l)) {
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/node.c:847:46: note: uninitialized use occurs here
+ tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+
+net/tipc/node.c:831:2: note: remove the 'if' if its condition is always
+true
+if (!tipc_link_is_establishing(l)) {
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/node.c:821:31: note: initialize the variable 'maddr' to silence
+this warning
+struct tipc_media_addr *maddr;
+
+We fix this by initializing 'maddr' to NULL. For the matter of clarity,
+we also test if 'xmitq' is non-empty before we use it and 'maddr'
+further down in the function. It will never happen that 'xmitq' is non-
+empty at the same time as 'maddr' is NULL, so this is a sufficient test.
+
+Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/node.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/net/tipc/node.c b/net/tipc/node.c
+index 42e9bdcc4bb6e..82f8f69f4d6b0 100644
+--- a/net/tipc/node.c
++++ b/net/tipc/node.c
+@@ -688,10 +688,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id,
+ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ {
+ struct tipc_link_entry *le = &n->links[bearer_id];
++ struct tipc_media_addr *maddr = NULL;
+ struct tipc_link *l = le->link;
+- struct tipc_media_addr *maddr;
+- struct sk_buff_head xmitq;
+ int old_bearer_id = bearer_id;
++ struct sk_buff_head xmitq;
+
+ if (!l)
+ return;
+@@ -713,7 +713,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
+ tipc_node_write_unlock(n);
+ if (delete)
+ tipc_mon_remove_peer(n->net, n->addr, old_bearer_id);
+- tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
++ if (!skb_queue_empty(&xmitq))
++ tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr);
+ tipc_sk_rcv(n->net, &le->inputq);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1aa5b42ce2cd1e6faa7dc0b6c59054bca8e3e98c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:30:51 +0800
+Subject: tty: ipwireless: Fix potential NULL pointer dereference
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ]
+
+There is a potential NULL pointer dereference in case
+alloc_ctrl_packet() fails and returns NULL.
+
+Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/ipwireless/hardware.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
+index a6b8240af6cdd..960e9375a1a9e 100644
+--- a/drivers/tty/ipwireless/hardware.c
++++ b/drivers/tty/ipwireless/hardware.c
+@@ -1516,6 +1516,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
+ sizeof(struct ipw_setup_get_version_query_packet),
+ ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
+ TL_SETUP_SIGNO_GET_VERSION_QRY);
++ if (!ver_packet)
++ return;
+ ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 782da2e4b013a4086dfb9477d227aa7fc3e6e4d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 12:52:15 -0700
+Subject: tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs
+
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+
+[ Upstream commit 1da17d7cf8e2c4b60163d54300f72c02f510327c ]
+
+When dealing with 32-bit variant of LPUART IP block appropriate I/O
+helpers have to be used to properly deal with endianness
+differences. Change all of the offending code to do that.
+
+Fixes: a5fa2660d787 ("tty/serial/fsl_lpuart: Add CONSOLE_POLL support
+for lpuart32.")
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: Stefan Agner <stefan@agner.ch>
+Cc: Bhuvanchandra DV <bhuvanchandra.dv@toradex.com>
+Cc: Chris Healy <cphealy@gmail.com>
+Cc: Cory Tusar <cory.tusar@zii.aero>
+Cc: Lucas Stach <l.stach@pengutronix.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Cc: linux-imx@nxp.com
+Cc: linux-serial@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/20190729195226.8862-14-andrew.smirnov@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/fsl_lpuart.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index fb2dcb3f85911..16422987ab0f3 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -532,26 +532,26 @@ static int lpuart32_poll_init(struct uart_port *port)
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ /* Disable Rx & Tx */
+- writel(0, sport->port.membase + UARTCTRL);
++ lpuart32_write(&sport->port, UARTCTRL, 0);
+
+- temp = readl(sport->port.membase + UARTFIFO);
++ temp = lpuart32_read(&sport->port, UARTFIFO);
+
+ /* Enable Rx and Tx FIFO */
+- writel(temp | UARTFIFO_RXFE | UARTFIFO_TXFE,
+- sport->port.membase + UARTFIFO);
++ lpuart32_write(&sport->port, UARTFIFO,
++ temp | UARTFIFO_RXFE | UARTFIFO_TXFE);
+
+ /* flush Tx and Rx FIFO */
+- writel(UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH,
+- sport->port.membase + UARTFIFO);
++ lpuart32_write(&sport->port, UARTFIFO,
++ UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH);
+
+ /* explicitly clear RDRF */
+- if (readl(sport->port.membase + UARTSTAT) & UARTSTAT_RDRF) {
+- readl(sport->port.membase + UARTDATA);
+- writel(UARTFIFO_RXUF, sport->port.membase + UARTFIFO);
++ if (lpuart32_read(&sport->port, UARTSTAT) & UARTSTAT_RDRF) {
++ lpuart32_read(&sport->port, UARTDATA);
++ lpuart32_write(&sport->port, UARTFIFO, UARTFIFO_RXUF);
+ }
+
+ /* Enable Rx and Tx */
+- writel(UARTCTRL_RE | UARTCTRL_TE, sport->port.membase + UARTCTRL);
++ lpuart32_write(&sport->port, UARTCTRL, UARTCTRL_RE | UARTCTRL_TE);
+ spin_unlock_irqrestore(&sport->port.lock, flags);
+
+ return 0;
+@@ -559,18 +559,18 @@ static int lpuart32_poll_init(struct uart_port *port)
+
+ static void lpuart32_poll_put_char(struct uart_port *port, unsigned char c)
+ {
+- while (!(readl(port->membase + UARTSTAT) & UARTSTAT_TDRE))
++ while (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_TDRE))
+ barrier();
+
+- writel(c, port->membase + UARTDATA);
++ lpuart32_write(port, UARTDATA, c);
+ }
+
+ static int lpuart32_poll_get_char(struct uart_port *port)
+ {
+- if (!(readl(port->membase + UARTSTAT) & UARTSTAT_RDRF))
++ if (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_RDRF))
+ return NO_POLL_CHAR;
+
+- return readl(port->membase + UARTDATA);
++ return lpuart32_read(port, UARTDATA);
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 4bbe79babf6257027dfa636af192184a22a39661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 14:25:32 +0200
+Subject: usb: gadget: fsl: fix link error against usb-gadget module
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ]
+
+The dependency to ensure this driver links correctly fails since
+it can not be a loadable module:
+
+drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral':
+phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect'
+
+Make the option 'tristate' so it can work correctly.
+
+Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig
+index 85a92d0813dd0..440238061eddf 100644
+--- a/drivers/usb/phy/Kconfig
++++ b/drivers/usb/phy/Kconfig
+@@ -20,7 +20,7 @@ config AB8500_USB
+ in host mode, low speed.
+
+ config FSL_USB2_OTG
+- bool "Freescale USB OTG Transceiver Driver"
++ tristate "Freescale USB OTG Transceiver Driver"
+ depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM
+ depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y'
+ select USB_PHY
+--
+2.20.1
+
--- /dev/null
+From 0511297fe62f0865d5268131f9175d3b609073db Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jul 2019 15:17:19 +0300
+Subject: usb: host: xhci-hub: fix extra endianness conversion
+
+From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+
+[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ]
+
+Don't do extra cpu_to_le32 conversion for
+put_unaligned_le32 because it is already implemented
+in this function.
+
+Fixes sparse error:
+xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types)
+xhci-hub.c:1152:44: expected unsigned int [usertype] val
+xhci-hub.c:1152:44: got restricted __le32 [usertype]
+
+Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status"
+Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index d1363f3fabfa6..3bb38d9dc45bf 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1118,7 +1118,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ }
+ port_li = readl(port_array[wIndex] + PORTLI);
+ status = xhci_get_ext_port_status(temp, port_li);
+- put_unaligned_le32(cpu_to_le32(status), &buf[4]);
++ put_unaligned_le32(status, &buf[4]);
+ }
+ break;
+ case SetPortFeature:
+--
+2.20.1
+
--- /dev/null
+From 9236f2277c25da5f55a643b12279ee43a628cfb0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Feb 2019 10:04:26 -0500
+Subject: usb: phy: twl6030-usb: fix possible use-after-free on remove
+
+From: Sven Van Asbroeck <thesven73@gmail.com>
+
+[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ]
+
+In remove(), use cancel_delayed_work_sync() to cancel the
+delayed work. Otherwise there's a chance that this work
+will continue to run until after the device has been removed.
+
+This issue was detected with the help of Coccinelle.
+
+Cc: Tony Lindgren <tony@atomide.com>
+Cc: Bin Liu <b-liu@ti.com>
+Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030")
+Signed-off-by: Sven Van Asbroeck <TheSven73@gmail.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/phy/phy-twl6030-usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
+index b5dc077ed7d3c..8e14fa2211912 100644
+--- a/drivers/usb/phy/phy-twl6030-usb.c
++++ b/drivers/usb/phy/phy-twl6030-usb.c
+@@ -413,7 +413,7 @@ static int twl6030_usb_remove(struct platform_device *pdev)
+ {
+ struct twl6030_usb *twl = platform_get_drvdata(pdev);
+
+- cancel_delayed_work(&twl->get_status_work);
++ cancel_delayed_work_sync(&twl->get_status_work);
+ twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+ REG_INT_MSK_LINE_C);
+ twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK,
+--
+2.20.1
+
--- /dev/null
+From b527df804f2b394940a4171e4bf3508e1b0e9c33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2019 17:49:28 -0500
+Subject: vfio/mdev: Avoid release parent reference during error path
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 60e7f2c3fe9919cee9534b422865eed49f4efb15 ]
+
+During mdev parent registration in mdev_register_device(),
+if parent device is duplicate, it releases the reference of existing
+parent device.
+This is incorrect. Existing parent device should not be touched.
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 0212f0ee8aea7..8cfa712308773 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -182,6 +182,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops)
+ /* Check for duplicate */
+ parent = __find_parent_device(dev);
+ if (parent) {
++ parent = NULL;
+ ret = -EEXIST;
+ goto add_dev_err;
+ }
+--
+2.20.1
+
--- /dev/null
+From 36cd079a13e4c4e96f89f05185b5facd8fcb5309 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Apr 2019 17:49:33 -0500
+Subject: vfio/mdev: Fix aborting mdev child device removal if one fails
+
+From: Parav Pandit <parav@mellanox.com>
+
+[ Upstream commit 6093e348a5e2475c5bb2e571346460f939998670 ]
+
+device_for_each_child() stops executing callback function for remaining
+child devices, if callback hits an error.
+Each child mdev device is independent of each other.
+While unregistering parent device, mdev core must remove all child mdev
+devices.
+Therefore, mdev_device_remove_cb() always returns success so that
+device_for_each_child doesn't abort if one child removal hits error.
+
+While at it, improve remove and unregister functions for below simplicity.
+
+There isn't need to pass forced flag pointer during mdev parent
+removal which invokes mdev_device_remove(). So simplify the flow.
+
+mdev_device_remove() is called from two paths.
+1. mdev_unregister_driver()
+ mdev_device_remove_cb()
+ mdev_device_remove()
+2. remove_store()
+ mdev_device_remove()
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/mdev/mdev_core.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 8cfa712308773..e052f62fdea7e 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -150,10 +150,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove)
+
+ static int mdev_device_remove_cb(struct device *dev, void *data)
+ {
+- if (!dev_is_mdev(dev))
+- return 0;
++ if (dev_is_mdev(dev))
++ mdev_device_remove(dev, true);
+
+- return mdev_device_remove(dev, data ? *(bool *)data : true);
++ return 0;
+ }
+
+ /*
+@@ -241,7 +241,6 @@ EXPORT_SYMBOL(mdev_register_device);
+ void mdev_unregister_device(struct device *dev)
+ {
+ struct mdev_parent *parent;
+- bool force_remove = true;
+
+ mutex_lock(&parent_list_lock);
+ parent = __find_parent_device(dev);
+@@ -255,8 +254,7 @@ void mdev_unregister_device(struct device *dev)
+ list_del(&parent->next);
+ class_compat_remove_link(mdev_bus_compat_class, dev, NULL);
+
+- device_for_each_child(dev, (void *)&force_remove,
+- mdev_device_remove_cb);
++ device_for_each_child(dev, NULL, mdev_device_remove_cb);
+
+ parent_remove_sysfs_files(parent);
+
+--
+2.20.1
+
--- /dev/null
+From d5b525fdd4adabacc8ebfcacbdce34a44654cbbd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 17:16:06 +0100
+Subject: vfio_pci: Enable memory accesses before calling pci_map_rom
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ]
+
+pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
+In case the Memory Space accesses were disabled, readw() is likely
+to trigger a synchronous external abort on some platforms.
+
+In case memory accesses were disabled, re-enable them before the
+call and disable them back again just after.
+
+Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 9bd3e7911af2b..550ab7707b57f 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -717,6 +717,7 @@ static long vfio_pci_ioctl(void *device_data,
+ {
+ void __iomem *io;
+ size_t size;
++ u16 orig_cmd;
+
+ info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ info.flags = 0;
+@@ -732,15 +733,23 @@ static long vfio_pci_ioctl(void *device_data,
+ break;
+ }
+
+- /* Is it really there? */
++ /*
++ * Is it really there? Enable memory decode for
++ * implicit access in pci_map_rom().
++ */
++ pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
++ pci_write_config_word(pdev, PCI_COMMAND,
++ orig_cmd | PCI_COMMAND_MEMORY);
++
+ io = pci_map_rom(pdev, &size);
+- if (!io || !size) {
++ if (io) {
++ info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_unmap_rom(pdev, io);
++ } else {
+ info.size = 0;
+- break;
+ }
+- pci_unmap_rom(pdev, io);
+
+- info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ break;
+ }
+ case VFIO_PCI_VGA_REGION_INDEX:
+--
+2.20.1
+
--- /dev/null
+From 1c9df81aaa6cfe46c8a37c04e2ff67c3ebcd61ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Dec 2018 13:16:02 +0000
+Subject: vxlan: changelink: Fix handling of default remotes
+
+From: Petr Machata <petrm@mellanox.com>
+
+[ Upstream commit ce5e098f7a10b4bf8e948c12fa350320c5c3afad ]
+
+Default remotes are stored as FDB entries with an Ethernet address of
+00:00:00:00:00:00. When a request is made to change a remote address of
+a VXLAN device, vxlan_changelink() first deletes the existing default
+remote, and then creates a new FDB entry.
+
+This works well as long as the list of default remotes matches exactly
+the configuration of a VXLAN remote address. Thus when the VXLAN device
+has a remote of X, there should be exactly one default remote FDB entry
+X. If the VXLAN device has no remote address, there should be no such
+entry.
+
+Besides using "ip link set", it is possible to manipulate the list of
+default remotes by using the "bridge fdb". It is therefore easy to break
+the above condition. Under such circumstances, the __vxlan_fdb_delete()
+call doesn't delete the FDB entry itself, but just one remote. The
+following vxlan_fdb_create() then creates a new FDB entry, leading to a
+situation where two entries exist for the address 00:00:00:00:00:00,
+each with a different subset of default remotes.
+
+An even more obvious breakage rooted in the same cause can be observed
+when a remote address is configured for a VXLAN device that did not have
+one before. In that case vxlan_changelink() doesn't remove any remote,
+and just creates a new FDB entry for the new address:
+
+$ ip link add name vx up type vxlan id 2000 dstport 4789
+$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.20 self permanent
+$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.30 self permanent
+$ ip link set dev vx type vxlan remote 192.0.2.30
+$ bridge fdb sh dev vx | grep 00:00:00:00:00:00
+00:00:00:00:00:00 dst 192.0.2.30 self permanent <- new entry, 1 rdst
+00:00:00:00:00:00 dst 192.0.2.20 self permanent <- orig. entry, 2 rdsts
+00:00:00:00:00:00 dst 192.0.2.30 self permanent
+
+To fix this, instead of calling vxlan_fdb_create() directly, defer to
+vxlan_fdb_update(). That has logic to handle the duplicates properly.
+Additionally, it also handles notifications, so drop that call from
+changelink as well.
+
+Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/vxlan.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 5aa7d5091f4d0..4d97a7b5fe3ca 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -3494,7 +3494,6 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct vxlan_rdst *dst = &vxlan->default_dst;
+ struct vxlan_rdst old_dst;
+ struct vxlan_config conf;
+- struct vxlan_fdb *f = NULL;
+ int err;
+
+ err = vxlan_nl2conf(tb, data,
+@@ -3520,19 +3519,19 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
+ old_dst.remote_ifindex, 0);
+
+ if (!vxlan_addr_any(&dst->remote_ip)) {
+- err = vxlan_fdb_create(vxlan, all_zeros_mac,
++ err = vxlan_fdb_update(vxlan, all_zeros_mac,
+ &dst->remote_ip,
+ NUD_REACHABLE | NUD_PERMANENT,
++ NLM_F_APPEND | NLM_F_CREATE,
+ vxlan->cfg.dst_port,
+ dst->remote_vni,
+ dst->remote_vni,
+ dst->remote_ifindex,
+- NTF_SELF, &f);
++ NTF_SELF);
+ if (err) {
+ spin_unlock_bh(&vxlan->hash_lock);
+ return err;
+ }
+- vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH);
+ }
+ spin_unlock_bh(&vxlan->hash_lock);
+ }
+--
+2.20.1
+
--- /dev/null
+From 7a2f04c8ea59c01b2ff0cea183d896b11e374eb2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:47:06 +0200
+Subject: x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 2591bc4e8d70b4e1330d327fb7e3921f4e070a51 ]
+
+apic->send_IPI_allbutself() takes a vector number as argument.
+
+APIC_DM_NMI is clearly not a vector number. It's defined to 0x400 which is
+outside the vector space.
+
+Use NMI_VECTOR instead as that's what it is intended to be.
+
+Fixes: 82da3ff89dc2 ("x86: kgdb support")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20190722105218.855189979@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kgdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
+index 8e36f249646e2..904e18bb38c52 100644
+--- a/arch/x86/kernel/kgdb.c
++++ b/arch/x86/kernel/kgdb.c
+@@ -438,7 +438,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
+ */
+ void kgdb_roundup_cpus(unsigned long flags)
+ {
+- apic->send_IPI_allbutself(APIC_DM_NMI);
++ apic->send_IPI_allbutself(NMI_VECTOR);
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 90f82d48874eb51c30b644b892d9d52d9ae995ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Feb 2019 17:01:55 -0500
+Subject: x86/mm: Remove unused variable 'cpu'
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 3609e31bc8dc03b701390f79c74fc7fe92b95039 ]
+
+The commit a2055abe9c67 ("x86/mm: Pass flush_tlb_info to
+flush_tlb_others() etc") removed the unnecessary cpu parameter from
+uv_flush_tlb_others() but left an unused variable.
+
+arch/x86/mm/tlb.c: In function 'native_flush_tlb_others':
+arch/x86/mm/tlb.c:688:16: warning: variable 'cpu' set but not used
+[-Wunused-but-set-variable]
+ unsigned int cpu;
+ ^~~
+
+Fixes: a2055abe9c67 ("x86/mm: Pass flush_tlb_info to flush_tlb_others() etc")
+Signed-off-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Andyt Lutomirski <luto@kernel.org>
+Cc: dave.hansen@linux.intel.com
+Cc: peterz@infradead.org
+Cc: bp@alien8.de
+Cc: hpa@zytor.com
+Link: https://lkml.kernel.org/r/20190228220155.88124-1-cai@lca.pw
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/mm/tlb.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 5400a24e1a8c0..c5d7b4ae17cab 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -651,9 +651,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask,
+ * that UV should be updated so that smp_call_function_many(),
+ * etc, are optimal on UV.
+ */
+- unsigned int cpu;
+-
+- cpu = smp_processor_id();
+ cpumask = uv_flush_tlb_others(cpumask, info);
+ if (cpumask)
+ smp_call_function_many(cpumask, flush_tlb_func_remote,
+--
+2.20.1
+
--- /dev/null
+From c2828aceaade3b53131b28f17c06447330481439 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2019 12:03:08 +0900
+Subject: x86, perf: Fix the dependency of the x86 insn decoder selftest
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 7720804a2ae46c90265a32c81c45fb6f8d2f4e8b ]
+
+Since x86 instruction decoder is not only for kprobes,
+it should be tested when the insn.c is compiled.
+(e.g. perf is enabled but kprobes is disabled)
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: cbe5c34c8c1f ("x86: Compile insn.c and inat.c only for KPROBES")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
+index 6293a8768a912..bec0952c55958 100644
+--- a/arch/x86/Kconfig.debug
++++ b/arch/x86/Kconfig.debug
+@@ -189,7 +189,7 @@ config HAVE_MMIOTRACE_SUPPORT
+
+ config X86_DECODER_SELFTEST
+ bool "x86 instruction decoder selftest"
+- depends on DEBUG_KERNEL && KPROBES
++ depends on DEBUG_KERNEL && INSTRUCTION_DECODER
+ depends on !COMPILE_TEST
+ ---help---
+ Perform x86 instruction decoder selftests at build time.
+--
+2.20.1
+
--- /dev/null
+From 4b2032f7180971f25bb626e5fcaa4277b4301fe7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 08:41:22 +0300
+Subject: xen, cpu_hotplug: Prevent an out of bounds access
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]
+
+The "cpu" variable comes from the sscanf() so Smatch marks it as
+untrusted data. We can't pass a higher value than "nr_cpu_ids" to
+cpu_possible() or it results in an out of bounds access.
+
+Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/cpu_hotplug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
+index b1357aa4bc552..f192b6f42da9f 100644
+--- a/drivers/xen/cpu_hotplug.c
++++ b/drivers/xen/cpu_hotplug.c
+@@ -54,7 +54,7 @@ static int vcpu_online(unsigned int cpu)
+ }
+ static void vcpu_hotplug(unsigned int cpu)
+ {
+- if (!cpu_possible(cpu))
++ if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
+ return;
+
+ switch (vcpu_online(cpu)) {
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
