--- /dev/null
+From 31623468be0bf57617b8057dcd335693935a9491 Mon Sep 17 00:00:00 2001
+From: Suman Anna <s-anna@ti.com>
+Date: Mon, 10 Feb 2020 15:04:23 -0600
+Subject: ARM: dts: am437x-idk-evm: Fix incorrect OPP node names
+
+From: Suman Anna <s-anna@ti.com>
+
+commit 31623468be0bf57617b8057dcd335693935a9491 upstream.
+
+The commit 337c6c9a69af ("ARM: dts: am437x-idk-evm: Disable
+OPP50 for MPU") adjusts couple of OPP nodes defined in the
+common am4372.dtsi file, but used outdated node names. This
+results in these getting treated as new OPP nodes with missing
+properties.
+
+Fix this properly by using the correct node names as updated in
+commit b9cb2ba71848 ("ARM: dts: Use - instead of @ for DT OPP
+entries for TI SoCs").
+
+Reported-by: Roger Quadros <rogerq@ti.com>
+Fixes: 337c6c9a69af ("ARM: dts: am437x-idk-evm: Disable OPP50 for MPU")
+Signed-off-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/am437x-idk-evm.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/am437x-idk-evm.dts
++++ b/arch/arm/boot/dts/am437x-idk-evm.dts
+@@ -526,11 +526,11 @@
+ * Supply voltage supervisor on board will not allow opp50 so
+ * disable it and set opp100 as suspend OPP.
+ */
+- opp50@300000000 {
++ opp50-300000000 {
+ status = "disabled";
+ };
+
+- opp100@600000000 {
++ opp100-600000000 {
+ opp-suspend;
+ };
+ };
--- /dev/null
+From 78722d37b2b4cf9178295e2aa5510880e6135fd7 Mon Sep 17 00:00:00 2001
+From: Suman Anna <s-anna@ti.com>
+Date: Tue, 11 Feb 2020 09:51:03 -0600
+Subject: ARM: dts: dra7xx-clocks: Fixup IPU1 mux clock parent source
+
+From: Suman Anna <s-anna@ti.com>
+
+commit 78722d37b2b4cf9178295e2aa5510880e6135fd7 upstream.
+
+The IPU1 functional clock is the output of a mux clock (represented
+by ipu1_gfclk_mux previously) and the clock source for this has been
+updated to be sourced from dpll_core_h22x2_ck in commit 39879c7d963e
+("ARM: dts: dra7xx-clocks: Source IPU1 functional clock from CORE DPLL").
+ipu1_gfclk_mux is an obsolete clock now with the clkctrl conversion,
+and this clock source parenting is lost during the new clkctrl layout
+conversion.
+
+Remove this stale clock and fix up the clock source for this mux
+clock using the latest equivalent clkctrl clock. This restores the
+previous logic and ensures that the IPU1 continues to run at the
+same frequency of IPU2 and independent of the ABE DPLL.
+
+Fixes: b5f8ffbb6fad ("ARM: dts: dra7: convert to use new clkctrl layout")
+Signed-off-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/dra7xx-clocks.dtsi | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+--- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
++++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
+@@ -796,16 +796,6 @@
+ clock-div = <1>;
+ };
+
+- ipu1_gfclk_mux: ipu1_gfclk_mux@520 {
+- #clock-cells = <0>;
+- compatible = "ti,mux-clock";
+- clocks = <&dpll_abe_m2x2_ck>, <&dpll_core_h22x2_ck>;
+- ti,bit-shift = <24>;
+- reg = <0x0520>;
+- assigned-clocks = <&ipu1_gfclk_mux>;
+- assigned-clock-parents = <&dpll_core_h22x2_ck>;
+- };
+-
+ dummy_ck: dummy_ck {
+ #clock-cells = <0>;
+ compatible = "fixed-clock";
+@@ -1564,6 +1554,8 @@
+ compatible = "ti,clkctrl";
+ reg = <0x20 0x4>;
+ #clock-cells = <2>;
++ assigned-clocks = <&ipu1_clkctrl DRA7_IPU1_MMU_IPU1_CLKCTRL 24>;
++ assigned-clock-parents = <&dpll_core_h22x2_ck>;
+ };
+
+ ipu_clkctrl: ipu-clkctrl@50 {
--- /dev/null
+From bcbf53a0dab50980867476994f6079c1ec5bb3a3 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 12 Feb 2020 11:46:29 +0100
+Subject: ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties
+
+From: Johan Hovold <johan@kernel.org>
+
+commit bcbf53a0dab50980867476994f6079c1ec5bb3a3 upstream.
+
+The sram-node compatible properties have mistakingly combined the
+model-specific string with the generic "mtd-ram" string.
+
+Note that neither "cy7c1019dv33-10zsxi, mtd-ram" or
+"cy7c1019dv33-10zsxi" are used by any in-kernel driver and they are
+not present in any binding.
+
+The physmap driver will however bind to platform devices that specify
+"mtd-ram".
+
+Fixes: fc48e76489fd ("ARM: dts: imx6: Add support for Toradex Colibri iMX6 module")
+Cc: Sanchayan Maity <maitysanchayan@gmail.com>
+Cc: Marcel Ziswiler <marcel.ziswiler@toradex.com>
+Cc: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts
++++ b/arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts
+@@ -236,7 +236,7 @@
+
+ /* SRAM on Colibri nEXT_CS0 */
+ sram@0,0 {
+- compatible = "cypress,cy7c1019dv33-10zsxi, mtd-ram";
++ compatible = "cypress,cy7c1019dv33-10zsxi", "mtd-ram";
+ reg = <0 0 0x00010000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
+@@ -247,7 +247,7 @@
+
+ /* SRAM on Colibri nEXT_CS1 */
+ sram@1,0 {
+- compatible = "cypress,cy7c1019dv33-10zsxi, mtd-ram";
++ compatible = "cypress,cy7c1019dv33-10zsxi", "mtd-ram";
+ reg = <1 0 0x00010000>;
+ #address-cells = <1>;
+ #size-cells = <1>;
--- /dev/null
+From 2773fe1d31c42ffae2a9cb9a6055d99dd86e2fee Mon Sep 17 00:00:00 2001
+From: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Date: Wed, 19 Feb 2020 13:11:24 +0000
+Subject: ARM: dts: imx7-colibri: Fix frequency for sd/mmc
+
+From: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+
+commit 2773fe1d31c42ffae2a9cb9a6055d99dd86e2fee upstream.
+
+SD/MMC on Colibri iMX7S/D modules successfully support
+200Mhz frequency in HS200 mode.
+
+Removing the unnecessary max-frequency limit significantly
+increases the performance:
+
+== before fix ====
+root@colibri-imx7-emmc:~# hdparm -t /dev/mmcblk0
+/dev/mmcblk0:
+ Timing buffered disk reads: 252 MB in 3.02 seconds = 83.54 MB/sec
+==================
+
+=== after fix ====
+root@colibri-imx7-emmc:~# hdparm -t /dev/mmcblk0
+/dev/mmcblk0:
+ Timing buffered disk reads: 408 MB in 3.00 seconds = 135.94 MB/sec
+==================
+
+Fixes: f928a4a377e4 ("ARM: dts: imx7: add Toradex Colibri iMX7D 1GB (eMMC) support")
+Signed-off-by: Oleksandr Suvorov <oleksandr.suvorov@toradex.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx7-colibri.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/imx7-colibri.dtsi
++++ b/arch/arm/boot/dts/imx7-colibri.dtsi
+@@ -337,7 +337,6 @@
+ assigned-clock-rates = <400000000>;
+ bus-width = <8>;
+ fsl,tuning-step = <2>;
+- max-frequency = <100000000>;
+ vmmc-supply = <®_module_3v3>;
+ vqmmc-supply = <®_DCDC3>;
+ non-removable;
--- /dev/null
+From 512a928affd51c2dc631401e56ad5ee5d5dd68b6 Mon Sep 17 00:00:00 2001
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Date: Thu, 16 Jan 2020 15:18:49 +0100
+Subject: ARM: imx: build v7_cpu_resume() unconditionally
+
+From: Ahmad Fatoum <a.fatoum@pengutronix.de>
+
+commit 512a928affd51c2dc631401e56ad5ee5d5dd68b6 upstream.
+
+This function is not only needed by the platform suspend code, but is also
+reused as the CPU resume function when the ARM cores can be powered down
+completely in deep idle, which is the case on i.MX6SX and i.MX6UL(L).
+
+Providing the static inline stub whenever CONFIG_SUSPEND is disabled means
+that those platforms will hang on resume from cpuidle if suspend is disabled.
+
+So there are two problems:
+
+ - The static inline stub masks the linker error
+ - The function is not available where needed
+
+Fix both by just building the function unconditionally, when
+CONFIG_SOC_IMX6 is enabled. The actual code is three instructions long,
+so it's arguably ok to just leave it in for all i.MX6 kernel configurations.
+
+Fixes: 05136f0897b5 ("ARM: imx: support arm power off in cpuidle for i.mx6sx")
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
+Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-imx/Makefile | 2 ++
+ arch/arm/mach-imx/common.h | 4 ++--
+ arch/arm/mach-imx/resume-imx6.S | 24 ++++++++++++++++++++++++
+ arch/arm/mach-imx/suspend-imx6.S | 14 --------------
+ 4 files changed, 28 insertions(+), 16 deletions(-)
+
+--- a/arch/arm/mach-imx/Makefile
++++ b/arch/arm/mach-imx/Makefile
+@@ -91,6 +91,8 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7
+ obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o
+ obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o
+ endif
++AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a
++obj-$(CONFIG_SOC_IMX6) += resume-imx6.o
+ obj-$(CONFIG_SOC_IMX6) += pm-imx6.o
+
+ obj-$(CONFIG_SOC_IMX1) += mach-imx1.o
+--- a/arch/arm/mach-imx/common.h
++++ b/arch/arm/mach-imx/common.h
+@@ -109,17 +109,17 @@ void imx_cpu_die(unsigned int cpu);
+ int imx_cpu_kill(unsigned int cpu);
+
+ #ifdef CONFIG_SUSPEND
+-void v7_cpu_resume(void);
+ void imx53_suspend(void __iomem *ocram_vbase);
+ extern const u32 imx53_suspend_sz;
+ void imx6_suspend(void __iomem *ocram_vbase);
+ #else
+-static inline void v7_cpu_resume(void) {}
+ static inline void imx53_suspend(void __iomem *ocram_vbase) {}
+ static const u32 imx53_suspend_sz;
+ static inline void imx6_suspend(void __iomem *ocram_vbase) {}
+ #endif
+
++void v7_cpu_resume(void);
++
+ void imx6_pm_ccm_init(const char *ccm_compat);
+ void imx6q_pm_init(void);
+ void imx6dl_pm_init(void);
+--- /dev/null
++++ b/arch/arm/mach-imx/resume-imx6.S
+@@ -0,0 +1,24 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Copyright 2014 Freescale Semiconductor, Inc.
++ */
++
++#include <linux/linkage.h>
++#include <asm/assembler.h>
++#include <asm/asm-offsets.h>
++#include <asm/hardware/cache-l2x0.h>
++#include "hardware.h"
++
++/*
++ * The following code must assume it is running from physical address
++ * where absolute virtual addresses to the data section have to be
++ * turned into relative ones.
++ */
++
++ENTRY(v7_cpu_resume)
++ bl v7_invalidate_l1
++#ifdef CONFIG_CACHE_L2X0
++ bl l2c310_early_resume
++#endif
++ b cpu_resume
++ENDPROC(v7_cpu_resume)
+--- a/arch/arm/mach-imx/suspend-imx6.S
++++ b/arch/arm/mach-imx/suspend-imx6.S
+@@ -327,17 +327,3 @@ resume:
+
+ ret lr
+ ENDPROC(imx6_suspend)
+-
+-/*
+- * The following code must assume it is running from physical address
+- * where absolute virtual addresses to the data section have to be
+- * turned into relative ones.
+- */
+-
+-ENTRY(v7_cpu_resume)
+- bl v7_invalidate_l1
+-#ifdef CONFIG_CACHE_L2X0
+- bl l2c310_early_resume
+-#endif
+- b cpu_resume
+-ENDPROC(v7_cpu_resume)
--- /dev/null
+From 146033562e7e5d1c9aae9653986806664995f1d5 Mon Sep 17 00:00:00 2001
+From: Christian Hewitt <christianshewitt@gmail.com>
+Date: Thu, 20 Feb 2020 19:33:10 +0400
+Subject: arm64: dts: meson: fix gxm-khadas-vim2 wifi
+
+From: Christian Hewitt <christianshewitt@gmail.com>
+
+commit 146033562e7e5d1c9aae9653986806664995f1d5 upstream.
+
+before
+
+[6.418252] brcmfmac: F1 signature read @0x18000000=0x17224356
+[6.435663] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2
+[6.551259] brcmfmac: brcmf_sdiod_ramrw: membytes transfer failed
+[6.551275] brcmfmac: brcmf_sdio_verifymemory: error -84 on reading 2048 membytes at 0x00184000
+[6.551352] brcmfmac: brcmf_sdio_download_firmware: dongle image file download failed
+
+after
+
+[6.657165] brcmfmac: F1 signature read @0x18000000=0x17224356
+[6.660807] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2
+[6.918643] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac4356-sdio for chip BCM4356/2
+[6.918734] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
+[6.922724] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM4356/2 wl0: Jun 16 2015 14:25:06 version 7.35.184.r1 (TOB) (r559293) FWID 01-b22ae69c
+
+Fixes: adc52bf7ef16 ("arm64: dts: meson: fix mmc v2 chips max frequencies")
+Suggested-by: Art Nikpal <email2tema@gmail.com>
+Signed-off-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Link: https://lore.kernel.org/r/1582212790-11402-1-git-send-email-christianshewitt@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts
+@@ -327,7 +327,7 @@
+ #size-cells = <0>;
+
+ bus-width = <4>;
+- max-frequency = <50000000>;
++ max-frequency = <60000000>;
+
+ non-removable;
+ disable-wp;
--- /dev/null
+From aec551c7a00fb7eae049c0c4cc3208ca53e26355 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 24 Feb 2020 12:58:03 -0800
+Subject: bus: ti-sysc: Fix 1-wire reset quirk
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit aec551c7a00fb7eae049c0c4cc3208ca53e26355 upstream.
+
+Because of the i2c quirk we have the reset quirks named in a confusing
+way. Let's fix the 1-wire quirk accordinlyg. Then let's switch to using
+better naming later on.
+
+Fixes: 4e23be473e30 ("bus: ti-sysc: Add support for module specific reset quirks")
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/bus/ti-sysc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/bus/ti-sysc.c
++++ b/drivers/bus/ti-sysc.c
+@@ -1406,7 +1406,7 @@ static void sysc_init_revision_quirks(st
+ }
+
+ /* 1-wire needs module's internal clocks enabled for reset */
+-static void sysc_clk_enable_quirk_hdq1w(struct sysc *ddata)
++static void sysc_pre_reset_quirk_hdq1w(struct sysc *ddata)
+ {
+ int offset = 0x0c; /* HDQ_CTRL_STATUS */
+ u16 val;
+@@ -1494,7 +1494,7 @@ static void sysc_init_module_quirks(stru
+ return;
+
+ if (ddata->cfg.quirks & SYSC_MODULE_QUIRK_HDQ1W) {
+- ddata->clk_enable_quirk = sysc_clk_enable_quirk_hdq1w;
++ ddata->clk_disable_quirk = sysc_pre_reset_quirk_hdq1w;
+
+ return;
+ }
--- /dev/null
+From d1f37226431f5d9657aa144a40f2383adbcf27e1 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Thu, 26 Dec 2019 22:32:04 -0800
+Subject: dma-buf: free dmabuf->name in dma_buf_release()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+commit d1f37226431f5d9657aa144a40f2383adbcf27e1 upstream.
+
+dma-buf name can be set via DMA_BUF_SET_NAME ioctl, but once set
+it never gets freed.
+
+Free it in dma_buf_release().
+
+Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls")
+Reported-by: syzbot+b2098bc44728a4efb3e9@syzkaller.appspotmail.com
+Cc: Greg Hackmann <ghackmann@google.com>
+Cc: Chenbo Feng <fengc@google.com>
+Cc: Sumit Semwal <sumit.semwal@linaro.org>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Acked-by: Chenbo Feng <fengc@google.com>
+Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191227063204.5813-1-xiyou.wangcong@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma-buf/dma-buf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -108,6 +108,7 @@ static int dma_buf_release(struct inode
+ dma_resv_fini(dmabuf->resv);
+
+ module_put(dmabuf->owner);
++ kfree(dmabuf->name);
+ kfree(dmabuf);
+ return 0;
+ }
--- /dev/null
+From 36d5d22090d13fd3a7a8c9663a711cbe6970aac8 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 17 Feb 2020 17:40:50 +0300
+Subject: dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 36d5d22090d13fd3a7a8c9663a711cbe6970aac8 upstream.
+
+The caller is already holding the lock so this will deadlock.
+
+Fixes: 0b58828c923e ("DMAENGINE: COH 901 318 remove irq counting")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: https://lore.kernel.org/r/20200217144050.3i4ymbytogod4ijn@kili.mountain
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/coh901318.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/dma/coh901318.c
++++ b/drivers/dma/coh901318.c
+@@ -1947,8 +1947,6 @@ static void dma_tc_handle(struct coh9013
+ return;
+ }
+
+- spin_lock(&cohc->lock);
+-
+ /*
+ * When we reach this point, at least one queue item
+ * should have been moved over from cohc->queue to
+@@ -1969,8 +1967,6 @@ static void dma_tc_handle(struct coh9013
+ if (coh901318_queue_start(cohc) == NULL)
+ cohc->busy = 0;
+
+- spin_unlock(&cohc->lock);
+-
+ /*
+ * This tasklet will remove items from cohc->active
+ * and thus terminates them.
--- /dev/null
+From dfc6014e3b60713f375d0601d7549eed224c4615 Mon Sep 17 00:00:00 2001
+From: Sherry Sun <sherry.sun@nxp.com>
+Date: Thu, 27 Feb 2020 16:34:12 +0800
+Subject: EDAC/synopsys: Do not print an error with back-to-back snprintf() calls
+
+From: Sherry Sun <sherry.sun@nxp.com>
+
+commit dfc6014e3b60713f375d0601d7549eed224c4615 upstream.
+
+handle_error() currently calls snprintf() a couple of times in
+succession to output the message for a CE/UE, therefore overwriting each
+part of the message which was formatted with the previous snprintf()
+call. As a result, only the part of the message from the last snprintf()
+call will be printed.
+
+The simplest and most effective way to fix this problem is to combine
+the whole string into one which to supply to a single snprintf() call.
+
+ [ bp: Massage. ]
+
+Fixes: b500b4a029d57 ("EDAC, synopsys: Add ECC support for ZynqMP DDR controller")
+Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: James Morse <james.morse@arm.com>
+Cc: Manish Narani <manish.narani@xilinx.com>
+Link: https://lkml.kernel.org/r/1582792452-32575-1-git-send-email-sherry.sun@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/edac/synopsys_edac.c | 22 +++++++---------------
+ 1 file changed, 7 insertions(+), 15 deletions(-)
+
+--- a/drivers/edac/synopsys_edac.c
++++ b/drivers/edac/synopsys_edac.c
+@@ -479,20 +479,14 @@ static void handle_error(struct mem_ctl_
+ pinf = &p->ceinfo;
+ if (!priv->p_data->quirks) {
+ snprintf(priv->message, SYNPS_EDAC_MSG_SIZE,
+- "DDR ECC error type:%s Row %d Bank %d Col %d ",
+- "CE", pinf->row, pinf->bank, pinf->col);
+- snprintf(priv->message, SYNPS_EDAC_MSG_SIZE,
+- "Bit Position: %d Data: 0x%08x\n",
++ "DDR ECC error type:%s Row %d Bank %d Col %d Bit Position: %d Data: 0x%08x",
++ "CE", pinf->row, pinf->bank, pinf->col,
+ pinf->bitpos, pinf->data);
+ } else {
+ snprintf(priv->message, SYNPS_EDAC_MSG_SIZE,
+- "DDR ECC error type:%s Row %d Bank %d Col %d ",
+- "CE", pinf->row, pinf->bank, pinf->col);
+- snprintf(priv->message, SYNPS_EDAC_MSG_SIZE,
+- "BankGroup Number %d Block Number %d ",
+- pinf->bankgrpnr, pinf->blknr);
+- snprintf(priv->message, SYNPS_EDAC_MSG_SIZE,
+- "Bit Position: %d Data: 0x%08x\n",
++ "DDR ECC error type:%s Row %d Bank %d Col %d BankGroup Number %d Block Number %d Bit Position: %d Data: 0x%08x",
++ "CE", pinf->row, pinf->bank, pinf->col,
++ pinf->bankgrpnr, pinf->blknr,
+ pinf->bitpos, pinf->data);
+ }
+
+@@ -509,10 +503,8 @@ static void handle_error(struct mem_ctl_
+ "UE", pinf->row, pinf->bank, pinf->col);
+ } else {
+ snprintf(priv->message, SYNPS_EDAC_MSG_SIZE,
+- "DDR ECC error type :%s Row %d Bank %d Col %d ",
+- "UE", pinf->row, pinf->bank, pinf->col);
+- snprintf(priv->message, SYNPS_EDAC_MSG_SIZE,
+- "BankGroup Number %d Block Number %d",
++ "DDR ECC error type :%s Row %d Bank %d Col %d BankGroup Number %d Block Number %d",
++ "UE", pinf->row, pinf->bank, pinf->col,
+ pinf->bankgrpnr, pinf->blknr);
+ }
+
--- /dev/null
+From be36f9e7517e17810ec369626a128d7948942259 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Fri, 21 Feb 2020 09:48:49 +0100
+Subject: efi: READ_ONCE rng seed size before munmap
+
+From: Jason A. Donenfeld <Jason@zx2c4.com>
+
+commit be36f9e7517e17810ec369626a128d7948942259 upstream.
+
+This function is consistent with using size instead of seed->size
+(except for one place that this patch fixes), but it reads seed->size
+without using READ_ONCE, which means the compiler might still do
+something unwanted. So, this commit simply adds the READ_ONCE
+wrapper.
+
+Fixes: 636259880a7e ("efi: Add support for seeding the RNG from a UEFI ...")
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: linux-efi@vger.kernel.org
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20200217123354.21140-1-Jason@zx2c4.com
+Link: https://lore.kernel.org/r/20200221084849.26878-5-ardb@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/firmware/efi/efi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -544,7 +544,7 @@ int __init efi_config_parse_tables(void
+
+ seed = early_memremap(efi.rng_seed, sizeof(*seed));
+ if (seed != NULL) {
+- size = seed->size;
++ size = READ_ONCE(seed->size);
+ early_memunmap(seed, sizeof(*seed));
+ } else {
+ pr_err("Could not map UEFI random seed!\n");
+@@ -554,7 +554,7 @@ int __init efi_config_parse_tables(void
+ sizeof(*seed) + size);
+ if (seed != NULL) {
+ pr_notice("seeding entropy pool\n");
+- add_bootloader_randomness(seed->bits, seed->size);
++ add_bootloader_randomness(seed->bits, size);
+ early_memunmap(seed, sizeof(*seed) + size);
+ } else {
+ pr_err("Could not map UEFI random seed!\n");
--- /dev/null
+From 63056e8b5ebf41d52170e9f5ba1fc83d1855278c Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Fri, 21 Feb 2020 09:48:46 +0100
+Subject: efi/x86: Align GUIDs to their size in the mixed mode runtime wrapper
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 63056e8b5ebf41d52170e9f5ba1fc83d1855278c upstream.
+
+Hans reports that his mixed mode systems running v5.6-rc1 kernels hit
+the WARN_ON() in virt_to_phys_or_null_size(), caused by the fact that
+efi_guid_t objects on the vmap'ed stack happen to be misaligned with
+respect to their sizes. As a quick (i.e., backportable) fix, copy GUID
+pointer arguments to the local stack into a buffer that is naturally
+aligned to its size, so that it is guaranteed to cover only one
+physical page.
+
+Note that on x86, we cannot rely on the stack pointer being aligned
+the way the compiler expects, so we need to allocate an 8-byte aligned
+buffer of sufficient size, and copy the GUID into that buffer at an
+offset that is aligned to 16 bytes.
+
+Fixes: f6697df36bdf0bf7 ("x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y")
+Reported-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Cc: linux-efi@vger.kernel.org
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20200221084849.26878-2-ardb@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi_64.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -791,6 +791,8 @@ static efi_status_t
+ efi_thunk_get_variable(efi_char16_t *name, efi_guid_t *vendor,
+ u32 *attr, unsigned long *data_size, void *data)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ efi_status_t status;
+ u32 phys_name, phys_vendor, phys_attr;
+ u32 phys_data_size, phys_data;
+@@ -798,8 +800,10 @@ efi_thunk_get_variable(efi_char16_t *nam
+
+ spin_lock_irqsave(&efi_runtime_lock, flags);
+
++ *vnd = *vendor;
++
+ phys_data_size = virt_to_phys_or_null(data_size);
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+ phys_attr = virt_to_phys_or_null(attr);
+ phys_data = virt_to_phys_or_null_size(data, *data_size);
+@@ -816,14 +820,18 @@ static efi_status_t
+ efi_thunk_set_variable(efi_char16_t *name, efi_guid_t *vendor,
+ u32 attr, unsigned long data_size, void *data)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ u32 phys_name, phys_vendor, phys_data;
+ efi_status_t status;
+ unsigned long flags;
+
+ spin_lock_irqsave(&efi_runtime_lock, flags);
+
++ *vnd = *vendor;
++
+ phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+ /* If data_size is > sizeof(u32) we've got problems */
+@@ -840,6 +848,8 @@ efi_thunk_set_variable_nonblocking(efi_c
+ u32 attr, unsigned long data_size,
+ void *data)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ u32 phys_name, phys_vendor, phys_data;
+ efi_status_t status;
+ unsigned long flags;
+@@ -847,8 +857,10 @@ efi_thunk_set_variable_nonblocking(efi_c
+ if (!spin_trylock_irqsave(&efi_runtime_lock, flags))
+ return EFI_NOT_READY;
+
++ *vnd = *vendor;
++
+ phys_name = virt_to_phys_or_null_size(name, efi_name_size(name));
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+ /* If data_size is > sizeof(u32) we've got problems */
+@@ -865,14 +877,18 @@ efi_thunk_get_next_variable(unsigned lon
+ efi_char16_t *name,
+ efi_guid_t *vendor)
+ {
++ u8 buf[24] __aligned(8);
++ efi_guid_t *vnd = PTR_ALIGN((efi_guid_t *)buf, sizeof(*vnd));
+ efi_status_t status;
+ u32 phys_name_size, phys_name, phys_vendor;
+ unsigned long flags;
+
+ spin_lock_irqsave(&efi_runtime_lock, flags);
+
++ *vnd = *vendor;
++
+ phys_name_size = virt_to_phys_or_null(name_size);
+- phys_vendor = virt_to_phys_or_null(vendor);
++ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_name = virt_to_phys_or_null_size(name, *name_size);
+
+ status = efi_thunk(get_next_variable, phys_name_size,
+@@ -880,6 +896,7 @@ efi_thunk_get_next_variable(unsigned lon
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
++ *vendor = *vnd;
+ return status;
+ }
+
--- /dev/null
+From 8319e9d5ad98ffccd19f35664382c73cea216193 Mon Sep 17 00:00:00 2001
+From: Ard Biesheuvel <ardb@kernel.org>
+Date: Fri, 21 Feb 2020 09:48:48 +0100
+Subject: efi/x86: Handle by-ref arguments covering multiple pages in mixed mode
+
+From: Ard Biesheuvel <ardb@kernel.org>
+
+commit 8319e9d5ad98ffccd19f35664382c73cea216193 upstream.
+
+The mixed mode runtime wrappers are fragile when it comes to how the
+memory referred to by its pointer arguments are laid out in memory, due
+to the fact that it translates these addresses to physical addresses that
+the runtime services can dereference when running in 1:1 mode. Since
+vmalloc'ed pages (including the vmap'ed stack) are not contiguous in the
+physical address space, this scheme only works if the referenced memory
+objects do not cross page boundaries.
+
+Currently, the mixed mode runtime service wrappers require that all by-ref
+arguments that live in the vmalloc space have a size that is a power of 2,
+and are aligned to that same value. While this is a sensible way to
+construct an object that is guaranteed not to cross a page boundary, it is
+overly strict when it comes to checking whether a given object violates
+this requirement, as we can simply take the physical address of the first
+and the last byte, and verify that they point into the same physical page.
+
+When this check fails, we emit a WARN(), but then simply proceed with the
+call, which could cause data corruption if the next physical page belongs
+to a mapping that is entirely unrelated.
+
+Given that with vmap'ed stacks, this condition is much more likely to
+trigger, let's relax the condition a bit, but fail the runtime service
+call if it does trigger.
+
+Fixes: f6697df36bdf0bf7 ("x86/efi: Prevent mixed mode boot corruption with CONFIG_VMAP_STACK=y")
+Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: linux-efi@vger.kernel.org
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20200221084849.26878-4-ardb@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi_64.c | 45 +++++++++++++++++++++++------------------
+ 1 file changed, 26 insertions(+), 19 deletions(-)
+
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -316,7 +316,7 @@ void efi_sync_low_kernel_mappings(void)
+ static inline phys_addr_t
+ virt_to_phys_or_null_size(void *va, unsigned long size)
+ {
+- bool bad_size;
++ phys_addr_t pa;
+
+ if (!va)
+ return 0;
+@@ -324,16 +324,13 @@ virt_to_phys_or_null_size(void *va, unsi
+ if (virt_addr_valid(va))
+ return virt_to_phys(va);
+
+- /*
+- * A fully aligned variable on the stack is guaranteed not to
+- * cross a page bounary. Try to catch strings on the stack by
+- * checking that 'size' is a power of two.
+- */
+- bad_size = size > PAGE_SIZE || !is_power_of_2(size);
++ pa = slow_virt_to_phys(va);
+
+- WARN_ON(!IS_ALIGNED((unsigned long)va, size) || bad_size);
++ /* check if the object crosses a page boundary */
++ if (WARN_ON((pa ^ (pa + size - 1)) & PAGE_MASK))
++ return 0;
+
+- return slow_virt_to_phys(va);
++ return pa;
+ }
+
+ #define virt_to_phys_or_null(addr) \
+@@ -808,8 +805,11 @@ efi_thunk_get_variable(efi_char16_t *nam
+ phys_attr = virt_to_phys_or_null(attr);
+ phys_data = virt_to_phys_or_null_size(data, *data_size);
+
+- status = efi_thunk(get_variable, phys_name, phys_vendor,
+- phys_attr, phys_data_size, phys_data);
++ if (!phys_name || (data && !phys_data))
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(get_variable, phys_name, phys_vendor,
++ phys_attr, phys_data_size, phys_data);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+@@ -834,9 +834,11 @@ efi_thunk_set_variable(efi_char16_t *nam
+ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+- /* If data_size is > sizeof(u32) we've got problems */
+- status = efi_thunk(set_variable, phys_name, phys_vendor,
+- attr, data_size, phys_data);
++ if (!phys_name || !phys_data)
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(set_variable, phys_name, phys_vendor,
++ attr, data_size, phys_data);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+@@ -863,9 +865,11 @@ efi_thunk_set_variable_nonblocking(efi_c
+ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_data = virt_to_phys_or_null_size(data, data_size);
+
+- /* If data_size is > sizeof(u32) we've got problems */
+- status = efi_thunk(set_variable, phys_name, phys_vendor,
+- attr, data_size, phys_data);
++ if (!phys_name || !phys_data)
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(set_variable, phys_name, phys_vendor,
++ attr, data_size, phys_data);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
+@@ -891,8 +895,11 @@ efi_thunk_get_next_variable(unsigned lon
+ phys_vendor = virt_to_phys_or_null(vnd);
+ phys_name = virt_to_phys_or_null_size(name, *name_size);
+
+- status = efi_thunk(get_next_variable, phys_name_size,
+- phys_name, phys_vendor);
++ if (!phys_name)
++ status = EFI_INVALID_PARAMETER;
++ else
++ status = efi_thunk(get_next_variable, phys_name_size,
++ phys_name, phys_vendor);
+
+ spin_unlock_irqrestore(&efi_runtime_lock, flags);
+
--- /dev/null
+From 44f2f882909fedfc3a56e4b90026910456019743 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 3 Mar 2020 13:16:08 +0300
+Subject: hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 44f2f882909fedfc3a56e4b90026910456019743 upstream.
+
+This is only called from adt7462_update_device(). The caller expects it
+to return zero on error. I fixed a similar issue earlier in commit
+a4bf06d58f21 ("hwmon: (adt7462) ADT7462_REG_VOLT_MAX() should return 0")
+but I missed this one.
+
+Fixes: c0b4e3ab0c76 ("adt7462: new hwmon driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Link: https://lore.kernel.org/r/20200303101608.kqjwfcazu2ylhi2a@kili.mountain
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwmon/adt7462.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/hwmon/adt7462.c
++++ b/drivers/hwmon/adt7462.c
+@@ -413,7 +413,7 @@ static int ADT7462_REG_VOLT(struct adt74
+ return 0x95;
+ break;
+ }
+- return -ENODEV;
++ return 0;
+ }
+
+ /* Provide labels for sysfs */
--- /dev/null
+From fc37a1632d40c80c067eb1bc235139f5867a2667 Mon Sep 17 00:00:00 2001
+From: "Desnes A. Nunes do Rosario" <desnesn@linux.ibm.com>
+Date: Thu, 27 Feb 2020 10:47:15 -0300
+Subject: powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
+
+From: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
+
+commit fc37a1632d40c80c067eb1bc235139f5867a2667 upstream.
+
+PowerVM systems running compatibility mode on a few Power8 revisions are
+still vulnerable to the hardware defect that loses PMU exceptions arriving
+prior to a context switch.
+
+The software fix for this issue is enabled through the CPU_FTR_PMAO_BUG
+cpu_feature bit, nevertheless this bit also needs to be set for PowerVM
+compatibility mode systems.
+
+Fixes: 68f2f0d431d9ea4 ("powerpc: Add a cpu feature CPU_FTR_PMAO_BUG")
+Signed-off-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
+Reviewed-by: Leonardo Bras <leonardo@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200227134715.9715-1-desnesn@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/cputable.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/cputable.c
++++ b/arch/powerpc/kernel/cputable.c
+@@ -2193,11 +2193,13 @@ static struct cpu_spec * __init setup_cp
+ * oprofile_cpu_type already has a value, then we are
+ * possibly overriding a real PVR with a logical one,
+ * and, in that case, keep the current value for
+- * oprofile_cpu_type.
++ * oprofile_cpu_type. Futhermore, let's ensure that the
++ * fix for the PMAO bug is enabled on compatibility mode.
+ */
+ if (old.oprofile_cpu_type != NULL) {
+ t->oprofile_cpu_type = old.oprofile_cpu_type;
+ t->oprofile_type = old.oprofile_type;
++ t->cpu_features |= old.cpu_features & CPU_FTR_PMAO_BUG;
+ }
+ }
+
regulator-stm32-vrefbuf-fix-a-possible-overshoot-when-re-enabling.patch
rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch
ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch
+arm-imx-build-v7_cpu_resume-unconditionally.patch
+arm-dts-am437x-idk-evm-fix-incorrect-opp-node-names.patch
+arm-dts-dra7xx-clocks-fixup-ipu1-mux-clock-parent-source.patch
+arm-dts-imx6dl-colibri-eval-v3-fix-sram-compatible-properties.patch
+arm-dts-imx7-colibri-fix-frequency-for-sd-mmc.patch
+hwmon-adt7462-fix-an-error-return-in-adt7462_reg_volt.patch
+dma-buf-free-dmabuf-name-in-dma_buf_release.patch
+dmaengine-coh901318-fix-a-double-lock-bug-in-dma_tc_handle.patch
+arm64-dts-meson-fix-gxm-khadas-vim2-wifi.patch
+bus-ti-sysc-fix-1-wire-reset-quirk.patch
+edac-synopsys-do-not-print-an-error-with-back-to-back-snprintf-calls.patch
+powerpc-fix-hardware-pmu-exception-bug-on-powervm-compatibility-mode-systems.patch
+efi-x86-align-guids-to-their-size-in-the-mixed-mode-runtime-wrapper.patch
+efi-x86-handle-by-ref-arguments-covering-multiple-pages-in-mixed-mode.patch
+efi-read_once-rng-seed-size-before-munmap.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
