--- /dev/null
+From 59ab91ceddb4327d3a3384598b10694a42d5cce8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 08:34:16 +0300
+Subject: 6lowpan: Off by one handling ->nexthdr
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ]
+
+NEXTHDR_MAX is 255. What happens here is that we take a u8 value
+"hdr->nexthdr" from the network and then look it up in
+lowpan_nexthdr_nhcs[]. The problem is that if hdr->nexthdr is 0xff then
+we read one element beyond the end of the array so the array needs to
+be one element larger.
+
+Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Jukka Rissanen <jukka.rissanen@linux.intel.com>
+Acked-by: Alexander Aring <aring@mojatatu.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/6lowpan/nhc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c
+index 7008d53e455c5..e61679bf09085 100644
+--- a/net/6lowpan/nhc.c
++++ b/net/6lowpan/nhc.c
+@@ -18,7 +18,7 @@
+ #include "nhc.h"
+
+ static struct rb_root rb_root = RB_ROOT;
+-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX];
++static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1];
+ static DEFINE_SPINLOCK(lowpan_nhc_lock);
+
+ static int lowpan_nhc_insert(struct lowpan_nhc *nhc)
+--
+2.20.1
+
--- /dev/null
+From 73e6bc6191711e1173251568325617e7191b6b4e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 22:42:55 +0300
+Subject: ahci: Do not export local variable ahci_em_messages
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 60fc35f327e0a9e60b955c0f3c3ed623608d1baa ]
+
+The commit ed08d40cdec4
+ ("ahci: Changing two module params with static and __read_mostly")
+moved ahci_em_messages to be static while missing the fact of exporting it.
+
+WARNING: "ahci_em_messages" [vmlinux] is a static EXPORT_SYMBOL_GPL
+
+Drop export for the local variable ahci_em_messages.
+
+Fixes: ed08d40cdec4 ("ahci: Changing two module params with static and __read_mostly")
+Cc: Chuansheng Liu <chuansheng.liu@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libahci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 8116cb2fef2da..1241cecfcfcad 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -187,7 +187,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = {
+ EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops);
+
+ static bool ahci_em_messages __read_mostly = true;
+-EXPORT_SYMBOL_GPL(ahci_em_messages);
+ module_param(ahci_em_messages, bool, 0444);
+ /* add other LED protocol types when they become supported */
+ MODULE_PARM_DESC(ahci_em_messages,
+--
+2.20.1
+
--- /dev/null
+From 37e3423e3edf077e6b9ef3e117408d07d7c38ed4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 09:14:22 +0200
+Subject: ALSA: aoa: onyx: always initialize register read value
+
+From: Johannes Berg <johannes@sipsolutions.net>
+
+[ Upstream commit f474808acb3c4b30552d9c59b181244e0300d218 ]
+
+A lot of places in the driver use onyx_read_register() without
+checking the return value, and it's been working OK for ~10 years
+or so, so probably never fails ... Rather than trying to check the
+return value everywhere, which would be relatively intrusive, at
+least make sure we don't use an uninitialized value.
+
+Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/aoa/codecs/onyx.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c
+index a04edff8b729e..ae50d59fb810f 100644
+--- a/sound/aoa/codecs/onyx.c
++++ b/sound/aoa/codecs/onyx.c
+@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value)
+ return 0;
+ }
+ v = i2c_smbus_read_byte_data(onyx->i2c, reg);
+- if (v < 0)
++ if (v < 0) {
++ *value = 0;
+ return -1;
++ }
+ *value = (u8)v;
+ onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value;
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 45810ab423c0f66d6e8c02f5dcd2a3d4f0de17a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Sep 2018 16:18:36 +0200
+Subject: ALSA: hda: fix unused variable warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Anders Roxell <anders.roxell@linaro.org>
+
+[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ]
+
+When CONFIG_X86=n function azx_snoop doesn't use the variable chip it
+only returns true.
+
+sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’:
+sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable]
+ struct azx *chip = bus_to_azx(bus);
+ ^~~~
+
+Create a inline function of azx_snoop.
+
+Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object")
+Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/hda_controller.h | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index 55ec4470f6b69..499873d29cc18 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -164,11 +164,10 @@ struct azx {
+ #define azx_bus(chip) (&(chip)->bus.core)
+ #define bus_to_azx(_bus) container_of(_bus, struct azx, bus.core)
+
+-#ifdef CONFIG_X86
+-#define azx_snoop(chip) ((chip)->snoop)
+-#else
+-#define azx_snoop(chip) true
+-#endif
++static inline bool azx_snoop(struct azx *chip)
++{
++ return !IS_ENABLED(CONFIG_X86) || chip->snoop;
++}
+
+ /*
+ * macros for easy use
+--
+2.20.1
+
--- /dev/null
+From 9fc88a2086527b97474d70d3f1e464a3916aa172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 13:00:03 +0200
+Subject: ALSA: usb-audio: Handle the error from
+ snd_usb_mixer_apply_create_quirk()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ]
+
+The error from snd_usb_mixer_apply_create_quirk() is ignored in the
+current usb-audio driver code, which will continue the probing even
+after the error. Let's take it more serious.
+
+Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 1b81f18010d25..73149b9be29c9 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2552,7 +2552,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ (err = snd_usb_mixer_status_create(mixer)) < 0)
+ goto _error;
+
+- snd_usb_mixer_apply_create_quirk(mixer);
++ err = snd_usb_mixer_apply_create_quirk(mixer);
++ if (err < 0)
++ goto _error;
+
+ err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ if (err < 0)
+--
+2.20.1
+
--- /dev/null
+From bfc5358d6b9c882b499cae1cf5b35d1d9d35df8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Oct 2018 16:42:05 +0200
+Subject: ALSA: usb-audio: update quirk for B&W PX to remove microphone
+
+From: Nicolas Huaman <nicolas@herochao.de>
+
+[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ]
+
+A quirk in snd-usb-audio was added to automate setting sample rate to
+4800k and remove the previously exposed nonfunctional microphone for
+the Bowers & Wilkins PX:
+commit 240a8af929c7c57dcde28682725b29cf8474e8e5
+https://lore.kernel.org/patchwork/patch/919689/
+
+However the headphones where updated shortly after that to remove the
+unintentional microphone functionality. I guess because of this the
+headphones now crash when connecting them via USB while the quirk is
+active. Dmesg:
+
+snd-usb-audio: probe of 2-3:1.0 failed with error -22
+usb 2-3: 2:1: cannot get min/max values for control 2 (id 2)
+
+This patch removes the microfone and allows the headphones to connect
+and work out of the box. It is based on the current mainline kernel
+ and successfully applied an tested on my machine (4.18.10.arch1-1).
+
+Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
+Signed-off-by: Nicolas Huaman <nicolas@herochao.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/quirks-table.h | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index d32727c74a168..c892b4d1e733f 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3293,19 +3293,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ .ifnum = 0,
+ .type = QUIRK_AUDIO_STANDARD_MIXER,
+ },
+- /* Capture */
+- {
+- .ifnum = 1,
+- .type = QUIRK_IGNORE_INTERFACE,
+- },
+ /* Playback */
+ {
+- .ifnum = 2,
++ .ifnum = 1,
+ .type = QUIRK_AUDIO_FIXED_ENDPOINT,
+ .data = &(const struct audioformat) {
+ .formats = SNDRV_PCM_FMTBIT_S16_LE,
+ .channels = 2,
+- .iface = 2,
++ .iface = 1,
+ .altsetting = 1,
+ .altset_idx = 1,
+ .attributes = UAC_EP_CS_ATTR_FILL_MAX |
+--
+2.20.1
+
--- /dev/null
+From 8d78e6ee378dd8ba353767faea5bf5b88fcad2eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 09:31:41 +0100
+Subject: ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ]
+
+MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to
+perform low-level platform initialization. This results in a try to install
+HYP stubs for the second time for each CPU and results in false HYP/SVC
+mode mismatch detection. The HYP stubs are already installed at the
+beginning of the kernel initialization on the boot CPU (head.S) or in the
+secondary_startup() for other CPUs. To fix this issue MCPM code should use
+a cpu_resume() routine without HYP stubs installation.
+
+This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid
+XU3/XU4/HC1 boards.
+
+Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Tested-by: Anand Moon <linux.amoon@gmail.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/common/mcpm_entry.c | 2 +-
+ arch/arm/include/asm/suspend.h | 1 +
+ arch/arm/kernel/sleep.S | 12 ++++++++++++
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c
+index a923524d10407..8617323eb2735 100644
+--- a/arch/arm/common/mcpm_entry.c
++++ b/arch/arm/common/mcpm_entry.c
+@@ -379,7 +379,7 @@ static int __init nocache_trampoline(unsigned long _arg)
+ unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1);
+ phys_reset_t phys_reset;
+
+- mcpm_set_entry_vector(cpu, cluster, cpu_resume);
++ mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp);
+ setup_mm_for_reboot();
+
+ __mcpm_cpu_going_down(cpu, cluster);
+diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h
+index 6c7182f32cefe..e6c2f426f8c86 100644
+--- a/arch/arm/include/asm/suspend.h
++++ b/arch/arm/include/asm/suspend.h
+@@ -7,6 +7,7 @@ struct sleep_save_sp {
+ };
+
+ extern void cpu_resume(void);
++extern void cpu_resume_no_hyp(void);
+ extern void cpu_resume_arm(void);
+ extern int cpu_suspend(unsigned long, int (*)(unsigned long));
+
+diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S
+index 0f6c1000582c3..c8569390e7e7e 100644
+--- a/arch/arm/kernel/sleep.S
++++ b/arch/arm/kernel/sleep.S
+@@ -119,6 +119,14 @@ ENDPROC(cpu_resume_after_mmu)
+ .text
+ .align
+
++#ifdef CONFIG_MCPM
++ .arm
++THUMB( .thumb )
++ENTRY(cpu_resume_no_hyp)
++ARM_BE8(setend be) @ ensure we are in BE mode
++ b no_hyp
++#endif
++
+ #ifdef CONFIG_MMU
+ .arm
+ ENTRY(cpu_resume_arm)
+@@ -134,6 +142,7 @@ ARM_BE8(setend be) @ ensure we are in BE mode
+ bl __hyp_stub_install_secondary
+ #endif
+ safe_svcmode_maskall r1
++no_hyp:
+ mov r1, #0
+ ALT_SMP(mrc p15, 0, r0, c0, c0, 5)
+ ALT_UP_B(1f)
+@@ -162,6 +171,9 @@ ENDPROC(cpu_resume)
+
+ #ifdef CONFIG_MMU
+ ENDPROC(cpu_resume_arm)
++#endif
++#ifdef CONFIG_MCPM
++ENDPROC(cpu_resume_no_hyp)
+ #endif
+
+ .align 2
+--
+2.20.1
+
--- /dev/null
+From 4fcbbc4b5e4b98a7890b76c5ce46a62f39f2f11f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Mar 2019 11:00:21 -0700
+Subject: ARM: OMAP2+: Fix potentially uninitialized return value for
+ _setup_reset()
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ]
+
+Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made
+the call to _enable() conditional based on no oh->rst_lines_cnt. This
+caused the return value to be potentially uninitialized. Curiously we see
+no compiler warnings for this, probably as this gets inlined.
+
+We call _setup_reset() from _setup() and only _setup_postsetup() if the
+return value is zero. Currently the return value can be uninitialized for
+cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set.
+
+Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
+Cc: Paul Walmsley <paul@pwsan.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap_hwmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
+index 36706d32d656d..1bc87c29467b3 100644
+--- a/arch/arm/mach-omap2/omap_hwmod.c
++++ b/arch/arm/mach-omap2/omap_hwmod.c
+@@ -2563,7 +2563,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh)
+ */
+ static int _setup_reset(struct omap_hwmod *oh)
+ {
+- int r;
++ int r = 0;
+
+ if (oh->_state != _HWMOD_STATE_INITIALIZED)
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From e77092300357a4b8887f7b874dcd2a1aa66782f2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Jan 2019 16:03:24 +0800
+Subject: ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data"
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ]
+
+Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+kfree, iounmap, clk_put etc are not needed anymore in remove path.
+
+Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+[ commit message spelling fix ]
+Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/plat-pxa/ssp.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c
+index 6748827c2ec8b..b6b0979e3cf94 100644
+--- a/arch/arm/plat-pxa/ssp.c
++++ b/arch/arm/plat-pxa/ssp.c
+@@ -231,18 +231,12 @@ static int pxa_ssp_probe(struct platform_device *pdev)
+
+ static int pxa_ssp_remove(struct platform_device *pdev)
+ {
+- struct resource *res;
+ struct ssp_device *ssp;
+
+ ssp = platform_get_drvdata(pdev);
+ if (ssp == NULL)
+ return -ENODEV;
+
+- res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+- release_mem_region(res->start, resource_size(res));
+-
+- clk_put(ssp->clk);
+-
+ mutex_lock(&ssp_lock);
+ list_del(&ssp->node);
+ mutex_unlock(&ssp_lock);
+--
+2.20.1
+
--- /dev/null
+From c0c7d0d058095f5db3f68c11032500a32b7c9751 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Apr 2019 22:43:49 +0100
+Subject: ARM: riscpc: fix lack of keyboard interrupts after irq conversion
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ]
+
+Fix lack of keyboard interrupts for RiscPC due to incorrect conversion.
+
+Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-rpc/irq.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c
+index 66502e6207fea..fce7fecbd8fa4 100644
+--- a/arch/arm/mach-rpc/irq.c
++++ b/arch/arm/mach-rpc/irq.c
+@@ -117,7 +117,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end;
+
+ void __init rpc_init_irq(void)
+ {
+- unsigned int irq, clr, set = 0;
++ unsigned int irq, clr, set;
+
+ iomd_writeb(0, IOMD_IRQMASKA);
+ iomd_writeb(0, IOMD_IRQMASKB);
+@@ -129,6 +129,7 @@ void __init rpc_init_irq(void)
+
+ for (irq = 0; irq < NR_IRQS; irq++) {
+ clr = IRQ_NOREQUEST;
++ set = 0;
+
+ if (irq <= 6 || (irq >= 9 && irq <= 15))
+ clr |= IRQ_NOPROBE;
+--
+2.20.1
+
--- /dev/null
+From 9a0019b67de694613c0318f0d0301104924b4516 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 12:03:31 +0000
+Subject: arm64: dts: juno: Fix UART frequency
+
+From: Andre Przywara <andre.przywara@arm.com>
+
+[ Upstream commit 39a1a8941b27c37f79508426e27a2ec29829d66c ]
+
+Older versions of the Juno *SoC* TRM [1] recommended that the UART clock
+source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more
+correct value of 7.3728 MHz. Somehow the wrong value managed to end up in
+our DT.
+
+Doing a prime factorisation, a modulo divide by 115200 and trying
+to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest
+that the old value was actually a typo. The actual UART clock is driven
+by a PLL, configured via a parameter in some board.txt file in the
+firmware, which reads 7.37 MHz (sic!).
+
+Fix this to correct the baud rate divisor calculation on the Juno board.
+
+[1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf
+[2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf
+
+Fixes: 71f867ec130e ("arm64: Add Juno board device tree.")
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Acked-by: Liviu Dudau <liviu.dudau@arm.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/arm/juno-clocks.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+index 25352ed943e6e..00bcbf7688c77 100644
+--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi
++++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi
+@@ -8,10 +8,10 @@
+ */
+
+ /* SoC fixed clocks */
+- soc_uartclk: refclk7273800hz {
++ soc_uartclk: refclk7372800hz {
+ compatible = "fixed-clock";
+ #clock-cells = <0>;
+- clock-frequency = <7273800>;
++ clock-frequency = <7372800>;
+ clock-output-names = "juno:uartclk";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 50811d49bb4c71e5b1e6365a3c932e5cb33a3e00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:01:57 +0800
+Subject: ASoC: cs4349: Use PM ops 'cs4349_runtime_pm'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 9b4275c415acca6264a3d7f1182589959c93d530 ]
+
+sound/soc/codecs/cs4349.c:358:32: warning:
+ cs4349_runtime_pm defined but not used [-Wunused-const-variable=]
+
+cs4349_runtime_pm ops already defined, it seems
+we should enable it.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: e40da86 ("ASoC: cs4349: Add support for Cirrus Logic CS4349")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815090157.70036-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/cs4349.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c
+index 0ac8fc5ed4ae4..9ebd500ecf38d 100644
+--- a/sound/soc/codecs/cs4349.c
++++ b/sound/soc/codecs/cs4349.c
+@@ -379,6 +379,7 @@ static struct i2c_driver cs4349_i2c_driver = {
+ .driver = {
+ .name = "cs4349",
+ .of_match_table = cs4349_of_match,
++ .pm = &cs4349_runtime_pm,
+ },
+ .id_table = cs4349_i2c_id,
+ .probe = cs4349_i2c_probe,
+--
+2.20.1
+
--- /dev/null
+From 4f543ab60b591a0b7b03aa22a76ffdd7dc2cd8a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:23:00 +0800
+Subject: ASoC: es8328: Fix copy-paste error in es8328_right_line_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 630742c296341a8cfe00dfd941392025ba8dd4e8 ]
+
+It seems 'es8328_rline_enum' should be used
+in es8328_right_line_controls
+
+Fixes: 567e4f98922c ("ASoC: add es8328 codec driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Link: https://lore.kernel.org/r/20190815092300.68712-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/es8328.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index afa6c5db9dccc..2bf30d0eb82f3 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -210,7 +210,7 @@ static const struct soc_enum es8328_rline_enum =
+ ARRAY_SIZE(es8328_line_texts),
+ es8328_line_texts);
+ static const struct snd_kcontrol_new es8328_right_line_controls =
+- SOC_DAPM_ENUM("Route", es8328_lline_enum);
++ SOC_DAPM_ENUM("Route", es8328_rline_enum);
+
+ /* Left Mixer */
+ static const struct snd_kcontrol_new es8328_left_mixer_controls[] = {
+--
+2.20.1
+
--- /dev/null
+From 2a16927f29d316d49ab0c64b71e247a957a227ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:47:49 +0200
+Subject: ASoC: fix valid stream condition
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ]
+
+A stream may specify a rate range using 'rate_min' and 'rate_max', so a
+stream may be valid and not specify any rates. However, as stream cannot
+be valid and not have any channel. Let's use this condition instead to
+determine if a stream is valid or not.
+
+Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 78813057167d7..dbdea1975f90c 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -48,8 +48,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ else
+ codec_stream = &dai->driver->capture;
+
+- /* If the codec specifies any rate at all, it supports the stream. */
+- return codec_stream->rates;
++ /* If the codec specifies any channels at all, it supports the stream */
++ return codec_stream->channels_min;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 978eb21f88849193491b75c30963dccdb867a116 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 18 Jan 2019 10:06:52 +0100
+Subject: ASoC: imx-sgtl5000: put of nodes if finding codec fails
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ]
+
+Make sure to properly put the of node in case finding the codec
+fails.
+
+Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000")
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/fsl/imx-sgtl5000.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
+index 8e525f7ac08d1..3d99a8579c99f 100644
+--- a/sound/soc/fsl/imx-sgtl5000.c
++++ b/sound/soc/fsl/imx-sgtl5000.c
+@@ -119,7 +119,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
+ codec_dev = of_find_i2c_device_by_node(codec_np);
+ if (!codec_dev) {
+ dev_err(&pdev->dev, "failed to find codec platform device\n");
+- return -EPROBE_DEFER;
++ ret = -EPROBE_DEFER;
++ goto fail;
+ }
+
+ data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
+--
+2.20.1
+
--- /dev/null
+From 35304e9df8c68f46427e2f3a81ecb0ba74cf8015 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Feb 2019 16:46:50 +0100
+Subject: ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of()
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ]
+
+The apq8016 driver leaves the of-node refcount at aborting from the
+loop of for_each_child_of_node() in the error path. Not only the
+iterator node of for_each_child_of_node(), the children nodes referred
+from it for codec and cpu have to be properly unreferenced.
+
+Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support")
+Cc: Patrick Lai <plai@codeaurora.org>
+Cc: Banajit Goswami <bgoswami@codeaurora.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++-----
+ 1 file changed, 16 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c
+index 1efdf0088ecdf..886f2027e6712 100644
+--- a/sound/soc/qcom/apq8016_sbc.c
++++ b/sound/soc/qcom/apq8016_sbc.c
+@@ -98,13 +98,15 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+
+ if (!cpu || !codec) {
+ dev_err(dev, "Can't find cpu/codec DT node\n");
+- return ERR_PTR(-EINVAL);
++ ret = -EINVAL;
++ goto error;
+ }
+
+ link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0);
+ if (!link->cpu_of_node) {
+ dev_err(card->dev, "error getting cpu phandle\n");
+- return ERR_PTR(-EINVAL);
++ ret = -EINVAL;
++ goto error;
+ }
+
+ link->codec_of_node = of_parse_phandle(codec, "sound-dai", 0);
+@@ -116,13 +118,13 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+ ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name);
+ if (ret) {
+ dev_err(card->dev, "error getting cpu dai name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ ret = snd_soc_of_get_dai_name(codec, &link->codec_dai_name);
+ if (ret) {
+ dev_err(card->dev, "error getting codec dai name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ link->platform_of_node = link->cpu_of_node;
+@@ -132,15 +134,24 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card)
+ ret = of_property_read_string(np, "link-name", &link->name);
+ if (ret) {
+ dev_err(card->dev, "error getting codec dai_link name\n");
+- return ERR_PTR(ret);
++ goto error;
+ }
+
+ link->stream_name = link->name;
+ link->init = apq8016_sbc_dai_init;
+ link++;
++
++ of_node_put(cpu);
++ of_node_put(codec);
+ }
+
+ return data;
++
++ error:
++ of_node_put(np);
++ of_node_put(cpu);
++ of_node_put(codec);
++ return ERR_PTR(ret);
+ }
+
+ static int apq8016_sbc_platform_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 8a4e51c8db06a3ce2df004d85cd07b966e39eb3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Jun 2019 12:20:02 +0300
+Subject: ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple
+ AXRs
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit fd14f4436fd47d5418023c90e933e66d3645552e ]
+
+If multiple serializers are connected in the system and the number of
+channels will need to use more than one serializer the mask to enable the
+serializers were left to 0 if tdm_mask is provided
+
+Fixes: dd55ff8346a97 ("ASoC: davinci-mcasp: Add set_tdm_slots() support")
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/davinci/davinci-mcasp.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c
+index 2f7be6cee98e9..fc0a73227b023 100644
+--- a/sound/soc/davinci/davinci-mcasp.c
++++ b/sound/soc/davinci/davinci-mcasp.c
+@@ -875,14 +875,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream,
+ active_slots = hweight32(mcasp->tdm_mask[stream]);
+ active_serializers = (channels + active_slots - 1) /
+ active_slots;
+- if (active_serializers == 1) {
++ if (active_serializers == 1)
+ active_slots = channels;
+- for (i = 0; i < total_slots; i++) {
+- if ((1 << i) & mcasp->tdm_mask[stream]) {
+- mask |= (1 << i);
+- if (--active_slots <= 0)
+- break;
+- }
++ for (i = 0; i < total_slots; i++) {
++ if ((1 << i) & mcasp->tdm_mask[stream]) {
++ mask |= (1 << i);
++ if (--active_slots <= 0)
++ break;
+ }
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From 9d67c24445839d7e80cb27d454fa3d260103370f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 17:19:20 +0800
+Subject: ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 554b75bde64bcad9662530726d1483f7ef012069 ]
+
+sound/soc/codecs/wm8737.c:112:29: warning:
+ high_3d defined but not used [-Wunused-const-variable=]
+
+'high_3d' should be used for 3D High Cut-off.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 2a9ae13a2641 ("ASoC: Add initial WM8737 driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190815091920.64480-1-yuehaibing@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8737.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
+index e7807601e675c..ae69cb790ac38 100644
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0),
+ SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0),
+ SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0),
+ SOC_ENUM("3D Low Cut-off", low_3d),
+-SOC_ENUM("3D High Cut-off", low_3d),
++SOC_ENUM("3D High Cut-off", high_3d),
+ SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv),
+
+ SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0),
+--
+2.20.1
+
--- /dev/null
+From 96f83cda148b2a747d95b60a9cfd41575c9723c2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Aug 2019 09:41:39 +0200
+Subject: ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit e1aa1a1db3b01c9890e82cf065cee99962ba1ed9 ]
+
+Fix following lockdep warning disabling bh in
+ath_dynack_node_init/ath_dynack_node_deinit
+
+[ 75.955878] --------------------------------
+[ 75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
+[ 75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes:
+[ 75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.955905] {SOFTIRQ-ON-W} state was registered at:
+[ 75.955912] lock_acquire+0x9a/0x160
+[ 75.955917] _raw_spin_lock+0x2c/0x70
+[ 75.955927] ath_dynack_node_init+0x2a/0x60 [ath9k_hw]
+[ 75.955934] ath9k_sta_state+0xec/0x160 [ath9k]
+[ 75.955976] drv_sta_state+0xb2/0x740 [mac80211]
+[ 75.956008] sta_info_insert_finish+0x21a/0x420 [mac80211]
+[ 75.956039] sta_info_insert_rcu+0x12b/0x2c0 [mac80211]
+[ 75.956069] sta_info_insert+0x7/0x70 [mac80211]
+[ 75.956093] ieee80211_prep_connection+0x42e/0x730 [mac80211]
+[ 75.956120] ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211]
+[ 75.956152] cfg80211_mlme_auth+0x143/0x350 [cfg80211]
+[ 75.956169] nl80211_authenticate+0x25e/0x2b0 [cfg80211]
+[ 75.956172] genl_family_rcv_msg+0x198/0x400
+[ 75.956174] genl_rcv_msg+0x42/0x90
+[ 75.956176] netlink_rcv_skb+0x35/0xf0
+[ 75.956178] genl_rcv+0x1f/0x30
+[ 75.956180] netlink_unicast+0x154/0x200
+[ 75.956182] netlink_sendmsg+0x1bf/0x3d0
+[ 75.956186] ___sys_sendmsg+0x2c2/0x2f0
+[ 75.956187] __sys_sendmsg+0x44/0x80
+[ 75.956190] do_syscall_64+0x55/0x1a0
+[ 75.956192] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 75.956194] irq event stamp: 2357092
+[ 75.956196] hardirqs last enabled at (2357092): [<ffffffff818c62de>] _raw_spin_unlock_irqrestore+0x3e/0x50
+[ 75.956199] hardirqs last disabled at (2357091): [<ffffffff818c60b1>] _raw_spin_lock_irqsave+0x11/0x80
+[ 75.956202] softirqs last enabled at (2357072): [<ffffffff8106dc09>] irq_enter+0x59/0x60
+[ 75.956204] softirqs last disabled at (2357073): [<ffffffff8106dcbe>] irq_exit+0xae/0xc0
+[ 75.956206]
+ other info that might help us debug this:
+[ 75.956207] Possible unsafe locking scenario:
+
+[ 75.956208] CPU0
+[ 75.956209] ----
+[ 75.956210] lock(&(&da->qlock)->rlock);
+[ 75.956213] <Interrupt>
+[ 75.956214] lock(&(&da->qlock)->rlock);
+[ 75.956216]
+ *** DEADLOCK ***
+
+[ 75.956217] 1 lock held by swapper/0/0:
+[ 75.956219] #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k]
+[ 75.956225]
+ stack backtrace:
+[ 75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13
+[ 75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009
+[ 75.956231] Call Trace:
+[ 75.956233] <IRQ>
+[ 75.956236] dump_stack+0x67/0x90
+[ 75.956239] mark_lock+0x4c1/0x640
+[ 75.956242] ? check_usage_backwards+0x130/0x130
+[ 75.956245] ? sched_clock_local+0x12/0x80
+[ 75.956247] __lock_acquire+0x484/0x7a0
+[ 75.956250] ? __lock_acquire+0x3b9/0x7a0
+[ 75.956252] lock_acquire+0x9a/0x160
+[ 75.956259] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.956262] _raw_spin_lock_bh+0x34/0x80
+[ 75.956268] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.956275] ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw]
+[ 75.956280] ath_rx_tasklet+0xd09/0xe90 [ath9k]
+[ 75.956286] ath9k_tasklet+0x102/0x240 [ath9k]
+[ 75.956288] tasklet_action_common.isra.0+0x6d/0x170
+[ 75.956291] __do_softirq+0xcc/0x425
+[ 75.956294] irq_exit+0xae/0xc0
+[ 75.956296] do_IRQ+0x8a/0x110
+[ 75.956298] common_interrupt+0xf/0xf
+[ 75.956300] </IRQ>
+[ 75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400
+[ 75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7
+[ 75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000
+[ 75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800
+[ 75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000
+[ 75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002
+[ 75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800
+[ 75.956321] cpuidle_enter+0x24/0x40
+[ 75.956323] do_idle+0x1ac/0x220
+[ 75.956326] cpu_startup_entry+0x14/0x20
+[ 75.956329] start_kernel+0x482/0x489
+[ 75.956332] secondary_startup_64+0xa4/0xb0
+
+Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-by: Koen Vandeputte <koen.vandeputte@ncentric.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath9k/dynack.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c
+index 22b3cc4c27cda..58205a5bd74b5 100644
+--- a/drivers/net/wireless/ath/ath9k/dynack.c
++++ b/drivers/net/wireless/ath/ath9k/dynack.c
+@@ -285,9 +285,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an)
+
+ an->ackto = ackto;
+
+- spin_lock(&da->qlock);
++ spin_lock_bh(&da->qlock);
+ list_add_tail(&an->list, &da->nodes);
+- spin_unlock(&da->qlock);
++ spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_init);
+
+@@ -301,9 +301,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an)
+ {
+ struct ath_dynack *da = &ah->dynack;
+
+- spin_lock(&da->qlock);
++ spin_lock_bh(&da->qlock);
+ list_del(&an->list);
+- spin_unlock(&da->qlock);
++ spin_unlock_bh(&da->qlock);
+ }
+ EXPORT_SYMBOL(ath_dynack_node_deinit);
+
+--
+2.20.1
+
--- /dev/null
+From d3ddd3b6a4b628a0c7b432d49297c1fc59f454c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:25:03 -0400
+Subject: backlight: lm3630a: Return 0 on success in update_status functions
+
+From: Brian Masney <masneyb@onstation.org>
+
+[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ]
+
+lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
+both return the brightness value if the brightness was successfully
+updated. Writing to these attributes via sysfs would cause a 'Bad
+address' error to be returned. These functions should return 0 on
+success, so let's change it to correct that error.
+
+Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/backlight/lm3630a_bl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 35fe4825a4546..5ef6f9d420a23 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -200,7 +200,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access\n");
+@@ -277,7 +277,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+--
+2.20.1
+
--- /dev/null
+From d1979a7f1a409381b7b5d6a383cf72838475aa55 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 27 Aug 2019 09:16:20 +0100
+Subject: bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 420c20be08a4597404d272ae9793b642401146eb ]
+
+An earlier commit re-worked the setting of the bitmask and is now
+assigning v with some bit flags rather than bitwise or-ing them
+into v, consequently the earlier bit-settings of v are being lost.
+Fix this by replacing an assignment with the bitwise or instead.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 2be25cac8402 ("bcma: add constants for PCI and use them")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/bcma/driver_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
+index f499a469e66d0..12b2cc9a3fbe8 100644
+--- a/drivers/bcma/driver_pci.c
++++ b/drivers/bcma/driver_pci.c
+@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address)
+ v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ }
+
+- v = BCMA_CORE_PCI_MDIODATA_START;
++ v |= BCMA_CORE_PCI_MDIODATA_START;
+ v |= BCMA_CORE_PCI_MDIODATA_READ;
+ v |= BCMA_CORE_PCI_MDIODATA_TA;
+
+@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device,
+ v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD);
+ }
+
+- v = BCMA_CORE_PCI_MDIODATA_START;
++ v |= BCMA_CORE_PCI_MDIODATA_START;
+ v |= BCMA_CORE_PCI_MDIODATA_WRITE;
+ v |= BCMA_CORE_PCI_MDIODATA_TA;
+ v |= data;
+--
+2.20.1
+
--- /dev/null
+From 417f8208f399bbb725935385f96c284ffa4b3b17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 19:13:08 +0800
+Subject: block: don't use bio->bi_vcnt to figure out segment number
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ]
+
+It is wrong to use bio->bi_vcnt to figure out how many segments
+there are in the bio even though CLONED flag isn't set on this bio,
+because this bio may be splitted or advanced.
+
+So always use bio_segments() in blk_recount_segments(), and it shouldn't
+cause any performance loss now because the physical segment number is figured
+out in blk_queue_split() and BIO_SEG_VALID is set meantime since
+bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting").
+
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments")
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-merge.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/block/blk-merge.c b/block/blk-merge.c
+index 7225511cf0b48..b8f1eaeeaac25 100644
+--- a/block/blk-merge.c
++++ b/block/blk-merge.c
+@@ -296,13 +296,7 @@ void blk_recalc_rq_segments(struct request *rq)
+
+ void blk_recount_segments(struct request_queue *q, struct bio *bio)
+ {
+- unsigned short seg_cnt;
+-
+- /* estimate segment number by bi_vcnt for non-cloned bio */
+- if (bio_flagged(bio, BIO_CLONED))
+- seg_cnt = bio_segments(bio);
+- else
+- seg_cnt = bio->bi_vcnt;
++ unsigned short seg_cnt = bio_segments(bio);
+
+ if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) &&
+ (seg_cnt < queue_max_segments(q)))
+--
+2.20.1
+
--- /dev/null
+From f87323300b9f4243b170cb14dde0763529b5cac3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Jul 2019 16:24:09 +0100
+Subject: Btrfs: fix hang when loading existing inode cache off disk
+
+From: Filipe Manana <fdmanana@suse.com>
+
+[ Upstream commit 7764d56baa844d7f6206394f21a0e8c1f303c476 ]
+
+If we are able to load an existing inode cache off disk, we set the state
+of the cache to BTRFS_CACHE_FINISHED, but we don't wake up any one waiting
+for the cache to be available. This means that anyone waiting for the
+cache to be available, waiting on the condition that either its state is
+BTRFS_CACHE_FINISHED or its available free space is greather than zero,
+can hang forever.
+
+This could be observed running fstests with MOUNT_OPTIONS="-o inode_cache",
+in particular test case generic/161 triggered it very frequently for me,
+producing a trace like the following:
+
+ [63795.739712] BTRFS info (device sdc): enabling inode map caching
+ [63795.739714] BTRFS info (device sdc): disk space caching is enabled
+ [63795.739716] BTRFS info (device sdc): has skinny extents
+ [64036.653886] INFO: task btrfs-transacti:3917 blocked for more than 120 seconds.
+ [64036.654079] Not tainted 5.2.0-rc4-btrfs-next-50 #1
+ [64036.654143] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [64036.654232] btrfs-transacti D 0 3917 2 0x80004000
+ [64036.654239] Call Trace:
+ [64036.654258] ? __schedule+0x3ae/0x7b0
+ [64036.654271] schedule+0x3a/0xb0
+ [64036.654325] btrfs_commit_transaction+0x978/0xae0 [btrfs]
+ [64036.654339] ? remove_wait_queue+0x60/0x60
+ [64036.654395] transaction_kthread+0x146/0x180 [btrfs]
+ [64036.654450] ? btrfs_cleanup_transaction+0x620/0x620 [btrfs]
+ [64036.654456] kthread+0x103/0x140
+ [64036.654464] ? kthread_create_worker_on_cpu+0x70/0x70
+ [64036.654476] ret_from_fork+0x3a/0x50
+ [64036.654504] INFO: task xfs_io:3919 blocked for more than 120 seconds.
+ [64036.654568] Not tainted 5.2.0-rc4-btrfs-next-50 #1
+ [64036.654617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [64036.654685] xfs_io D 0 3919 3633 0x00000000
+ [64036.654691] Call Trace:
+ [64036.654703] ? __schedule+0x3ae/0x7b0
+ [64036.654716] schedule+0x3a/0xb0
+ [64036.654756] btrfs_find_free_ino+0xa9/0x120 [btrfs]
+ [64036.654764] ? remove_wait_queue+0x60/0x60
+ [64036.654809] btrfs_create+0x72/0x1f0 [btrfs]
+ [64036.654822] lookup_open+0x6bc/0x790
+ [64036.654849] path_openat+0x3bc/0xc00
+ [64036.654854] ? __lock_acquire+0x331/0x1cb0
+ [64036.654869] do_filp_open+0x99/0x110
+ [64036.654884] ? __alloc_fd+0xee/0x200
+ [64036.654895] ? do_raw_spin_unlock+0x49/0xc0
+ [64036.654909] ? do_sys_open+0x132/0x220
+ [64036.654913] do_sys_open+0x132/0x220
+ [64036.654926] do_syscall_64+0x60/0x1d0
+ [64036.654933] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fix this by adding a wake_up() call right after setting the cache state to
+BTRFS_CACHE_FINISHED, at start_caching(), when we are able to load the
+cache from disk.
+
+Fixes: 82d5902d9c681b ("Btrfs: Support reading/writing on disk free ino cache")
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/inode-map.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index 07573dc1614ab..3469c7ce7cb6d 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -158,6 +158,7 @@ static void start_caching(struct btrfs_root *root)
+ spin_lock(&root->ino_cache_lock);
+ root->ino_cache_state = BTRFS_CACHE_FINISHED;
+ spin_unlock(&root->ino_cache_lock);
++ wake_up(&root->ino_cache_wait);
+ return;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1956e01dbbe2b44a6c2d5981eb49578aa4a0fdc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 22:34:51 +0800
+Subject: cdc-wdm: pass return value of recover_from_urb_loss
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ]
+
+'rv' is the correct return value, pass it upstream instead of 0
+
+Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/class/cdc-wdm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 71ad04d542128..1a1d1cfc3704c 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -1098,7 +1098,7 @@ static int wdm_post_reset(struct usb_interface *intf)
+ rv = recover_from_urb_loss(desc);
+ mutex_unlock(&desc->wlock);
+ mutex_unlock(&desc->rlock);
+- return 0;
++ return rv;
+ }
+
+ static struct usb_driver wdm_driver = {
+--
+2.20.1
+
--- /dev/null
+From bbeebf9798261937a4622d5bf544ef963a845097 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Jul 2019 22:14:29 -0500
+Subject: cifs: fix rmmod regression in cifs.ko caused by force_sig changes
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 ]
+
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+
+The global change from force_sig caused module unloading of cifs.ko
+to fail (since the cifsd process could not be killed, "rmmod cifs"
+now would always fail)
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+CC: Eric W. Biederman <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index b608ce741444f..f44281a5eb9ff 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -939,6 +939,7 @@ cifs_demultiplex_thread(void *p)
+ mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+
+ set_freezable();
++ allow_signal(SIGKILL);
+ while (server->tcpStatus != CifsExiting) {
+ if (try_to_freeze())
+ continue;
+--
+2.20.1
+
--- /dev/null
+From 70b3ea6bb9b2dc227c422e04044f724e0ce276ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:36:58 -0500
+Subject: clk: armada-370: fix refcount leak in a370_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-370.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c
+index 2c7c1085f8830..8fdfa97900cd8 100644
+--- a/drivers/clk/mvebu/armada-370.c
++++ b/drivers/clk/mvebu/armada-370.c
+@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &a370_coreclks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, a370_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init);
+
+--
+2.20.1
+
--- /dev/null
+From 676a41ff2976f219f74b741d0f0dea1d89bf13d7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:42:26 -0500
+Subject: clk: armada-xp: fix refcount leak in axp_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/armada-xp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c
+index b3094315a3c0f..2fa15a2747190 100644
+--- a/drivers/clk/mvebu/armada-xp.c
++++ b/drivers/clk/mvebu/armada-xp.c
+@@ -202,7 +202,9 @@ static void __init axp_clk_init(struct device_node *np)
+
+ mvebu_coreclk_setup(np, &axp_coreclks);
+
+- if (cgnp)
++ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, axp_gating_desc);
++ of_node_put(cgnp);
++ }
+ }
+ CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init);
+--
+2.20.1
+
--- /dev/null
+From a4ea30f30a088c05801b70bf0a147b7bd09844ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:10:01 -0500
+Subject: clk: highbank: fix refcount leak in hb_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-highbank.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c
+index be3a21abb185a..4105066b428ca 100644
+--- a/drivers/clk/clk-highbank.c
++++ b/drivers/clk/clk-highbank.c
+@@ -294,6 +294,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk
+ /* Map system registers */
+ srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs");
+ hb_clk->reg = of_iomap(srnp, 0);
++ of_node_put(srnp);
+ BUG_ON(!hb_clk->reg);
+ hb_clk->reg += reg;
+
+--
+2.20.1
+
--- /dev/null
+From 5f6562906159d3fab1685012160d7d1ca3c811d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:53:00 -0500
+Subject: clk: imx6q: fix refcount leak in imx6q_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6q.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c
+index 46c05c9a93541..39ea50102d52f 100644
+--- a/drivers/clk/imx/clk-imx6q.c
++++ b/drivers/clk/imx/clk-imx6q.c
+@@ -155,6 +155,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop");
+ base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ /* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */
+ if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) {
+--
+2.20.1
+
--- /dev/null
+From 93f1387d3b83bc3f3e3c132cd4bfd7f8ca477e0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:55:10 -0500
+Subject: clk: imx6sx: fix refcount leak in imx6sx_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx6sx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c
+index fea125eb4330b..8f2958ac04e8e 100644
+--- a/drivers/clk/imx/clk-imx6sx.c
++++ b/drivers/clk/imx/clk-imx6sx.c
+@@ -162,6 +162,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop");
+ base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+ clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels));
+--
+2.20.1
+
--- /dev/null
+From 2a9c3a5d80dbf97aa52e96511d55618f2126a06d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:57:16 -0500
+Subject: clk: imx7d: fix refcount leak in imx7d_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-imx7d.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c
+index 448ef321948b1..863163b239a30 100644
+--- a/drivers/clk/imx/clk-imx7d.c
++++ b/drivers/clk/imx/clk-imx7d.c
+@@ -386,6 +386,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop");
+ base = of_iomap(np, 0);
+ WARN_ON(!base);
++ of_node_put(np);
+
+ clks[IMX7D_PLL_ARM_MAIN_SRC] = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+ clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel));
+--
+2.20.1
+
--- /dev/null
+From c3bc37bb9c5999df57d7c50c921a58eaffaa272c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:40:19 -0500
+Subject: clk: kirkwood: fix refcount leak in kirkwood_clk_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mvebu/kirkwood.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c
+index 99550f25975ea..1d2b9a1a96094 100644
+--- a/drivers/clk/mvebu/kirkwood.c
++++ b/drivers/clk/mvebu/kirkwood.c
+@@ -335,6 +335,8 @@ static void __init kirkwood_clk_init(struct device_node *np)
+ if (cgnp) {
+ mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc);
+ kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc);
++
++ of_node_put(cgnp);
+ }
+ }
+ CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock",
+--
+2.20.1
+
--- /dev/null
+From 4a8d8180219f492823fbd5dc8fb2448379ff1df6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:14:42 -0500
+Subject: clk: qoriq: fix refcount leak in clockgen_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk-qoriq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c
+index 7244a621c61b9..efc9e19732957 100644
+--- a/drivers/clk/clk-qoriq.c
++++ b/drivers/clk/clk-qoriq.c
+@@ -1244,6 +1244,7 @@ static void __init clockgen_init(struct device_node *np)
+ pr_err("%s: Couldn't map %s regs\n", __func__,
+ guts->full_name);
+ }
++ of_node_put(guts);
+ }
+
+ }
+--
+2.20.1
+
--- /dev/null
+From 3767299e06e500125f47929261528e19a57201a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:32:15 -0500
+Subject: clk: samsung: exynos4: fix refcount leak in exynos4_get_xom()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos4.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index 7f370d3e09837..6c8e45e007c84 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1224,6 +1224,7 @@ static unsigned long exynos4_get_xom(void)
+ xom = readl(chipid_base + 8);
+
+ iounmap(chipid_base);
++ of_node_put(np);
+ }
+
+ return xom;
+--
+2.20.1
+
--- /dev/null
+From e295a37391b8391a0dd7705e2d3e8b209ff09d2a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:29:02 -0500
+Subject: clk: socfpga: fix refcount leak
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform")
+Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/socfpga/clk-pll-a10.c | 1 +
+ drivers/clk/socfpga/clk-pll.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c
+index 402d630bd531e..623d5b77fb432 100644
+--- a/drivers/clk/socfpga/clk-pll-a10.c
++++ b/drivers/clk/socfpga/clk-pll-a10.c
+@@ -95,6 +95,7 @@ static struct __init clk * __socfpga_pll_init(struct device_node *node,
+
+ clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0);
++ of_node_put(clkmgr_np);
+ BUG_ON(!clk_mgr_a10_base_addr);
+ pll_clk->hw.reg = clk_mgr_a10_base_addr + reg;
+
+diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c
+index c7f463172e4b9..b4b44e9b59011 100644
+--- a/drivers/clk/socfpga/clk-pll.c
++++ b/drivers/clk/socfpga/clk-pll.c
+@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node,
+
+ clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr");
+ clk_mgr_base_addr = of_iomap(clkmgr_np, 0);
++ of_node_put(clkmgr_np);
+ BUG_ON(!clk_mgr_base_addr);
+ pll_clk->hw.reg = clk_mgr_base_addr + reg;
+
+--
+2.20.1
+
--- /dev/null
+From 43e4e3d97b240a862783527c3d0e57e62dd71dd6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Dec 2018 08:59:36 -0500
+Subject: clk: vf610: fix refcount leak in vf610_clocks_init()
+
+From: Yangtao Li <tiny.windzz@gmail.com>
+
+[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ]
+
+The of_find_compatible_node() returns a node pointer with refcount
+incremented, but there is the lack of use of the of_node_put() when
+done. Add the missing of_node_put() to release the refcount.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support")
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/imx/clk-vf610.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c
+index 0a94d9661d912..2c92a2706fdd0 100644
+--- a/drivers/clk/imx/clk-vf610.c
++++ b/drivers/clk/imx/clk-vf610.c
+@@ -155,6 +155,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node)
+ np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop");
+ anatop_base = of_iomap(np, 0);
+ BUG_ON(!anatop_base);
++ of_node_put(np);
+
+ np = ccm_node;
+ ccm_base = of_iomap(np, 0);
+--
+2.20.1
+
--- /dev/null
+From a9756a2209b6f311457312c133c53e308337ced7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 14:22:07 +0800
+Subject: clocksource/drivers/sun5i: Fail gracefully when clock rate is
+ unavailable
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ]
+
+If the clock tree is not fully populated when the timer-sun5i init code
+is called, attempts to get the clock rate for the timer would fail and
+return 0.
+
+Make the init code for both clock events and clocksource check the
+returned clock rate and fail gracefully if the result is 0, instead of
+causing a divide by 0 exception later on.
+
+Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-sun5i.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index bca9573e036a7..32b2dab69fd71 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -201,6 +201,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node,
+ }
+
+ rate = clk_get_rate(clk);
++ if (!rate) {
++ pr_err("Couldn't get parent clock rate\n");
++ ret = -EINVAL;
++ goto err_disable_clk;
++ }
+
+ cs->timer.base = base;
+ cs->timer.clk = clk;
+@@ -274,6 +279,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem
+ }
+
+ rate = clk_get_rate(clk);
++ if (!rate) {
++ pr_err("Couldn't get parent clock rate\n");
++ ret = -EINVAL;
++ goto err_disable_clk;
++ }
+
+ ce->timer.base = base;
+ ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+--
+2.20.1
+
--- /dev/null
+From 29348210974d4cd0f2e0f4bfc8d4b6b4e3deef3e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 16:08:12 +0300
+Subject: crypto: caam - free resources in case caam_rng registration failed
+
+From: Iuliana Prodan <iuliana.prodan@nxp.com>
+
+[ Upstream commit c59a1d41672a89b5cac49db1a472ff889e35a2d2 ]
+
+Check the return value of the hardware registration for caam_rng and free
+resources in case of failure.
+
+Fixes: e24f7c9e87d4 ("crypto: caam - hwrng support")
+Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
+Reviewed-by: Horia Geanta <horia.geanta@nxp.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/crypto/caam/caamrng.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
+index 9b92af2c72412..a77319bf221d8 100644
+--- a/drivers/crypto/caam/caamrng.c
++++ b/drivers/crypto/caam/caamrng.c
+@@ -361,7 +361,10 @@ static int __init caam_rng_init(void)
+ goto free_rng_ctx;
+
+ dev_info(dev, "registering rng-caam\n");
+- return hwrng_register(&caam_rng);
++
++ err = hwrng_register(&caam_rng);
++ if (!err)
++ return err;
+
+ free_rng_ctx:
+ kfree(rng_ctx);
+--
+2.20.1
+
--- /dev/null
+From 3e05105092f43c1881a8fc7a38fef4300f3e2159 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 12:17:58 -0800
+Subject: crypto: tgr192 - fix unaligned memory access
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ]
+
+Fix an unaligned memory access in tgr192_transform() by using the
+unaligned access helpers.
+
+Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/tgr192.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/crypto/tgr192.c b/crypto/tgr192.c
+index 321bc6ff2a9d1..904c8444aa0a2 100644
+--- a/crypto/tgr192.c
++++ b/crypto/tgr192.c
+@@ -25,8 +25,9 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/mm.h>
+-#include <asm/byteorder.h>
+ #include <linux/types.h>
++#include <asm/byteorder.h>
++#include <asm/unaligned.h>
+
+ #define TGR192_DIGEST_SIZE 24
+ #define TGR160_DIGEST_SIZE 20
+@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data)
+ u64 a, b, c, aa, bb, cc;
+ u64 x[8];
+ int i;
+- const __le64 *ptr = (const __le64 *)data;
+
+ for (i = 0; i < 8; i++)
+- x[i] = le64_to_cpu(ptr[i]);
++ x[i] = get_unaligned_le64(data + i * sizeof(__le64));
+
+ /* save */
+ a = aa = tctx->a;
+--
+2.20.1
+
--- /dev/null
+From 66ef98e64b48a3cdd4e2356661d5a4380dd4b81f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Jun 2019 16:59:45 +0200
+Subject: devres: allow const resource arguments
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 9dea44c91469512d346e638694c22c30a5273992 ]
+
+devm_ioremap_resource() does not currently take 'const' arguments,
+which results in a warning from the first driver trying to do it
+anyway:
+
+drivers/gpio/gpio-amd-fch.c: In function 'amd_fch_gpio_probe':
+drivers/gpio/gpio-amd-fch.c:171:49: error: passing argument 2 of 'devm_ioremap_resource' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
+ priv->base = devm_ioremap_resource(&pdev->dev, &amd_fch_gpio_iores);
+ ^~~~~~~~~~~~~~~~~~~
+
+Change the prototype to allow it, as there is no real reason not to.
+
+Fixes: 9bb2e0452508 ("gpio: amd: Make resource struct const")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190628150049.1108048-1-arnd@arndb.de
+Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviwed-By: Enrico Weigelt <info@metux.net>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/device.h | 3 ++-
+ lib/devres.c | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 834000903525d..eb891c9c4b620 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -677,7 +677,8 @@ extern unsigned long devm_get_free_pages(struct device *dev,
+ gfp_t gfp_mask, unsigned int order);
+ extern void devm_free_pages(struct device *dev, unsigned long addr);
+
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res);
++void __iomem *devm_ioremap_resource(struct device *dev,
++ const struct resource *res);
+
+ /* allows to add/remove a custom action to devres stack */
+ int devm_add_action(struct device *dev, void (*action)(void *), void *data);
+diff --git a/lib/devres.c b/lib/devres.c
+index 8c85672639d3e..9d18ccd00df52 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -131,7 +131,8 @@ EXPORT_SYMBOL(devm_iounmap);
+ * if (IS_ERR(base))
+ * return PTR_ERR(base);
+ */
+-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res)
++void __iomem *devm_ioremap_resource(struct device *dev,
++ const struct resource *res)
+ {
+ resource_size_t size;
+ const char *name;
+--
+2.20.1
+
--- /dev/null
+From a6854b3cf8f818c4f96b0b2af6532df24f990ace Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 16:05:20 +0200
+Subject: dmaengine: axi-dmac: Don't check the number of frames for alignment
+
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+
+[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ]
+
+In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
+Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
+for video transfers where screen resolutions ( X * Y ) are typically
+aligned for X, but not for Y.
+
+There is no requirement for Y_LENGTH to be aligned to the bus-width (or
+anything), and this is also true for AXI DMAC.
+
+Checking the Y_LENGTH for alignment causes false errors when initiating DMA
+transfers. This change fixes this by checking only that the Y_LENGTH is
+non-zero.
+
+Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dma-axi-dmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index 5b2395e7e04d8..6de3d2142c7d2 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -441,7 +441,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+
+ if (chan->hw_2d) {
+ if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+- !axi_dmac_check_len(chan, xt->numf))
++ xt->numf == 0)
+ return NULL;
+ if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ xt->sgl[0].size + src_icg > chan->max_length)
+--
+2.20.1
+
--- /dev/null
+From cd28e69fd31e9dc3e88792a73092823f9be6660f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 16:15:43 +0300
+Subject: dmaengine: dw: platform: Switch to acpi_dma_controller_register()
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit e7b8514e4d68bec21fc6385fa0a66797ddc34ac9 ]
+
+There is a possibility to have registered ACPI DMA controller
+while it has been gone already.
+
+To avoid the potential crash, move to non-managed
+acpi_dma_controller_register().
+
+Fixes: 42c91ee71d6d ("dw_dmac: add ACPI support")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20190820131546.75744-8-andriy.shevchenko@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/dw/platform.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index 68a4815750b51..22d0cc1855b5f 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw)
+ dma_cap_set(DMA_SLAVE, info->dma_cap);
+ info->filter_fn = dw_dma_acpi_filter;
+
+- ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate,
+- info);
++ ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info);
+ if (ret)
+ dev_err(dev, "could not register acpi_dma_controller\n");
+ }
++
++static void dw_dma_acpi_controller_free(struct dw_dma *dw)
++{
++ struct device *dev = dw->dma.dev;
++
++ acpi_dma_controller_free(dev);
++}
+ #else /* !CONFIG_ACPI */
+ static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {}
++static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {}
+ #endif /* !CONFIG_ACPI */
+
+ #ifdef CONFIG_OF
+@@ -225,6 +232,9 @@ static int dw_remove(struct platform_device *pdev)
+ {
+ struct dw_dma_chip *chip = platform_get_drvdata(pdev);
+
++ if (ACPI_HANDLE(&pdev->dev))
++ dw_dma_acpi_controller_free(chip->dw);
++
+ if (pdev->dev.of_node)
+ of_dma_controller_free(pdev->dev.of_node);
+
+--
+2.20.1
+
--- /dev/null
+From 0c104cbaaf8ade7c824bdcb8a7c3438db7507eb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 09:49:18 +0000
+Subject: dmaengine: imx-sdma: fix size check for sdma script_number
+
+From: Robin Gong <yibin.gong@nxp.com>
+
+[ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ]
+
+Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(41) exceed the size of structure sdma_script_start_addrs(40),
+thus cause memory corrupt such as slob block header so that kernel
+trap into while() loop forever in slob_free(). Please refer to below
+code piece in imx-sdma.c:
+for (i = 0; i < sdma->script_number; i++)
+ if (addr_arr[i] > 0)
+ saddr_arr[i] = addr_arr[i]; /* memory corrupt here */
+That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add
+support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3
+(38->41 3 scripts added) not align with script number added in
+sdma_script_start_addrs(2 scripts).
+
+Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware")
+Cc: stable@vger.kernel
+Link: https://www.spinics.net/lists/arm-kernel/msg754895.html
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Reported-by: Jurgen Lambrecht <J.Lambrecht@TELEVIC.com>
+Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com
+[vkoul: update the patch title]
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/imx-sdma.c | 8 ++++++++
+ include/linux/platform_data/dma-imx-sdma.h | 3 +++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index dd97dbf6618cd..1dc06e0e890f4 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -1411,6 +1411,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma,
+ if (!sdma->script_number)
+ sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1;
+
++ if (sdma->script_number > sizeof(struct sdma_script_start_addrs)
++ / sizeof(s32)) {
++ dev_err(sdma->dev,
++ "SDMA script number %d not match with firmware.\n",
++ sdma->script_number);
++ return;
++ }
++
+ for (i = 0; i < sdma->script_number; i++)
+ if (addr_arr[i] > 0)
+ saddr_arr[i] = addr_arr[i];
+diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h
+index 2d08816720f6d..5bb0a119f39a3 100644
+--- a/include/linux/platform_data/dma-imx-sdma.h
++++ b/include/linux/platform_data/dma-imx-sdma.h
+@@ -50,7 +50,10 @@ struct sdma_script_start_addrs {
+ /* End of v2 array */
+ s32 zcanfd_2_mcu_addr;
+ s32 zqspi_2_mcu_addr;
++ s32 mcu_2_ecspi_addr;
+ /* End of v3 array */
++ s32 mcu_2_zqspi_addr;
++ /* End of v4 array */
+ };
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 5b45d29bdbc552dd7a9e8dd422fe9ae49c5b7f0b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 15:38:02 +0800
+Subject: dmaengine: ti: edma: fix missed failure handling
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ]
+
+When devm_kcalloc fails, it forgets to call edma_free_slot.
+Replace direct return with failure handler to fix it.
+
+Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/edma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
+index e508c8c5f3fde..17521fcf226f2 100644
+--- a/drivers/dma/edma.c
++++ b/drivers/dma/edma.c
+@@ -2288,8 +2288,10 @@ static int edma_probe(struct platform_device *pdev)
+
+ ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
+ sizeof(*ecc->tc_list), GFP_KERNEL);
+- if (!ecc->tc_list)
+- return -ENOMEM;
++ if (!ecc->tc_list) {
++ ret = -ENOMEM;
++ goto err_reg1;
++ }
+
+ for (i = 0;; i++) {
+ ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
+--
+2.20.1
+
--- /dev/null
+From 64eab6cc7a71fede5d098fd70e00117a13ce1027 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 13 Nov 2018 17:46:14 -0500
+Subject: drm/dp_mst: Skip validating ports during destruction, just ref
+
+From: Lyude Paul <lyude@redhat.com>
+
+[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ]
+
+Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
+accidentally introduced into DRM two years ago.
+
+Pretend we have a topology like this:
+
+|- DP-1: mst_primary
+ |- DP-4: active display
+ |- DP-5: disconnected
+ |- DP-6: active hub
+ |- DP-7: active display
+ |- DP-8: disconnected
+ |- DP-9: disconnected
+
+If we unplug DP-6, the topology starting at DP-7 will be destroyed but
+it's payloads will live on in DP-1's VCPI allocations and thus require
+removal. However, this removal currently fails because
+drm_dp_update_payload_part1() will (rightly so) try to validate the port
+before accessing it, fail then abort. If we keep going, eventually we
+run the MST hub out of bandwidth and all new allocations will start to
+fail (or in my case; all new displays just start flickering a ton).
+
+We could just teach drm_dp_update_payload_part1() not to drop the port
+ref in this case, but then we also need to teach
+drm_dp_destroy_payload_step1() to do the same thing, then hope no one
+ever adds anything to the that requires a validated port reference in
+drm_dp_destroy_connector_work(). Kind of sketchy.
+
+So let's go with a more clever solution: any port that
+drm_dp_destroy_connector_work() interacts with is guaranteed to still
+exist in memory until we say so. While said port might not be valid we
+don't really care: that's the whole reason we're destroying it in the
+first place! So, teach drm_dp_get_validated_port_ref() to use the all
+mighty current_work() function to avoid attempting to validate ports
+from the context of mgr->destroy_connector_work. I can't see any
+situation where this wouldn't be safe, and this avoids having to play
+whack-a-mole in the future of trying to work around port validation.
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
+Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Jerry Zuo <Jerry.Zuo@amd.com>
+Cc: Harry Wentland <Harry.Wentland@amd.com>
+Cc: <stable@vger.kernel.org> # v4.6+
+Reviewed-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
+index 2cb924ffd5a3c..4d0f77f0edad1 100644
+--- a/drivers/gpu/drm/drm_dp_mst_topology.c
++++ b/drivers/gpu/drm/drm_dp_mst_topology.c
+@@ -975,9 +975,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
+ static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
+ {
+ struct drm_dp_mst_port *rport = NULL;
++
+ mutex_lock(&mgr->lock);
+- if (mgr->mst_primary)
+- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
++ /*
++ * Port may or may not be 'valid' but we don't care about that when
++ * destroying the port and we are guaranteed that the port pointer
++ * will be valid until we've finished
++ */
++ if (current_work() == &mgr->destroy_connector_work) {
++ kref_get(&port->kref);
++ rport = port;
++ } else if (mgr->mst_primary) {
++ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
++ port);
++ }
+ mutex_unlock(&mgr->lock);
+ return rport;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7556f8d4c85167bbbfdcdb18ba498b0415b5f14f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Jun 2019 09:09:47 -0700
+Subject: drm/msm/a3xx: remove TPL1 regs from snapshot
+
+From: Rob Clark <robdclark@chromium.org>
+
+[ Upstream commit f47bee2ba447bebc304111c16ef1e1a73a9744dd ]
+
+These regs are write-only, and the hw throws a hissy-fit (ie. reboots)
+when we try to read them for GPU state snapshot, in response to a GPU
+hang. It is rather impolite when GPU recovery triggers an insta-
+reboot, so lets remove the TPL1 registers from the snapshot.
+
+Fixes: 7198e6b03155 drm/msm: add a3xx gpu support
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Reviewed-by: Jordan Crouse <jcrouse@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 24 +++++++++++-------------
+ 1 file changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+index fd266ed963b6c..25a0e7d133405 100644
+--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c
+@@ -383,19 +383,17 @@ static const unsigned int a3xx_registers[] = {
+ 0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e,
+ 0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8,
+ 0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7,
+- 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356,
+- 0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d,
+- 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472,
+- 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef,
+- 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511,
+- 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed,
+- 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a,
+- 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce,
+- 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec,
+- 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749,
+- 0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d,
+- 0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036,
+- 0x303c, 0x303c, 0x305e, 0x305f,
++ 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444,
++ 0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470,
++ 0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3,
++ 0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e,
++ 0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea,
++ 0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617,
++ 0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0,
++ 0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9,
++ 0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743,
++ 0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d,
++ 0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f,
+ ~0 /* sentinel */
+ };
+
+--
+2.20.1
+
--- /dev/null
+From cfcb7cf596f2850522eee0844bd091ada689e47d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 06:39:39 -0700
+Subject: drm/msm/dsi: Implement reset correctly
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit 78e31c42261779a01bc73472d0f65f15378e9de3 ]
+
+On msm8998, vblank timeouts are observed because the DSI controller is not
+reset properly, which ends up stalling the MDP. This is because the reset
+logic is not correct per the hardware documentation.
+
+The documentation states that after asserting reset, software should wait
+some time (no indication of how long), or poll the status register until it
+returns 0 before deasserting reset.
+
+wmb() is insufficient for this purpose since it just ensures ordering, not
+timing between writes. Since asserting and deasserting reset occurs on the
+same register, ordering is already guaranteed by the architecture, making
+the wmb extraneous.
+
+Since we would define a timeout for polling the status register to avoid a
+possible infinite loop, lets just use a static delay of 20 ms, since 16.666
+ms is the time available to process one frame at 60 fps.
+
+Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
+Cc: Hai Li <hali@codeaurora.org>
+Cc: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Sean Paul <sean@poorly.run>
+[seanpaul renamed RESET_DELAY to DSI_RESET_TOGGLE_DELAY_MS]
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191011133939.16551-1-jeffrey.l.hugo@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/dsi/dsi_host.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
+index 4c49868efcda2..12ddbbb531077 100644
+--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
+@@ -30,6 +30,8 @@
+ #include "dsi.xml.h"
+ #include "dsi_cfg.h"
+
++#define DSI_RESET_TOGGLE_DELAY_MS 20
++
+ static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor)
+ {
+ u32 ver;
+@@ -764,7 +766,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host)
+ wmb(); /* clocks need to be enabled before reset */
+
+ dsi_write(msm_host, REG_DSI_RESET, 1);
+- wmb(); /* make sure reset happen */
++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ dsi_write(msm_host, REG_DSI_RESET, 0);
+ }
+
+@@ -1111,7 +1113,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host)
+
+ /* dsi controller can only be reset while clocks are running */
+ dsi_write(msm_host, REG_DSI_RESET, 1);
+- wmb(); /* make sure reset happen */
++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */
+ dsi_write(msm_host, REG_DSI_RESET, 0);
+ wmb(); /* controller out of reset */
+ dsi_write(msm_host, REG_DSI_CTRL, data0);
+--
+2.20.1
+
--- /dev/null
+From 16748cb44ac3168799110b0f70cfa6b8953627a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 08:00:30 -0700
+Subject: drm/msm/mdp5: Fix mdp5_cfg_init error return
+
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+
+[ Upstream commit fc19cbb785d7bbd1a1af26229b5240a3ab332744 ]
+
+If mdp5_cfg_init fails because of an unknown major version, a null pointer
+dereference occurs. This is because the caller of init expects error
+pointers, but init returns NULL on error. Fix this by returning the
+expected values on error.
+
+Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Rob Clark <robdclark@chromium.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+index bb1225aa2f75b..89305ad3cde29 100644
+--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c
+@@ -547,7 +547,7 @@ fail:
+ if (cfg_handler)
+ mdp5_cfg_destroy(cfg_handler);
+
+- return NULL;
++ return ERR_PTR(ret);
+ }
+
+ static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
+--
+2.20.1
+
--- /dev/null
+From 59ca546e2927b172758237308353868c6cf64892 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 25 Nov 2018 17:09:18 +0000
+Subject: drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ]
+
+Currently, the expression for calculating RON is always going to result
+in zero no matter the value of ram->mr[1] because the ! operator has
+higher precedence than the shift >> operator. I believe the missing
+parentheses around the expression before appying the ! operator will
+result in the desired result.
+
+[ Note, not tested ]
+
+Detected by CoveritScan, CID#1324005 ("Operands don't affect result")
+
+Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+index 60ece0a8a2e1b..1d2d6bae73cd1 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c
+@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram)
+ WR = (ram->next->bios.timing[2] & 0x007f0000) >> 16;
+ /* XXX: Get these values from the VBIOS instead */
+ DLL = !(ram->mr[1] & 0x1);
+- RON = !(ram->mr[1] & 0x300) >> 8;
++ RON = !((ram->mr[1] & 0x300) >> 8);
+ break;
+ default:
+ return -ENOSYS;
+--
+2.20.1
+
--- /dev/null
+From b839233ee4f80083f45de19373bfaf0769d50e2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Dec 2018 15:29:49 +0000
+Subject: drm/nouveau/pmu: don't print reply values if exec is false
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ]
+
+Currently the uninitialized values in the array reply are printed out
+when exec is false and nvkm_pmu_send has not updated the array. Avoid
+confusion by only dumping out these values if they have been actually
+updated.
+
+Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable")
+Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+index e6f74168238c7..2ef9e942f43a2 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c
+@@ -87,10 +87,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec)
+ if (exec) {
+ nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC,
+ memx->base, finish);
++ nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
++ reply[0], reply[1]);
+ }
+
+- nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n",
+- reply[0], reply[1]);
+ kfree(memx);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 8fb67ed6e0d61d0bf9f09bbd02b52f9821b9868a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 10:53:53 +1100
+Subject: drm/radeon: fix bad DMA from INTERRUPT_CNTL2
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ]
+
+The INTERRUPT_CNTL2 register expects a valid DMA address, but is
+currently set with a GPU MC address. This can cause problems on
+systems that detect the resulting DMA read from an invalid address
+(found on a Power8 guest).
+
+Instead, use the DMA address of the dummy page because it will always
+be safe.
+
+Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)")
+Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI")
+Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)")
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c | 4 ++--
+ drivers/gpu/drm/radeon/r600.c | 4 ++--
+ drivers/gpu/drm/radeon/si.c | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 80b6d6e4721a1..7acde09c8e8fb 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -7372,8 +7372,8 @@ static int cik_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* XXX this should actually be a bus address, not an MC address. same on older asics */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 0e20c08f8977f..2056224d0b3c4 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3647,8 +3647,8 @@ int r600_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 5cf3a2cbc07e8..4128c98d9054e 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -6013,8 +6013,8 @@ static int si_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+--
+2.20.1
+
--- /dev/null
+From d3e6d9c298a86b3714e178bdb9480e0d360af746 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Jul 2018 12:42:50 +0300
+Subject: drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ]
+
+This doesn't affect runtime because in the current code "idx" is always
+valid.
+
+First, we read from "vgdev->capsets[idx].max_size" before checking
+whether "idx" is within bounds. And secondly the bounds check is off by
+one so we could end up reading one element beyond the end of the
+vgdev->capsets[] array.
+
+Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index a1b3ea1ccb65b..772a5a3b0ce1a 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -681,11 +681,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ {
+ struct virtio_gpu_get_capset *cmd_p;
+ struct virtio_gpu_vbuffer *vbuf;
+- int max_size = vgdev->capsets[idx].max_size;
++ int max_size;
+ struct virtio_gpu_drv_cap_cache *cache_ent;
+ void *resp_buf;
+
+- if (idx > vgdev->num_capsets)
++ if (idx >= vgdev->num_capsets)
+ return -EINVAL;
+
+ if (version > vgdev->capsets[idx].max_version)
+@@ -695,6 +695,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ if (!cache_ent)
+ return -ENOMEM;
+
++ max_size = vgdev->capsets[idx].max_size;
+ cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
+ if (!cache_ent->caps_cache) {
+ kfree(cache_ent);
+--
+2.20.1
+
--- /dev/null
+From e6e35158a6b579f1f9963627a3bc21cf0be23ff6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Apr 2019 15:47:59 +0800
+Subject: ehea: Fix a copy-paste err in ehea_init_port_res
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ]
+
+pr->tx_bytes should be assigned to tx_bytes other than
+rx_bytes.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: ce45b873028f ("ehea: Fixing statistics")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 1a56de06b0140..fdbba588c6dba 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -1477,7 +1477,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
+
+ memset(pr, 0, sizeof(struct ehea_port_res));
+
+- pr->tx_bytes = rx_bytes;
++ pr->tx_bytes = tx_bytes;
+ pr->tx_packets = tx_packets;
+ pr->rx_bytes = rx_bytes;
+ pr->rx_packets = rx_packets;
+--
+2.20.1
+
--- /dev/null
+From d6bbff486b8051db8ea47d8483a326ece57123a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 11:32:41 +0800
+Subject: exportfs: fix 'passing zero to ERR_PTR()' warning
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ]
+
+Fix a static code checker warning:
+ fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR'
+
+The error path for lookup_one_len_unlocked failure
+should set err to PTR_ERR.
+
+Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/exportfs/expfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index 6599c6124552f..01cbdd0987c07 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -148,6 +148,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt,
+ mutex_unlock(&parent->d_inode->i_mutex);
+ if (IS_ERR(tmp)) {
+ dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp));
++ err = PTR_ERR(tmp);
+ goto out_err;
+ }
+ if (tmp != dentry) {
+--
+2.20.1
+
--- /dev/null
+From 9140677dad5a27b7de9ecaf392bf477d9a62b46d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Aug 2019 14:29:38 -0400
+Subject: ext4: set error return correctly when ext4_htree_store_dirent fails
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 7a14826ede1d714f0bb56de8167c0e519041eeda ]
+
+Currently when the call to ext4_htree_store_dirent fails the error return
+variable 'ret' is is not being set to the error code and variable count is
+instead, hence the error code is not being returned. Fix this by assigning
+ret to the error return code.
+
+Addresses-Coverity: ("Unused value")
+Fixes: 8af0f0822797 ("ext4: fix readdir error in the case of inline_data+dir_index")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/inline.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index 0dcd33f626376..00f9433eea23a 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1418,7 +1418,7 @@ int htree_inlinedir_to_tree(struct file *dir_file,
+ err = ext4_htree_store_dirent(dir_file, hinfo->hash,
+ hinfo->minor_hash, de, &tmp_str);
+ if (err) {
+- count = err;
++ ret = err;
+ goto out;
+ }
+ count++;
+--
+2.20.1
+
--- /dev/null
+From e20e490ff189b93f69ebad21822a8ee5555a6a44 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Feb 2019 19:24:45 +0100
+Subject: fbdev: chipsfb: remove set but not used variable 'size'
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
+drivers/video/fbdev/chipsfb.c:352:22: warning:
+ variable 'size' set but not used [-Wunused-but-set-variable]
+
+Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+[b.zolnierkie: minor commit summary and description fixups]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/chipsfb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index 59abdc6a97f66..314b7eceb81c5 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
+ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ {
+ struct fb_info *p;
+- unsigned long addr, size;
++ unsigned long addr;
+ unsigned short cmd;
+ int rc = -ENODEV;
+
+@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
+ goto err_disable;
+ addr = pci_resource_start(dp, 0);
+- size = pci_resource_len(dp, 0);
+ if (addr == 0)
+ goto err_disable;
+
+--
+2.20.1
+
--- /dev/null
+From 7633aeaf9b29907d48c0f7351f2ce8fd3631ac85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 07:58:38 -0600
+Subject: fs/nfs: Fix nfs_parse_devname to not modify it's argument
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ]
+
+In the rare and unsupported case of a hostname list nfs_parse_devname
+will modify dev_name. There is no need to modify dev_name as the all
+that is being computed is the length of the hostname, so the computed
+length can just be shorted.
+
+Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index dced329a85844..47a7751146cf5 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1901,7 +1901,7 @@ static int nfs_parse_devname(const char *dev_name,
+ /* kill possible hostname list: not supported */
+ comma = strchr(dev_name, ',');
+ if (comma != NULL && comma < end)
+- *comma = 0;
++ len = comma - dev_name;
+ }
+
+ if (len > maxnamlen)
+--
+2.20.1
+
--- /dev/null
+From 9bec6ff4a3298f9aad18820c85b3480824e573c4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 01:45:54 +0000
+Subject: hwmon: (shtc1) fix shtc1 and shtw1 id mask
+
+From: Dan Robertson <dan@dlrobertson.com>
+
+[ Upstream commit fdc7d8e829ec755c5cfb2f5a8d8c0cdfb664f895 ]
+
+Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to
+retrieve the chip ID from the ID register. See section 5.7 of the shtw1
+or shtc1 datasheet for details.
+
+Fixes: 1a539d372edd9832444e7a3daa710c444c014dc9 ("hwmon: add support for Sensirion SHTC1 sensor")
+Signed-off-by: Dan Robertson <dan@dlrobertson.com>
+Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com
+[groeck: Reordered to be first in series and adjusted accordingly]
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/shtc1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c
+index decd7df995abf..2a18539591eaf 100644
+--- a/drivers/hwmon/shtc1.c
++++ b/drivers/hwmon/shtc1.c
+@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[] = { 0xef, 0xc8 };
+
+ /* constants for reading the ID register */
+ #define SHTC1_ID 0x07
+-#define SHTC1_ID_REG_MASK 0x1f
++#define SHTC1_ID_REG_MASK 0x3f
+
+ /* delays for non-blocking i2c commands, both in us */
+ #define SHTC1_NONBLOCKING_WAIT_TIME_HPM 14400
+--
+2.20.1
+
--- /dev/null
+From c7e9517dc031c3bcf07d8be82d37f7179f0b72be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 5 Apr 2019 08:44:41 -0700
+Subject: hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ]
+
+Super-IO accesses may fail on a system with no or unmapped LPC bus.
+
+Also, other drivers may attempt to access the LPC bus at the same time,
+resulting in undefined behavior.
+
+Use request_muxed_region() to ensure that IO access on the requested
+address space is supported, and to ensure that access by multiple drivers
+is synchronized.
+
+Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 37 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c
+index 721295b9a0517..43c0f89cefdf0 100644
+--- a/drivers/hwmon/w83627hf.c
++++ b/drivers/hwmon/w83627hf.c
+@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld)
+ outb(ld, sio->sioaddr + 1);
+ }
+
+-static inline void
++static inline int
+ superio_enter(struct w83627hf_sio_data *sio)
+ {
++ if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
++ return -EBUSY;
++
+ outb(0x87, sio->sioaddr);
+ outb(0x87, sio->sioaddr);
++
++ return 0;
+ }
+
+ static inline void
+ superio_exit(struct w83627hf_sio_data *sio)
+ {
+ outb(0xAA, sio->sioaddr);
++ release_region(sio->sioaddr, 2);
+ }
+
+ #define W627_DEVID 0x52
+@@ -1275,7 +1281,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
+ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ struct w83627hf_sio_data *sio_data)
+ {
+- int err = -ENODEV;
++ int err;
+ u16 val;
+
+ static __initconst char *const names[] = {
+@@ -1287,7 +1293,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr,
+ };
+
+ sio_data->sioaddr = sioaddr;
+- superio_enter(sio_data);
++ err = superio_enter(sio_data);
++ if (err)
++ return err;
++
++ err = -ENODEV;
+ val = force_id ? force_id : superio_inb(sio_data, DEVID);
+ switch (val) {
+ case W627_DEVID:
+@@ -1641,9 +1651,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff, sel;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_GPIO5);
+
++ res = 0xff;
++
+ /* Make sure these GPIO pins are enabled */
+ if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
+ dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
+@@ -1674,7 +1696,17 @@ static int w83687thf_read_vid(struct platform_device *pdev)
+ struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
+ int res = 0xff;
+
+- superio_enter(sio_data);
++ if (superio_enter(sio_data)) {
++ /*
++ * Some other driver reserved the address space for itself.
++ * We don't want to fail driver instantiation because of that,
++ * so display a warning and keep going.
++ */
++ dev_warn(&pdev->dev,
++ "Can not read VID data: Failed to enable SuperIO access\n");
++ return res;
++ }
++
+ superio_select(sio_data, W83627HF_LD_HWM);
+
+ /* Make sure these GPIO pins are enabled */
+--
+2.20.1
+
--- /dev/null
+From 6e20aabb3587fb6cca435e656af5b0214f956f58 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 May 2019 08:38:30 +0300
+Subject: IB/mlx5: Add missing XRC options to QP optional params mask
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ]
+
+The QP transition optional parameters for the various transition for XRC
+QPs are identical to those for RC QPs.
+
+Many of the XRC QP transition optional parameter bits are missing from the
+QP optional mask table. These omissions caused failures when doing XRC QP
+state transitions.
+
+For example, when trying to change the response timer of an XRC receive QP
+via the RTS2RTS transition, the new timer value was ignored because
+MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask
+for XRC qps for the RTS2RTS transition.
+
+Fix this by adding the missing XRC optional parameters for all QP
+transitions to the opt_mask table.
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
+index 43d277a931c2a..eac5f5eff8d22 100644
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -1426,6 +1426,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX |
+ MLX5_QP_OPTPAR_Q_KEY |
+ MLX5_QP_OPTPAR_PRI_PORT,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_PKEY_INDEX |
++ MLX5_QP_OPTPAR_PRI_PORT,
+ },
+ [MLX5_QP_STATE_RTR] = {
+ [MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
+@@ -1459,6 +1464,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ MLX5_QP_OPTPAR_RWE |
+ MLX5_QP_OPTPAR_PM_STATE,
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH |
++ MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_PM_STATE |
++ MLX5_QP_OPTPAR_RNR_TIMEOUT,
+ },
+ },
+ [MLX5_QP_STATE_RTS] = {
+@@ -1475,6 +1486,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY |
+ MLX5_QP_OPTPAR_SRQN |
+ MLX5_QP_OPTPAR_CQN_RCV,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_RNR_TIMEOUT |
++ MLX5_QP_OPTPAR_PM_STATE |
++ MLX5_QP_OPTPAR_ALT_ADDR_PATH,
+ },
+ },
+ [MLX5_QP_STATE_SQER] = {
+@@ -1486,6 +1503,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q
+ MLX5_QP_OPTPAR_RWE |
+ MLX5_QP_OPTPAR_RAE |
+ MLX5_QP_OPTPAR_RRE,
++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RNR_TIMEOUT |
++ MLX5_QP_OPTPAR_RWE |
++ MLX5_QP_OPTPAR_RAE |
++ MLX5_QP_OPTPAR_RRE,
+ },
+ },
+ };
+--
+2.20.1
+
--- /dev/null
+From 1062743b580df5134f8ed0462cf8e7b907c8ce5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:54 +0200
+Subject: IB/usnic: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Acked-by: Parvi Kaustubhi <pkaustub@cisco.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+index f8e3211689a34..8e18bfca55166 100644
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -427,7 +427,7 @@ int usnic_ib_query_gid(struct ib_device *ibdev, u8 port, int index,
+ int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+ u16 *pkey)
+ {
+- if (index > 1)
++ if (index > 0)
+ return -EINVAL;
+
+ *pkey = 0xffff;
+--
+2.20.1
+
--- /dev/null
+From a6c1132c804ddd4b534f64618e67210c5d8fb377 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Aug 2019 12:58:46 +0100
+Subject: iio: dac: ad5380: fix incorrect assignment to val
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e18768ef1214c0a8048327918a182cabe09f9d ]
+
+Currently the pointer val is being incorrectly incremented
+instead of the value pointed to by val. Fix this by adding
+in the missing * indirection operator.
+
+Addresses-Coverity: ("Unused value")
+Fixes: c03f2c536818 ("staging:iio:dac: Add AD5380 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/dac/ad5380.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
+index 97d2c5111f438..8bf7fc626a9d4 100644
+--- a/drivers/iio/dac/ad5380.c
++++ b/drivers/iio/dac/ad5380.c
+@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev,
+ if (ret)
+ return ret;
+ *val >>= chan->scan_type.shift;
+- val -= (1 << chan->scan_type.realbits) / 2;
++ *val -= (1 << chan->scan_type.realbits) / 2;
+ return IIO_VAL_INT;
+ case IIO_CHAN_INFO_SCALE:
+ *val = 2 * st->vref;
+--
+2.20.1
+
--- /dev/null
+From 31b91a795c48a3067825500876a91815ad2f8d1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 May 2019 16:56:48 -0700
+Subject: inet: frags: call inet_frags_fini() after unregister_pernet_subsys()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ]
+
+Both IPv6 and 6lowpan are calling inet_frags_fini() too soon.
+
+inet_frags_fini() is dismantling a kmem_cache, that might be needed
+later when unregister_pernet_subsys() eventually has to remove
+frags queues from hash tables and free them.
+
+This fixes potential use-after-free, and is a prereq for the following patch.
+
+Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ieee802154/6lowpan/reassembly.c | 2 +-
+ net/ipv6/reassembly.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
+index 6183730d38db3..e728dae467c31 100644
+--- a/net/ieee802154/6lowpan/reassembly.c
++++ b/net/ieee802154/6lowpan/reassembly.c
+@@ -634,7 +634,7 @@ err_sysctl:
+
+ void lowpan_net_frag_exit(void)
+ {
+- inet_frags_fini(&lowpan_frags);
+ lowpan_frags_sysctl_unregister();
+ unregister_pernet_subsys(&lowpan_frags_ops);
++ inet_frags_fini(&lowpan_frags);
+ }
+diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
+index ec917f58d1050..17e9ed2edb868 100644
+--- a/net/ipv6/reassembly.c
++++ b/net/ipv6/reassembly.c
+@@ -774,8 +774,8 @@ err_protocol:
+
+ void ipv6_frag_exit(void)
+ {
+- inet_frags_fini(&ip6_frags);
+ ip6_frags_sysctl_unregister();
+ unregister_pernet_subsys(&ip6_frags_ops);
+ inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
++ inet_frags_fini(&ip6_frags);
+ }
+--
+2.20.1
+
--- /dev/null
+From b8b76227fd30333190aaed3300dd2215424f74b0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Dec 2018 00:38:30 -0800
+Subject: Input: nomadik-ske-keypad - fix a loop timeout test
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ]
+
+The loop exits with "timeout" set to -1 not to 0.
+
+Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
+index 8567ee47761e1..ae3b045570740 100644
+--- a/drivers/input/keyboard/nomadik-ske-keypad.c
++++ b/drivers/input/keyboard/nomadik-ske-keypad.c
+@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
+ while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
+ cpu_relax();
+
+- if (!timeout)
++ if (timeout == -1)
+ return -EINVAL;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From b7cccacc750e1103b052efb857b5e420ef66b451 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Jun 2019 14:52:03 -0700
+Subject: iommu/amd: Make iommu_disable safer
+
+From: Kevin Mitchell <kevmitch@arista.com>
+
+[ Upstream commit 3ddbe913e55516d3e2165d43d4d5570761769878 ]
+
+Make it safe to call iommu_disable during early init error conditions
+before mmio_base is set, but after the struct amd_iommu has been added
+to the amd_iommu_list. For example, this happens if firmware fails to
+fill in mmio_phys in the ACPI table leading to a NULL pointer
+dereference in iommu_feature_disable.
+
+Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine')
+Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu_init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 6a69b5bb231f8..036fb186a3bef 100644
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -360,6 +360,9 @@ static void iommu_enable(struct amd_iommu *iommu)
+
+ static void iommu_disable(struct amd_iommu *iommu)
+ {
++ if (!iommu->mmio_base)
++ return;
++
+ /* Disable command buffer */
+ iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
+
+--
+2.20.1
+
--- /dev/null
+From 3e0895782e7102d5e017588894d6606b5c32df0e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 19:49:21 +0200
+Subject: iommu/amd: Wait for completion of IOTLB flush in attach_device
+
+From: Filippo Sironi <sironi@amazon.de>
+
+[ Upstream commit 0b15e02f0cc4fb34a9160de7ba6db3a4013dc1b7 ]
+
+To make sure the domain tlb flush completes before the
+function returns, explicitly wait for its completion.
+
+Signed-off-by: Filippo Sironi <sironi@amazon.de>
+Fixes: 42a49f965a8d ("amd-iommu: flush domain tlb when attaching a new device")
+[joro: Added commit message and fixes tag]
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/amd_iommu.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 0ad8b7c78a438..66a406e87e117 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2184,6 +2184,8 @@ static int attach_device(struct device *dev,
+ */
+ domain_flush_tlb_pde(domain);
+
++ domain_flush_complete(domain);
++
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1c0456cf3aa2ccfbdfda1c32e14df0a248b2dbaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 May 2019 15:27:35 +0800
+Subject: iommu: Use right function to get group for device
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 57274ea25736496ee019a5c40479855b21888839 ]
+
+The iommu_group_get_for_dev() will allocate a group for a
+device if it isn't in any group. This isn't the use case
+in iommu_request_dm_for_dev(). Let's use iommu_group_get()
+instead.
+
+Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 5d5066cf3bbd7..589207176ffa1 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -1594,9 +1594,9 @@ int iommu_request_dm_for_dev(struct device *dev)
+ int ret;
+
+ /* Device must already be in a group before calling this function */
+- group = iommu_group_get_for_dev(dev);
+- if (IS_ERR(group))
+- return PTR_ERR(group);
++ group = iommu_group_get(dev);
++ if (!group)
++ return -EINVAL;
+
+ mutex_lock(&group->mutex);
+
+--
+2.20.1
+
--- /dev/null
+From 59f355e9e28b21293246d8abd0224a9310d25b85 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 09:34:26 +0800
+Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
+
+From: Lu Baolu <baolu.lu@linux.intel.com>
+
+[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ]
+
+The kernel parameter igfx_off is used by users to disable
+DMA remapping for the Intel integrated graphic device. It
+was designed for bare metal cases where a dedicated IOMMU
+is used for graphic. This doesn't apply to virtual IOMMU
+case where an include-all IOMMU is used. This makes the
+kernel parameter work with virtual IOMMU as well.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/intel-iommu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index b965561a41627..a2005b82ec8ff 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3259,9 +3259,12 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_ALL;
+
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+- iommu_identity_mapping |= IDENTMAP_GFX;
++ dmar_map_gfx = 0;
+ #endif
+
++ if (!dmar_map_gfx)
++ iommu_identity_mapping |= IDENTMAP_GFX;
++
+ check_tylersburg_isoch();
+
+ if (iommu_identity_mapping) {
+--
+2.20.1
+
--- /dev/null
+From 060752288245e50f17b941fb07713b56652b6edb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 15:19:16 +0100
+Subject: jfs: fix bogus variable self-initialization
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ]
+
+A statement was originally added in 2006 to shut up a gcc warning,
+now but now clang warns about it:
+
+fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization
+ [-Werror,-Wuninitialized]
+ pxd_t pxd = pxd; /* truncated extent of xad */
+ ~~~ ^~~
+
+Modern versions of gcc are fine without the silly assignment, so just
+drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9.
+
+Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/jfs/jfs_txnmgr.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
+index d595856453b24..de6351c1c8db2 100644
+--- a/fs/jfs/jfs_txnmgr.c
++++ b/fs/jfs/jfs_txnmgr.c
+@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd,
+ * header ?
+ */
+ if (tlck->type & tlckTRUNCATE) {
+- /* This odd declaration suppresses a bogus gcc warning */
+- pxd_t pxd = pxd; /* truncated extent of xad */
++ pxd_t pxd; /* truncated extent of xad */
+ int twm;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 74a37d6f7380546945b3b0e8dc2c6dfcea806ad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 May 2019 15:50:18 +0300
+Subject: kdb: do a sanity check on the cpu in kdb_per_cpu()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ]
+
+The "whichcpu" comes from argv[3]. The cpu_online() macro looks up the
+cpu in a bitmap of online cpus, but if the value is too high then it
+could read beyond the end of the bitmap and possibly Oops.
+
+Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/debug/kdb/kdb_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index ebc52c7bd8a6c..cba287a5c9760 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2632,7 +2632,7 @@ static int kdb_per_cpu(int argc, const char **argv)
+ diag = kdbgetularg(argv[3], &whichcpu);
+ if (diag)
+ return diag;
+- if (!cpu_online(whichcpu)) {
++ if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
+ kdb_printf("cpu %ld is not online\n", whichcpu);
+ return KDB_BADCPUNUM;
+ }
+--
+2.20.1
+
--- /dev/null
+From 883364111b04dd86d0016c38a2a0ba424726b9a6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jul 2019 22:42:18 +0800
+Subject: libertas_tf: Use correct channel range in lbtf_geo_init
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 ]
+
+It seems we should use 'range' instead of 'priv->range'
+in lbtf_geo_init(), because 'range' is the corret one
+related to current regioncode.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/libertas_tf/cmd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/libertas_tf/cmd.c b/drivers/net/wireless/libertas_tf/cmd.c
+index 909ac3685010f..2b193f1257a5a 100644
+--- a/drivers/net/wireless/libertas_tf/cmd.c
++++ b/drivers/net/wireless/libertas_tf/cmd.c
+@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv)
+ break;
+ }
+
+- for (ch = priv->range.start; ch < priv->range.end; ch++)
++ for (ch = range->start; ch < range->end; ch++)
+ priv->channels[CHAN_TO_IDX(ch)].flags = 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e6e6137bd99af84ed90ba676199792b4f16a33ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:26 -0700
+Subject: llc: fix another potential sk_buff leak in llc_ui_sendmsg()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ]
+
+All callers of llc_conn_state_process() except llc_build_and_send_pkt()
+(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always
+consumes a reference to the skb. Fix this caller to do the same.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/af_llc.c | 34 ++++++++++++++++++++--------------
+ net/llc/llc_conn.c | 2 ++
+ net/llc/llc_if.c | 12 ++++++++----
+ 3 files changed, 30 insertions(+), 18 deletions(-)
+
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index c153fc2883a86..69f1558dfcb74 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -111,22 +111,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr)
+ *
+ * Send data via reliable llc2 connection.
+ * Returns 0 upon success, non-zero if action did not succeed.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock)
+ {
+ struct llc_sock* llc = llc_sk(sk);
+- int rc = 0;
+
+ if (unlikely(llc_data_accept_state(llc->state) ||
+ llc->remote_busy_flag ||
+ llc->p_flag)) {
+ long timeout = sock_sndtimeo(sk, noblock);
++ int rc;
+
+ rc = llc_ui_wait_for_busy_core(sk, timeout);
++ if (rc) {
++ kfree_skb(skb);
++ return rc;
++ }
+ }
+- if (unlikely(!rc))
+- rc = llc_build_and_send_pkt(sk, skb);
+- return rc;
++ return llc_build_and_send_pkt(sk, skb);
+ }
+
+ static void llc_ui_sk_init(struct socket *sock, struct sock *sk)
+@@ -896,7 +900,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name);
+ int flags = msg->msg_flags;
+ int noblock = flags & MSG_DONTWAIT;
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
+ size_t size = 0;
+ int rc = -EINVAL, copied = 0, hdrlen;
+
+@@ -905,10 +909,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ lock_sock(sk);
+ if (addr) {
+ if (msg->msg_namelen < sizeof(*addr))
+- goto release;
++ goto out;
+ } else {
+ if (llc_ui_addr_null(&llc->addr))
+- goto release;
++ goto out;
+ addr = &llc->addr;
+ }
+ /* must bind connection to sap if user hasn't done it. */
+@@ -916,7 +920,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ /* bind to sap with null dev, exclusive. */
+ rc = llc_ui_autobind(sock, addr);
+ if (rc)
+- goto release;
++ goto out;
+ }
+ hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr);
+ size = hdrlen + len;
+@@ -925,12 +929,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ copied = size - hdrlen;
+ rc = -EINVAL;
+ if (copied < 0)
+- goto release;
++ goto out;
+ release_sock(sk);
+ skb = sock_alloc_send_skb(sk, size, noblock, &rc);
+ lock_sock(sk);
+ if (!skb)
+- goto release;
++ goto out;
+ skb->dev = llc->dev;
+ skb->protocol = llc_proto_type(addr->sllc_arphrd);
+ skb_reserve(skb, hdrlen);
+@@ -940,29 +944,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
+ if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) {
+ llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ if (addr->sllc_test) {
+ llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ if (addr->sllc_xid) {
+ llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac,
+ addr->sllc_sap);
++ skb = NULL;
+ goto out;
+ }
+ rc = -ENOPROTOOPT;
+ if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua))
+ goto out;
+ rc = llc_ui_send_data(sk, skb, noblock);
++ skb = NULL;
+ out:
+- if (rc) {
+- kfree_skb(skb);
+-release:
++ kfree_skb(skb);
++ if (rc)
+ dprintk("%s: failed sending from %02X to %02X: %d\n",
+ __func__, llc->laddr.lsap, llc->daddr.lsap, rc);
+- }
+ release_sock(sk);
+ return rc ? : copied;
+ }
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index d861b74ad068c..5d653f5261c55 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ;
+ * (executing it's actions and changing state), upper layer will be
+ * indicated or confirmed, if needed. Returns 0 for success, 1 for
+ * failure. The socket lock has to be held before calling this function.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ {
+diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c
+index 6daf391b3e847..fc4d2bd8816f5 100644
+--- a/net/llc/llc_if.c
++++ b/net/llc/llc_if.c
+@@ -38,6 +38,8 @@
+ * closed and -EBUSY when sending data is not permitted in this state or
+ * LLC has send an I pdu with p bit set to 1 and is waiting for it's
+ * response.
++ *
++ * This function always consumes a reference to the skb.
+ */
+ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ {
+@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb)
+ struct llc_sock *llc = llc_sk(sk);
+
+ if (unlikely(llc->state == LLC_CONN_STATE_ADM))
+- goto out;
++ goto out_free;
+ rc = -EBUSY;
+ if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */
+ llc->p_flag)) {
+ llc->failed_data_req = 1;
+- goto out;
++ goto out_free;
+ }
+ ev = llc_conn_ev(skb);
+ ev->type = LLC_CONN_EV_TYPE_PRIM;
+ ev->prim = LLC_DATA_PRIM;
+ ev->prim_type = LLC_PRIM_TYPE_REQ;
+ skb->dev = llc->dev;
+- rc = llc_conn_state_process(sk, skb);
+-out:
++ return llc_conn_state_process(sk, skb);
++
++out_free:
++ kfree_skb(skb);
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ee9c1c58decfddfce34ed8d7618406867bfed56a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 14:24:27 -0700
+Subject: llc: fix sk_buff refcounting in llc_conn_state_process()
+
+From: Eric Biggers <ebiggers@google.com>
+
+[ Upstream commit 36453c852816f19947ca482a595dffdd2efa4965 ]
+
+If llc_conn_state_process() sees that llc_conn_service() put the skb on
+a list, it will drop one fewer references to it. This is wrong because
+the current behavior is that llc_conn_service() never consumes a
+reference to the skb.
+
+The code also makes the number of skb references being dropped
+conditional on which of ind_prim and cfm_prim are nonzero, yet neither
+of these affects how many references are *acquired*. So there is extra
+code that tries to fix this up by sometimes taking another reference.
+
+Remove the unnecessary/broken refcounting logic and instead just add an
+skb_get() before the only two places where an extra reference is
+actually consumed.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/llc/llc_conn.c | 33 ++++++---------------------------
+ 1 file changed, 6 insertions(+), 27 deletions(-)
+
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 5d653f5261c55..3b002ab68b290 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -64,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ struct llc_sock *llc = llc_sk(skb->sk);
+ struct llc_conn_state_ev *ev = llc_conn_ev(skb);
+
+- /*
+- * We have to hold the skb, because llc_conn_service will kfree it in
+- * the sending path and we need to look at the skb->cb, where we encode
+- * llc_conn_state_ev.
+- */
+- skb_get(skb);
+ ev->ind_prim = ev->cfm_prim = 0;
+ /*
+ * Send event to state machine
+@@ -77,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ rc = llc_conn_service(skb->sk, skb);
+ if (unlikely(rc != 0)) {
+ printk(KERN_ERR "%s: llc_conn_service failed\n", __func__);
+- goto out_kfree_skb;
+- }
+-
+- if (unlikely(!ev->ind_prim && !ev->cfm_prim)) {
+- /* indicate or confirm not required */
+- if (!skb->next)
+- goto out_kfree_skb;
+ goto out_skb_put;
+ }
+
+- if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */
+- skb_get(skb);
+-
+ switch (ev->ind_prim) {
+ case LLC_DATA_PRIM:
++ skb_get(skb);
+ llc_save_primitive(sk, skb, LLC_DATA_PRIM);
+ if (unlikely(sock_queue_rcv_skb(sk, skb))) {
+ /*
+@@ -108,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ * skb->sk pointing to the newly created struct sock in
+ * llc_conn_handler. -acme
+ */
++ skb_get(skb);
+ skb_queue_tail(&sk->sk_receive_queue, skb);
+ sk->sk_state_change(sk);
+ break;
+@@ -123,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ sk->sk_state_change(sk);
+ }
+ }
+- kfree_skb(skb);
+ sock_put(sk);
+ break;
+ case LLC_RESET_PRIM:
+@@ -132,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ * RESET is not being notified to upper layers for now
+ */
+ printk(KERN_INFO "%s: received a reset ind!\n", __func__);
+- kfree_skb(skb);
+ break;
+ default:
+- if (ev->ind_prim) {
++ if (ev->ind_prim)
+ printk(KERN_INFO "%s: received unknown %d prim!\n",
+ __func__, ev->ind_prim);
+- kfree_skb(skb);
+- }
+ /* No indication */
+ break;
+ }
+@@ -181,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
+ printk(KERN_INFO "%s: received a reset conf!\n", __func__);
+ break;
+ default:
+- if (ev->cfm_prim) {
++ if (ev->cfm_prim)
+ printk(KERN_INFO "%s: received unknown %d prim!\n",
+ __func__, ev->cfm_prim);
+- break;
+- }
+- goto out_skb_put; /* No confirmation */
++ /* No confirmation */
++ break;
+ }
+-out_kfree_skb:
+- kfree_skb(skb);
+ out_skb_put:
+ kfree_skb(skb);
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 98aed459b0c4dd2fedc09a3d3abf54572657673a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: Call timer_interrupt() with interrupts disabled
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 1efdd4bd254311498123a15fa0acd565f454da97 ]
+
+Some platforms execute their timer handler with the interrupt priority
+level set below 6. That means the handler could be interrupted by another
+driver and this could lead to re-entry of the timer core.
+
+Avoid this by use of local_irq_save/restore for timer interrupt dispatch.
+This provides mutual exclusion around the timer interrupt flag access
+which is needed later in this series for the clocksource conversion.
+
+Reported-by: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1811131407120.2697@nanos.tec.linutronix.de
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/amiga/cia.c | 9 +++++++++
+ arch/m68k/atari/ataints.c | 4 ++--
+ arch/m68k/atari/time.c | 15 ++++++++++++++-
+ arch/m68k/bvme6000/config.c | 20 ++++++++++----------
+ arch/m68k/hp300/time.c | 10 ++++++++--
+ arch/m68k/mac/via.c | 17 +++++++++++++++++
+ arch/m68k/mvme147/config.c | 18 ++++++++++--------
+ arch/m68k/mvme16x/config.c | 21 +++++++++++----------
+ arch/m68k/q40/q40ints.c | 19 +++++++++++--------
+ arch/m68k/sun3/sun3ints.c | 3 +++
+ arch/m68k/sun3x/time.c | 16 ++++++++++------
+ 11 files changed, 105 insertions(+), 47 deletions(-)
+
+diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c
+index 2081b8cd5591c..b9aee983e6f4c 100644
+--- a/arch/m68k/amiga/cia.c
++++ b/arch/m68k/amiga/cia.c
+@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id)
+ struct ciabase *base = dev_id;
+ int mach_irq;
+ unsigned char ints;
++ unsigned long flags;
+
++ /* Interrupts get disabled while the timer irq flag is cleared and
++ * the timer interrupt serviced.
++ */
+ mach_irq = base->cia_irq;
++ local_irq_save(flags);
+ ints = cia_set_irq(base, CIA_ICR_ALL);
+ amiga_custom.intreq = base->int_mask;
++ if (ints & 1)
++ generic_handle_irq(mach_irq);
++ local_irq_restore(flags);
++ mach_irq++, ints >>= 1;
+ for (; ints; mach_irq++, ints >>= 1) {
+ if (ints & 1)
+ generic_handle_irq(mach_irq);
+diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
+index 3d2b63bedf058..56f02ea2c248d 100644
+--- a/arch/m68k/atari/ataints.c
++++ b/arch/m68k/atari/ataints.c
+@@ -142,7 +142,7 @@ struct mfptimerbase {
+ .name = "MFP Timer D"
+ };
+
+-static irqreturn_t mfptimer_handler(int irq, void *dev_id)
++static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id)
+ {
+ struct mfptimerbase *base = dev_id;
+ int mach_irq;
+@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void)
+ st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6;
+
+ /* request timer D dispatch handler */
+- if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED,
++ if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED,
+ stmfp_base.name, &stmfp_base))
+ pr_err("Couldn't register %s interrupt\n", stmfp_base.name);
+
+diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c
+index c549b48174ec8..972181c1fe4b7 100644
+--- a/arch/m68k/atari/time.c
++++ b/arch/m68k/atari/time.c
+@@ -24,6 +24,18 @@
+ DEFINE_SPINLOCK(rtc_lock);
+ EXPORT_SYMBOL_GPL(rtc_lock);
+
++static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id)
++{
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
++}
++
+ void __init
+ atari_sched_init(irq_handler_t timer_routine)
+ {
+@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine)
+ /* start timer C, div = 1:100 */
+ st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60;
+ /* install interrupt service routine for MFP Timer C */
+- if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine))
++ if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer",
++ timer_routine))
+ pr_err("Couldn't register timer interrupt\n");
+ }
+
+diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
+index 478623dbb2092..62054c01ecb45 100644
+--- a/arch/m68k/bvme6000/config.c
++++ b/arch/m68k/bvme6000/config.c
+@@ -46,11 +46,6 @@ extern int bvme6000_set_clock_mmss (unsigned long);
+ extern void bvme6000_reset (void);
+ void bvme6000_set_vectors (void);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+
+ int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -160,12 +155,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id)
+
+ static irqreturn_t bvme6000_timer_int (int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+ volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE;
+- unsigned char msr = rtc->msr & 0xc0;
++ unsigned char msr;
+
++ local_irq_save(flags);
++ msr = rtc->msr & 0xc0;
+ rtc->msr = msr | 0x20; /* Ack the interrupt */
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
+
+- return tick_handler(irq, dev_id);
++ return IRQ_HANDLED;
+ }
+
+ /*
+@@ -184,9 +185,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine)
+
+ rtc->msr = 0; /* Ensure timer registers accessible */
+
+- tick_handler = timer_routine;
+- if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0,
+- "timer", bvme6000_timer_int))
++ if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer",
++ timer_routine))
+ panic ("Couldn't register timer int");
+
+ rtc->t1cr_omr = 0x04; /* Mode 2, ext clk */
+diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c
+index 749543b425a4b..03c83b8f90328 100644
+--- a/arch/m68k/hp300/time.c
++++ b/arch/m68k/hp300/time.c
+@@ -37,13 +37,19 @@
+
+ static irqreturn_t hp300_tick(int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+ unsigned long tmp;
+- irq_handler_t vector = dev_id;
++
++ local_irq_save(flags);
+ in_8(CLOCKBASE + CLKSR);
+ asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE));
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
+ /* Turn off the network and SCSI leds */
+ blinken_leds(0, 0xe0);
+- return vector(irq, NULL);
++ return IRQ_HANDLED;
+ }
+
+ u32 hp300_gettimeoffset(void)
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index 2d687518c76fe..49f9fa4529a83 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -397,6 +397,8 @@ void via_nubus_irq_shutdown(int irq)
+ * via6522.c :-), disable/pending masks added.
+ */
+
++#define VIA_TIMER_1_INT BIT(6)
++
+ void via1_irq(struct irq_desc *desc)
+ {
+ int irq_num;
+@@ -406,6 +408,21 @@ void via1_irq(struct irq_desc *desc)
+ if (!events)
+ return;
+
++ irq_num = IRQ_MAC_TIMER_1;
++ irq_bit = VIA_TIMER_1_INT;
++ if (events & irq_bit) {
++ unsigned long flags;
++
++ local_irq_save(flags);
++ via1[vIFR] = irq_bit;
++ generic_handle_irq(irq_num);
++ local_irq_restore(flags);
++
++ events &= ~irq_bit;
++ if (!events)
++ return;
++ }
++
+ irq_num = VIA1_SOURCE_BASE;
+ irq_bit = 1;
+ do {
+diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
+index e6a3b56c6481d..152fbde234243 100644
+--- a/arch/m68k/mvme147/config.c
++++ b/arch/m68k/mvme147/config.c
+@@ -47,11 +47,6 @@ extern void mvme147_reset (void);
+
+ static int bcd2int (unsigned char b);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme147_process_int() */
+-
+-irq_handler_t tick_handler;
+-
+
+ int __init mvme147_parse_bootinfo(const struct bi_record *bi)
+ {
+@@ -107,16 +102,23 @@ void __init config_mvme147(void)
+
+ static irqreturn_t mvme147_timer_int (int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
+ m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR;
+ m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1;
+- return tick_handler(irq, dev_id);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
+ }
+
+
+ void mvme147_sched_init (irq_handler_t timer_routine)
+ {
+- tick_handler = timer_routine;
+- if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL))
++ if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1",
++ timer_routine))
+ pr_err("Couldn't register timer interrupt\n");
+
+ /* Init the clock with a value */
+diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
+index a53803cc66cde..0d43bfb3324d7 100644
+--- a/arch/m68k/mvme16x/config.c
++++ b/arch/m68k/mvme16x/config.c
+@@ -52,11 +52,6 @@ extern void mvme16x_reset (void);
+
+ int bcd2int (unsigned char b);
+
+-/* Save tick handler routine pointer, will point to xtime_update() in
+- * kernel/time/timekeeping.c, called via mvme16x_process_int() */
+-
+-static irq_handler_t tick_handler;
+-
+
+ unsigned short mvme16x_config;
+ EXPORT_SYMBOL(mvme16x_config);
+@@ -355,8 +350,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
+
+ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
+ {
+- *(volatile unsigned char *)0xfff4201b |= 8;
+- return tick_handler(irq, dev_id);
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ *(volatile unsigned char *)0xfff4201b |= 8;
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++
++ return IRQ_HANDLED;
+ }
+
+ void mvme16x_sched_init (irq_handler_t timer_routine)
+@@ -364,14 +366,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
+ uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
+ int irq;
+
+- tick_handler = timer_routine;
+ /* Using PCCchip2 or MC2 chip tick timer 1 */
+ *(volatile unsigned long *)0xfff42008 = 0;
+ *(volatile unsigned long *)0xfff42004 = 10000; /* 10ms */
+ *(volatile unsigned char *)0xfff42017 |= 3;
+ *(volatile unsigned char *)0xfff4201b = 0x16;
+- if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0,
+- "timer", mvme16x_timer_int))
++ if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer",
++ timer_routine))
+ panic ("Couldn't register timer int");
+
+ if (brdno == 0x0162 || brdno == 0x172)
+diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c
+index 513f9bb17b9cf..60b51f5b9cfc0 100644
+--- a/arch/m68k/q40/q40ints.c
++++ b/arch/m68k/q40/q40ints.c
+@@ -126,10 +126,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks)
+ sound_ticks = ticks << 1;
+ }
+
+-static irq_handler_t q40_timer_routine;
+-
+-static irqreturn_t q40_timer_int (int irq, void * dev)
++static irqreturn_t q40_timer_int(int irq, void *dev_id)
+ {
++ irq_handler_t timer_routine = dev_id;
++
+ ql_ticks = ql_ticks ? 0 : 1;
+ if (sound_ticks) {
+ unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL;
+@@ -138,8 +138,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev)
+ *DAC_RIGHT=sval;
+ }
+
+- if (!ql_ticks)
+- q40_timer_routine(irq, dev);
++ if (!ql_ticks) {
++ unsigned long flags;
++
++ local_irq_save(flags);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
++ }
+ return IRQ_HANDLED;
+ }
+
+@@ -147,11 +152,9 @@ void q40_sched_init (irq_handler_t timer_routine)
+ {
+ int timer_irq;
+
+- q40_timer_routine = timer_routine;
+ timer_irq = Q40_IRQ_FRAME;
+
+- if (request_irq(timer_irq, q40_timer_int, 0,
+- "timer", q40_timer_int))
++ if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine))
+ panic("Couldn't register timer int");
+
+ master_outb(-1, FRAME_CLEAR_REG);
+diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c
+index 6bbca30c91884..a5824abb4a39c 100644
+--- a/arch/m68k/sun3/sun3ints.c
++++ b/arch/m68k/sun3/sun3ints.c
+@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id)
+
+ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ {
++ unsigned long flags;
+ unsigned int cnt;
+
++ local_irq_save(flags);
+ #ifdef CONFIG_SUN3
+ intersil_clear();
+ #endif
+@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id)
+ cnt = kstat_irqs_cpu(irq, 0);
+ if (!(cnt % 20))
+ sun3_leds(led_pattern[cnt % 160 / 20]);
++ local_irq_restore(flags);
+ return IRQ_HANDLED;
+ }
+
+diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c
+index c8eb08add6b08..7a195313ff4ff 100644
+--- a/arch/m68k/sun3x/time.c
++++ b/arch/m68k/sun3x/time.c
+@@ -77,15 +77,19 @@ u32 sun3x_gettimeoffset(void)
+ }
+
+ #if 0
+-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs)
++static irqreturn_t sun3x_timer_tick(int irq, void *dev_id)
+ {
+- void (*vector)(int, void *, struct pt_regs *) = dev_id;
++ irq_handler_t timer_routine = dev_id;
++ unsigned long flags;
+
+- /* Clear the pending interrupt - pulse the enable line low */
+- disable_irq(5);
+- enable_irq(5);
++ local_irq_save(flags);
++ /* Clear the pending interrupt - pulse the enable line low */
++ disable_irq(5);
++ enable_irq(5);
++ timer_routine(0, NULL);
++ local_irq_restore(flags);
+
+- vector(irq, NULL, regs);
++ return IRQ_HANDLED;
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 80616e3d3678ea8ba0a892db83b489022309a1d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Dec 2018 11:53:10 +1100
+Subject: m68k: mac: Fix VIA timer counter accesses
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ]
+
+This resolves some bugs that affect VIA timer counter accesses.
+Avoid lost interrupts caused by reading the counter low byte register.
+Make allowance for the fact that the counter will be decremented to
+0xFFFF before being reloaded.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/m68k/mac/via.c | 102 +++++++++++++++++++++++---------------------
+ 1 file changed, 53 insertions(+), 49 deletions(-)
+
+diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
+index ce56e04386e70..2d687518c76fe 100644
+--- a/arch/m68k/mac/via.c
++++ b/arch/m68k/mac/via.c
+@@ -53,16 +53,6 @@ static __u8 rbv_clear;
+
+ static int gIER,gIFR,gBufA,gBufB;
+
+-/*
+- * Timer defs.
+- */
+-
+-#define TICK_SIZE 10000
+-#define MAC_CLOCK_TICK (783300/HZ) /* ticks per HZ */
+-#define MAC_CLOCK_LOW (MAC_CLOCK_TICK&0xFF)
+-#define MAC_CLOCK_HIGH (MAC_CLOCK_TICK>>8)
+-
+-
+ /*
+ * On Macs with a genuine VIA chip there is no way to mask an individual slot
+ * interrupt. This limitation also seems to apply to VIA clone logic cores in
+@@ -277,22 +267,6 @@ void __init via_init(void)
+ }
+ }
+
+-/*
+- * Start the 100 Hz clock
+- */
+-
+-void __init via_init_clock(irq_handler_t func)
+-{
+- via1[vACR] |= 0x40;
+- via1[vT1LL] = MAC_CLOCK_LOW;
+- via1[vT1LH] = MAC_CLOCK_HIGH;
+- via1[vT1CL] = MAC_CLOCK_LOW;
+- via1[vT1CH] = MAC_CLOCK_HIGH;
+-
+- if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func))
+- pr_err("Couldn't register %s interrupt\n", "timer");
+-}
+-
+ /*
+ * Debugging dump, used in various places to see what's going on.
+ */
+@@ -320,29 +294,6 @@ void via_debug_dump(void)
+ }
+ }
+
+-/*
+- * This is always executed with interrupts disabled.
+- *
+- * TBI: get time offset between scheduling timer ticks
+- */
+-
+-u32 mac_gettimeoffset(void)
+-{
+- unsigned long ticks, offset = 0;
+-
+- /* read VIA1 timer 2 current value */
+- ticks = via1[vT1CL] | (via1[vT1CH] << 8);
+- /* The probability of underflow is less than 2% */
+- if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50)
+- /* Check for pending timer interrupt in VIA1 IFR */
+- if (via1[vIFR] & 0x40) offset = TICK_SIZE;
+-
+- ticks = MAC_CLOCK_TICK - ticks;
+- ticks = ticks * 10000L / MAC_CLOCK_TICK;
+-
+- return (ticks + offset) * 1000;
+-}
+-
+ /*
+ * Flush the L2 cache on Macs that have it by flipping
+ * the system into 24-bit mode for an instant.
+@@ -619,3 +570,56 @@ int via2_scsi_drq_pending(void)
+ return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ));
+ }
+ EXPORT_SYMBOL(via2_scsi_drq_pending);
++
++/* timer and clock source */
++
++#define VIA_CLOCK_FREQ 783360 /* VIA "phase 2" clock in Hz */
++#define VIA_TIMER_INTERVAL (1000000 / HZ) /* microseconds per jiffy */
++#define VIA_TIMER_CYCLES (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */
++
++#define VIA_TC (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */
++#define VIA_TC_LOW (VIA_TC & 0xFF)
++#define VIA_TC_HIGH (VIA_TC >> 8)
++
++void __init via_init_clock(irq_handler_t timer_routine)
++{
++ if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) {
++ pr_err("Couldn't register %s interrupt\n", "timer");
++ return;
++ }
++
++ via1[vT1LL] = VIA_TC_LOW;
++ via1[vT1LH] = VIA_TC_HIGH;
++ via1[vT1CL] = VIA_TC_LOW;
++ via1[vT1CH] = VIA_TC_HIGH;
++ via1[vACR] |= 0x40;
++}
++
++u32 mac_gettimeoffset(void)
++{
++ unsigned long flags;
++ u8 count_high;
++ u16 count, offset = 0;
++
++ /*
++ * Timer counter wrap-around is detected with the timer interrupt flag
++ * but reading the counter low byte (vT1CL) would reset the flag.
++ * Also, accessing both counter registers is essentially a data race.
++ * These problems are avoided by ignoring the low byte. Clock accuracy
++ * is 256 times worse (error can reach 0.327 ms) but CPU overhead is
++ * reduced by avoiding slow VIA register accesses.
++ */
++
++ local_irq_save(flags);
++ count_high = via1[vT1CH];
++ if (count_high == 0xFF)
++ count_high = 0;
++ if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT))
++ offset = VIA_TIMER_CYCLES;
++ local_irq_restore(flags);
++
++ count = count_high << 8;
++ count = VIA_TIMER_CYCLES - count + offset;
++
++ return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000;
++}
+--
+2.20.1
+
--- /dev/null
+From d0e07ab3df745f98b1980af150ffd0079ede5d62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 15:37:05 +0300
+Subject: mac80211: accept deauth frames in IBSS mode
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 95697f9907bfe3eab0ef20265a766b22e27dde64 ]
+
+We can process deauth frames and all, but we drop them very
+early in the RX path today - this could never have worked.
+
+Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rx.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 3b8e2f97d8151..2b7975c4dac7b 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -3040,9 +3040,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
+ case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
+ /* process for all: mesh, mlme, ibss */
+ break;
++ case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
++ if (is_multicast_ether_addr(mgmt->da) &&
++ !is_broadcast_ether_addr(mgmt->da))
++ return RX_DROP_MONITOR;
++
++ /* process only for station/IBSS */
++ if (sdata->vif.type != NL80211_IFTYPE_STATION &&
++ sdata->vif.type != NL80211_IFTYPE_ADHOC)
++ return RX_DROP_MONITOR;
++ break;
+ case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
+ case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
+- case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
+ case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
+ if (is_multicast_ether_addr(mgmt->da) &&
+ !is_broadcast_ether_addr(mgmt->da))
+--
+2.20.1
+
--- /dev/null
+From c8ce3d31033c6bc60ab356ede2f76daede9f9da4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 20 Aug 2019 11:54:46 +0200
+Subject: mac80211: minstrel_ht: fix per-group max throughput rate
+ initialization
+
+From: Felix Fietkau <nbd@nbd.name>
+
+[ Upstream commit 56dd918ff06e3ee24d8067e93ed12b2a39e71394 ]
+
+The group number needs to be multiplied by the number of rates per group
+to get the full rate index
+
+Fixes: 5935839ad735 ("mac80211: improve minstrel_ht rate sorting by throughput & probability")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20190820095449.45255-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/rc80211_minstrel_ht.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
+index ff3b28e7dbce8..fb44f0107da1b 100644
+--- a/net/mac80211/rc80211_minstrel_ht.c
++++ b/net/mac80211/rc80211_minstrel_ht.c
+@@ -546,7 +546,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
+
+ /* (re)Initialize group rate indexes */
+ for(j = 0; j < MAX_THR_RATES; j++)
+- tmp_group_tp_rate[j] = group;
++ tmp_group_tp_rate[j] = MCS_GROUP_RATES * group;
+
+ for (i = 0; i < MCS_GROUP_RATES; i++) {
+ if (!(mg->supported & BIT(i)))
+--
+2.20.1
+
--- /dev/null
+From 700c2699d8261dedeb09bf984a8b9f39905b785c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:37:02 -0500
+Subject: media: cx18: update *pos correctly in cx18_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ]
+
+We should be updating *pos. The current code is a no-op.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx18/cx18-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index df837408efd59..0171dc5b8809e 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -490,7 +490,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+
+ CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 94d8b55ee798c9c3c6937674ffe9b08a66b2e4e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 19 Jan 2019 22:52:23 -0500
+Subject: media: cx23885: check allocation return
+
+From: Nicholas Mc Guire <hofrat@osadl.org>
+
+[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ]
+
+Checking of kmalloc() seems to have been committed - as
+cx23885_dvb_register() is checking for != 0 return, returning
+-ENOMEM should be fine here. While at it address the coccicheck
+suggestion to move to kmemdup rather than using kmalloc+memcpy.
+
+Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index e543cbbf2ec4f..8fe78b8b1c25b 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1452,8 +1452,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ if (fe0->dvb.frontend != NULL) {
+ struct i2c_adapter *tun_i2c;
+
+- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++ if (!fe0->dvb.frontend->sec_priv)
++ return -ENOMEM;
+ tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From 73309c852355d34361da8b153e81a3234a731199 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 10:34:22 -0400
+Subject: media: davinci-isif: avoid uninitialized variable use
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ]
+
+clang warns about a possible variable use that gcc never
+complained about:
+
+drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
+ [-Werror,-Wuninitialized]
+ dm365_vpss_set_pg_frame_size(frame_size);
+ ^~~~~~~~~~
+drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
+ struct vpss_pg_frame_size frame_size;
+ ^
+1 error generated.
+
+There is no initialization for this variable at all, and there
+has never been one in the mainline kernel, so we really should
+not put that stack data into an mmio register.
+
+On the other hand, I suspect that gcc checks the condition
+more closely and notices that the global
+isif_cfg.bayer.config_params.test_pat_gen flag is initialized
+to zero and never written to from any code path, so anything
+depending on it can be eliminated.
+
+To shut up the clang warning, just remove the dead code manually,
+it has probably never been used because any attempt to do so
+would have resulted in undefined behavior.
+
+Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/isif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 78e37cf3470f2..b51b875c5a612 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -890,9 +890,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+- struct vpss_pg_frame_size frame_size;
+ u32 modeset = 0, ccdcfg = 0;
+- struct vpss_sync_pol sync;
+
+ dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+
+@@ -980,13 +978,6 @@ static int isif_config_ycbcr(void)
+ /* two fields are interleaved in memory */
+ regw(0x00000249, SDOFST);
+
+- /* Setup test pattern if enabled */
+- if (isif_cfg.bayer.config_params.test_pat_gen) {
+- sync.ccdpg_hdpol = params->hd_pol;
+- sync.ccdpg_vdpol = params->vd_pol;
+- dm365_vpss_set_sync_pol(sync);
+- dm365_vpss_set_pg_frame_size(frame_size);
+- }
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 19559f996f1be0283a5c53cc7e164598b414f1d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 05:46:27 -0400
+Subject: media: davinci/vpbe: array underflow in vpbe_enum_outputs()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ]
+
+In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but
+the problem is that "temp_index" can be negative. This patch changes
+the types to unsigned to address this array underflow bug.
+
+Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/davinci/vpbe.c | 2 +-
+ include/media/davinci/vpbe.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c
+index abce9c4a1a8ec..59518c08528b8 100644
+--- a/drivers/media/platform/davinci/vpbe.c
++++ b/drivers/media/platform/davinci/vpbe.c
+@@ -130,7 +130,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev,
+ struct v4l2_output *output)
+ {
+ struct vpbe_config *cfg = vpbe_dev->cfg;
+- int temp_index = output->index;
++ unsigned int temp_index = output->index;
+
+ if (temp_index >= cfg->num_outputs)
+ return -EINVAL;
+diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h
+index 4376beeb28c2c..5d8ceeddc7973 100644
+--- a/include/media/davinci/vpbe.h
++++ b/include/media/davinci/vpbe.h
+@@ -96,7 +96,7 @@ struct vpbe_config {
+ struct encoder_config_info *ext_encoders;
+ /* amplifier information goes here */
+ struct amp_config_info *amp;
+- int num_outputs;
++ unsigned int num_outputs;
+ /* Order is venc outputs followed by LCD and then external encoders */
+ struct vpbe_output *outputs;
+ };
+--
+2.20.1
+
--- /dev/null
+From fb066247608d36f5a62afa255ac78bc28a1a019e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Feb 2019 01:36:41 -0500
+Subject: media: ivtv: update *pos correctly in ivtv_read_pos()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ]
+
+We had intended to update *pos, but the current code is a no-op.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 605d280d8a5f0..cb65fe6c49e01 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+
+ IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 86c069fc3b307bb6ebea23bfb50e0b73915d24e9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 11 Apr 2019 05:01:57 -0400
+Subject: media: omap_vout: potential buffer overflow in vidioc_dqbuf()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ]
+
+The "b->index" is a u32 the comes from the user in the ioctl. It hasn't
+been checked. We aren't supposed to use it but we're instead supposed
+to use the value that gets written to it when we call videobuf_dqbuf().
+
+The videobuf_dqbuf() first memsets it to zero and then re-initializes it
+inside the videobuf_status() function. It's this final value which we
+want.
+
+Hans Verkuil pointed out that we need to check the return from
+videobuf_dqbuf(). I ended up doing a little cleanup related to that as
+well.
+
+Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/omap/omap_vout.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c
+index 5963595761096..cf015bfc559bb 100644
+--- a/drivers/media/platform/omap/omap_vout.c
++++ b/drivers/media/platform/omap/omap_vout.c
+@@ -1580,23 +1580,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b)
+ unsigned long size;
+ struct videobuf_buffer *vb;
+
+- vb = q->bufs[b->index];
+-
+ if (!vout->streaming)
+ return -EINVAL;
+
+- if (file->f_flags & O_NONBLOCK)
+- /* Call videobuf_dqbuf for non blocking mode */
+- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
+- else
+- /* Call videobuf_dqbuf for blocking mode */
+- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
++ ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
++ if (ret)
++ return ret;
++
++ vb = q->bufs[b->index];
+
+ addr = (unsigned long) vout->buf_phy_addr[vb->i];
+ size = (unsigned long) vb->size;
+ dma_unmap_single(vout->vid_dev->v4l2_dev.dev, addr,
+ size, DMA_TO_DEVICE);
+- return ret;
++ return 0;
+ }
+
+ static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
+--
+2.20.1
+
--- /dev/null
+From 32d048a8c4b65b1f7b9e57a2807d76b72316fe51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 10:01:32 -0400
+Subject: media: ov2659: fix unbalanced mutex_lock/unlock
+
+From: Akinobu Mita <akinobu.mita@gmail.com>
+
+[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ]
+
+Avoid returning with mutex locked.
+
+Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
+
+Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/ov2659.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index 6eefb8bbb5b54..20e3c56991cf6 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1137,7 +1137,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ *mf = fmt->format;
+ #else
+- return -ENOTTY;
++ ret = -ENOTTY;
+ #endif
+ } else {
+ s64 val;
+--
+2.20.1
+
--- /dev/null
+From 4bd3b165e2ce925c16f14a9561296d606d656018 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:41 -0300
+Subject: media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 39034bb0c26b76a2c3abc54aa28c185f18b40c2f ]
+
+Commit da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad
+op get_fmt") converted a former ov6650_g_fmt() video operation callback
+to an ov6650_get_fmt() pad operation callback. However, the converted
+function disregards a format->which flag that pad operations should
+obey and always returns active frame format settings.
+
+That can be fixed by always responding to V4L2_SUBDEV_FORMAT_TRY with
+-EINVAL, or providing the response from a pad config argument, likely
+updated by a former user call to V4L2_SUBDEV_FORMAT_TRY .set_fmt().
+Since implementation of the latter is trivial, go for it.
+
+Fixes: da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad op get_fmt")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/soc_camera/ov6650.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
+index 01f82c3fc1d1c..7928ea8528e1b 100644
+--- a/drivers/media/i2c/soc_camera/ov6650.c
++++ b/drivers/media/i2c/soc_camera/ov6650.c
+@@ -524,10 +524,16 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
+ *mf = ov6650_def_fmt;
+
+ /* update media bus format code and frame size */
+- mf->width = priv->rect.width >> priv->half_scale;
+- mf->height = priv->rect.height >> priv->half_scale;
+- mf->code = priv->code;
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ mf->width = cfg->try_fmt.width;
++ mf->height = cfg->try_fmt.height;
++ mf->code = cfg->try_fmt.code;
+
++ } else {
++ mf->width = priv->rect.width >> priv->half_scale;
++ mf->height = priv->rect.height >> priv->half_scale;
++ mf->code = priv->code;
++ }
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8f79655a471259125a6546b7a056bca7cf19dcbe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:39 -0300
+Subject: media: ov6650: Fix incorrect use of JPEG colorspace
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 12500731895ef09afc5b66b86b76c0884fb9c7bf ]
+
+Since its initial submission, the driver selects V4L2_COLORSPACE_JPEG
+for supported formats other than V4L2_MBUS_FMT_SBGGR8_1X8. According
+to v4l2-compliance test program, V4L2_COLORSPACE_JPEG applies
+exclusively to V4L2_PIX_FMT_JPEG. Since the sensor does not support
+JPEG format, fix it to always select V4L2_COLORSPACE_SRGB.
+
+Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/soc_camera/ov6650.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
+index bb55ddfbf7337..7adbfc57cffa5 100644
+--- a/drivers/media/i2c/soc_camera/ov6650.c
++++ b/drivers/media/i2c/soc_camera/ov6650.c
+@@ -203,7 +203,6 @@ struct ov6650 {
+ unsigned long pclk_max; /* from resolution and format */
+ struct v4l2_fract tpf; /* as requested with s_parm */
+ u32 code;
+- enum v4l2_colorspace colorspace;
+ };
+
+
+@@ -513,7 +512,7 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
+ mf->width = priv->rect.width >> priv->half_scale;
+ mf->height = priv->rect.height >> priv->half_scale;
+ mf->code = priv->code;
+- mf->colorspace = priv->colorspace;
++ mf->colorspace = V4L2_COLORSPACE_SRGB;
+ mf->field = V4L2_FIELD_NONE;
+
+ return 0;
+@@ -623,11 +622,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ priv->pclk_max = 8000000;
+ }
+
+- if (code == MEDIA_BUS_FMT_SBGGR8_1X8)
+- priv->colorspace = V4L2_COLORSPACE_SRGB;
+- else if (code != 0)
+- priv->colorspace = V4L2_COLORSPACE_JPEG;
+-
+ if (half_scale) {
+ dev_dbg(&client->dev, "max resolution: QCIF\n");
+ coma_set |= COMA_QCIF;
+@@ -684,7 +678,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ priv->code = code;
+
+ if (!ret) {
+- mf->colorspace = priv->colorspace;
+ mf->width = priv->rect.width >> half_scale;
+ mf->height = priv->rect.height >> half_scale;
+ }
+@@ -707,6 +700,7 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ &mf->height, 2, H_CIF, 1, 0);
+
+ mf->field = V4L2_FIELD_NONE;
++ mf->colorspace = V4L2_COLORSPACE_SRGB;
+
+ switch (mf->code) {
+ case MEDIA_BUS_FMT_Y10_1X10:
+@@ -716,12 +710,10 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ case MEDIA_BUS_FMT_YUYV8_2X8:
+ case MEDIA_BUS_FMT_VYUY8_2X8:
+ case MEDIA_BUS_FMT_UYVY8_2X8:
+- mf->colorspace = V4L2_COLORSPACE_JPEG;
+ break;
+ default:
+ mf->code = MEDIA_BUS_FMT_SBGGR8_1X8;
+ case MEDIA_BUS_FMT_SBGGR8_1X8:
+- mf->colorspace = V4L2_COLORSPACE_SRGB;
+ break;
+ }
+
+@@ -1048,7 +1040,6 @@ static int ov6650_probe(struct i2c_client *client,
+ priv->rect.height = H_CIF;
+ priv->half_scale = false;
+ priv->code = MEDIA_BUS_FMT_YUYV8_2X8;
+- priv->colorspace = V4L2_COLORSPACE_JPEG;
+
+ ret = ov6650_video_probe(client);
+ if (ret)
+--
+2.20.1
+
--- /dev/null
+From 29d8d67efc0f40938dc00793b59d56d33b8ddab6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Sep 2019 17:11:40 -0300
+Subject: media: ov6650: Fix some format attributes not under control
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+[ Upstream commit 1c6a2b63095154bbf9e8f38d79487a728331bf65 ]
+
+User arguments passed to .get/set_fmt() pad operation callbacks may
+contain unsupported values. The driver takes control over frame size
+and pixel code as well as colorspace and field attributes but has never
+cared for remainig format attributes, i.e., ycbcr_enc, quantization
+and xfer_func, introduced by commit 11ff030c7365 ("[media]
+v4l2-mediabus: improve colorspace support"). Fix it.
+
+Set up a static v4l2_mbus_framefmt structure with attributes
+initialized to reasonable defaults and use it for updating content of
+user provided arguments. In case of V4L2_SUBDEV_FORMAT_ACTIVE,
+postpone frame size update, now performed from inside ov6650_s_fmt()
+helper, util the user argument is first updated in ov6650_set_fmt() with
+default frame format content. For V4L2_SUBDEV_FORMAT_TRY, don't copy
+all attributes to pad config, only those handled by the driver, then
+fill the response with the default frame format updated with resulting
+pad config format code and frame size.
+
+Fixes: 11ff030c7365 ("[media] v4l2-mediabus: improve colorspace support")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/i2c/soc_camera/ov6650.c | 51 ++++++++++++++++++++-------
+ 1 file changed, 39 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/media/i2c/soc_camera/ov6650.c b/drivers/media/i2c/soc_camera/ov6650.c
+index 7adbfc57cffa5..01f82c3fc1d1c 100644
+--- a/drivers/media/i2c/soc_camera/ov6650.c
++++ b/drivers/media/i2c/soc_camera/ov6650.c
+@@ -215,6 +215,17 @@ static u32 ov6650_codes[] = {
+ MEDIA_BUS_FMT_Y8_1X8,
+ };
+
++static const struct v4l2_mbus_framefmt ov6650_def_fmt = {
++ .width = W_CIF,
++ .height = H_CIF,
++ .code = MEDIA_BUS_FMT_SBGGR8_1X8,
++ .colorspace = V4L2_COLORSPACE_SRGB,
++ .field = V4L2_FIELD_NONE,
++ .ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT,
++ .quantization = V4L2_QUANTIZATION_DEFAULT,
++ .xfer_func = V4L2_XFER_FUNC_DEFAULT,
++};
++
+ /* read a register */
+ static int ov6650_reg_read(struct i2c_client *client, u8 reg, u8 *val)
+ {
+@@ -509,11 +520,13 @@ static int ov6650_get_fmt(struct v4l2_subdev *sd,
+ if (format->pad)
+ return -EINVAL;
+
++ /* initialize response with default media bus frame format */
++ *mf = ov6650_def_fmt;
++
++ /* update media bus format code and frame size */
+ mf->width = priv->rect.width >> priv->half_scale;
+ mf->height = priv->rect.height >> priv->half_scale;
+ mf->code = priv->code;
+- mf->colorspace = V4L2_COLORSPACE_SRGB;
+- mf->field = V4L2_FIELD_NONE;
+
+ return 0;
+ }
+@@ -677,10 +690,6 @@ static int ov6650_s_fmt(struct v4l2_subdev *sd, struct v4l2_mbus_framefmt *mf)
+ if (!ret)
+ priv->code = code;
+
+- if (!ret) {
+- mf->width = priv->rect.width >> half_scale;
+- mf->height = priv->rect.height >> half_scale;
+- }
+ return ret;
+ }
+
+@@ -699,9 +708,6 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
+ &mf->height, 2, H_CIF, 1, 0);
+
+- mf->field = V4L2_FIELD_NONE;
+- mf->colorspace = V4L2_COLORSPACE_SRGB;
+-
+ switch (mf->code) {
+ case MEDIA_BUS_FMT_Y10_1X10:
+ mf->code = MEDIA_BUS_FMT_Y8_1X8;
+@@ -717,10 +723,31 @@ static int ov6650_set_fmt(struct v4l2_subdev *sd,
+ break;
+ }
+
+- if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
+- return ov6650_s_fmt(sd, mf);
+- cfg->try_fmt = *mf;
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ /* store media bus format code and frame size in pad config */
++ cfg->try_fmt.width = mf->width;
++ cfg->try_fmt.height = mf->height;
++ cfg->try_fmt.code = mf->code;
+
++ /* return default mbus frame format updated with pad config */
++ *mf = ov6650_def_fmt;
++ mf->width = cfg->try_fmt.width;
++ mf->height = cfg->try_fmt.height;
++ mf->code = cfg->try_fmt.code;
++
++ } else {
++ /* apply new media bus format code and frame size */
++ int ret = ov6650_s_fmt(sd, mf);
++
++ if (ret)
++ return ret;
++
++ /* return default format updated with active size and code */
++ *mf = ov6650_def_fmt;
++ mf->width = priv->rect.width >> priv->half_scale;
++ mf->height = priv->rect.height >> priv->half_scale;
++ mf->code = priv->code;
++ }
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2916ffcc47465c232bb8ee0cef6b3d027aa310e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Jan 2019 13:00:41 -0500
+Subject: media: s5p-jpeg: Correct step and max values for
+ V4L2_CID_JPEG_RESTART_INTERVAL
+
+From: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+
+[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ]
+
+This commit corrects max and step values for v4l2 control for
+V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1.
+It was found by using v4l2-compliance tool and checking result of
+VIDIOC_QUERY_EXT_CTRL/QUERYMENU test.
+Previously it was complaining that step was bigger than difference
+between max and min.
+
+Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support")
+
+Signed-off-by: Pawe? Chmiel <pawel.mikolaj.chmiel@gmail.com>
+Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+index 0d981bbf38bcd..255f70999ee8a 100644
+--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
+@@ -1952,7 +1952,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx)
+
+ v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops,
+ V4L2_CID_JPEG_RESTART_INTERVAL,
+- 0, 3, 0xffff, 0);
++ 0, 0xffff, 1, 0);
+ if (ctx->jpeg->variant->version == SJPEG_S5P)
+ mask = ~0x06; /* 422, 420 */
+ }
+--
+2.20.1
+
--- /dev/null
+From c9dd32f313e5c89b237078e56be26b804a72aa52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 10:55:15 -0400
+Subject: media: vivid: fix incorrect assignment operation when setting video
+ mode
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c ]
+
+The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a
+bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment,
+otherwise the previous clearing of the FB_VMODE_MASK bits of
+var->vmode makes no sense and is redundant.
+
+Addresses-Coverity: ("Unused value")
+Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vivid/vivid-osd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
+index e15eef6a94e55..f3afc74f98eda 100644
+--- a/drivers/media/platform/vivid/vivid-osd.c
++++ b/drivers/media/platform/vivid/vivid-osd.c
+@@ -167,7 +167,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
+ var->nonstd = 0;
+
+ var->vmode &= ~FB_VMODE_MASK;
+- var->vmode = FB_VMODE_NONINTERLACED;
++ var->vmode |= FB_VMODE_NONINTERLACED;
+
+ /* Dummy values */
+ var->hsync_len = 24;
+--
+2.20.1
+
--- /dev/null
+From 1edb0c21d37c26514536b031e440d7a681cd6e5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Mar 2019 02:27:43 -0500
+Subject: media: wl128x: Fix an error code in fm_download_firmware()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ]
+
+We forgot to set "ret" on this error path.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 51639a3f7abe4..0cee10cca0e57 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1278,8 +1278,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+
+ switch (action->type) {
+ case ACTION_SEND_COMMAND: /* Send */
+- if (fmc_send_cmd(fmdev, 0, 0, action->data,
+- action->size, NULL, NULL))
++ ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++ action->size, NULL, NULL);
++ if (ret)
+ goto rel_fw;
+
+ cmd_cnt++;
+--
+2.20.1
+
--- /dev/null
+From e06bfc75fb3d0965f372546c4733c39ccc5940f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Jun 2019 15:56:31 +0300
+Subject: mfd: intel-lpss: Release IDA resources
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 02f36911c1b41fcd8779fa0c135aab0554333fa5 ]
+
+ida instances allocate some internal memory for ->free_bitmap
+in addition to the base 'struct ida'. Use ida_destroy() to release
+that memory at module_exit().
+
+Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mfd/intel-lpss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
+index 4988751933867..adbb23b6595f6 100644
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -525,6 +525,7 @@ module_init(intel_lpss_init);
+
+ static void __exit intel_lpss_exit(void)
+ {
++ ida_destroy(&intel_lpss_devid_ida);
+ debugfs_remove(intel_lpss_debugfs);
+ }
+ module_exit(intel_lpss_exit);
+--
+2.20.1
+
--- /dev/null
+From a83487a10c944b107a486c50e59385135b74eeb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Jul 2019 11:24:09 +0200
+Subject: mic: avoid statically declaring a 'struct device'.
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit bc83f79bd2119230888fb8574639d5a51b38f903 ]
+
+Generally, declaring a platform device as a static variable is
+a bad idea and can cause all kinds of problems, in particular
+with the DMA configuration and lifetime rules.
+
+A specific problem we hit here is from a bug in clang that warns
+about certain (otherwise valid) macros when used in static variables:
+
+drivers/misc/mic/card/mic_x100.c:285:27: warning: shift count >= width of type [-Wshift-count-overflow]
+static u64 mic_dma_mask = DMA_BIT_MASK(64);
+ ^~~~~~~~~~~~~~~~
+include/linux/dma-mapping.h:141:54: note: expanded from macro 'DMA_BIT_MASK'
+ #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
+ ^ ~~~
+
+A slightly better way here is to create the platform device dynamically
+and set the dma mask in the probe function.
+This avoids the warning and some other problems, but is still not ideal
+because the device creation should really be separated from the driver,
+and the fact that the device has no parent means we have to force
+the dma mask rather than having it set up from the bus that the device
+is actually on.
+
+Fixes: dd8d8d44df64 ("misc: mic: MIC card driver specific changes to enable SCIF")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190712092426.872625-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/mic/card/mic_x100.c | 28 ++++++++++++----------------
+ 1 file changed, 12 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
+index b2958ce2368c7..cd778e2b4f3ea 100644
+--- a/drivers/misc/mic/card/mic_x100.c
++++ b/drivers/misc/mic/card/mic_x100.c
+@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev)
+ mdrv->dev = &pdev->dev;
+ snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name);
+
++ /* FIXME: use dma_set_mask_and_coherent() and check result */
++ dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++
+ mdev->mmio.pa = MIC_X100_MMIO_BASE;
+ mdev->mmio.len = MIC_X100_MMIO_LEN;
+ mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE,
+@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev)
+ mic_remove(pdev);
+ }
+
+-static u64 mic_dma_mask = DMA_BIT_MASK(64);
+-
+-static struct platform_device mic_platform_dev = {
+- .name = mic_driver_name,
+- .id = 0,
+- .num_resources = 0,
+- .dev = {
+- .dma_mask = &mic_dma_mask,
+- .coherent_dma_mask = DMA_BIT_MASK(64),
+- },
+-};
+-
+ static struct platform_driver __refdata mic_platform_driver = {
+ .probe = mic_probe,
+ .remove = mic_remove,
+@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = {
+ },
+ };
+
++static struct platform_device *mic_platform_dev;
++
+ static int __init mic_init(void)
+ {
+ int ret;
+@@ -327,9 +320,12 @@ static int __init mic_init(void)
+ }
+
+ mic_init_card_debugfs();
+- ret = platform_device_register(&mic_platform_dev);
++
++ mic_platform_dev = platform_device_register_simple(mic_driver_name,
++ 0, NULL, 0);
++ ret = PTR_ERR_OR_ZERO(mic_platform_dev);
+ if (ret) {
+- pr_err("platform_device_register ret %d\n", ret);
++ pr_err("platform_device_register_full ret %d\n", ret);
+ goto cleanup_debugfs;
+ }
+ ret = platform_driver_register(&mic_platform_driver);
+@@ -340,7 +336,7 @@ static int __init mic_init(void)
+ return ret;
+
+ device_unregister:
+- platform_device_unregister(&mic_platform_dev);
++ platform_device_unregister(mic_platform_dev);
+ cleanup_debugfs:
+ mic_exit_card_debugfs();
+ done:
+@@ -350,7 +346,7 @@ done:
+ static void __exit mic_exit(void)
+ {
+ platform_driver_unregister(&mic_platform_driver);
+- platform_device_unregister(&mic_platform_dev);
++ platform_device_unregister(mic_platform_dev);
+ mic_exit_card_debugfs();
+ }
+
+--
+2.20.1
+
--- /dev/null
+From dbe074e0b81ee214c8bab25a64184931fb52b5ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Jul 2019 14:10:12 -0700
+Subject: mips: avoid explicit UB in assignment of mips_io_port_base
+
+From: Nick Desaulniers <ndesaulniers@google.com>
+
+[ Upstream commit 12051b318bc3ce5b42d6d786191008284b067d83 ]
+
+The code in question is modifying a variable declared const through
+pointer manipulation. Such code is explicitly undefined behavior, and
+is the lone issue preventing malta_defconfig from booting when built
+with Clang:
+
+If an attempt is made to modify an object defined with a const-qualified
+type through use of an lvalue with non-const-qualified type, the
+behavior is undefined.
+
+LLVM is removing such assignments. A simple fix is to not declare
+variables const that you plan on modifying. Limiting the scope would be
+a better method of preventing unwanted writes to such a variable.
+
+Further, the code in question mentions "compiler bugs" without any links
+to bug reports, so it is difficult to know if the issue is resolved in
+GCC. The patch was authored in 2006, which would have been GCC 4.0.3 or
+4.1.1. The minimal supported version of GCC in the Linux kernel is
+currently 4.6.
+
+For what its worth, there was UB before the commit in question, it just
+added a barrier and got lucky IRT codegen. I don't think there's any
+actual compiler bugs related, just runtime bugs due to UB.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/610
+Fixes: 966f4406d903 ("[MIPS] Work around bad code generation for <asm/io.h>.")
+Reported-by: Nathan Chancellor <natechancellor@gmail.com>
+Debugged-by: Nathan Chancellor <natechancellor@gmail.com>
+Suggested-by: Eli Friedman <efriedma@quicinc.com>
+Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Tested-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: Maciej W. Rozycki <macro@linux-mips.org>
+Cc: Hassan Naveed <hnaveed@wavecomp.com>
+Cc: Stephen Kitt <steve@sk2.org>
+Cc: Serge Semin <fancer.lancer@gmail.com>
+Cc: Mike Rapoport <rppt@linux.ibm.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: clang-built-linux@googlegroups.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/io.h | 14 ++------------
+ arch/mips/kernel/setup.c | 2 +-
+ 2 files changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
+index ab1df19b09571..60604b26fa72c 100644
+--- a/arch/mips/include/asm/io.h
++++ b/arch/mips/include/asm/io.h
+@@ -60,21 +60,11 @@
+ * instruction, so the lower 16 bits must be zero. Should be true on
+ * on any sane architecture; generic code does not use this assumption.
+ */
+-extern const unsigned long mips_io_port_base;
++extern unsigned long mips_io_port_base;
+
+-/*
+- * Gcc will generate code to load the value of mips_io_port_base after each
+- * function call which may be fairly wasteful in some cases. So we don't
+- * play quite by the book. We tell gcc mips_io_port_base is a long variable
+- * which solves the code generation issue. Now we need to violate the
+- * aliasing rules a little to make initialization possible and finally we
+- * will need the barrier() to fight side effects of the aliasing chat.
+- * This trickery will eventually collapse under gcc's optimizer. Oh well.
+- */
+ static inline void set_io_port_base(unsigned long base)
+ {
+- * (unsigned long *) &mips_io_port_base = base;
+- barrier();
++ mips_io_port_base = base;
+ }
+
+ /*
+diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
+index 4f9f1ae492138..fadc946b306d2 100644
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -80,7 +80,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
+ * mips_io_port_base is the begin of the address space to which x86 style
+ * I/O ports are mapped.
+ */
+-const unsigned long mips_io_port_base = -1;
++unsigned long mips_io_port_base = -1;
+ EXPORT_SYMBOL(mips_io_port_base);
+
+ static struct resource code_resource = { .name = "Kernel code", };
+--
+2.20.1
+
--- /dev/null
+From d079efde5db25ee8e1ed2ee74a5386c13b6a8d3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 21:33:50 +0800
+Subject: MIPS: Loongson: Fix return value of loongson_hwmon_init
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit dece3c2a320b0a6d891da6ff774ab763969b6860 ]
+
+When call function hwmon_device_register failed, use the actual
+return value instead of always -ENOMEM.
+
+Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/mips/cpu_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c
+index 0f6c63e17049e..9a201c3caaf41 100644
+--- a/drivers/platform/mips/cpu_hwmon.c
++++ b/drivers/platform/mips/cpu_hwmon.c
+@@ -155,7 +155,7 @@ static int __init loongson_hwmon_init(void)
+
+ cpu_hwmon_dev = hwmon_device_register(NULL);
+ if (IS_ERR(cpu_hwmon_dev)) {
+- ret = -ENOMEM;
++ ret = PTR_ERR(cpu_hwmon_dev);
+ pr_err("hwmon_device_register fail!\n");
+ goto fail_hwmon_device_register;
+ }
+--
+2.20.1
+
--- /dev/null
+From 318998d8604e435cc834bd7e44c7df897ff81105 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 May 2019 09:15:17 -0700
+Subject: misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ]
+
+Clang warns:
+
+drivers/misc/sgi-xp/xpc_partition.c:73:14: warning: variable 'buf' is
+uninitialized when used within its own initialization [-Wuninitialized]
+ void *buf = buf;
+ ~~~ ^~~
+1 warning generated.
+
+Arnd's explanation during review:
+
+ /*
+ * Returns the physical address of the partition's reserved page through
+ * an iterative number of calls.
+ *
+ * On first call, 'cookie' and 'len' should be set to 0, and 'addr'
+ * set to the nasid of the partition whose reserved page's address is
+ * being sought.
+ * On subsequent calls, pass the values, that were passed back on the
+ * previous call.
+ *
+ * While the return status equals SALRET_MORE_PASSES, keep calling
+ * this function after first copying 'len' bytes starting at 'addr'
+ * into 'buf'. Once the return status equals SALRET_OK, 'addr' will
+ * be the physical address of the partition's reserved page. If the
+ * return status equals neither of these, an error as occurred.
+ */
+ static inline s64
+ sn_partition_reserved_page_pa(u64 buf, u64 *cookie, u64 *addr, u64 *len)
+
+ so *len is set to zero on the first call and tells the bios how many
+ bytes are accessible at 'buf', and it does get updated by the BIOS to
+ tell us how many bytes it needs, and then we allocate that and try again.
+
+Fixes: 279290294662 ("[IA64-SGI] cleanup the way XPC locates the reserved page")
+Link: https://github.com/ClangBuiltLinux/linux/issues/466
+Suggested-by: Stephen Hines <srhines@google.com>
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/sgi-xp/xpc_partition.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
+index 6956f7e7d4392..ca5f0102daef4 100644
+--- a/drivers/misc/sgi-xp/xpc_partition.c
++++ b/drivers/misc/sgi-xp/xpc_partition.c
+@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid)
+ unsigned long rp_pa = nasid; /* seed with nasid */
+ size_t len = 0;
+ size_t buf_len = 0;
+- void *buf = buf;
++ void *buf = NULL;
+ void *buf_base = NULL;
+ enum xp_retval (*get_partition_rsvd_page_pa)
+ (void *, u64 *, unsigned long *, size_t *) =
+--
+2.20.1
+
--- /dev/null
+From 9f8ef6d422dbffa57c43dff975f05891fdf915ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 18 Jun 2019 20:43:01 +0200
+Subject: net/af_iucv: always register net_device notifier
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit 06996c1d4088a0d5f3e7789d7f96b4653cc947cc ]
+
+Even when running as VM guest (ie pr_iucv != NULL), af_iucv can still
+open HiperTransport-based connections. For robust operation these
+connections require the af_iucv_netdev_notifier, so register it
+unconditionally.
+
+Also handle any error that register_netdevice_notifier() returns.
+
+Fixes: 9fbd87d41392 ("af_iucv: handle netdev events")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/iucv/af_iucv.c | 27 ++++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index 5984cc35d5088..3edffb7bf2a46 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -2392,6 +2392,13 @@ out:
+ return err;
+ }
+
++static void afiucv_iucv_exit(void)
++{
++ device_unregister(af_iucv_dev);
++ driver_unregister(&af_iucv_driver);
++ pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++}
++
+ static int __init afiucv_init(void)
+ {
+ int err;
+@@ -2425,11 +2432,18 @@ static int __init afiucv_init(void)
+ err = afiucv_iucv_init();
+ if (err)
+ goto out_sock;
+- } else
+- register_netdevice_notifier(&afiucv_netdev_notifier);
++ }
++
++ err = register_netdevice_notifier(&afiucv_netdev_notifier);
++ if (err)
++ goto out_notifier;
++
+ dev_add_pack(&iucv_packet_type);
+ return 0;
+
++out_notifier:
++ if (pr_iucv)
++ afiucv_iucv_exit();
+ out_sock:
+ sock_unregister(PF_IUCV);
+ out_proto:
+@@ -2443,12 +2457,11 @@ out:
+ static void __exit afiucv_exit(void)
+ {
+ if (pr_iucv) {
+- device_unregister(af_iucv_dev);
+- driver_unregister(&af_iucv_driver);
+- pr_iucv->iucv_unregister(&af_iucv_handler, 0);
++ afiucv_iucv_exit();
+ symbol_put(iucv_if);
+- } else
+- unregister_netdevice_notifier(&afiucv_netdev_notifier);
++ }
++
++ unregister_netdevice_notifier(&afiucv_netdev_notifier);
+ dev_remove_pack(&iucv_packet_type);
+ sock_unregister(PF_IUCV);
+ proto_unregister(&iucv_proto);
+--
+2.20.1
+
--- /dev/null
+From c4c4e271fb369c6b7f9cee9338c95d4a72f88229 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:56:04 +0300
+Subject: net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 25a584955f020d6ec499c513923fb220f3112d2b ]
+
+The "priv->phy_interface" variable is an enum and in this context GCC
+will treat it as unsigned so the error handling will never be
+triggered.
+
+Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 53b3c1a5851c3..9530ee12726f3 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1794,7 +1794,7 @@ static int bcm_sysport_probe(struct platform_device *pdev)
+
+ priv->phy_interface = of_get_phy_mode(dn);
+ /* Default to GMII interface mode */
+- if (priv->phy_interface < 0)
++ if ((int)priv->phy_interface < 0)
+ priv->phy_interface = PHY_INTERFACE_MODE_GMII;
+
+ /* In the case of a fixed PHY, the DT node associated
+--
+2.20.1
+
--- /dev/null
+From 933ea4ef99bf56a840139822dd1dac64dc8835cf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 14:05:54 +0300
+Subject: net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 231042181dc9d6122c6faba64e99ccb25f13cc6c ]
+
+The "gmac->phy_mode" variable is an enum and in this context GCC will
+treat it as an unsigned int so the error handling will never be
+triggered.
+
+Fixes: b1c17215d718 ("stmmac: add ipq806x glue layer")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+index 82de68b1a4527..1fc356c177509 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+@@ -203,7 +203,7 @@ static void *ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac)
+ struct device *dev = &gmac->pdev->dev;
+
+ gmac->phy_mode = of_get_phy_mode(dev->of_node);
+- if (gmac->phy_mode < 0) {
++ if ((int)gmac->phy_mode < 0) {
+ dev_err(dev, "missing phy mode property\n");
+ return ERR_PTR(-EINVAL);
+ }
+--
+2.20.1
+
--- /dev/null
+From 2cda14c4b33b2432c96cd1e262fe7b7449481934 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 13:55:32 +0300
+Subject: net: hisilicon: Fix signedness bug in hix5hd2_dev_probe()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 002dfe8085255b7bf1e0758c3d195c5412d35be9 ]
+
+The "priv->phy_mode" variable is an enum and in this context GCC will
+treat it as unsigned to the error handling will never trigger.
+
+Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+index e51892d518ff3..761c80eb8a68f 100644
+--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c
+@@ -951,7 +951,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev)
+ goto err_free_mdio;
+
+ priv->phy_mode = of_get_phy_mode(node);
+- if (priv->phy_mode < 0) {
++ if ((int)priv->phy_mode < 0) {
+ netdev_err(ndev, "not find phy-mode\n");
+ ret = -EINVAL;
+ goto err_mdiobus;
+--
+2.20.1
+
--- /dev/null
+From 63800d4cbede41f1d561488aec7bec06f73c6e5c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:11:49 -0800
+Subject: net: neigh: use long type to store jiffies delta
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ]
+
+A difference of two unsigned long needs long storage.
+
+Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index af1ecd0e7b070..9849f1f4cf4f7 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1837,8 +1837,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
+ goto nla_put_failure;
+ {
+ unsigned long now = jiffies;
+- unsigned int flush_delta = now - tbl->last_flush;
+- unsigned int rand_delta = now - tbl->last_rand;
++ long flush_delta = now - tbl->last_flush;
++ long rand_delta = now - tbl->last_rand;
+ struct neigh_hash_table *nht;
+ struct ndt_config ndc = {
+ .ndtc_key_len = tbl->key_len,
+--
+2.20.1
+
--- /dev/null
+From d57b00d25d2585e4bd25ae5d255fcbd176b3a67f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jul 2019 12:23:41 +0800
+Subject: net: pasemi: fix an use-after-free in pasemi_mac_phy_init()
+
+From: Wen Yang <wen.yang99@zte.com.cn>
+
+[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ]
+
+The phy_dn variable is still being used in of_phy_connect() after the
+of_node_put() call, which may result in use-after-free.
+
+Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index 57a6e6cd74fc3..48106953cf64b 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1091,7 +1091,6 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+
+ dn = pci_device_to_OF_node(mac->pdev);
+ phy_dn = of_parse_phandle(dn, "phy-handle", 0);
+- of_node_put(phy_dn);
+
+ mac->link = 0;
+ mac->speed = 0;
+@@ -1100,6 +1099,7 @@ static int pasemi_mac_phy_init(struct net_device *dev)
+ phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0,
+ PHY_INTERFACE_MODE_SGMII);
+
++ of_node_put(phy_dn);
+ if (!phydev) {
+ printk(KERN_ERR "%s: Could not attach to phy\n", dev->name);
+ return -ENODEV;
+--
+2.20.1
+
--- /dev/null
+From 9759501d41bf8aa20892445471bb4987b255af80 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 Nov 2019 18:29:13 +0100
+Subject: net: qca_spi: Move reset_count to struct qcaspi
+
+From: Stefan Wahren <stefan.wahren@in-tech.com>
+
+[ Upstream commit bc19c32904e36548335b35fdce6ce734e20afc0a ]
+
+The reset counter is specific for every QCA700x chip. So move this
+into the private driver struct. Otherwise we get unpredictable reset
+behavior in setups with multiple QCA700x chips.
+
+Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000)
+Signed-off-by: Stefan Wahren <stefan.wahren@in-tech.com>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qualcomm/qca_spi.c | 9 ++++-----
+ drivers/net/ethernet/qualcomm/qca_spi.h | 1 +
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 7886a8a5b55b3..fb944e65c6324 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -438,7 +438,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+ u16 signature = 0;
+ u16 spi_config;
+ u16 wrbuf_space = 0;
+- static u16 reset_count;
+
+ if (event == QCASPI_EVENT_CPUON) {
+ /* Read signature twice, if not valid
+@@ -491,13 +490,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event)
+
+ qca->sync = QCASPI_SYNC_RESET;
+ qca->stats.trig_reset++;
+- reset_count = 0;
++ qca->reset_count = 0;
+ break;
+ case QCASPI_SYNC_RESET:
+- reset_count++;
++ qca->reset_count++;
+ netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n",
+- reset_count);
+- if (reset_count >= QCASPI_RESET_TIMEOUT) {
++ qca->reset_count);
++ if (qca->reset_count >= QCASPI_RESET_TIMEOUT) {
+ /* reset did not seem to take place, try again */
+ qca->sync = QCASPI_SYNC_UNKNOWN;
+ qca->stats.reset_timeout++;
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h
+index 6e31a0e744a45..c48c314ca4dfa 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.h
++++ b/drivers/net/ethernet/qualcomm/qca_spi.h
+@@ -97,6 +97,7 @@ struct qcaspi {
+
+ unsigned int intr_req;
+ unsigned int intr_svc;
++ u16 reset_count;
+
+ #ifdef CONFIG_DEBUG_FS
+ struct dentry *device_root;
+--
+2.20.1
+
--- /dev/null
+From 1222e4383f369de05d7906b724a3b2ecd56b70a3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 13:49:41 -0700
+Subject: net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'
+
+From: Gerd Rausch <gerd.rausch@oracle.com>
+
+[ Upstream commit 05a82481a3024b94db00b8c816bb3d526b5209e0 ]
+
+All entries in 'rds_ib_stat_names' are stringified versions
+of the corresponding "struct rds_ib_statistics" element
+without the "s_"-prefix.
+
+Fix entry 'ib_evt_handler_call' to do the same.
+
+Fixes: f4f943c958a2 ("RDS: IB: ack more receive completions to improve performance")
+Signed-off-by: Gerd Rausch <gerd.rausch@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rds/ib_stats.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c
+index d77e044730563..a88460058185b 100644
+--- a/net/rds/ib_stats.c
++++ b/net/rds/ib_stats.c
+@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
+ static const char *const rds_ib_stat_names[] = {
+ "ib_connect_raced",
+ "ib_listen_closed_stale",
+- "s_ib_evt_handler_call",
++ "ib_evt_handler_call",
+ "ib_tasklet_call",
+ "ib_tx_cq_event",
+ "ib_tx_ring_full",
+--
+2.20.1
+
--- /dev/null
+From f7f20b179e27a8ff179103b90165f9d54948792a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 12 Mar 2019 02:43:18 -0500
+Subject: net: sh_eth: fix a missing check of of_get_phy_mode
+
+From: Kangjie Lu <kjlu@umn.edu>
+
+[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ]
+
+of_get_phy_mode may fail and return a negative error code;
+the fix checks the return value of of_get_phy_mode and
+returns NULL of it fails.
+
+Fixes: b356e978e92f ("sh_eth: add device tree support")
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 2d9f4ed9a65ed..8413f93f5cd94 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -3040,12 +3040,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev)
+ struct device_node *np = dev->of_node;
+ struct sh_eth_plat_data *pdata;
+ const char *mac_addr;
++ int ret;
+
+ pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
+ if (!pdata)
+ return NULL;
+
+- pdata->phy_interface = of_get_phy_mode(np);
++ ret = of_get_phy_mode(np);
++ if (ret < 0)
++ return NULL;
++ pdata->phy_interface = ret;
+
+ mac_addr = of_get_mac_address(np);
+ if (mac_addr)
+--
+2.20.1
+
--- /dev/null
+From 75b1eedeb39b1bddbf42438b7d761a8af18ea784 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 09:36:23 +0800
+Subject: net: sonic: replace dev_kfree_skb in sonic_send_packet
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 49f6c90bf6805948b597eabb499e500a47cf24be ]
+
+sonic_send_packet will be processed in irq or non-irq
+context, so it would better use dev_kfree_skb_any
+instead of dev_kfree_skb.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index b5f1f4ea9d4a3..6679005782499 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -222,7 +222,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ if (!laddr) {
+ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+- dev_kfree_skb(skb);
++ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 5c8a39ff6b162fffb19ed10520369c3a1d9b19a8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Sep 2019 09:57:12 +0800
+Subject: net: sonic: return NETDEV_TX_OK if failed to map buffer
+
+From: Mao Wenan <maowenan@huawei.com>
+
+[ Upstream commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 ]
+
+NETDEV_TX_BUSY really should only be used by drivers that call
+netif_tx_stop_queue() at the wrong moment. If dma_map_single() is
+failed to map tx DMA buffer, it might trigger an infinite loop.
+This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change
+printk to pr_err_ratelimited.
+
+Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers")
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 0798b4adb0394..b5f1f4ea9d4a3 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -221,9 +221,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+
+ laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE);
+ if (!laddr) {
+- printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name);
++ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name);
+ dev_kfree_skb(skb);
+- return NETDEV_TX_BUSY;
++ return NETDEV_TX_OK;
+ }
+
+ sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
+--
+2.20.1
+
--- /dev/null
+From f3dd7dd8ef549fae9775485e10da29c3b659049c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 17:43:04 +0200
+Subject: net: stmmac: fix length of PTP clock's name string
+
+From: Antonio Borneo <antonio.borneo@st.com>
+
+[ Upstream commit 5da202c88f8c355ad79bc2e8eb582e6d433060e7 ]
+
+The field "name" in struct ptp_clock_info has a fixed size of 16
+chars and is used as zero terminated string by clock_name_show()
+in drivers/ptp/ptp_sysfs.c
+The current initialization value requires 17 chars to fit also the
+null termination, and this causes overflow to the next bytes in
+the struct when the string is read as null terminated:
+ hexdump -C /sys/class/ptp/ptp0/clock_name
+ 00000000 73 74 6d 6d 61 63 5f 70 74 70 5f 63 6c 6f 63 6b |stmmac_ptp_clock|
+ 00000010 a0 ac b9 03 0a |.....|
+where the extra 4 bytes (excluding the newline) after the string
+represent the integer 0x03b9aca0 = 62500000 assigned to the field
+"max_adj" that follows "name" in the same struct.
+
+There is no strict requirement for the "name" content and in the
+comment in ptp_clock_kernel.h it's reported it should just be 'A
+short "friendly name" to identify the clock'.
+Replace it with "stmmac ptp".
+
+Signed-off-by: Antonio Borneo <antonio.borneo@st.com>
+Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+index 170a18b61281d..147c9f8cee7f7 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+@@ -157,7 +157,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp,
+ /* structure describing a PTP hardware clock */
+ static struct ptp_clock_info stmmac_ptp_clock_ops = {
+ .owner = THIS_MODULE,
+- .name = "stmmac_ptp_clock",
++ .name = "stmmac ptp",
+ .max_adj = 62500000,
+ .n_alarm = 0,
+ .n_ext_ts = 0,
+--
+2.20.1
+
--- /dev/null
+From aaa3497bbf00f0899894e16e090b96c98f1c3cfc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 May 2019 18:47:33 +0200
+Subject: netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last
+ rule
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ]
+
+If userspace provides a rule blob with trailing data after last target,
+we trigger a splat, then convert ruleset to 64bit format (with trailing
+data), then pass that to do_replace_finish() which then returns -EINVAL.
+
+Erroring out right away avoids the splat plus unneeded translation and
+error unwind.
+
+Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebtables.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index fd1af7cb960d5..e7c170949b210 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2174,7 +2174,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user,
+ if (ret < 0)
+ return ret;
+
+- WARN_ON(size_remaining);
++ if (size_remaining)
++ return -EINVAL;
++
+ return state->buf_kern_offset;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a42c6acb1376760d6d8720dbc7485fd39548dfc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 7 Nov 2018 10:36:10 +0800
+Subject: nios2: ksyms: Add missing symbol exports
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ]
+
+Building nios2:allmodconfig fails as follows (each symbol is only listed
+once).
+
+ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined!
+ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined!
+ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined!
+ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined!
+ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined!
+ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined!
+
+The problem is seen with gcc 7.3.0.
+
+Export the missing symbols.
+
+Fixes: 2fc8483fdcde ("nios2: Build infrastructure")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Ley Foon Tan <ley.foon.tan@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c
+index bf2f55d10a4d8..4e704046a150c 100644
+--- a/arch/nios2/kernel/nios2_ksyms.c
++++ b/arch/nios2/kernel/nios2_ksyms.c
+@@ -9,12 +9,20 @@
+ #include <linux/export.h>
+ #include <linux/string.h>
+
++#include <asm/cacheflush.h>
++#include <asm/pgtable.h>
++
+ /* string functions */
+
+ EXPORT_SYMBOL(memcpy);
+ EXPORT_SYMBOL(memset);
+ EXPORT_SYMBOL(memmove);
+
++/* memory management */
++
++EXPORT_SYMBOL(empty_zero_page);
++EXPORT_SYMBOL(flush_icache_range);
++
+ /*
+ * libgcc functions - functions that are used internally by the
+ * compiler... (prototypes are not correct though, but that
+@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3);
+ DECLARE_EXPORT(__umoddi3);
+ DECLARE_EXPORT(__umodsi3);
+ DECLARE_EXPORT(__muldi3);
++DECLARE_EXPORT(__ucmpdi2);
++DECLARE_EXPORT(__lshrdi3);
++DECLARE_EXPORT(__ashldi3);
++DECLARE_EXPORT(__ashrdi3);
+--
+2.20.1
+
--- /dev/null
+From cb3ad1c023b5c0be73a5be22003bfb23beca7818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 05:07:46 -0800
+Subject: packet: fix data-race in fanout_flow_is_huge()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]
+
+KCSAN reported the following data-race [1]
+
+Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.
+
+Since the report hinted about multiple cpus using the history
+concurrently, I added a test avoiding writing on it if the
+victim slot already contains the desired value.
+
+[1]
+
+BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover
+
+read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1:
+ fanout_flow_is_huge net/packet/af_packet.c:1303 [inline]
+ fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0:
+ fanout_flow_is_huge net/packet/af_packet.c:1306 [inline]
+ fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 9de7e3e6edd30..eac6f7eea7b51 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1332,15 +1332,21 @@ static void packet_sock_destruct(struct sock *sk)
+
+ static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
+ {
+- u32 rxhash;
++ u32 *history = po->rollover->history;
++ u32 victim, rxhash;
+ int i, count = 0;
+
+ rxhash = skb_get_hash(skb);
+ for (i = 0; i < ROLLOVER_HLEN; i++)
+- if (po->rollover->history[i] == rxhash)
++ if (READ_ONCE(history[i]) == rxhash)
+ count++;
+
+- po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
++ victim = prandom_u32() % ROLLOVER_HLEN;
++
++ /* Avoid dirtying the cache line if possible */
++ if (READ_ONCE(history[victim]) != rxhash)
++ WRITE_ONCE(history[victim], rxhash);
++
+ return count > (ROLLOVER_HLEN >> 1);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fdfc87792445d84d0be7c26049dbfd999273bc40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Apr 2019 11:46:55 -0400
+Subject: packet: in recvmsg msg_name return at least sizeof sockaddr_ll
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ]
+
+Packet send checks that msg_name is at least sizeof sockaddr_ll.
+Packet recv must return at least this length, so that its output
+can be passed unmodified to packet send.
+
+This ceased to be true since adding support for lladdr longer than
+sll_addr. Since, the return value uses true address length.
+
+Always return at least sizeof sockaddr_ll, even if address length
+is shorter. Zero the padding bytes.
+
+Change v1->v2: do not overwrite zeroed padding again. use copy_len.
+
+Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
+Suggested-by: David Laight <David.Laight@aculab.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 8b277658905f7..9de7e3e6edd30 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3309,20 +3309,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (msg->msg_name) {
++ int copy_len;
++
+ /* If the address length field is there to be filled
+ * in, we fill it in now.
+ */
+ if (sock->type == SOCK_PACKET) {
+ __sockaddr_check_size(sizeof(struct sockaddr_pkt));
+ msg->msg_namelen = sizeof(struct sockaddr_pkt);
++ copy_len = msg->msg_namelen;
+ } else {
+ struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+
+ msg->msg_namelen = sll->sll_halen +
+ offsetof(struct sockaddr_ll, sll_addr);
++ copy_len = msg->msg_namelen;
++ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
++ memset(msg->msg_name +
++ offsetof(struct sockaddr_ll, sll_addr),
++ 0, sizeof(sll->sll_addr));
++ msg->msg_namelen = sizeof(struct sockaddr_ll);
++ }
+ }
+- memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
+- msg->msg_namelen);
++ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+ if (pkt_sk(sk)->auxdata) {
+--
+2.20.1
+
--- /dev/null
+From 47f69ed9011dcf69d32a6b8f71e8f9014f6ecdcb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 18:47:15 -0700
+Subject: Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 ]
+
+Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made
+the kfifo code round the number of elements up. That was good for
+__kfifo_alloc(), but it's actually wrong for __kfifo_init().
+
+The difference? __kfifo_alloc() will allocate the rounded-up number of
+elements, but __kfifo_init() uses an allocation done by the caller. We
+can't just say "use more elements than the caller allocated", and have
+to round down.
+
+The good news? All the normal cases will be using power-of-two arrays
+anyway, and most users of kfifo's don't use kfifo_init() at all, but one
+of the helper macros to declare a KFIFO that enforce the proper
+power-of-two behavior. But it looks like at least ibmvscsis might be
+affected.
+
+The bad news? Will Deacon refers to an old thread and points points out
+that the memory ordering in kfifo's is questionable. See
+
+ https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/
+
+for more.
+
+Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()")
+Reported-by: laokz <laokz@foxmail.com>
+Cc: Stefani Seibold <stefani@seibold.net>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg KH <greg@kroah.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Will Deacon <will@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/kfifo.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/kfifo.c b/lib/kfifo.c
+index 90ba1eb1df06e..a94227c555510 100644
+--- a/lib/kfifo.c
++++ b/lib/kfifo.c
+@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer,
+ {
+ size /= esize;
+
+- size = roundup_pow_of_two(size);
++ if (!is_power_of_2(size))
++ size = rounddown_pow_of_two(size);
+
+ fifo->in = 0;
+ fifo->out = 0;
+--
+2.20.1
+
--- /dev/null
+From 14feb77023a8a4efdb53d34e1ebf84ce4f0c86ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 27 Oct 2018 15:49:26 +0100
+Subject: pcrypt: use format specifier in kobject_add
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ]
+
+Passing string 'name' as the format specifier is potentially hazardous
+because name could (although very unlikely to) have a format specifier
+embedded in it causing issues when parsing the non-existent arguments
+to these. Follow best practice by using the "%s" format string for
+the string 'name'.
+
+Cleans up clang warning:
+crypto/pcrypt.c:397:40: warning: format string is not a string literal
+(potentially insecure) [-Wformat-security]
+
+Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ crypto/pcrypt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
+index f8ec3d4ba4a80..a5718c0a3dc4e 100644
+--- a/crypto/pcrypt.c
++++ b/crypto/pcrypt.c
+@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
+ int ret;
+
+ pinst->kobj.kset = pcrypt_kset;
+- ret = kobject_add(&pinst->kobj, NULL, name);
++ ret = kobject_add(&pinst->kobj, NULL, "%s", name);
+ if (!ret)
+ kobject_uevent(&pinst->kobj, KOBJ_ADD);
+
+--
+2.20.1
+
--- /dev/null
+From 4bf2c49ba470bd0e99168de1908f80e12e6f8627 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Jan 2019 13:04:52 +0100
+Subject: pinctrl: sh-pfc: emev2: Add missing pinmux functions
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ]
+
+The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present,
+but no pinmux functions refer to them, hence they can not be selected.
+
+Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+index 02118ab336fcb..5ab3ac61f418c 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c
++++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c
+@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = {
+ "dtv_b",
+ };
+
++static const char * const err_rst_reqb_groups[] = {
++ "err_rst_reqb",
++};
++
++static const char * const ext_clki_groups[] = {
++ "ext_clki",
++};
++
+ static const char * const iic0_groups[] = {
+ "iic0",
+ };
+@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = {
+ "yuv3",
+ };
+
++static const char * const lowpwr_groups[] = {
++ "lowpwr",
++};
++
+ static const char * const ntsc_groups[] = {
+ "ntsc_clk",
+ "ntsc_data",
+@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = {
+ "pwm1",
+ };
+
++static const char * const ref_clko_groups[] = {
++ "ref_clko",
++};
++
+ static const char * const sd_groups[] = {
+ "sd_cki",
+ };
+@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = {
+ SH_PFC_FUNCTION(cam),
+ SH_PFC_FUNCTION(cf),
+ SH_PFC_FUNCTION(dtv),
++ SH_PFC_FUNCTION(err_rst_reqb),
++ SH_PFC_FUNCTION(ext_clki),
+ SH_PFC_FUNCTION(iic0),
+ SH_PFC_FUNCTION(iic1),
+ SH_PFC_FUNCTION(jtag),
+ SH_PFC_FUNCTION(lcd),
++ SH_PFC_FUNCTION(lowpwr),
+ SH_PFC_FUNCTION(ntsc),
+ SH_PFC_FUNCTION(pwm0),
+ SH_PFC_FUNCTION(pwm1),
++ SH_PFC_FUNCTION(ref_clko),
+ SH_PFC_FUNCTION(sd),
+ SH_PFC_FUNCTION(sdi0),
+ SH_PFC_FUNCTION(sdi1),
+--
+2.20.1
+
--- /dev/null
+From f1283b57de740314c61e993c178c8751cec6b9a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:00:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ]
+
+The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers,
+but the lcd0_data24_1_mux[] array lacks the corresponding pin marks.
+
+Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index aa7c346dff6d0..bc2ee07fa92fb 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -2155,6 +2155,7 @@ static const unsigned int lcd0_data24_1_mux[] = {
+ LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK,
+ LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK,
+ LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK,
++ LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK,
+ LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK,
+ LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK,
+ LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK,
+--
+2.20.1
+
--- /dev/null
+From 02b60b0a0443bb0124e7ae0b94247d23180e2c23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 10:57:27 +0100
+Subject: pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ]
+
+The gether_gmii_mux[] array contains the REF125CK pin mark, but the
+gether_gmii_pins[] array lacks the corresponding pin number.
+
+Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+index 279e9dd442e44..aa7c346dff6d0 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c
+@@ -1983,7 +1983,7 @@ static const unsigned int gether_gmii_pins[] = {
+ */
+ 185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204,
+ 171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203,
+- 205, 163, 206, 207,
++ 205, 163, 206, 207, 158,
+ };
+ static const unsigned int gether_gmii_mux[] = {
+ ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK,
+--
+2.20.1
+
--- /dev/null
+From 0ffb9de78c9da2e52dd4db220c314ce6627b1c59 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 17:07:43 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ]
+
+The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a
+typo, thus the group cannot be selected.
+
+Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index f94e34e7f0b01..b2f8898ddb2c8 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -4967,7 +4967,7 @@ static const char * const scifb2_groups[] = {
+ "scifb2_data_b",
+ "scifb2_clk_b",
+ "scifb2_ctrl_b",
+- "scifb0_data_c",
++ "scifb2_data_c",
+ "scifb2_clk_c",
+ "scifb2_data_d",
+ };
+--
+2.20.1
+
--- /dev/null
+From 18817bb36cfe39b7acdc809797175776dd31a44e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:05:57 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b
+ group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ]
+
+The qspi_data4_b_mux[] array contains pin marks for the clock and chip
+select pins. The qspi_data4_b_pins[] array rightfully does not contain
+the corresponding pin numbers, as the control pins are provided by a
+separate group (qspi_ctrl_b).
+
+Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 42ffa8708abc6..4fbd6d8067196 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -3059,8 +3059,7 @@ static const unsigned int qspi_data4_b_pins[] = {
+ RCAR_GP_PIN(6, 4),
+ };
+ static const unsigned int qspi_data4_b_mux[] = {
+- SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK,
+- IO2_B_MARK, IO3_B_MARK, SSL_B_MARK,
++ MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK,
+ };
+ /* - SCIF0 ------------------------------------------------------------------ */
+ static const unsigned int scif0_data_pins[] = {
+--
+2.20.1
+
--- /dev/null
+From cedd582ec6e4c8586d473ebf85f3a9a5b3115880 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:12:20 +0100
+Subject: pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ]
+
+The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of
+the color components. The vin1_b_data18_pins[] array rightfully does
+not include the corresponding pin numbers, as RGB18 is subset of RGB24,
+containing only the 6 MSB bits of each component.
+
+Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 4fbd6d8067196..f94e34e7f0b01 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -4170,17 +4170,14 @@ static const unsigned int vin1_b_data18_pins[] = {
+ };
+ static const unsigned int vin1_b_data18_mux[] = {
+ /* B */
+- VI1_DATA0_B_MARK, VI1_DATA1_B_MARK,
+ VI1_DATA2_B_MARK, VI1_DATA3_B_MARK,
+ VI1_DATA4_B_MARK, VI1_DATA5_B_MARK,
+ VI1_DATA6_B_MARK, VI1_DATA7_B_MARK,
+ /* G */
+- VI1_G0_B_MARK, VI1_G1_B_MARK,
+ VI1_G2_B_MARK, VI1_G3_B_MARK,
+ VI1_G4_B_MARK, VI1_G5_B_MARK,
+ VI1_G6_B_MARK, VI1_G7_B_MARK,
+ /* R */
+- VI1_R0_B_MARK, VI1_R1_B_MARK,
+ VI1_R2_B_MARK, VI1_R3_B_MARK,
+ VI1_R4_B_MARK, VI1_R5_B_MARK,
+ VI1_R6_B_MARK, VI1_R7_B_MARK,
+--
+2.20.1
+
--- /dev/null
+From 66126379c74afe913eb5d045a1ec9c776578a298 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:21:16 +0100
+Subject: pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ]
+
+The Peripheral Function Select Register 9 contains 12 fields, but the
+variable field descriptor contains a 13th bogus field of 3 bits.
+
+Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+index 086f6798b1294..3b79e893b5ed3 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+@@ -4046,7 +4046,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, }
+ },
+ { PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32,
+- 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) {
++ 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) {
+ /* IP9_31 [1] */
+ 0, 0,
+ /* IP9_30_28 [3] */
+--
+2.20.1
+
--- /dev/null
+From 2a300cdceaf4730ed064c05e79ba4bb8ac04ace5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:27:56 +0100
+Subject: pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ]
+
+The Port C I/O Register 0 contains 7 reserved bits, but the descriptor
+contains only dummy configuration values for 6 reserved bits, thus
+breaking the configuration of all subsequent fields in the register.
+
+Fix this by adding the two missing configuration values.
+
+Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+index a50d22bef1f44..cfdb4fc177c3e 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c
+@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ },
+
+ { PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) {
+- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+ PC8_IN, PC8_OUT,
+ PC7_IN, PC7_OUT,
+ PC6_IN, PC6_OUT,
+--
+2.20.1
+
--- /dev/null
+From d3cbb736326ae906d87fbcfab53445b95903cfb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 11:20:14 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ]
+
+The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the
+tpu4_to3_pins[] array lacks the corresponding pin number.
+
+Add the missing pin number, for non-GPIO pin F26.
+
+Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index 6a69c8c5d9433..ea5da5dcad2c5 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -2672,6 +2672,7 @@ static const unsigned int tpu4_to2_mux[] = {
+ };
+ static const unsigned int tpu4_to3_pins[] = {
+ /* TO */
++ PIN_NUMBER(6, 26),
+ };
+ static const unsigned int tpu4_to3_mux[] = {
+ TPU4TO3_MARK,
+--
+2.20.1
+
--- /dev/null
+From 2c401d0890c87da18f540a54ccf7c68686a907a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Jan 2019 16:51:21 +0100
+Subject: pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ]
+
+There are two pin groups for the FSIC SPDIF signal, but the FSIC pin
+group array lists only one, and it refers to a nonexistent group.
+
+Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+index ea5da5dcad2c5..b173bd759ee19 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c
+@@ -2895,7 +2895,8 @@ static const char * const fsic_groups[] = {
+ "fsic_sclk_out",
+ "fsic_data_in",
+ "fsic_data_out",
+- "fsic_spdif",
++ "fsic_spdif_0",
++ "fsic_spdif_1",
+ };
+
+ static const char * const fsid_groups[] = {
+--
+2.20.1
+
--- /dev/null
+From 99ee4876893a166b0c19b758650844937fd51fe8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Dec 2018 14:42:16 +0100
+Subject: pinctrl: sh-pfc: sh7734: Add missing IPSR11 field
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ]
+
+The Peripheral Function Select Register 11 contains 3 reserved bits and
+15 variable-width fields, but the variable field descriptor does not
+contain the 3-bit field IP11[25:23].
+
+Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index ab09d385f95d1..a0835306f76eb 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2242,7 +2242,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_LCD_DATA15_B, 0, 0, 0 }
+ },
+ { PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32,
+- 3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
++ 3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) {
+ /* IP11_31_29 [3] */
+ 0, 0, 0, 0, 0, 0, 0, 0,
+ /* IP11_28 [1] */
+--
+2.20.1
+
--- /dev/null
+From 5b44eb743dbca34aa96fcc057a8230ddb87b299c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Dec 2018 14:32:34 +0100
+Subject: pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ]
+
+The IP10[5:3] field in Peripheral Function Select Register 10 has a
+width of 3 bits, i.e. it allows programming one out of 8 different
+configurations.
+However, 9 values are provided instead of 8, overflowing into the
+subsequent field in the register, and thus breaking the configuration of
+the latter.
+
+Fix this by dropping a bogus zero value.
+
+Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+index a0835306f76eb..ce543f3c39b2d 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c
++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c
+@@ -2236,7 +2236,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ FN_LCD_CL1_B, 0, 0,
+ /* IP10_5_3 [3] */
+ FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B,
+- FN_LCD_DON_B, 0, 0, 0,
++ FN_LCD_DON_B, 0, 0,
+ /* IP10_2_0 [3] */
+ FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B,
+ FN_LCD_DATA15_B, 0, 0, 0 }
+--
+2.20.1
+
--- /dev/null
+From f2368ea81a97952dced334dfea5355d94ba9774b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2019 12:44:18 +0300
+Subject: platform/x86: alienware-wmi: printing the wrong error code
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ]
+
+The "out_data" variable is uninitialized at the point. Originally, this
+used to print "status" instead and that seems like the correct thing to
+print.
+
+Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/alienware-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index 3df47c1b04ec7..f5585740a7650 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -511,7 +511,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ return scnprintf(buf, PAGE_SIZE,
+ "input [gpu] unknown\n");
+ }
+- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 96a25e27bd95970a25122a84d1dc965abaa5dbc3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 1 Aug 2019 14:33:30 -0700
+Subject: power: supply: Init device wakeup after device_add()
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+[ Upstream commit 8288022284859acbcc3cf1a073a1e2692d6c2543 ]
+
+We may want to use the device pointer in device_init_wakeup() with
+functions that expect the device to already be added with device_add().
+For example, if we were to link the device initializing wakeup to
+something in sysfs such as a class for wakeups we'll run into an error.
+It looks like this code was written with the assumption that the device
+would be added before initializing wakeup due to the order of operations
+in power_supply_unregister().
+
+Let's change the order of operations so we don't run into problems here.
+
+Fixes: 948dcf966228 ("power_supply: Prevent suspend until power supply events are processed")
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Tri Vo <trong@android.com>
+Cc: Kalesh Singh <kaleshsingh@google.com>
+Cc: Ravi Chandra Sadineni <ravisadineni@chromium.org>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/power_supply_core.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
+index b13cd074c52af..9281e42c9ed56 100644
+--- a/drivers/power/power_supply_core.c
++++ b/drivers/power/power_supply_core.c
+@@ -755,14 +755,14 @@ __power_supply_register(struct device *parent,
+ }
+
+ spin_lock_init(&psy->changed_lock);
+- rc = device_init_wakeup(dev, ws);
+- if (rc)
+- goto wakeup_init_failed;
+-
+ rc = device_add(dev);
+ if (rc)
+ goto device_add_failed;
+
++ rc = device_init_wakeup(dev, ws);
++ if (rc)
++ goto wakeup_init_failed;
++
+ rc = psy_register_thermal(psy);
+ if (rc)
+ goto register_thermal_failed;
+@@ -798,8 +798,8 @@ register_cooler_failed:
+ psy_unregister_thermal(psy);
+ register_thermal_failed:
+ device_del(dev);
+-device_add_failed:
+ wakeup_init_failed:
++device_add_failed:
+ check_supplies_failed:
+ dev_set_name_failed:
+ put_device(dev);
+--
+2.20.1
+
--- /dev/null
+From 16f3b1a8cf13288e95890a9b665553d1a573faf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 23:45:04 -0500
+Subject: powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild
+
+From: Nathan Lynch <nathanl@linux.ibm.com>
+
+[ Upstream commit d4aa219a074a5abaf95a756b9f0d190b5c03a945 ]
+
+Allow external callers to force the cacheinfo code to release all its
+references to cache nodes, e.g. before processing device tree updates
+post-migration, and to rebuild the hierarchy afterward.
+
+CPU online/offline must be blocked by callers; enforce this.
+
+Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/cacheinfo.c | 21 +++++++++++++++++++++
+ arch/powerpc/kernel/cacheinfo.h | 4 ++++
+ 2 files changed, 25 insertions(+)
+
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index c641983bbdd68..0122d5ce0637d 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -867,4 +867,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id)
+ if (cache)
+ cache_cpu_clear(cache, cpu_id);
+ }
++
++void cacheinfo_teardown(void)
++{
++ unsigned int cpu;
++
++ lockdep_assert_cpus_held();
++
++ for_each_online_cpu(cpu)
++ cacheinfo_cpu_offline(cpu);
++}
++
++void cacheinfo_rebuild(void)
++{
++ unsigned int cpu;
++
++ lockdep_assert_cpus_held();
++
++ for_each_online_cpu(cpu)
++ cacheinfo_cpu_online(cpu);
++}
++
+ #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */
+diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h
+index a7b74d36acd71..2cdee87a482c5 100644
+--- a/arch/powerpc/kernel/cacheinfo.h
++++ b/arch/powerpc/kernel/cacheinfo.h
+@@ -5,4 +5,8 @@
+ extern void cacheinfo_cpu_online(unsigned int cpu_id);
+ extern void cacheinfo_cpu_offline(unsigned int cpu_id);
+
++/* Allow migration/suspend to tear down and rebuild the hierarchy. */
++extern void cacheinfo_teardown(void);
++extern void cacheinfo_rebuild(void);
++
+ #endif /* _PPC_CACHEINFO_H */
+--
+2.20.1
+
--- /dev/null
+From 10884ee66085d2e7d3cab9f17d8ae16df1af4390 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 Mar 2019 04:24:37 +0000
+Subject: powerpc: vdso: Make vdso32 installation conditional in vdso_install
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ]
+
+The 32-bit vDSO is not needed and not normally built for 64-bit
+little-endian configurations. However, the vdso_install target still
+builds and installs it. Add the same config condition as is normally
+used for the build.
+
+Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/Makefile | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index d7eb035a9c960..65cb22541c660 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -350,7 +350,9 @@ vdso_install:
+ ifeq ($(CONFIG_PPC64),y)
+ $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@
+ endif
++ifdef CONFIG_VDSO32
+ $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@
++endif
+
+ archclean:
+ $(Q)$(MAKE) $(clean)=$(boot)
+--
+2.20.1
+
--- /dev/null
+From 35575b1b55d282733d4daafcc14c3a9876e3b5ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Jan 2019 17:27:55 +0200
+Subject: RDMA/ocrdma: Fix out of bounds index check in query pkey
+
+From: Gal Pressman <galpress@amazon.com>
+
+[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ]
+
+The pkey table size is one element, index should be tested for > 0 instead
+of > 1.
+
+Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter")
+Signed-off-by: Gal Pressman <galpress@amazon.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+index 76e96f97b3f64..6385448b22c5a 100644
+--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+@@ -55,7 +55,7 @@
+
+ int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey)
+ {
+- if (index > 1)
++ if (index > 0)
+ return -EINVAL;
+
+ *pkey = 0xffff;
+--
+2.20.1
+
--- /dev/null
+From 0b7d04869c1e40900835e5989701a64e8241c263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Oct 2018 22:43:46 +0200
+Subject: regulator: fixed: Default enable high on DT regulators
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+[ Upstream commit 28be5f15df2ee6882b0a122693159c96a28203c7 ]
+
+commit efdfeb079cc3
+("regulator: fixed: Convert to use GPIO descriptor only")
+switched to use gpiod_get() to look up the regulator from the
+gpiolib core whether that is device tree or boardfile.
+
+This meant that we activate the code in
+a603a2b8d86e ("gpio: of: Add special quirk to parse regulator flags")
+which means the descriptors coming from the device tree already
+have the right inversion and open drain semantics set up from
+the gpiolib core.
+
+As the fixed regulator was inspected again we got the
+inverted inversion and things broke.
+
+Fix it by ignoring the config in the device tree for now: the
+later patches in the series will push all inversion handling
+over to the gpiolib core and set it up properly in the
+boardfiles for legacy devices, but I did not finish that
+for this kernel cycle.
+
+Fixes: commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only")
+Reported-by: Leonard Crestez <leonard.crestez@nxp.com>
+Reported-by: Fabio Estevam <festevam@gmail.com>
+Reported-by: John Stultz <john.stultz@linaro.org>
+Reported-by: Anders Roxell <anders.roxell@linaro.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Tested-by: John Stultz <john.stultz@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/fixed.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
+index ff62d69ba0bed..24ad5e6832dfd 100644
+--- a/drivers/regulator/fixed.c
++++ b/drivers/regulator/fixed.c
+@@ -94,9 +94,14 @@ of_get_fixed_voltage_config(struct device *dev,
+
+ of_property_read_u32(np, "startup-delay-us", &config->startup_delay);
+
+- config->enable_high = of_property_read_bool(np, "enable-active-high");
+- config->gpio_is_open_drain = of_property_read_bool(np,
+- "gpio-open-drain");
++ /*
++ * FIXME: we pulled active low/high and open drain handling into
++ * gpiolib so it will be handled there. Delete this in the second
++ * step when we also remove the custom inversion handling for all
++ * legacy boardfiles.
++ */
++ config->enable_high = 1;
++ config->gpio_is_open_drain = 0;
+
+ if (of_find_property(np, "vin-supply", NULL))
+ config->input_supply = "vin";
+--
+2.20.1
+
--- /dev/null
+From 5163383abd0364e87aaf2a10d9254d8509a34c49 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 24 Feb 2019 21:16:51 +0800
+Subject: regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA
+
+From: Axel Lin <axel.lin@ingics.com>
+
+[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ]
+
+The wm831x_dcdc_ilim entries needs to be uA because it is used to compare
+with min_uA and max_uA.
+While at it also make the array const and change to use unsigned int.
+
+Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support")
+Signed-off-by: Axel Lin <axel.lin@ingics.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/wm831x-dcdc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
+index 8cbb82ceec405..fad424e20bd5b 100644
+--- a/drivers/regulator/wm831x-dcdc.c
++++ b/drivers/regulator/wm831x-dcdc.c
+@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev)
+ }
+
+ /* Current limit options */
+-static u16 wm831x_dcdc_ilim[] = {
+- 125, 250, 375, 500, 625, 750, 875, 1000
++static const unsigned int wm831x_dcdc_ilim[] = {
++ 125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000
+ };
+
+ static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev,
+--
+2.20.1
+
--- /dev/null
+From 4d3fba7b0d188fc542511f68bd3c08226ddfe4dd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:08:11 +0000
+Subject: rtc: 88pm80x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension")
+
+Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c
+index 466bf7f9a285a..7da2a1fb50f89 100644
+--- a/drivers/rtc/rtc-88pm80x.c
++++ b/drivers/rtc/rtc-88pm80x.c
+@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ unsigned char buf[4];
+ unsigned long ticks, base, data;
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ int ret;
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0);
+
+ regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4);
+- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]);
+
+ /* load 32-bit read-only counter */
+ regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+--
+2.20.1
+
--- /dev/null
+From f7f6d7a49fa5b6fb49754d7618d85e03e99cf858 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 09:50:53 +0000
+Subject: rtc: 88pm860x: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension")
+
+Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++-------
+ 1 file changed, 14 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c
+index 166faae3a59cd..7d3e5168fcefc 100644
+--- a/drivers/rtc/rtc-88pm860x.c
++++ b/drivers/rtc/rtc-88pm860x.c
+@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm)
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ base = ticks - data;
+ dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
+ pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf);
+ dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1],
+ buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]);
+- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7];
++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) |
++ (buf[5] << 8) | buf[7];
+
+ /* load 32-bit read-only counter */
+ pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf);
+- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+ ticks = base + data;
+ dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n",
+ base, data, ticks);
+--
+2.20.1
+
--- /dev/null
+From fde1f5afab8ebc76ccf58281f4aeae6a216a69bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Jan 2019 08:21:03 +0000
+Subject: rtc: cmos: ignore bogus century byte
+
+From: Eric Wong <e@80x24.org>
+
+[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ]
+
+Older versions of Libreboot and Coreboot had an invalid value
+(`3' in my case) in the century byte affecting the GM45 in
+the Thinkpad X200. Not everybody's updated their firmwares,
+and Linux <= 4.2 was able to read the RTC without problems,
+so workaround this by ignoring invalid values.
+
+Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support")
+
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Alessandro Zummo <a.zummo@towertech.it>
+Cc: Sylvain Chouleur <sylvain.chouleur@intel.com>
+Cc: Patrick McDermott <patrick.mcdermott@libiquity.com>
+Cc: linux-rtc@vger.kernel.org
+Signed-off-by: Eric Wong <e@80x24.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/rtc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/asm-generic/rtc.h b/include/asm-generic/rtc.h
+index 4e3b6558331ea..3e457ae2d571d 100644
+--- a/include/asm-generic/rtc.h
++++ b/include/asm-generic/rtc.h
+@@ -106,7 +106,7 @@ static inline unsigned int __get_rtc_time(struct rtc_time *time)
+ time->tm_year += real_year - 72;
+ #endif
+
+- if (century)
++ if (century > 20)
+ time->tm_year += (century - 19) * 100;
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 9a01cf71113abd715d56cd4d5c42258749b9405e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Feb 2019 18:04:49 +0000
+Subject: rtc: ds1672: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#138801 ("Unintended sign extension")
+
+Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-ds1672.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
+index 92b1cbf2c4a76..2bea733b15893 100644
+--- a/drivers/rtc/rtc-ds1672.c
++++ b/drivers/rtc/rtc-ds1672.c
+@@ -60,7 +60,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
+ "%s: raw read data - counters=%02x,%02x,%02x,%02x\n",
+ __func__, buf[0], buf[1], buf[2], buf[3]);
+
+- time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
++ time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) |
++ (buf[1] << 8) | buf[0];
+
+ rtc_time_to_tm(time, tm);
+
+--
+2.20.1
+
--- /dev/null
+From 8720f674e40bc07ad37557ad3b579fb8c9b659be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Jun 2019 12:23:36 +0800
+Subject: rtc: pcf8563: Clear event flags and disable interrupts before
+ requesting irq
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit 3572e8aea3bf925dac1dbf86127657c39fe5c254 ]
+
+Besides the alarm, the PCF8563 also has a timer triggered interrupt.
+In cases where the previous system left the timer and interrupts on,
+or somehow the bits got enabled, the interrupt would keep triggering
+as the kernel doesn't know about it.
+
+Clear both the alarm and timer event flags, and disable the interrupts,
+before requesting the interrupt line.
+
+Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support")
+Fixes: a45d528aab8b ("rtc: pcf8563: clear expired alarm at boot time")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pcf8563.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
+index 45b5a3d47ccf0..1982eec0a3eac 100644
+--- a/drivers/rtc/rtc-pcf8563.c
++++ b/drivers/rtc/rtc-pcf8563.c
+@@ -568,7 +568,6 @@ static int pcf8563_probe(struct i2c_client *client,
+ struct pcf8563 *pcf8563;
+ int err;
+ unsigned char buf;
+- unsigned char alm_pending;
+
+ dev_dbg(&client->dev, "%s\n", __func__);
+
+@@ -594,13 +593,13 @@ static int pcf8563_probe(struct i2c_client *client,
+ return err;
+ }
+
+- err = pcf8563_get_alarm_mode(client, NULL, &alm_pending);
+- if (err) {
+- dev_err(&client->dev, "%s: read error\n", __func__);
++ /* Clear flags and disable interrupts */
++ buf = 0;
++ err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf);
++ if (err < 0) {
++ dev_err(&client->dev, "%s: write error\n", __func__);
+ return err;
+ }
+- if (alm_pending)
+- pcf8563_set_alarm_mode(client, 0);
+
+ pcf8563->rtc = devm_rtc_device_register(&client->dev,
+ pcf8563_driver.driver.name,
+--
+2.20.1
+
--- /dev/null
+From e253324a9c1b19eee2231ef2c6dc2690d5020a26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Feb 2019 10:31:02 +0000
+Subject: rtc: pm8xxx: fix unintended sign extension
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ]
+
+Shifting a u8 by 24 will cause the value to be promoted to an integer. If
+the top bit of the u8 is set then the following conversion to an unsigned
+long will sign extend the value causing the upper 32 bits to be set in
+the result.
+
+Fix this by casting the u8 value to an unsigned long before the shift.
+
+Detected by CoverityScan, CID#1309693 ("Unintended sign extension")
+
+Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-pm8xxx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
+index 795fcbd02ea39..a0dae6271ff64 100644
+--- a/drivers/rtc/rtc-pm8xxx.c
++++ b/drivers/rtc/rtc-pm8xxx.c
+@@ -186,7 +186,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
+ }
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, tm);
+
+@@ -267,7 +268,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
+ return rc;
+ }
+
+- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24);
++ secs = value[0] | (value[1] << 8) | (value[2] << 16) |
++ ((unsigned long)value[3] << 24);
+
+ rtc_time_to_tm(secs, &alarm->time);
+
+--
+2.20.1
+
--- /dev/null
+From 57d23211c7dcab95d0165897985d74d15e27e5ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 2 Jul 2019 10:18:35 +0100
+Subject: scsi: libfc: fix null pointer dereference on a null lport
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ]
+
+Currently if lport is null then the null lport pointer is dereference when
+printing out debug via the FC_LPORT_DB macro. Fix this by using the more
+generic FC_LIBFC_DBG debug macro instead that does not use lport.
+
+Addresses-Coverity: ("Dereference after null check")
+Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/libfc/fc_exch.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
+index 30f9ef0c0d4f8..b20c575564e43 100644
+--- a/drivers/scsi/libfc/fc_exch.c
++++ b/drivers/scsi/libfc/fc_exch.c
+@@ -2499,7 +2499,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp)
+
+ /* lport lock ? */
+ if (!lport || lport->state == LPORT_ST_DISABLED) {
+- FC_LPORT_DBG(lport, "Receiving frames for an lport that "
++ FC_LIBFC_DBG("Receiving frames for an lport that "
+ "has not been initialized correctly\n");
+ fc_frame_free(fp);
+ return;
+--
+2.20.1
+
--- /dev/null
+From 8a3a964207f5a2409b9f1fcdb21e8f6c20d1813b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Mar 2019 06:46:28 -0800
+Subject: scsi: megaraid_sas: reduce module load time
+
+From: Steve Sistare <steven.sistare@oracle.com>
+
+[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ]
+
+megaraid_sas takes 1+ seconds to load while waiting for firmware:
+
+[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+This is due to the following loop in megasas_transition_to_ready(), which
+waits a minimum of 1 second, even though the FW becomes ready in tens of
+millisecs:
+
+ /*
+ * The cur_state should not last for more than max_wait secs
+ */
+ for (i = 0; i < max_wait; i++) {
+ ...
+ msleep(1000);
+ ...
+ dev_info(&instance->pdev->dev, "FW now in Ready state\n");
+
+This is a regression, caused by a change of the msleep granularity from 1
+to 1000 due to concern about waiting too long on systems with coarse
+jiffies.
+
+To fix, increase iterations and use msleep(20), which results in:
+
+[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state
+[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state
+
+Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity")
+Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 7be968f60b590..1efd876f0728c 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3585,12 +3585,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr)
+ /*
+ * The cur_state should not last for more than max_wait secs
+ */
+- for (i = 0; i < max_wait; i++) {
++ for (i = 0; i < max_wait * 50; i++) {
+ curr_abs_state = instance->instancet->
+ read_fw_status_reg(instance->reg_set);
+
+ if (abs_state == curr_abs_state) {
+- msleep(1000);
++ msleep(20);
+ } else
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From 07606b44145179065bc17831d2891eb723612edc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 4 Apr 2019 12:44:46 -0700
+Subject: scsi: qla2xxx: Unregister chrdev if module initialization fails
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ]
+
+If module initialization fails after the character device has been
+registered, unregister the character device. Additionally, avoid
+duplicating error path code.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Cc: Giridhar Malavali <giridhar.malavali@qlogic.com>
+Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++-------------
+ 1 file changed, 21 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 611a127f08d82..8975baab73e55 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -5780,8 +5780,7 @@ qla2x00_module_init(void)
+ /* Initialize target kmem_cache and mem_pools */
+ ret = qlt_init();
+ if (ret < 0) {
+- kmem_cache_destroy(srb_cachep);
+- return ret;
++ goto destroy_cache;
+ } else if (ret > 0) {
+ /*
+ * If initiator mode is explictly disabled by qlt_init(),
+@@ -5800,11 +5799,10 @@ qla2x00_module_init(void)
+ qla2xxx_transport_template =
+ fc_attach_transport(&qla2xxx_transport_functions);
+ if (!qla2xxx_transport_template) {
+- kmem_cache_destroy(srb_cachep);
+ ql_log(ql_log_fatal, NULL, 0x0002,
+ "fc_attach_transport failed...Failing load!.\n");
+- qlt_exit();
+- return -ENODEV;
++ ret = -ENODEV;
++ goto qlt_exit;
+ }
+
+ apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
+@@ -5816,27 +5814,37 @@ qla2x00_module_init(void)
+ qla2xxx_transport_vport_template =
+ fc_attach_transport(&qla2xxx_transport_vport_functions);
+ if (!qla2xxx_transport_vport_template) {
+- kmem_cache_destroy(srb_cachep);
+- qlt_exit();
+- fc_release_transport(qla2xxx_transport_template);
+ ql_log(ql_log_fatal, NULL, 0x0004,
+ "fc_attach_transport vport failed...Failing load!.\n");
+- return -ENODEV;
++ ret = -ENODEV;
++ goto unreg_chrdev;
+ }
+ ql_log(ql_log_info, NULL, 0x0005,
+ "QLogic Fibre Channel HBA Driver: %s.\n",
+ qla2x00_version_str);
+ ret = pci_register_driver(&qla2xxx_pci_driver);
+ if (ret) {
+- kmem_cache_destroy(srb_cachep);
+- qlt_exit();
+- fc_release_transport(qla2xxx_transport_template);
+- fc_release_transport(qla2xxx_transport_vport_template);
+ ql_log(ql_log_fatal, NULL, 0x0006,
+ "pci_register_driver failed...ret=%d Failing load!.\n",
+ ret);
++ goto release_vport_transport;
+ }
+ return ret;
++
++release_vport_transport:
++ fc_release_transport(qla2xxx_transport_vport_template);
++
++unreg_chrdev:
++ if (apidev_major >= 0)
++ unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
++ fc_release_transport(qla2xxx_transport_template);
++
++qlt_exit:
++ qlt_exit();
++
++destroy_cache:
++ kmem_cache_destroy(srb_cachep);
++ return ret;
+ }
+
+ /**
+--
+2.20.1
+
xfs-sanity-check-flags-of-q_xquotarm-call.patch
powerpc-archrandom-fix-arch_get_random_seed_int.patch
mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch
+drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
+alsa-hda-fix-unused-variable-warning.patch
+regulator-fixed-default-enable-high-on-dt-regulators.patch
+alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch
+staging-comedi-ni_mio_common-protect-register-write-.patch
+pcrypt-use-format-specifier-in-kobject_add.patch
+exportfs-fix-passing-zero-to-err_ptr-warning.patch
+drm-dp_mst-skip-validating-ports-during-destruction-.patch
+pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch
+pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch
+pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch
+pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch
+pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch
+pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch
+pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch
+pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch
+input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
+clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
+clk-qoriq-fix-refcount-leak-in-clockgen_init.patch
+clk-socfpga-fix-refcount-leak.patch
+clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch
+clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch
+clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch
+clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch
+clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch
+clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch
+clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch
+clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch
+ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch
+rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch
+media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch
+crypto-tgr192-fix-unaligned-memory-access.patch
+asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch
+rtc-cmos-ignore-bogus-century-byte.patch
+tty-ipwireless-fix-potential-null-pointer-dereferenc.patch
+rtc-ds1672-fix-unintended-sign-extension.patch
+rtc-88pm860x-fix-unintended-sign-extension.patch
+rtc-88pm80x-fix-unintended-sign-extension.patch
+rtc-pm8xxx-fix-unintended-sign-extension.patch
+fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
+pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch
+pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch
+pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch
+block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch
+vfio_pci-enable-memory-accesses-before-calling-pci_m.patch
+cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch
+drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch
+drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch
+asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch
+fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch
+clocksource-drivers-sun5i-fail-gracefully-when-clock.patch
+arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch
+regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch
+nios2-ksyms-add-missing-symbol-exports.patch
+scsi-megaraid_sas-reduce-module-load-time.patch
+xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch
+net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch
+media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
+media-cx18-update-pos-correctly-in-cx18_read_pos.patch
+media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch
+media-cx23885-check-allocation-return.patch
+jfs-fix-bogus-variable-self-initialization.patch
+m68k-mac-fix-via-timer-counter-accesses.patch
+arm-omap2-fix-potentially-uninitialized-return-value.patch
+media-davinci-isif-avoid-uninitialized-variable-use.patch
+spi-tegra114-clear-packed-bit-for-unpacked-mode.patch
+spi-tegra114-fix-for-unpacked-mode-transfers.patch
+soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch
+spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch
+ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch
+scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch
+arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch
+hwmon-w83627hf-use-request_muxed_region-for-super-io.patch
+tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch
+powerpc-vdso-make-vdso32-installation-conditional-in.patch
+media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
+6lowpan-off-by-one-handling-nexthdr.patch
+dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch
+alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch
+packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
+asoc-fix-valid-stream-condition.patch
+ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch
+iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch
+media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
+media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
+platform-x86-alienware-wmi-printing-the-wrong-error-.patch
+netfilter-ebtables-config_compat-reject-trailing-dat.patch
+arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch
+kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch
+backlight-lm3630a-return-0-on-success-in-update_stat.patch
+thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch
+spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch
+misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch
+iommu-use-right-function-to-get-group-for-device.patch
+signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch
+inet-frags-call-inet_frags_fini-after-unregister_per.patch
+media-vivid-fix-incorrect-assignment-operation-when-.patch
+powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch
+drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch
+net-af_iucv-always-register-net_device-notifier.patch
+asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch
+rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch
+drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch
+iommu-amd-make-iommu_disable-safer.patch
+mfd-intel-lpss-release-ida-resources.patch
+devres-allow-const-resource-arguments.patch
+net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch
+scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch
+libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch
+usb-host-xhci-hub-fix-extra-endianness-conversion.patch
+mic-avoid-statically-declaring-a-struct-device.patch
+x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch
+alsa-aoa-onyx-always-initialize-register-read-value.patch
+cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch
+crypto-caam-free-resources-in-case-caam_rng-registra.patch
+ext4-set-error-return-correctly-when-ext4_htree_stor.patch
+asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch
+asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch
+asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch
+signal-allow-cifs-and-drbd-to-receive-their-terminat.patch
+dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch
+mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
+mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch
+ahci-do-not-export-local-variable-ahci_em_messages.patch
+partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch
+power-supply-init-device-wakeup-after-device_add.patch
+x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch
+bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch
+iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
+ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch
+net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch
+btrfs-fix-hang-when-loading-existing-inode-cache-off.patch
+hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch
+net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch
+net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch
+iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch
+net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch
+net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch
+net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch
+mac80211-accept-deauth-frames-in-ibss-mode.patch
+llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch
+llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch
+net-stmmac-fix-length-of-ptp-clock-s-name-string.patch
+drm-msm-dsi-implement-reset-correctly.patch
+dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch
+net-qca_spi-move-reset_count-to-struct-qcaspi.patch
+media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch
+media-ov6650-fix-some-format-attributes-not-under-co.patch
+media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-sup.patch
+mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch
+net-neigh-use-long-type-to-store-jiffies-delta.patch
+packet-fix-data-race-in-fanout_flow_is_huge.patch
+dmaengine-ti-edma-fix-missed-failure-handling.patch
+drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
+arm64-dts-juno-fix-uart-frequency.patch
+m68k-call-timer_interrupt-with-interrupts-disabled.patch
--- /dev/null
+From 8d3cab1a93ed448f83140f17f948af09f03eb592 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 16 Aug 2019 12:33:54 -0500
+Subject: signal: Allow cifs and drbd to receive their terminating signals
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ]
+
+My recent to change to only use force_sig for a synchronous events
+wound up breaking signal reception cifs and drbd. I had overlooked
+the fact that by default kthreads start out with all signals set to
+SIG_IGN. So a change I thought was safe turned out to have made it
+impossible for those kernel thread to catch their signals.
+
+Reverting the work on force_sig is a bad idea because what the code
+was doing was very much a misuse of force_sig. As the way force_sig
+ultimately allowed the signal to happen was to change the signal
+handler to SIG_DFL. Which after the first signal will allow userspace
+to send signals to these kernel threads. At least for
+wake_ack_receiver in drbd that does not appear actively wrong.
+
+So correct this problem by adding allow_kernel_signal that will allow
+signals whose siginfo reports they were sent by the kernel through,
+but will not allow userspace generated signals, and update cifs and
+drbd to call allow_kernel_signal in an appropriate place so that their
+thread can receive this signal.
+
+Fixing things this way ensures that userspace won't be able to send
+signals and cause problems, that it is clear which signals the
+threads are expecting to receive, and it guarantees that nothing
+else in the system will be affected.
+
+This change was partly inspired by similar cifs and drbd patches that
+added allow_signal.
+
+Reported-by: ronnie sahlberg <ronniesahlberg@gmail.com>
+Reported-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Tested-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
+Cc: Steve French <smfrench@gmail.com>
+Cc: Philipp Reisner <philipp.reisner@linbit.com>
+Cc: David Laight <David.Laight@ACULAB.COM>
+Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes")
+Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig")
+Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig")
+Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 2 ++
+ fs/cifs/connect.c | 2 +-
+ include/linux/signal.h | 15 ++++++++++++++-
+ kernel/signal.c | 5 +++++
+ 4 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 385ec4ae33945..456350bd24b3c 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -331,6 +331,8 @@ static int drbd_thread_setup(void *arg)
+ thi->name[0],
+ resource->name);
+
++ allow_kernel_signal(DRBD_SIGKILL);
++ allow_kernel_signal(SIGXCPU);
+ restart:
+ retval = thi->function(thi);
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index f44281a5eb9ff..4bde8acca455c 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -939,7 +939,7 @@ cifs_demultiplex_thread(void *p)
+ mempool_resize(cifs_req_poolp, length + cifs_min_rcv);
+
+ set_freezable();
+- allow_signal(SIGKILL);
++ allow_kernel_signal(SIGKILL);
+ while (server->tcpStatus != CifsExiting) {
+ if (try_to_freeze())
+ continue;
+diff --git a/include/linux/signal.h b/include/linux/signal.h
+index bcc094cb697cc..649cd9fc63cae 100644
+--- a/include/linux/signal.h
++++ b/include/linux/signal.h
+@@ -313,6 +313,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping);
+ extern void exit_signals(struct task_struct *tsk);
+ extern void kernel_sigaction(int, __sighandler_t);
+
++#define SIG_KTHREAD ((__force __sighandler_t)2)
++#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3)
++
+ static inline void allow_signal(int sig)
+ {
+ /*
+@@ -320,7 +323,17 @@ static inline void allow_signal(int sig)
+ * know it'll be handled, so that they don't get converted to
+ * SIGKILL or just silently dropped.
+ */
+- kernel_sigaction(sig, (__force __sighandler_t)2);
++ kernel_sigaction(sig, SIG_KTHREAD);
++}
++
++static inline void allow_kernel_signal(int sig)
++{
++ /*
++ * Kernel threads handle their own signals. Let the signal code
++ * know signals sent by the kernel will be handled, so that they
++ * don't get silently dropped.
++ */
++ kernel_sigaction(sig, SIG_KTHREAD_KERNEL);
+ }
+
+ static inline void disallow_signal(int sig)
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 3095b2309876d..7e4a4b199a117 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -79,6 +79,11 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force)
+ handler == SIG_DFL && !(force && sig_kernel_only(sig)))
+ return 1;
+
++ /* Only allow kernel generated signals to this kthread */
++ if (unlikely((t->flags & PF_KTHREAD) &&
++ (handler == SIG_KTHREAD_KERNEL) && !force))
++ return true;
++
+ return sig_handler_ignored(handler, sig);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e74e64ebc13c45336967ee2c82b6f11a14783de4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 May 2019 12:33:50 -0500
+Subject: signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of
+ force_sig
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit 72abe3bcf0911d69b46c1e8bdb5612675e0ac42c ]
+
+The locking in force_sig_info is not prepared to deal with a task that
+exits or execs (as sighand may change). The is not a locking problem
+in force_sig as force_sig is only built to handle synchronous
+exceptions.
+
+Further the function force_sig_info changes the signal state if the
+signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the
+delivery of the signal. The signal SIGKILL can not be ignored and can
+not be blocked and SIGNAL_UNKILLABLE won't prevent it from being
+delivered.
+
+So using force_sig rather than send_sig for SIGKILL is confusing
+and pointless.
+
+Because it won't impact the sending of the signal and and because
+using force_sig is wrong, replace force_sig with send_sig.
+
+Cc: Namjae Jeon <namjae.jeon@samsung.com>
+Cc: Jeff Layton <jlayton@primarydata.com>
+Cc: Steve French <smfrench@gmail.com>
+Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"")
+Fixes: e7ddee9037e7 ("cifs: disable sharing session and tcon and add new TCP sharing code")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index 63108343124af..b608ce741444f 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -2246,7 +2246,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect)
+
+ task = xchg(&server->tsk, NULL);
+ if (task)
+- force_sig(SIGKILL, task);
++ send_sig(SIGKILL, task, 1);
+ }
+
+ static struct TCP_Server_Info *
+--
+2.20.1
+
--- /dev/null
+From cf2c867792760d8fdb9e43c0ba76349ddc2801f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 28 Mar 2019 17:18:41 +0300
+Subject: soc/fsl/qe: Fix an error code in qe_pin_request()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ]
+
+We forgot to set "err" on this error path.
+
+Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/sysdev/qe_lib/gpio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/sysdev/qe_lib/gpio.c b/arch/powerpc/sysdev/qe_lib/gpio.c
+index 521e67a49dc40..4052e3d7edbd5 100644
+--- a/arch/powerpc/sysdev/qe_lib/gpio.c
++++ b/arch/powerpc/sysdev/qe_lib/gpio.c
+@@ -155,8 +155,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index)
+ if (err < 0)
+ goto err0;
+ gc = gpio_to_chip(err);
+- if (WARN_ON(!gc))
++ if (WARN_ON(!gc)) {
++ err = -ENODEV;
+ goto err0;
++ }
+
+ if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) {
+ pr_debug("%s: tried to get a non-qe pin\n", __func__);
+--
+2.20.1
+
--- /dev/null
+From 3ef9b7c2743cb260fa1ab369d0c7460f8c12e563 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Mar 2019 09:31:02 +0000
+Subject: spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios
+
+From: Martin Sperl <kernel@martin.sperl.org>
+
+[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ]
+
+The original driver by default defines num_chipselects as -1.
+This actually allicates an array of 65535 entries in
+of_spi_register_master.
+
+There is a side-effect for buggy device trees that (contrary to
+dt-binding documentation) have no cs-gpio defined.
+
+This mode was never supported by the driver due to limitations
+of native cs and additional code complexity and is explicitly
+not stated to be implemented.
+
+To keep backwards compatibility with such buggy DTs we limit
+the number of chip_selects to 1, as for all practical purposes
+it is only ever realistic to use a single chip select in
+native cs mode without negative side-effects.
+
+Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...")
+Signed-off-by: Martin Sperl <kernel@martin.sperl.org>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c
+index ca655593c5e0e..1cedd640705f3 100644
+--- a/drivers/spi/spi-bcm2835aux.c
++++ b/drivers/spi/spi-bcm2835aux.c
+@@ -390,7 +390,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, master);
+ master->mode_bits = BCM2835_AUX_SPI_MODE_BITS;
+ master->bits_per_word_mask = SPI_BPW_MASK(8);
+- master->num_chipselect = -1;
++ /* even though the driver never officially supported native CS
++ * allow a single native CS for legacy DT support purposes when
++ * no cs-gpio is configured.
++ * Known limitations for native cs are:
++ * * multiple chip-selects: cs0-cs2 are all simultaniously asserted
++ * whenever there is a transfer - this even includes SPI_NO_CS
++ * * SPI_CS_HIGH: is ignores - cs are always asserted low
++ * * cs_change: cs is deasserted after each spi_transfer
++ * * cs_delay_usec: cs is always deasserted one SCK cycle after
++ * a spi_transfer
++ */
++ master->num_chipselect = 1;
+ master->transfer_one = bcm2835aux_spi_transfer_one;
+ master->handle_err = bcm2835aux_spi_handle_err;
+ master->dev.of_node = pdev->dev.of_node;
+--
+2.20.1
+
--- /dev/null
+From 4984a942e7c7a1633400ee759a35c277c150722a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 May 2019 11:00:36 +0000
+Subject: spi: spi-fsl-spi: call spi_finalize_current_message() at the end
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ]
+
+spi_finalize_current_message() shall be called once all
+actions are finished, otherwise the last actions might
+step over a newly started transfer.
+
+Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing")
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-fsl-spi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
+index 8b290d9d79350..5419de19859a0 100644
+--- a/drivers/spi/spi-fsl-spi.c
++++ b/drivers/spi/spi-fsl-spi.c
+@@ -408,7 +408,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ }
+
+ m->status = status;
+- spi_finalize_current_message(master);
+
+ if (status || !cs_change) {
+ ndelay(nsecs);
+@@ -416,6 +415,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master,
+ }
+
+ fsl_spi_setup_transfer(spi, NULL);
++ spi_finalize_current_message(master);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 7a62022966fd4edfa807dfb1cdc74f65a30f52b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:23 -0700
+Subject: spi: tegra114: clear packed bit for unpacked mode
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ]
+
+Fixes: Clear packed bit when not using packed mode.
+
+Packed bit is not cleared when not using packed mode. This results
+in transfer timeouts for the unpacked mode transfers followed by the
+packed mode transfers.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index 705f515863d4f..d98c502a9c478 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi,
+
+ if (tspi->is_packed)
+ command1 |= SPI_PACKED;
++ else
++ command1 &= ~SPI_PACKED;
+
+ command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN);
+ tspi->cur_direction = 0;
+--
+2.20.1
+
--- /dev/null
+From 7f4d4ad344427826a3db273b79b5b71f70390b51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 Mar 2019 22:56:24 -0700
+Subject: spi: tegra114: fix for unpacked mode transfers
+
+From: Sowjanya Komatineni <skomatineni@nvidia.com>
+
+[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ]
+
+Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked
+mode when transfer length is not a multiple of requested bits per word.
+
+unpacked mode transfers fails when the transfer includes partial bytes in
+the last word.
+
+Total words to be written/read to/from FIFO is computed based on transfer
+length and bits per word. Unpacked mode includes 0 padding bytes for partial
+words to align with bits per word and these extra bytes are also accounted
+for calculating bytes left to transfer in the current driver.
+
+This causes extra bytes access of tx/rx buffers along with buffer index
+position crossing actual length where remain_len becomes negative and due to
+unsigned type, negative value is a 32 bit representation of signed value
+and transferred bytes never meets the actual transfer length resulting in
+transfer timeout and a hang.
+
+This patch fixes this with proper computation of the actual bytes to fill in
+FIFO during transmit and the actual bytes to read from FIFO during receive
+ignoring 0 padded bytes.
+
+Signed-off-by: Sowjanya Komatineni <skomatineni@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 36 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c
+index d98c502a9c478..e37712bed0b2d 100644
+--- a/drivers/spi/spi-tegra114.c
++++ b/drivers/spi/spi-tegra114.c
+@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ }
++
++ tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
+ } else {
++ unsigned int write_bytes;
+ max_n_32bit = min(tspi->curr_dma_words, tx_empty_count);
+ written_words = max_n_32bit;
+ nbytes = written_words * tspi->bytes_per_word;
++ if (nbytes > t->len - tspi->cur_pos)
++ nbytes = t->len - tspi->cur_pos;
++ write_bytes = nbytes;
+ for (count = 0; count < max_n_32bit; count++) {
+ u32 x = 0;
+
+@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tegra_spi_writel(tspi, x, SPI_TX_FIFO);
+ }
++
++ tspi->cur_tx_pos += write_bytes;
+ }
+- tspi->cur_tx_pos += written_words * tspi->bytes_per_word;
++
+ return written_words;
+ }
+
+@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf(
+ for (i = 0; len && (i < 4); i++, len--)
+ *rx_buf++ = (x >> i*8) & 0xFF;
+ }
+- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ read_words += tspi->curr_dma_words;
++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++ u8 bytes_per_word = tspi->bytes_per_word;
++ unsigned int read_bytes;
+
++ len = rx_full_count * bytes_per_word;
++ if (len > t->len - tspi->cur_pos)
++ len = t->len - tspi->cur_pos;
++ read_bytes = len;
+ for (count = 0; count < rx_full_count; count++) {
+ u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask;
+
+- for (i = 0; (i < tspi->bytes_per_word); i++)
++ for (i = 0; len && (i < bytes_per_word); i++, len--)
+ *rx_buf++ = (x >> (i*8)) & 0xFF;
+ }
+- tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word;
+ read_words += rx_full_count;
++ tspi->cur_rx_pos += read_bytes;
+ }
++
+ return read_words;
+ }
+
+@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+
+ memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len);
++ tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ unsigned int i;
+ unsigned int count;
+ u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos;
+ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++ unsigned int write_bytes;
+
++ if (consume > t->len - tspi->cur_pos)
++ consume = t->len - tspi->cur_pos;
++ write_bytes = consume;
+ for (count = 0; count < tspi->curr_dma_words; count++) {
+ u32 x = 0;
+
+@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf(
+ x |= (u32)(*tx_buf++) << (i * 8);
+ tspi->tx_dma_buf[count] = x;
+ }
++
++ tspi->cur_tx_pos += write_bytes;
+ }
+- tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys,
+@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf(
+ unsigned len = tspi->curr_dma_words * tspi->bytes_per_word;
+
+ memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len);
++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+ } else {
+ unsigned int i;
+ unsigned int count;
+ unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos;
+ u32 rx_mask = ((u32)1 << t->bits_per_word) - 1;
++ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word;
++ unsigned int read_bytes;
+
++ if (consume > t->len - tspi->cur_pos)
++ consume = t->len - tspi->cur_pos;
++ read_bytes = consume;
+ for (count = 0; count < tspi->curr_dma_words; count++) {
+ u32 x = tspi->rx_dma_buf[count] & rx_mask;
+
+- for (i = 0; (i < tspi->bytes_per_word); i++)
++ for (i = 0; consume && (i < tspi->bytes_per_word);
++ i++, consume--)
+ *rx_buf++ = (x >> (i*8)) & 0xFF;
+ }
++
++ tspi->cur_rx_pos += read_bytes;
+ }
+- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word;
+
+ /* Make the dma buffer to read by dma */
+ dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys,
+--
+2.20.1
+
--- /dev/null
+From 1a19dbd6ac101a0b9b2e7148cafeca6de9cd807e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Oct 2018 14:54:16 -0600
+Subject: staging: comedi: ni_mio_common: protect register write overflow
+
+From: Spencer E. Olson <olsonse@umich.edu>
+
+[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ]
+
+Fixes two problems introduced as early as
+commit 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code"):
+(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
+ not unduly overwritten on e-series devices. On e-series devices, the
+ first three of the last four bits are reserved. The last bit defines
+ the output selection of the RGOUT0 pin, otherwise known as
+ RTSI_Sub_Selection. For m-series devices, these last four bits are
+ indeed used as the output selection of the RTSI7 pin (and the
+ RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
+ RTSI_Trig_Direction register.
+(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
+ lines.
+
+This patch also cleans up the ni_get_rtsi_routing command for readability.
+
+Fixes: 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code")
+Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../staging/comedi/drivers/ni_mio_common.c | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 619c989c5f370..d682907c146a5 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -4809,7 +4809,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
+ case NI_RTSI_OUTPUT_G_SRC0:
+ case NI_RTSI_OUTPUT_G_GATE0:
+ case NI_RTSI_OUTPUT_RGOUT0:
+- case NI_RTSI_OUTPUT_RTSI_BRD_0:
++ case NI_RTSI_OUTPUT_RTSI_BRD(0):
++ case NI_RTSI_OUTPUT_RTSI_BRD(1):
++ case NI_RTSI_OUTPUT_RTSI_BRD(2):
++ case NI_RTSI_OUTPUT_RTSI_BRD(3):
+ return 1;
+ case NI_RTSI_OUTPUT_RTSI_OSC:
+ return (devpriv->is_m_series) ? 1 : 0;
+@@ -4830,11 +4833,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
+ devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
+ NISTC_RTSI_TRIGA_OUT_REG);
+- } else if (chan < 8) {
++ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
+ devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
+ NISTC_RTSI_TRIGB_OUT_REG);
++ } else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ /* probably should never reach this, since the
++ * ni_valid_rtsi_output_source above errors out if chan is too
++ * high
++ */
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+ return 2;
+ }
+@@ -4849,12 +4859,12 @@ static unsigned ni_get_rtsi_routing(struct comedi_device *dev, unsigned chan)
+ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ return NISTC_RTSI_TRIG_TO_SRC(chan,
+ devpriv->rtsi_trig_b_output_reg);
+- } else {
+- if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
+- return NI_RTSI_OUTPUT_RTSI_OSC;
+- dev_err(dev->class_dev, "bug! should never get here?\n");
+- return 0;
++ } else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ return NI_RTSI_OUTPUT_RTSI_OSC;
+ }
++
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+
+ static int ni_rtsi_insn_config(struct comedi_device *dev,
+--
+2.20.1
+
--- /dev/null
+From d65e7ff76e8220e9e55d2f0c7b2fa70379f5ed24 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2019 11:32:38 -0700
+Subject: thermal: cpu_cooling: Actually trace CPU load in
+ thermal_power_cpu_get_power
+
+From: Matthias Kaehlcke <mka@chromium.org>
+
+[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ]
+
+The CPU load values passed to the thermal_power_cpu_get_power
+tracepoint are zero for all CPUs, unless, unless the
+thermal_power_cpu_limit tracepoint is enabled too:
+
+ irq/41-rockchip-98 [000] .... 290.972410: thermal_power_cpu_get_power:
+ cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815
+
+vs
+
+ irq/41-rockchip-96 [000] .... 95.773585: thermal_power_cpu_get_power:
+ cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959
+ irq/41-rockchip-96 [000] .... 95.773596: thermal_power_cpu_limit:
+ cpus=0000000f freq=408000 cdev_state=10 power=416
+
+There seems to be no good reason for omitting the CPU load information
+depending on another tracepoint. My guess is that the intention was to
+check whether thermal_power_cpu_get_power is (still) enabled, however
+'load_cpu != NULL' already indicates that it was at least enabled when
+cpufreq_get_requested_power() was entered, there seems little gain
+from omitting the assignment if the tracepoint was just disabled, so
+just remove the check.
+
+Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor")
+Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
+Reviewed-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Acked-by: Javi Merino <javi.merino@kernel.org>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thermal/cpu_cooling.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
+index 87d87ac1c8a04..96567b4a4f201 100644
+--- a/drivers/thermal/cpu_cooling.c
++++ b/drivers/thermal/cpu_cooling.c
+@@ -607,7 +607,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
+ load = 0;
+
+ total_load += load;
+- if (trace_thermal_power_cpu_limit_enabled() && load_cpu)
++ if (load_cpu)
+ load_cpu[i] = load;
+
+ i++;
+--
+2.20.1
+
--- /dev/null
+From 263ed5558462bb917922412c2c3a1f4a0bcbb2a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Apr 2019 13:10:09 +0800
+Subject: tipc: set sysctl_tipc_rmem and named_timeout right range
+
+From: Jie Liu <liujie165@huawei.com>
+
+[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ]
+
+We find that sysctl_tipc_rmem and named_timeout do not have the right minimum
+setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem.
+And named_timeout as a timeout setting should be not less than zero.
+
+Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf")
+Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue")
+Signed-off-by: Jie Liu <liujie165@huawei.com>
+Reported-by: Qiang Ning <ningqiang1@huawei.com>
+Reviewed-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/sysctl.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c
+index 1a779b1e85100..40f6d82083d7b 100644
+--- a/net/tipc/sysctl.c
++++ b/net/tipc/sysctl.c
+@@ -37,6 +37,8 @@
+
+ #include <linux/sysctl.h>
+
++static int zero;
++static int one = 1;
+ static struct ctl_table_header *tipc_ctl_hdr;
+
+ static struct ctl_table tipc_table[] = {
+@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = {
+ .data = &sysctl_tipc_rmem,
+ .maxlen = sizeof(sysctl_tipc_rmem),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "named_timeout",
+ .data = &sysctl_tipc_named_timeout,
+ .maxlen = sizeof(sysctl_tipc_named_timeout),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &zero,
+ },
+ {}
+ };
+--
+2.20.1
+
--- /dev/null
+From c5600bf641a6c9a9972f73d35a547f11b52ed38c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Jan 2019 18:30:51 +0800
+Subject: tty: ipwireless: Fix potential NULL pointer dereference
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ]
+
+There is a potential NULL pointer dereference in case
+alloc_ctrl_packet() fails and returns NULL.
+
+Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/ipwireless/hardware.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
+index ad7031a4f3c4d..454cdc6f2c05e 100644
+--- a/drivers/tty/ipwireless/hardware.c
++++ b/drivers/tty/ipwireless/hardware.c
+@@ -1515,6 +1515,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw)
+ sizeof(struct ipw_setup_get_version_query_packet),
+ ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
+ TL_SETUP_SIGNO_GET_VERSION_QRY);
++ if (!ver_packet)
++ return;
+ ver_packet->header.length = sizeof(struct tl_setup_get_version_qry);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 5699c3dd8d1a22567043cec1dbe9e398178d6208 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Jul 2019 15:17:19 +0300
+Subject: usb: host: xhci-hub: fix extra endianness conversion
+
+From: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+
+[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ]
+
+Don't do extra cpu_to_le32 conversion for
+put_unaligned_le32 because it is already implemented
+in this function.
+
+Fixes sparse error:
+xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types)
+xhci-hub.c:1152:44: expected unsigned int [usertype] val
+xhci-hub.c:1152:44: got restricted __le32 [usertype]
+
+Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status"
+Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
+Signed-off-by: Ruslan Bilovol <ruslan.bilovol@gmail.com>
+Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 40c95ed6afbf6..3ef80c2c0dcc1 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -965,7 +965,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ }
+ port_li = readl(port_array[wIndex] + PORTLI);
+ status = xhci_get_ext_port_status(temp, port_li);
+- put_unaligned_le32(cpu_to_le32(status), &buf[4]);
++ put_unaligned_le32(status, &buf[4]);
+ }
+ break;
+ case SetPortFeature:
+--
+2.20.1
+
--- /dev/null
+From a79504d8ad755395bab7e30b7be5547955c1a323 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Feb 2019 17:16:06 +0100
+Subject: vfio_pci: Enable memory accesses before calling pci_map_rom
+
+From: Eric Auger <eric.auger@redhat.com>
+
+[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ]
+
+pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
+In case the Memory Space accesses were disabled, readw() is likely
+to trigger a synchronous external abort on some platforms.
+
+In case memory accesses were disabled, re-enable them before the
+call and disable them back again just after.
+
+Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 4b62eb3b59233..7a82735d53087 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -496,6 +496,7 @@ static long vfio_pci_ioctl(void *device_data,
+ {
+ void __iomem *io;
+ size_t size;
++ u16 orig_cmd;
+
+ info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ info.flags = 0;
+@@ -505,15 +506,23 @@ static long vfio_pci_ioctl(void *device_data,
+ if (!info.size)
+ break;
+
+- /* Is it really there? */
++ /*
++ * Is it really there? Enable memory decode for
++ * implicit access in pci_map_rom().
++ */
++ pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
++ pci_write_config_word(pdev, PCI_COMMAND,
++ orig_cmd | PCI_COMMAND_MEMORY);
++
+ io = pci_map_rom(pdev, &size);
+- if (!io || !size) {
++ if (io) {
++ info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_unmap_rom(pdev, io);
++ } else {
+ info.size = 0;
+- break;
+ }
+- pci_unmap_rom(pdev, io);
+
+- info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ break;
+ }
+ case VFIO_PCI_VGA_REGION_INDEX:
+--
+2.20.1
+
--- /dev/null
+From aa48ddf08f829379ad3ab217149947365cefae5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 22 Jul 2019 20:47:06 +0200
+Subject: x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 2591bc4e8d70b4e1330d327fb7e3921f4e070a51 ]
+
+apic->send_IPI_allbutself() takes a vector number as argument.
+
+APIC_DM_NMI is clearly not a vector number. It's defined to 0x400 which is
+outside the vector space.
+
+Use NMI_VECTOR instead as that's what it is intended to be.
+
+Fixes: 82da3ff89dc2 ("x86: kgdb support")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20190722105218.855189979@linutronix.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/kgdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
+index 44256a62702b2..4a08fda2b06f0 100644
+--- a/arch/x86/kernel/kgdb.c
++++ b/arch/x86/kernel/kgdb.c
+@@ -437,7 +437,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs)
+ */
+ void kgdb_roundup_cpus(unsigned long flags)
+ {
+- apic->send_IPI_allbutself(APIC_DM_NMI);
++ apic->send_IPI_allbutself(NMI_VECTOR);
+ }
+ #endif
+
+--
+2.20.1
+
--- /dev/null
+From 707f704f4c78e05d1d67032a5e3238f791d47ee7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 1 Sep 2019 12:03:08 +0900
+Subject: x86, perf: Fix the dependency of the x86 insn decoder selftest
+
+From: Masami Hiramatsu <mhiramat@kernel.org>
+
+[ Upstream commit 7720804a2ae46c90265a32c81c45fb6f8d2f4e8b ]
+
+Since x86 instruction decoder is not only for kprobes,
+it should be tested when the insn.c is compiled.
+(e.g. perf is enabled but kprobes is disabled)
+
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: cbe5c34c8c1f ("x86: Compile insn.c and inat.c only for KPROBES")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
+index 2aa212fb0faf5..31c191a08bb19 100644
+--- a/arch/x86/Kconfig.debug
++++ b/arch/x86/Kconfig.debug
+@@ -221,7 +221,7 @@ config HAVE_MMIOTRACE_SUPPORT
+
+ config X86_DECODER_SELFTEST
+ bool "x86 instruction decoder selftest"
+- depends on DEBUG_KERNEL && KPROBES
++ depends on DEBUG_KERNEL && INSTRUCTION_DECODER
+ depends on !COMPILE_TEST
+ ---help---
+ Perform x86 instruction decoder selftests at build time.
+--
+2.20.1
+
--- /dev/null
+From e9cbe0c9a5ac02e072d988831633e3bcba9711cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Mar 2019 08:41:22 +0300
+Subject: xen, cpu_hotplug: Prevent an out of bounds access
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]
+
+The "cpu" variable comes from the sscanf() so Smatch marks it as
+untrusted data. We can't pass a higher value than "nr_cpu_ids" to
+cpu_possible() or it results in an out of bounds access.
+
+Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/cpu_hotplug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
+index f4e59c445964d..17054d6954117 100644
+--- a/drivers/xen/cpu_hotplug.c
++++ b/drivers/xen/cpu_hotplug.c
+@@ -53,7 +53,7 @@ static int vcpu_online(unsigned int cpu)
+ }
+ static void vcpu_hotplug(unsigned int cpu)
+ {
+- if (!cpu_possible(cpu))
++ if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
+ return;
+
+ switch (vcpu_online(cpu)) {
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
