--- /dev/null
+From b9d09409b3f7d8023776dbe2bdbf4c461010ec46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 Nov 2019 11:39:48 +0200
+Subject: ARM: dts: am437x-gp/epos-evm: fix panel compatible
+
+From: Tomi Valkeinen <tomi.valkeinen@ti.com>
+
+[ Upstream commit c6b16761c6908d3dc167a0a566578b4b0b972905 ]
+
+The LCD panel on AM4 GP EVMs and ePOS boards seems to be
+osd070t1718-19ts. The current dts files say osd057T0559-34ts. Possibly
+the panel has changed since the early EVMs, or there has been a mistake
+with the panel type.
+
+Update the DT files accordingly.
+
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am437x-gp-evm.dts | 2 +-
+ arch/arm/boot/dts/am43x-epos-evm.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts
+index d2450ab0a380..3293484028ad 100644
+--- a/arch/arm/boot/dts/am437x-gp-evm.dts
++++ b/arch/arm/boot/dts/am437x-gp-evm.dts
+@@ -79,7 +79,7 @@
+ };
+
+ lcd0: display {
+- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
+ label = "lcd";
+
+ panel-timing {
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index 00707aac72fc..a74b09f17a1a 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -41,7 +41,7 @@
+ };
+
+ lcd0: display {
+- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi";
++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi";
+ label = "lcd";
+
+ panel-timing {
+--
+2.20.1
+
--- /dev/null
+From 5760010f47909e2ebfc00711c8f35eb40bab63cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 15:56:40 +0000
+Subject: ARM: vexpress: Set-up shared OPP table instead of individual for each
+ CPU
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 2a76352ad2cc6b78e58f737714879cc860903802 ]
+
+Currently we add individual copy of same OPP table for each CPU within
+the cluster. This is redundant and doesn't reflect the reality.
+
+We can't use core cpumask to set policy->cpus in ve_spc_cpufreq_init()
+anymore as it gets called via cpuhp_cpufreq_online()->cpufreq_online()
+->cpufreq_driver->init() and the cpumask gets updated upon CPU hotplug
+operations. It also may cause issues when the vexpress_spc_cpufreq
+driver is built as a module.
+
+Since ve_spc_clk_init is built-in device initcall, we should be able to
+use the same topology_core_cpumask to set the opp sharing cpumask via
+dev_pm_opp_set_sharing_cpus and use the same later in the driver via
+dev_pm_opp_get_sharing_cpus.
+
+Cc: Liviu Dudau <liviu.dudau@arm.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-vexpress/spc.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c
+index 5766ce2be32b..29eb945075e3 100644
+--- a/arch/arm/mach-vexpress/spc.c
++++ b/arch/arm/mach-vexpress/spc.c
+@@ -555,8 +555,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev)
+
+ static int __init ve_spc_clk_init(void)
+ {
+- int cpu;
++ int cpu, cluster;
+ struct clk *clk;
++ bool init_opp_table[MAX_CLUSTERS] = { false };
+
+ if (!info)
+ return 0; /* Continue only if SPC is initialised */
+@@ -582,8 +583,17 @@ static int __init ve_spc_clk_init(void)
+ continue;
+ }
+
++ cluster = topology_physical_package_id(cpu_dev->id);
++ if (init_opp_table[cluster])
++ continue;
++
+ if (ve_init_opp_table(cpu_dev))
+ pr_warn("failed to initialise cpu%d opp table\n", cpu);
++ else if (dev_pm_opp_set_sharing_cpus(cpu_dev,
++ topology_core_cpumask(cpu_dev->id)))
++ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu);
++ else
++ init_opp_table[cluster] = true;
+ }
+
+ platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0);
+--
+2.20.1
+
--- /dev/null
+From 631d4f2c755f241ccb622a3e07d98024d28faea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 19:57:22 +0800
+Subject: ASoC: wm8962: fix lambda value
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 556672d75ff486e0b6786056da624131679e0576 ]
+
+According to user manual, it is required that FLL_LAMBDA > 0
+in all cases (Integer and Franctional modes).
+
+Fixes: 9a76f1ff6e29 ("ASoC: Add initial WM8962 CODEC driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/1576065442-19763-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8962.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index a7e79784fc16..4a3ce9b85253 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -2792,7 +2792,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref,
+
+ if (target % Fref == 0) {
+ fll_div->theta = 0;
+- fll_div->lambda = 0;
++ fll_div->lambda = 1;
+ } else {
+ gcd_fll = gcd(target, fratio * Fref);
+
+@@ -2862,7 +2862,7 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source,
+ return -EINVAL;
+ }
+
+- if (fll_div.theta || fll_div.lambda)
++ if (fll_div.theta)
+ fll1 |= WM8962_FLL_FRAC;
+
+ /* Stop the FLL while we reconfigure */
+--
+2.20.1
+
--- /dev/null
+From 9d26fcd79b709d5c78cd42bad3235c275f5b2317 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 09:59:55 -0800
+Subject: bnx2x: Do not handle requests from VFs after parity
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 7113f796bbbced2470cd6d7379d50d7a7a78bf34 ]
+
+Parity error from the hardware will cause PF to lose the state
+of their VFs due to PF's internal reload and hardware reset following
+the parity error. Restrict any configuration request from the VFs after
+the parity as it could cause unexpected hardware behavior, only way
+for VFs to recover would be to trigger FLR on VFs and reload them.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 12 ++++++++++--
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 +
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 12 ++++++++++++
+ 3 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index 82960603da33..026c72e62c18 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -9942,10 +9942,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp)
+ */
+ static void bnx2x_parity_recover(struct bnx2x *bp)
+ {
+- bool global = false;
+ u32 error_recovered, error_unrecovered;
+- bool is_parity;
++ bool is_parity, global = false;
++#ifdef CONFIG_BNX2X_SRIOV
++ int vf_idx;
++
++ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) {
++ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx);
+
++ if (vf)
++ vf->state = VF_LOST;
++ }
++#endif
+ DP(NETIF_MSG_HW, "Handling parity\n");
+ while (1) {
+ switch (bp->recovery_state) {
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+index 6f6f13dc2be3..ab8339594cd3 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+@@ -139,6 +139,7 @@ struct bnx2x_virtf {
+ #define VF_ACQUIRED 1 /* VF acquired, but not initialized */
+ #define VF_ENABLED 2 /* VF Enabled */
+ #define VF_RESET 3 /* VF FLR'd, pending cleanup */
++#define VF_LOST 4 /* Recovery while VFs are loaded */
+
+ bool flr_clnup_stage; /* true during flr cleanup */
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+index a12a4236b143..e9fc3b09dba8 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+@@ -2095,6 +2095,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf,
+ {
+ int i;
+
++ if (vf->state == VF_LOST) {
++ /* Just ack the FW and return if VFs are lost
++ * in case of parity error. VFs are supposed to be timedout
++ * on waiting for PF response.
++ */
++ DP(BNX2X_MSG_IOV,
++ "VF 0x%x lost, not handling the request\n", vf->abs_vfid);
++
++ storm_memset_vf_mbx_ack(bp, vf->abs_vfid);
++ return;
++ }
++
+ /* check if tlv type is known */
+ if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) {
+ /* Lock the per vf op mutex and note the locker's identity.
+--
+2.20.1
+
--- /dev/null
+From b7eae752f1943e27646dc4b8da99a8c219731a0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 09:59:56 -0800
+Subject: bnx2x: Fix logic to get total no. of PFs per engine
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit ee699f89bdbaa19c399804504241b5c531b48888 ]
+
+Driver doesn't calculate total number of PFs configured on a
+given engine correctly which messed up resources in the PFs
+loaded on that engine, leading driver to exceed configuration
+of resources (like vlan filters etc.) beyond the limit per
+engine, which ended up with asserts from the firmware.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+index b7d32e8412f1..ec2122acc3c1 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -1107,7 +1107,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp)
+ for (i = 0; i < E1H_FUNC_MAX / 2; i++) {
+ u32 func_config =
+ MF_CFG_RD(bp,
+- func_mf_config[BP_PORT(bp) + 2 * i].
++ func_mf_config[BP_PATH(bp) + 2 * i].
+ config);
+ func_num +=
+ ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1);
+--
+2.20.1
+
--- /dev/null
+From ced83f23c29e8ebc67158136c52203a30805c832 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 00:19:17 -0800
+Subject: kconfig: don't crash on NULL expressions in expr_eq()
+
+From: Thomas Hebb <tommyhebb@gmail.com>
+
+[ Upstream commit 272a72103012862e3a24ea06635253ead0b6e808 ]
+
+NULL expressions are taken to always be true, as implemented by the
+expr_is_yes() macro and by several other functions in expr.c. As such,
+they ought to be valid inputs to expr_eq(), which compares two
+expressions.
+
+Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/kconfig/expr.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c
+index ed29bad1f03a..96420b620963 100644
+--- a/scripts/kconfig/expr.c
++++ b/scripts/kconfig/expr.c
+@@ -201,6 +201,13 @@ static int expr_eq(struct expr *e1, struct expr *e2)
+ {
+ int res, old_count;
+
++ /*
++ * A NULL expr is taken to be yes, but there's also a different way to
++ * represent yes. expr_is_yes() checks for either representation.
++ */
++ if (!e1 || !e2)
++ return expr_is_yes(e1) && expr_is_yes(e2);
++
+ if (e1->type != e2->type)
+ return 0;
+ switch (e1->type) {
+--
+2.20.1
+
--- /dev/null
+From ae512cadc1be4056f9cd27e1b2fea81e3ef1df96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Dec 2019 14:16:18 +0800
+Subject: llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and
+ _test_c)
+
+From: Chan Shu Tak, Alex <alexchan@task.com.hk>
+
+[ Upstream commit af1c0e4e00f3cc76cb136ebf2e2c04e8b6446285 ]
+
+When a frame with NULL DSAP is received, llc_station_rcv is called.
+In turn, llc_stat_ev_rx_null_dsap_xid_c is called to check if it is a NULL
+XID frame. The return statement of llc_stat_ev_rx_null_dsap_xid_c returns 1
+when the incoming frame is not a NULL XID frame and 0 otherwise. Hence, a
+NULL XID response is returned unexpectedly, e.g. when the incoming frame is
+a NULL TEST command.
+
+To fix the error, simply remove the conditional operator.
+
+A similar error in llc_stat_ev_rx_null_dsap_test_c is also fixed.
+
+Signed-off-by: Chan Shu Tak, Alex <alexchan@task.com.hk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/llc_station.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
+index 204a8351efff..c29170e767a8 100644
+--- a/net/llc/llc_station.c
++++ b/net/llc/llc_station.c
+@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb)
+ return LLC_PDU_IS_CMD(pdu) && /* command PDU */
+ LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */
+ LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID &&
+- !pdu->dsap ? 0 : 1; /* NULL DSAP value */
++ !pdu->dsap; /* NULL DSAP value */
+ }
+
+ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
+@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb)
+ return LLC_PDU_IS_CMD(pdu) && /* command PDU */
+ LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */
+ LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST &&
+- !pdu->dsap ? 0 : 1; /* NULL DSAP */
++ !pdu->dsap; /* NULL DSAP */
+ }
+
+ static int llc_station_ac_send_xid_r(struct sk_buff *skb)
+--
+2.20.1
+
--- /dev/null
+From 94d2d936ddddc296f89867b4100b2af480d96b8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 16:57:15 +0100
+Subject: locking/spinlock/debug: Fix various data races
+
+From: Marco Elver <elver@google.com>
+
+[ Upstream commit 1a365e822372ba24c9da0822bc583894f6f3d821 ]
+
+This fixes various data races in spinlock_debug. By testing with KCSAN,
+it is observable that the console gets spammed with data races reports,
+suggesting these are extremely frequent.
+
+Example data race report:
+
+ read to 0xffff8ab24f403c48 of 4 bytes by task 221 on cpu 2:
+ debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline]
+ do_raw_spin_lock+0x9b/0x210 kernel/locking/spinlock_debug.c:112
+ __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
+ _raw_spin_lock+0x39/0x40 kernel/locking/spinlock.c:151
+ spin_lock include/linux/spinlock.h:338 [inline]
+ get_partial_node.isra.0.part.0+0x32/0x2f0 mm/slub.c:1873
+ get_partial_node mm/slub.c:1870 [inline]
+ <snip>
+
+ write to 0xffff8ab24f403c48 of 4 bytes by task 167 on cpu 3:
+ debug_spin_unlock kernel/locking/spinlock_debug.c:103 [inline]
+ do_raw_spin_unlock+0xc9/0x1a0 kernel/locking/spinlock_debug.c:138
+ __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:159 [inline]
+ _raw_spin_unlock_irqrestore+0x2d/0x50 kernel/locking/spinlock.c:191
+ spin_unlock_irqrestore include/linux/spinlock.h:393 [inline]
+ free_debug_processing+0x1b3/0x210 mm/slub.c:1214
+ __slab_free+0x292/0x400 mm/slub.c:2864
+ <snip>
+
+As a side-effect, with KCSAN, this eventually locks up the console, most
+likely due to deadlock, e.g. .. -> printk lock -> spinlock_debug ->
+KCSAN detects data race -> kcsan_print_report() -> printk lock ->
+deadlock.
+
+This fix will 1) avoid the data races, and 2) allow using lock debugging
+together with KCSAN.
+
+Reported-by: Qian Cai <cai@lca.pw>
+Signed-off-by: Marco Elver <elver@google.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will.deacon@arm.com>
+Link: https://lkml.kernel.org/r/20191120155715.28089-1-elver@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/locking/spinlock_debug.c | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c
+index 0374a596cffa..95e610e3f7ef 100644
+--- a/kernel/locking/spinlock_debug.c
++++ b/kernel/locking/spinlock_debug.c
+@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init);
+
+ static void spin_dump(raw_spinlock_t *lock, const char *msg)
+ {
+- struct task_struct *owner = NULL;
++ struct task_struct *owner = READ_ONCE(lock->owner);
+
+- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT)
+- owner = lock->owner;
++ if (owner == SPINLOCK_OWNER_INIT)
++ owner = NULL;
+ printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n",
+ msg, raw_smp_processor_id(),
+ current->comm, task_pid_nr(current));
+ printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, "
+ ".owner_cpu: %d\n",
+- lock, lock->magic,
++ lock, READ_ONCE(lock->magic),
+ owner ? owner->comm : "<none>",
+ owner ? task_pid_nr(owner) : -1,
+- lock->owner_cpu);
++ READ_ONCE(lock->owner_cpu));
+ dump_stack();
+ }
+
+@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg)
+ static inline void
+ debug_spin_lock_before(raw_spinlock_t *lock)
+ {
+- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic");
+- SPIN_BUG_ON(lock->owner == current, lock, "recursion");
+- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(),
++ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic");
++ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion");
++ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(),
+ lock, "cpu recursion");
+ }
+
+ static inline void debug_spin_lock_after(raw_spinlock_t *lock)
+ {
+- lock->owner_cpu = raw_smp_processor_id();
+- lock->owner = current;
++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
++ WRITE_ONCE(lock->owner, current);
+ }
+
+ static inline void debug_spin_unlock(raw_spinlock_t *lock)
+@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock)
+ SPIN_BUG_ON(lock->owner != current, lock, "wrong owner");
+ SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
+ lock, "wrong CPU");
+- lock->owner = SPINLOCK_OWNER_INIT;
+- lock->owner_cpu = -1;
++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
++ WRITE_ONCE(lock->owner_cpu, -1);
+ }
+
+ static void __spin_lock_debug(raw_spinlock_t *lock)
+@@ -233,8 +233,8 @@ static inline void debug_write_lock_before(rwlock_t *lock)
+
+ static inline void debug_write_lock_after(rwlock_t *lock)
+ {
+- lock->owner_cpu = raw_smp_processor_id();
+- lock->owner = current;
++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id());
++ WRITE_ONCE(lock->owner, current);
+ }
+
+ static inline void debug_write_unlock(rwlock_t *lock)
+@@ -243,8 +243,8 @@ static inline void debug_write_unlock(rwlock_t *lock)
+ RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner");
+ RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(),
+ lock, "wrong CPU");
+- lock->owner = SPINLOCK_OWNER_INIT;
+- lock->owner_cpu = -1;
++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT);
++ WRITE_ONCE(lock->owner_cpu, -1);
+ }
+
+ #if 0 /* This can cause lockups */
+--
+2.20.1
+
--- /dev/null
+From 445c7ef86635710801de98e3bae3b3fd4d80b0ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 13 Dec 2019 18:33:11 +0200
+Subject: net: usb: lan78xx: Fix error message format specifier
+
+From: Cristian Birsan <cristian.birsan@microchip.com>
+
+[ Upstream commit 858ce8ca62ea1530f2779d0e3f934b0176e663c3 ]
+
+Display the return code as decimal integer.
+
+Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
+Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/lan78xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index c813c5345a52..2340c61073de 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -370,7 +370,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev,
+ }
+ } else {
+ netdev_warn(dev->net,
+- "Failed to read stat ret = 0x%x", ret);
++ "Failed to read stat ret = %d", ret);
+ }
+
+ kfree(stats);
+--
+2.20.1
+
--- /dev/null
+From 2c2d572291a3ee9493c67a1f7c5c3325cb25d0df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 12:39:23 +0100
+Subject: netfilter: ctnetlink: netns exit must wait for callbacks
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 18a110b022a5c02e7dc9f6109d0bd93e58ac6ebb ]
+
+Curtis Taylor and Jon Maxwell reported and debugged a crash on 3.10
+based kernel.
+
+Crash occurs in ctnetlink_conntrack_events because net->nfnl socket is
+NULL. The nfnl socket was set to NULL by netns destruction running on
+another cpu.
+
+The exiting network namespace calls the relevant destructors in the
+following order:
+
+1. ctnetlink_net_exit_batch
+
+This nulls out the event callback pointer in struct netns.
+
+2. nfnetlink_net_exit_batch
+
+This nulls net->nfnl socket and frees it.
+
+3. nf_conntrack_cleanup_net_list
+
+This removes all remaining conntrack entries.
+
+This is order is correct. The only explanation for the crash so ar is:
+
+cpu1: conntrack is dying, eviction occurs:
+ -> nf_ct_delete()
+ -> nf_conntrack_event_report \
+ -> nf_conntrack_eventmask_report
+ -> notify->fcn() (== ctnetlink_conntrack_events).
+
+cpu1: a. fetches rcu protected pointer to obtain ctnetlink event callback.
+ b. gets interrupted.
+ cpu2: runs netns exit handlers:
+ a runs ctnetlink destructor, event cb pointer set to NULL.
+ b runs nfnetlink destructor, nfnl socket is closed and set to NULL.
+cpu1: c. resumes and trips over NULL net->nfnl.
+
+Problem appears to be that ctnetlink_net_exit_batch only prevents future
+callers of nf_conntrack_eventmask_report() from obtaining the callback.
+It doesn't wait of other cpus that might have already obtained the
+callbacks address.
+
+I don't see anything in upstream kernels that would prevent similar
+crash: We need to wait for all cpus to have exited the event callback.
+
+Fixes: 9592a5c01e79dbc59eb56fa ("netfilter: ctnetlink: netns support")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_conntrack_netlink.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 3a24c01cb909..f324a1124418 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -3390,6 +3390,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list)
+
+ list_for_each_entry(net, net_exit_list, exit_list)
+ ctnetlink_net_exit(net);
++
++ /* wait for other cpus until they are done with ctnl_notifiers */
++ synchronize_rcu();
+ }
+
+ static struct pernet_operations ctnetlink_net_ops = {
+--
+2.20.1
+
--- /dev/null
+From 60dc790a261af2b19688c014562482c490ec11ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 13:35:11 +0100
+Subject: netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
+
+From: Phil Sutter <phil@nwl.cc>
+
+[ Upstream commit 164166558aacea01b99c8c8ffb710d930405ba69 ]
+
+With 'bytes(__u32)' being 32, a left-shift of 31 may happen which is
+undefined for the signed 32-bit value 1. Avoid this by declaring 1 as
+unsigned.
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/linux/netfilter/xt_sctp.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h
+index 29287be696a2..788b77c347a0 100644
+--- a/include/uapi/linux/netfilter/xt_sctp.h
++++ b/include/uapi/linux/netfilter/xt_sctp.h
+@@ -40,19 +40,19 @@ struct xt_sctp_info {
+ #define SCTP_CHUNKMAP_SET(chunkmap, type) \
+ do { \
+ (chunkmap)[type / bytes(__u32)] |= \
+- 1 << (type % bytes(__u32)); \
++ 1u << (type % bytes(__u32)); \
+ } while (0)
+
+ #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \
+ do { \
+ (chunkmap)[type / bytes(__u32)] &= \
+- ~(1 << (type % bytes(__u32))); \
++ ~(1u << (type % bytes(__u32))); \
+ } while (0)
+
+ #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \
+ ({ \
+ ((chunkmap)[type / bytes (__u32)] & \
+- (1 << (type % bytes (__u32)))) ? 1: 0; \
++ (1u << (type % bytes (__u32)))) ? 1: 0; \
+ })
+
+ #define SCTP_CHUNKMAP_RESET(chunkmap) \
+--
+2.20.1
+
--- /dev/null
+From 2e7398729798194be9dc651688c7c43594ee7bec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 21:00:19 +0100
+Subject: parisc: Fix compiler warnings in debug_core.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Helge Deller <deller@gmx.de>
+
+[ Upstream commit 75cf9797006a3a9f29a3a25c1febd6842a4a9eb2 ]
+
+Fix this compiler warning:
+kernel/debug/debug_core.c: In function ‘kgdb_cpu_enter’:
+arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value]
+ 48 | ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
+arch/parisc/include/asm/atomic.h:78:30: note: in expansion of macro ‘xchg’
+ 78 | #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
+ | ^~~~
+kernel/debug/debug_core.c:596:4: note: in expansion of macro ‘atomic_xchg’
+ 596 | atomic_xchg(&kgdb_active, cpu);
+ | ^~~~~~~~~~~
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/include/asm/cmpxchg.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h
+index 0a90b965cccb..9849bef2a766 100644
+--- a/arch/parisc/include/asm/cmpxchg.h
++++ b/arch/parisc/include/asm/cmpxchg.h
+@@ -43,8 +43,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size)
+ ** if (((unsigned long)p & 0xf) == 0)
+ ** return __ldcw(p);
+ */
+-#define xchg(ptr, x) \
+- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr))))
++#define xchg(ptr, x) \
++({ \
++ __typeof__(*(ptr)) __ret; \
++ __typeof__(*(ptr)) _x_ = (x); \
++ __ret = (__typeof__(*(ptr))) \
++ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \
++ __ret; \
++})
+
+ /* bug catcher for when unsupported size is used - won't link */
+ extern void __cmpxchg_called_with_bad_pointer(void);
+--
+2.20.1
+
--- /dev/null
+From c5db76c8b989866e636c89c3d2e91e47141fe875 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 14:35:24 +0200
+Subject: powerpc: Ensure that swiotlb buffer is allocated from low memory
+
+From: Mike Rapoport <rppt@linux.ibm.com>
+
+[ Upstream commit 8fabc623238e68b3ac63c0dd1657bf86c1fa33af ]
+
+Some powerpc platforms (e.g. 85xx) limit DMA-able memory way below 4G.
+If a system has more physical memory than this limit, the swiotlb
+buffer is not addressable because it is allocated from memblock using
+top-down mode.
+
+Force memblock to bottom-up mode before calling swiotlb_init() to
+ensure that the swiotlb buffer is DMA-able.
+
+Reported-by: Christian Zigotzky <chzigotzky@xenosoft.de>
+Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191204123524.22919-1-rppt@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/mm/mem.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c
+index 1efe5ca5c3bc..5bb2c89d55c8 100644
+--- a/arch/powerpc/mm/mem.c
++++ b/arch/powerpc/mm/mem.c
+@@ -330,6 +330,14 @@ void __init mem_init(void)
+ BUILD_BUG_ON(MMU_PAGE_COUNT > 16);
+
+ #ifdef CONFIG_SWIOTLB
++ /*
++ * Some platforms (e.g. 85xx) limit DMA-able memory way below
++ * 4G. We force memblock to bottom-up mode to ensure that the
++ * memory allocated in swiotlb_init() is DMA-able.
++ * As it's the last memblock allocation, no need to reset it
++ * back to to-down.
++ */
++ memblock_set_bottom_up(true);
+ swiotlb_init(0);
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 6fd9484eb5df78b8521f2f389fda02d89e938f6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 23:16:00 +0100
+Subject: regulator: rn5t618: fix module aliases
+
+From: Andreas Kemnade <andreas@kemnade.info>
+
+[ Upstream commit 62a1923cc8fe095912e6213ed5de27abbf1de77e ]
+
+platform device aliases were missing, preventing
+autoloading of module.
+
+Fixes: 811b700630ff ("regulator: rn5t618: add driver for Ricoh RN5T618 regulators")
+Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
+Link: https://lore.kernel.org/r/20191211221600.29438-1-andreas@kemnade.info
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/rn5t618-regulator.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c
+index b85ceb8ff911..eccdddcf5315 100644
+--- a/drivers/regulator/rn5t618-regulator.c
++++ b/drivers/regulator/rn5t618-regulator.c
+@@ -95,6 +95,7 @@ static struct platform_driver rn5t618_regulator_driver = {
+
+ module_platform_driver(rn5t618_regulator_driver);
+
++MODULE_ALIAS("platform:rn5t618-regulator");
+ MODULE_AUTHOR("Beniamino Galvani <b.galvani@gmail.com>");
+ MODULE_DESCRIPTION("RN5T618 regulator driver");
+ MODULE_LICENSE("GPL v2");
+--
+2.20.1
+
--- /dev/null
+From 76f7cf8163d71e502c9901eee6eb4c45a466a70c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 15 Dec 2019 09:34:08 -0600
+Subject: rfkill: Fix incorrect check to avoid NULL pointer dereference
+
+From: Aditya Pakki <pakki001@umn.edu>
+
+[ Upstream commit 6fc232db9e8cd50b9b83534de9cd91ace711b2d7 ]
+
+In rfkill_register, the struct rfkill pointer is first derefernced
+and then checked for NULL. This patch removes the BUG_ON and returns
+an error to the caller in case rfkill is NULL.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Link: https://lore.kernel.org/r/20191215153409.21696-1-pakki001@umn.edu
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rfkill/core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index cf5b69ab1829..ad927a6ca2a1 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -941,10 +941,13 @@ static void rfkill_sync_work(struct work_struct *work)
+ int __must_check rfkill_register(struct rfkill *rfkill)
+ {
+ static unsigned long rfkill_no;
+- struct device *dev = &rfkill->dev;
++ struct device *dev;
+ int error;
+
+- BUG_ON(!rfkill);
++ if (!rfkill)
++ return -EINVAL;
++
++ dev = &rfkill->dev;
+
+ mutex_lock(&rfkill_global_mutex);
+
+--
+2.20.1
+
s390-smp-fix-physical-to-logical-cpu-map-for-smt.patch
locking-x86-remove-the-unused-atomic_inc_short-methd.patch
pstore-ram-write-new-dumps-to-start-of-recycled-zone.patch
+locking-spinlock-debug-fix-various-data-races.patch
+netfilter-ctnetlink-netns-exit-must-wait-for-callbac.patch
+arm-vexpress-set-up-shared-opp-table-instead-of-indi.patch
+netfilter-uapi-avoid-undefined-left-shift-in-xt_sctp.patch
+arm-dts-am437x-gp-epos-evm-fix-panel-compatible.patch
+powerpc-ensure-that-swiotlb-buffer-is-allocated-from.patch
+bnx2x-do-not-handle-requests-from-vfs-after-parity.patch
+bnx2x-fix-logic-to-get-total-no.-of-pfs-per-engine.patch
+net-usb-lan78xx-fix-error-message-format-specifier.patch
+rfkill-fix-incorrect-check-to-avoid-null-pointer-der.patch
+asoc-wm8962-fix-lambda-value.patch
+regulator-rn5t618-fix-module-aliases.patch
+kconfig-don-t-crash-on-null-expressions-in-expr_eq.patch
+parisc-fix-compiler-warnings-in-debug_core.c.patch
+llc2-fix-return-statement-of-llc_stat_ev_rx_null_dsa.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
