--- /dev/null
+From 167ee0b82429cb5df272808c7a21370b7c961ab2 Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Thu, 2 Jan 2020 18:24:09 +0100
+Subject: arm: Implement copy_thread_tls
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit 167ee0b82429cb5df272808c7a21370b7c961ab2 upstream.
+
+This is required for clone3 which passes the TLS value through a
+struct rather than a register.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: <stable@vger.kernel.org> # 5.3.x
+Link: https://lore.kernel.org/r/20200102172413.654385-4-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/Kconfig | 1 +
+ arch/arm/kernel/process.c | 6 +++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -73,6 +73,7 @@ config ARM
+ select HAVE_ARM_SMCCC if CPU_V7
+ select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32
+ select HAVE_CONTEXT_TRACKING
++ select HAVE_COPY_THREAD_TLS
+ select HAVE_C_RECORDMCOUNT
+ select HAVE_DEBUG_KMEMLEAK
+ select HAVE_DMA_CONTIGUOUS if MMU
+--- a/arch/arm/kernel/process.c
++++ b/arch/arm/kernel/process.c
+@@ -224,8 +224,8 @@ void release_thread(struct task_struct *
+ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
+
+ int
+-copy_thread(unsigned long clone_flags, unsigned long stack_start,
+- unsigned long stk_sz, struct task_struct *p)
++copy_thread_tls(unsigned long clone_flags, unsigned long stack_start,
++ unsigned long stk_sz, struct task_struct *p, unsigned long tls)
+ {
+ struct thread_info *thread = task_thread_info(p);
+ struct pt_regs *childregs = task_pt_regs(p);
+@@ -259,7 +259,7 @@ copy_thread(unsigned long clone_flags, u
+ clear_ptrace_hw_breakpoint(p);
+
+ if (clone_flags & CLONE_SETTLS)
+- thread->tp_value[0] = childregs->ARM_r3;
++ thread->tp_value[0] = tls;
+ thread->tp_value[1] = get_tpuser();
+
+ thread_notify(THREAD_NOTIFY_COPY, thread);
--- /dev/null
+From a4376f2fbcc8084832f2f114577c8d68234c7903 Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Thu, 2 Jan 2020 18:24:08 +0100
+Subject: arm64: Implement copy_thread_tls
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit a4376f2fbcc8084832f2f114577c8d68234c7903 upstream.
+
+This is required for clone3 which passes the TLS value through a
+struct rather than a register.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: <stable@vger.kernel.org> # 5.3.x
+Acked-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20200102172413.654385-3-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/Kconfig | 1 +
+ arch/arm64/kernel/process.c | 10 +++++-----
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -139,6 +139,7 @@ config ARM64
+ select HAVE_CMPXCHG_DOUBLE
+ select HAVE_CMPXCHG_LOCAL
+ select HAVE_CONTEXT_TRACKING
++ select HAVE_COPY_THREAD_TLS
+ select HAVE_DEBUG_BUGVERBOSE
+ select HAVE_DEBUG_KMEMLEAK
+ select HAVE_DMA_CONTIGUOUS
+--- a/arch/arm64/kernel/process.c
++++ b/arch/arm64/kernel/process.c
+@@ -360,8 +360,8 @@ int arch_dup_task_struct(struct task_str
+
+ asmlinkage void ret_from_fork(void) asm("ret_from_fork");
+
+-int copy_thread(unsigned long clone_flags, unsigned long stack_start,
+- unsigned long stk_sz, struct task_struct *p)
++int copy_thread_tls(unsigned long clone_flags, unsigned long stack_start,
++ unsigned long stk_sz, struct task_struct *p, unsigned long tls)
+ {
+ struct pt_regs *childregs = task_pt_regs(p);
+
+@@ -394,11 +394,11 @@ int copy_thread(unsigned long clone_flag
+ }
+
+ /*
+- * If a TLS pointer was passed to clone (4th argument), use it
+- * for the new thread.
++ * If a TLS pointer was passed to clone, use it for the new
++ * thread.
+ */
+ if (clone_flags & CLONE_SETTLS)
+- p->thread.uw.tp_value = childregs->regs[3];
++ p->thread.uw.tp_value = tls;
+ } else {
+ memset(childregs, 0, sizeof(struct pt_regs));
+ childregs->pstate = PSR_MODE_EL1h;
--- /dev/null
+From 3e3c8ca5a351350031f0f3d5ecedf7048b1b9008 Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Thu, 2 Jan 2020 18:24:07 +0100
+Subject: arm64: Move __ARCH_WANT_SYS_CLONE3 definition to uapi headers
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit 3e3c8ca5a351350031f0f3d5ecedf7048b1b9008 upstream.
+
+Previously this was only defined in the internal headers which
+resulted in __NR_clone3 not being defined in the user headers.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: <stable@vger.kernel.org> # 5.3.x
+Reviewed-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200102172413.654385-2-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/include/asm/unistd.h | 1 -
+ arch/arm64/include/uapi/asm/unistd.h | 1 +
+ 2 files changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/include/asm/unistd.h
++++ b/arch/arm64/include/asm/unistd.h
+@@ -42,7 +42,6 @@
+ #endif
+
+ #define __ARCH_WANT_SYS_CLONE
+-#define __ARCH_WANT_SYS_CLONE3
+
+ #ifndef __COMPAT_SYSCALL_NR
+ #include <uapi/asm/unistd.h>
+--- a/arch/arm64/include/uapi/asm/unistd.h
++++ b/arch/arm64/include/uapi/asm/unistd.h
+@@ -19,5 +19,6 @@
+ #define __ARCH_WANT_NEW_STAT
+ #define __ARCH_WANT_SET_GET_RLIMIT
+ #define __ARCH_WANT_TIME32_SYSCALLS
++#define __ARCH_WANT_SYS_CLONE3
+
+ #include <asm-generic/unistd.h>
--- /dev/null
+From e7153bf70c3496bac00e7e4f395bb8d8394ac0ea Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Sat, 7 Dec 2019 19:34:18 +0100
+Subject: can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit e7153bf70c3496bac00e7e4f395bb8d8394ac0ea upstream.
+
+KMSAN sysbot detected a read access to an untinitialized value in the
+headroom of an outgoing CAN related sk_buff. When using CAN sockets this
+area is filled appropriately - but when using a packet socket this
+initialization is missing.
+
+The problematic read access occurs in the CAN receive path which can
+only be triggered when the sk_buff is sent through a (virtual) CAN
+interface. So we check in the sending path whether we need to perform
+the missing initializations.
+
+Fixes: d3b58c47d330d ("can: replace timestamp as unique skb attribute")
+Reported-by: syzbot+b02ff0707a97e4e79ebb@syzkaller.appspotmail.com
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Tested-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Cc: linux-stable <stable@vger.kernel.org> # >= v4.1
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/can/dev.h | 34 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -18,6 +18,7 @@
+ #include <linux/can/error.h>
+ #include <linux/can/led.h>
+ #include <linux/can/netlink.h>
++#include <linux/can/skb.h>
+ #include <linux/netdevice.h>
+
+ /*
+@@ -91,6 +92,36 @@ struct can_priv {
+ #define get_can_dlc(i) (min_t(__u8, (i), CAN_MAX_DLC))
+ #define get_canfd_dlc(i) (min_t(__u8, (i), CANFD_MAX_DLC))
+
++/* Check for outgoing skbs that have not been created by the CAN subsystem */
++static inline bool can_skb_headroom_valid(struct net_device *dev,
++ struct sk_buff *skb)
++{
++ /* af_packet creates a headroom of HH_DATA_MOD bytes which is fine */
++ if (WARN_ON_ONCE(skb_headroom(skb) < sizeof(struct can_skb_priv)))
++ return false;
++
++ /* af_packet does not apply CAN skb specific settings */
++ if (skb->ip_summed == CHECKSUM_NONE) {
++ /* init headroom */
++ can_skb_prv(skb)->ifindex = dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
++
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
++
++ /* preform proper loopback on capable devices */
++ if (dev->flags & IFF_ECHO)
++ skb->pkt_type = PACKET_LOOPBACK;
++ else
++ skb->pkt_type = PACKET_HOST;
++
++ skb_reset_mac_header(skb);
++ skb_reset_network_header(skb);
++ skb_reset_transport_header(skb);
++ }
++
++ return true;
++}
++
+ /* Drop a given socketbuffer if it does not contain a valid CAN frame. */
+ static inline bool can_dropped_invalid_skb(struct net_device *dev,
+ struct sk_buff *skb)
+@@ -108,6 +139,9 @@ static inline bool can_dropped_invalid_s
+ } else
+ goto inval_skb;
+
++ if (!can_skb_headroom_valid(dev, skb))
++ goto inval_skb;
++
+ return false;
+
+ inval_skb:
--- /dev/null
+From 2f361cd9474ab2c4ab9ac8db20faf81e66c6279b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:32:31 +0100
+Subject: can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 2f361cd9474ab2c4ab9ac8db20faf81e66c6279b upstream.
+
+Make sure to always use the descriptors of the current alternate setting
+to avoid future issues when accessing fields that may differ between
+settings.
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/gs_usb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -918,7 +918,7 @@ static int gs_usb_probe(struct usb_inter
+ GS_USB_BREQ_HOST_FORMAT,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+ 1,
+- intf->altsetting[0].desc.bInterfaceNumber,
++ intf->cur_altsetting->desc.bInterfaceNumber,
+ hconf,
+ sizeof(*hconf),
+ 1000);
+@@ -941,7 +941,7 @@ static int gs_usb_probe(struct usb_inter
+ GS_USB_BREQ_DEVICE_CONFIG,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
+ 1,
+- intf->altsetting[0].desc.bInterfaceNumber,
++ intf->cur_altsetting->desc.bInterfaceNumber,
+ dconf,
+ sizeof(*dconf),
+ 1000);
--- /dev/null
+From 5660493c637c9d83786f1c9297f403eae44177b6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Tue, 10 Dec 2019 12:32:30 +0100
+Subject: can: kvaser_usb: fix interface sanity check
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 5660493c637c9d83786f1c9297f403eae44177b6 upstream.
+
+Make sure to use the current alternate setting when verifying the
+interface descriptors to avoid binding to an invalid interface.
+
+Failing to do so could cause the driver to misbehave or trigger a WARN()
+in usb_submit_urb() that kernels with panic_on_warn set would choke on.
+
+Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family")
+Cc: stable <stable@vger.kernel.org> # 4.19
+Cc: Jimmy Assarsson <extja@kvaser.com>
+Cc: Christer Beskow <chbe@kvaser.com>
+Cc: Nicklas Johansson <extnj@kvaser.com>
+Cc: Martin Henriksson <mh@kvaser.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +-
+ drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+@@ -1590,7 +1590,7 @@ static int kvaser_usb_hydra_setup_endpoi
+ struct usb_endpoint_descriptor *ep;
+ int i;
+
+- iface_desc = &dev->intf->altsetting[0];
++ iface_desc = dev->intf->cur_altsetting;
+
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ ep = &iface_desc->endpoint[i].desc;
+--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+@@ -1310,7 +1310,7 @@ static int kvaser_usb_leaf_setup_endpoin
+ struct usb_endpoint_descriptor *endpoint;
+ int i;
+
+- iface_desc = &dev->intf->altsetting[0];
++ iface_desc = dev->intf->cur_altsetting;
+
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
+ endpoint = &iface_desc->endpoint[i].desc;
--- /dev/null
+From 2d77bd61a2927be8f4e00d9478fe6996c47e8d45 Mon Sep 17 00:00:00 2001
+From: Florian Faber <faber@faberman.de>
+Date: Thu, 26 Dec 2019 19:51:24 +0100
+Subject: can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode
+
+From: Florian Faber <faber@faberman.de>
+
+commit 2d77bd61a2927be8f4e00d9478fe6996c47e8d45 upstream.
+
+Under load, the RX side of the mscan driver can get stuck while TX still
+works. Restarting the interface locks up the system. This behaviour
+could be reproduced reliably on a MPC5121e based system.
+
+The patch fixes the return value of the NAPI polling function (should be
+the number of processed packets, not constant 1) and the condition under
+which IRQs are enabled again after polling is finished.
+
+With this patch, no more lockups were observed over a test period of ten
+days.
+
+Fixes: afa17a500a36 ("net/can: add driver for mscan family & mpc52xx_mscan")
+Signed-off-by: Florian Faber <faber@faberman.de>
+Cc: linux-stable <stable@vger.kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/mscan/mscan.c | 21 ++++++++++-----------
+ 1 file changed, 10 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/can/mscan/mscan.c
++++ b/drivers/net/can/mscan/mscan.c
+@@ -381,13 +381,12 @@ static int mscan_rx_poll(struct napi_str
+ struct net_device *dev = napi->dev;
+ struct mscan_regs __iomem *regs = priv->reg_base;
+ struct net_device_stats *stats = &dev->stats;
+- int npackets = 0;
+- int ret = 1;
++ int work_done = 0;
+ struct sk_buff *skb;
+ struct can_frame *frame;
+ u8 canrflg;
+
+- while (npackets < quota) {
++ while (work_done < quota) {
+ canrflg = in_8(®s->canrflg);
+ if (!(canrflg & (MSCAN_RXF | MSCAN_ERR_IF)))
+ break;
+@@ -408,18 +407,18 @@ static int mscan_rx_poll(struct napi_str
+
+ stats->rx_packets++;
+ stats->rx_bytes += frame->can_dlc;
+- npackets++;
++ work_done++;
+ netif_receive_skb(skb);
+ }
+
+- if (!(in_8(®s->canrflg) & (MSCAN_RXF | MSCAN_ERR_IF))) {
+- napi_complete(&priv->napi);
+- clear_bit(F_RX_PROGRESS, &priv->flags);
+- if (priv->can.state < CAN_STATE_BUS_OFF)
+- out_8(®s->canrier, priv->shadow_canrier);
+- ret = 0;
++ if (work_done < quota) {
++ if (likely(napi_complete_done(&priv->napi, work_done))) {
++ clear_bit(F_RX_PROGRESS, &priv->flags);
++ if (priv->can.state < CAN_STATE_BUS_OFF)
++ out_8(®s->canrier, priv->shadow_canrier);
++ }
+ }
+- return ret;
++ return work_done;
+ }
+
+ static irqreturn_t mscan_isr(int irq, void *dev_id)
--- /dev/null
+From 3069ce620daed85e4ef2b0c087dca2509f809470 Mon Sep 17 00:00:00 2001
+From: Sean Nyekjaer <sean@geanix.com>
+Date: Wed, 11 Dec 2019 14:58:52 +0100
+Subject: can: tcan4x5x: tcan4x5x_can_probe(): get the device out of standby before register access
+
+From: Sean Nyekjaer <sean@geanix.com>
+
+commit 3069ce620daed85e4ef2b0c087dca2509f809470 upstream.
+
+The m_can tries to detect if Non ISO Operation is available while in
+standby mode, this function results in the following error:
+
+| tcan4x5x spi2.0 (unnamed net_device) (uninitialized): Failed to init module
+| tcan4x5x spi2.0: m_can device registered (irq=84, version=32)
+| tcan4x5x spi2.0 can2: TCAN4X5X successfully initialized.
+
+When the tcan device comes out of reset it goes in standby mode. The
+m_can driver tries to access the control register but fails due to the
+device being in standby mode.
+
+So this patch will put the tcan device in normal mode before the m_can
+driver does the initialization.
+
+Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Nyekjaer <sean@geanix.com>
+Acked-by: Dan Murphy <dmurphy@ti.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/m_can/tcan4x5x.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/can/m_can/tcan4x5x.c
++++ b/drivers/net/can/m_can/tcan4x5x.c
+@@ -445,6 +445,10 @@ static int tcan4x5x_can_probe(struct spi
+
+ tcan4x5x_power_enable(priv->power, 1);
+
++ ret = tcan4x5x_init(mcan_class);
++ if (ret)
++ goto out_power;
++
+ ret = m_can_class_register(mcan_class);
+ if (ret)
+ goto out_power;
--- /dev/null
+From dd499f7a7e34270208350a849ef103c0b3ae477f Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Thu, 2 Jan 2020 18:24:13 +0100
+Subject: clone3: ensure copy_thread_tls is implemented
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit dd499f7a7e34270208350a849ef103c0b3ae477f upstream.
+
+copy_thread implementations handle CLONE_SETTLS by reading the TLS
+value from the registers containing the syscall arguments for
+clone. This doesn't work with clone3 since the TLS value is passed
+in clone_args instead.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: <stable@vger.kernel.org> # 5.3.x
+Link: https://lore.kernel.org/r/20200102172413.654385-8-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/fork.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2513,6 +2513,16 @@ SYSCALL_DEFINE5(clone, unsigned long, cl
+ #endif
+
+ #ifdef __ARCH_WANT_SYS_CLONE3
++
++/*
++ * copy_thread implementations handle CLONE_SETTLS by reading the TLS value from
++ * the registers containing the syscall arguments for clone. This doesn't work
++ * with clone3 since the TLS value is passed in clone_args instead.
++ */
++#ifndef CONFIG_HAVE_COPY_THREAD_TLS
++#error clone3 requires copy_thread_tls support in arch
++#endif
++
+ noinline static int copy_clone_args_from_user(struct kernel_clone_args *kargs,
+ struct clone_args __user *uargs,
+ size_t usize)
--- /dev/null
+From aa23ca3d98f756d5b1e503fb140665fb24a41a38 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 5 Jan 2020 17:03:57 +0100
+Subject: gpiolib: acpi: Add honor_wakeup module-option + quirk mechanism
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit aa23ca3d98f756d5b1e503fb140665fb24a41a38 upstream.
+
+On some laptops enabling wakeup on the GPIO interrupts used for ACPI _AEI
+event handling causes spurious wakeups.
+
+This commit adds a new honor_wakeup option, defaulting to true (our current
+behavior), which can be used to disable wakeup on troublesome hardware
+to avoid these spurious wakeups.
+
+This is a workaround for an architectural problem with s2idle under Linux
+where we do not have any mechanism to immediately go back to sleep after
+wakeup events, other then for embedded-controller events using the standard
+ACPI EC interface, for details see:
+https://lore.kernel.org/linux-acpi/61450f9b-cbc6-0c09-8b3a-aff6bf9a0b3c@redhat.com/
+
+One series of laptops which is not able to suspend without this workaround
+is the HP x2 10 Cherry Trail models, this commit adds a DMI based quirk
+which makes sets honor_wakeup to false on these models.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20200105160357.97154-3-hdegoede@redhat.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib-acpi.c | 32 +++++++++++++++++++++++++++++++-
+ 1 file changed, 31 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -22,12 +22,18 @@
+ #include "gpiolib-acpi.h"
+
+ #define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l
++#define QUIRK_NO_WAKEUP 0x02l
+
+ static int run_edge_events_on_boot = -1;
+ module_param(run_edge_events_on_boot, int, 0444);
+ MODULE_PARM_DESC(run_edge_events_on_boot,
+ "Run edge _AEI event-handlers at boot: 0=no, 1=yes, -1=auto");
+
++static int honor_wakeup = -1;
++module_param(honor_wakeup, int, 0444);
++MODULE_PARM_DESC(honor_wakeup,
++ "Honor the ACPI wake-capable flag: 0=no, 1=yes, -1=auto");
++
+ /**
+ * struct acpi_gpio_event - ACPI GPIO event handler data
+ *
+@@ -276,7 +282,7 @@ static acpi_status acpi_gpiochip_alloc_e
+ event->handle = evt_handle;
+ event->handler = handler;
+ event->irq = irq;
+- event->irq_is_wake = agpio->wake_capable == ACPI_WAKE_CAPABLE;
++ event->irq_is_wake = honor_wakeup && agpio->wake_capable == ACPI_WAKE_CAPABLE;
+ event->pin = pin;
+ event->desc = desc;
+
+@@ -1330,6 +1336,23 @@ static const struct dmi_system_id gpioli
+ },
+ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
+ },
++ {
++ /*
++ * Various HP X2 10 Cherry Trail models use an external
++ * embedded-controller connected via I2C + an ACPI GPIO
++ * event handler. The embedded controller generates various
++ * spurious wakeup events when suspended. So disable wakeup
++ * for its handler (it uses the only ACPI GPIO event handler).
++ * This breaks wakeup when opening the lid, the user needs
++ * to press the power-button to wakeup the system. The
++ * alternative is suspend simply not working, which is worse.
++ */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "HP"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP x2 Detachable 10-p0XX"),
++ },
++ .driver_data = (void *)QUIRK_NO_WAKEUP,
++ },
+ {} /* Terminating entry */
+ };
+
+@@ -1349,6 +1372,13 @@ static int acpi_gpio_setup_params(void)
+ run_edge_events_on_boot = 1;
+ }
+
++ if (honor_wakeup < 0) {
++ if (quirks & QUIRK_NO_WAKEUP)
++ honor_wakeup = 0;
++ else
++ honor_wakeup = 1;
++ }
++
+ return 0;
+ }
+
--- /dev/null
+From 1ad1b54099c231aed8f6f257065c1b322583f264 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 5 Jan 2020 17:03:56 +0100
+Subject: gpiolib: acpi: Turn dmi_system_id table into a generic quirk table
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+commit 1ad1b54099c231aed8f6f257065c1b322583f264 upstream.
+
+Turn the existing run_edge_events_on_boot_blacklist dmi_system_id table
+into a generic quirk table, storing the quirks in the driver_data ptr.
+
+This is a preparation patch for adding other types of (DMI based) quirks.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20200105160357.97154-2-hdegoede@redhat.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpiolib-acpi.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpio/gpiolib-acpi.c
++++ b/drivers/gpio/gpiolib-acpi.c
+@@ -21,6 +21,8 @@
+ #include "gpiolib.h"
+ #include "gpiolib-acpi.h"
+
++#define QUIRK_NO_EDGE_EVENTS_ON_BOOT 0x01l
++
+ static int run_edge_events_on_boot = -1;
+ module_param(run_edge_events_on_boot, int, 0444);
+ MODULE_PARM_DESC(run_edge_events_on_boot,
+@@ -1302,7 +1304,7 @@ static int acpi_gpio_handle_deferred_req
+ /* We must use _sync so that this runs after the first deferred_probe run */
+ late_initcall_sync(acpi_gpio_handle_deferred_request_irqs);
+
+-static const struct dmi_system_id run_edge_events_on_boot_blacklist[] = {
++static const struct dmi_system_id gpiolib_acpi_quirks[] = {
+ {
+ /*
+ * The Minix Neo Z83-4 has a micro-USB-B id-pin handler for
+@@ -1312,7 +1314,8 @@ static const struct dmi_system_id run_ed
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MINIX"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"),
+- }
++ },
++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
+ },
+ {
+ /*
+@@ -1324,15 +1327,23 @@ static const struct dmi_system_id run_ed
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Wortmann_AG"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "TERRA_PAD_1061"),
+- }
++ },
++ .driver_data = (void *)QUIRK_NO_EDGE_EVENTS_ON_BOOT,
+ },
+ {} /* Terminating entry */
+ };
+
+ static int acpi_gpio_setup_params(void)
+ {
++ const struct dmi_system_id *id;
++ long quirks = 0;
++
++ id = dmi_first_match(gpiolib_acpi_quirks);
++ if (id)
++ quirks = (long)id->driver_data;
++
+ if (run_edge_events_on_boot < 0) {
+- if (dmi_check_system(run_edge_events_on_boot_blacklist))
++ if (quirks & QUIRK_NO_EDGE_EVENTS_ON_BOOT)
+ run_edge_events_on_boot = 0;
+ else
+ run_edge_events_on_boot = 1;
--- /dev/null
+From 4a350a0ee5b0a14f826fcdf60dd1a3199cafbfd6 Mon Sep 17 00:00:00 2001
+From: Patrick Steinhardt <ps@pks.im>
+Date: Fri, 27 Dec 2019 00:56:18 +0100
+Subject: iommu/vt-d: Fix adding non-PCI devices to Intel IOMMU
+
+From: Patrick Steinhardt <ps@pks.im>
+
+commit 4a350a0ee5b0a14f826fcdf60dd1a3199cafbfd6 upstream.
+
+Starting with commit fa212a97f3a3 ("iommu/vt-d: Probe DMA-capable ACPI
+name space devices"), we now probe DMA-capable ACPI name
+space devices. On Dell XPS 13 9343, which has an Intel LPSS platform
+device INTL9C60 enumerated via ACPI, this change leads to the following
+warning:
+
+ ------------[ cut here ]------------
+ WARNING: CPU: 1 PID: 1 at pci_device_group+0x11a/0x130
+ CPU: 1 PID: 1 Comm: swapper/0 Tainted: G T 5.5.0-rc3+ #22
+ Hardware name: Dell Inc. XPS 13 9343/0310JH, BIOS A20 06/06/2019
+ RIP: 0010:pci_device_group+0x11a/0x130
+ Code: f0 ff ff 48 85 c0 49 89 c4 75 c4 48 8d 74 24 10 48 89 ef e8 48 ef ff ff 48 85 c0 49 89 c4 75 af e8 db f7 ff ff 49 89 c4 eb a5 <0f> 0b 49 c7 c4 ea ff ff ff eb 9a e8 96 1e c7 ff 66 0f 1f 44 00 00
+ RSP: 0000:ffffc0d6c0043cb0 EFLAGS: 00010202
+ RAX: 0000000000000000 RBX: ffffa3d1d43dd810 RCX: 0000000000000000
+ RDX: ffffa3d1d4fecf80 RSI: ffffa3d12943dcc0 RDI: ffffa3d1d43dd810
+ RBP: ffffa3d1d43dd810 R08: 0000000000000000 R09: ffffa3d1d4c04a80
+ R10: ffffa3d1d4c00880 R11: ffffa3d1d44ba000 R12: 0000000000000000
+ R13: ffffa3d1d4383b80 R14: ffffa3d1d4c090d0 R15: ffffa3d1d4324530
+ FS: 0000000000000000(0000) GS:ffffa3d1d6700000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 000000000460a001 CR4: 00000000003606e0
+ Call Trace:
+ ? iommu_group_get_for_dev+0x81/0x1f0
+ ? intel_iommu_add_device+0x61/0x170
+ ? iommu_probe_device+0x43/0xd0
+ ? intel_iommu_init+0x1fa2/0x2235
+ ? pci_iommu_init+0x52/0xe7
+ ? e820__memblock_setup+0x15c/0x15c
+ ? do_one_initcall+0xcc/0x27e
+ ? kernel_init_freeable+0x169/0x259
+ ? rest_init+0x95/0x95
+ ? kernel_init+0x5/0xeb
+ ? ret_from_fork+0x35/0x40
+ ---[ end trace 28473e7abc25b92c ]---
+ DMAR: ACPI name space devices didn't probe correctly
+
+The bug results from the fact that while we now enumerate ACPI devices,
+we aren't able to handle any non-PCI device when generating the device
+group. Fix the issue by implementing an Intel-specific callback that
+returns `pci_device_group` only if the device is a PCI device.
+Otherwise, it will return a generic device group.
+
+Fixes: fa212a97f3a3 ("iommu/vt-d: Probe DMA-capable ACPI name space devices")
+Signed-off-by: Patrick Steinhardt <ps@pks.im>
+Cc: stable@vger.kernel.org # v5.3+
+Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/intel-iommu.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -5786,6 +5786,13 @@ static void intel_iommu_apply_resv_regio
+ WARN_ON_ONCE(!reserve_iova(&dmar_domain->iovad, start, end));
+ }
+
++static struct iommu_group *intel_iommu_device_group(struct device *dev)
++{
++ if (dev_is_pci(dev))
++ return pci_device_group(dev);
++ return generic_device_group(dev);
++}
++
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ struct intel_iommu *intel_svm_device_to_iommu(struct device *dev)
+ {
+@@ -5958,7 +5965,7 @@ const struct iommu_ops intel_iommu_ops =
+ .get_resv_regions = intel_iommu_get_resv_regions,
+ .put_resv_regions = intel_iommu_put_resv_regions,
+ .apply_resv_region = intel_iommu_apply_resv_region,
+- .device_group = pci_device_group,
++ .device_group = intel_iommu_device_group,
+ .dev_has_feat = intel_iommu_dev_has_feat,
+ .dev_feat_enabled = intel_iommu_dev_feat_enabled,
+ .dev_enable_feat = intel_iommu_dev_enable_feat,
--- /dev/null
+From d2f36c787b2181561d8b95814f8cdad64b348ad7 Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Thu, 2 Jan 2020 18:24:10 +0100
+Subject: parisc: Implement copy_thread_tls
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit d2f36c787b2181561d8b95814f8cdad64b348ad7 upstream.
+
+This is required for clone3 which passes the TLS value through a
+struct rather than a register.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: linux-parisc@vger.kernel.org
+Cc: <stable@vger.kernel.org> # 5.3.x
+Link: https://lore.kernel.org/r/20200102172413.654385-5-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/parisc/Kconfig | 1 +
+ arch/parisc/kernel/process.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/parisc/Kconfig
++++ b/arch/parisc/Kconfig
+@@ -62,6 +62,7 @@ config PARISC
+ select HAVE_FTRACE_MCOUNT_RECORD if HAVE_DYNAMIC_FTRACE
+ select HAVE_KPROBES_ON_FTRACE
+ select HAVE_DYNAMIC_FTRACE_WITH_REGS
++ select HAVE_COPY_THREAD_TLS
+
+ help
+ The PA-RISC microprocessor is designed by Hewlett-Packard and used
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -208,8 +208,8 @@ arch_initcall(parisc_idle_init);
+ * Copy architecture-specific thread state
+ */
+ int
+-copy_thread(unsigned long clone_flags, unsigned long usp,
+- unsigned long kthread_arg, struct task_struct *p)
++copy_thread_tls(unsigned long clone_flags, unsigned long usp,
++ unsigned long kthread_arg, struct task_struct *p, unsigned long tls)
+ {
+ struct pt_regs *cregs = &(p->thread.regs);
+ void *stack = task_stack_page(p);
+@@ -254,9 +254,9 @@ copy_thread(unsigned long clone_flags, u
+ cregs->ksp = (unsigned long)stack + THREAD_SZ_ALGN + FRAME_SIZE;
+ cregs->kpc = (unsigned long) &child_return;
+
+- /* Setup thread TLS area from the 4th parameter in clone */
++ /* Setup thread TLS area */
+ if (clone_flags & CLONE_SETTLS)
+- cregs->cr27 = cregs->gr[23];
++ cregs->cr27 = tls;
+ }
+
+ return 0;
--- /dev/null
+From e163fdb3f7f8c62dccf194f3f37a7bcb3c333aa8 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 8 Jan 2020 10:06:54 -0800
+Subject: pstore/ram: Regularize prz label allocation lifetime
+
+From: Kees Cook <keescook@chromium.org>
+
+commit e163fdb3f7f8c62dccf194f3f37a7bcb3c333aa8 upstream.
+
+In my attempt to fix a memory leak, I introduced a double-free in the
+pstore error path. Instead of trying to manage the allocation lifetime
+between persistent_ram_new() and its callers, adjust the logic so
+persistent_ram_new() always takes a kstrdup() copy, and leaves the
+caller's allocation lifetime up to the caller. Therefore callers are
+_always_ responsible for freeing their label. Before, it only needed
+freeing when the prz itself failed to allocate, and not in any of the
+other prz failure cases, which callers would have no visibility into,
+which is the root design problem that lead to both the leak and now
+double-free bugs.
+
+Reported-by: Cengiz Can <cengiz@kernel.wtf>
+Link: https://lore.kernel.org/lkml/d4ec59002ede4aaf9928c7f7526da87c@kernel.wtf
+Fixes: 8df955a32a73 ("pstore/ram: Fix error-path memory leak in persistent_ram_new() callers")
+Cc: stable@vger.kernel.org
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/pstore/ram.c | 4 ++--
+ fs/pstore/ram_core.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/pstore/ram.c
++++ b/fs/pstore/ram.c
+@@ -583,12 +583,12 @@ static int ramoops_init_przs(const char
+ prz_ar[i] = persistent_ram_new(*paddr, zone_sz, sig,
+ &cxt->ecc_info,
+ cxt->memtype, flags, label);
++ kfree(label);
+ if (IS_ERR(prz_ar[i])) {
+ err = PTR_ERR(prz_ar[i]);
+ dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n",
+ name, record_size,
+ (unsigned long long)*paddr, err);
+- kfree(label);
+
+ while (i > 0) {
+ i--;
+@@ -629,12 +629,12 @@ static int ramoops_init_prz(const char *
+ label = kasprintf(GFP_KERNEL, "ramoops:%s", name);
+ *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info,
+ cxt->memtype, PRZ_FLAG_ZAP_OLD, label);
++ kfree(label);
+ if (IS_ERR(*prz)) {
+ int err = PTR_ERR(*prz);
+
+ dev_err(dev, "failed to request %s mem region (0x%zx@0x%llx): %d\n",
+ name, sz, (unsigned long long)*paddr, err);
+- kfree(label);
+ return err;
+ }
+
+--- a/fs/pstore/ram_core.c
++++ b/fs/pstore/ram_core.c
+@@ -574,7 +574,7 @@ struct persistent_ram_zone *persistent_r
+ /* Initialize general buffer state. */
+ raw_spin_lock_init(&prz->buffer_lock);
+ prz->flags = flags;
+- prz->label = label;
++ prz->label = kstrdup(label, GFP_KERNEL);
+
+ ret = persistent_ram_buffer_map(start, size, prz, memtype);
+ if (ret)
--- /dev/null
+From 20bda4ed62f507ed72e30e817b43c65fdba60be7 Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Thu, 2 Jan 2020 18:24:11 +0100
+Subject: riscv: Implement copy_thread_tls
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit 20bda4ed62f507ed72e30e817b43c65fdba60be7 upstream.
+
+This is required for clone3 which passes the TLS value through a
+struct rather than a register.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: linux-riscv@lists.infradead.org
+Cc: <stable@vger.kernel.org> # 5.3.x
+Link: https://lore.kernel.org/r/20200102172413.654385-6-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/Kconfig | 1 +
+ arch/riscv/kernel/process.c | 6 +++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -61,6 +61,7 @@ config RISCV
+ select SPARSEMEM_STATIC if 32BIT
+ select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT if MMU
+ select HAVE_ARCH_MMAP_RND_BITS
++ select HAVE_COPY_THREAD_TLS
+
+ config ARCH_MMAP_RND_BITS_MIN
+ default 18 if 64BIT
+--- a/arch/riscv/kernel/process.c
++++ b/arch/riscv/kernel/process.c
+@@ -99,8 +99,8 @@ int arch_dup_task_struct(struct task_str
+ return 0;
+ }
+
+-int copy_thread(unsigned long clone_flags, unsigned long usp,
+- unsigned long arg, struct task_struct *p)
++int copy_thread_tls(unsigned long clone_flags, unsigned long usp,
++ unsigned long arg, struct task_struct *p, unsigned long tls)
+ {
+ struct pt_regs *childregs = task_pt_regs(p);
+
+@@ -120,7 +120,7 @@ int copy_thread(unsigned long clone_flag
+ if (usp) /* User fork */
+ childregs->sp = usp;
+ if (clone_flags & CLONE_SETTLS)
+- childregs->tp = childregs->a5;
++ childregs->tp = tls;
+ childregs->a0 = 0; /* Return value of fork() */
+ p->thread.ra = (unsigned long)ret_from_fork;
+ }
--- /dev/null
+From c5ee0b3104e0b292d353e63fd31cb8c692645d8c Mon Sep 17 00:00:00 2001
+From: Punit Agrawal <punit1.agrawal@toshiba.co.jp>
+Date: Thu, 19 Dec 2019 19:03:45 +0900
+Subject: serdev: Don't claim unsupported ACPI serial devices
+
+From: Punit Agrawal <punit1.agrawal@toshiba.co.jp>
+
+commit c5ee0b3104e0b292d353e63fd31cb8c692645d8c upstream.
+
+Serdev sub-system claims all ACPI serial devices that are not already
+initialised. As a result, no device node is created for serial ports
+on certain boards such as the Apollo Lake based UP2. This has the
+unintended consequence of not being able to raise the login prompt via
+serial connection.
+
+Introduce a blacklist to reject ACPI serial devices that should not be
+claimed by serdev sub-system. Add the peripheral ids for Intel HS UART
+to the blacklist to bring back serial port on SoCs carrying them.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Punit Agrawal <punit1.agrawal@toshiba.co.jp>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Johan Hovold <johan@kernel.org>
+Cc: Rob Herring <robh@kernel.org>
+Link: https://lore.kernel.org/r/20191219100345.911093-1-punit1.agrawal@toshiba.co.jp
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serdev/core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/tty/serdev/core.c
++++ b/drivers/tty/serdev/core.c
+@@ -582,6 +582,12 @@ static acpi_status acpi_serdev_register_
+ return AE_OK;
+ }
+
++static const struct acpi_device_id serdev_acpi_devices_blacklist[] = {
++ { "INT3511", 0 },
++ { "INT3512", 0 },
++ { },
++};
++
+ static acpi_status acpi_serdev_add_device(acpi_handle handle, u32 level,
+ void *data, void **return_value)
+ {
+@@ -591,6 +597,10 @@ static acpi_status acpi_serdev_add_devic
+ if (acpi_bus_get_device(handle, &adev))
+ return AE_OK;
+
++ /* Skip if black listed */
++ if (!acpi_match_device_ids(adev, serdev_acpi_devices_blacklist))
++ return AE_OK;
++
+ return acpi_serdev_register_device(ctrl, adev);
+ }
+
drm-i915-add-wa_1407352427-icl-ehl.patch
drm-i915-gt-mark-up-virtual-engine-uabi_instance.patch
ib-hfi1-adjust-flow-psn-with-the-correct-resync_psn.patch
+can-kvaser_usb-fix-interface-sanity-check.patch
+can-gs_usb-gs_usb_probe-use-descriptors-of-current-altsetting.patch
+can-tcan4x5x-tcan4x5x_can_probe-get-the-device-out-of-standby-before-register-access.patch
+can-mscan-mscan_rx_poll-fix-rx-path-lockup-when-returning-from-polling-to-irq-mode.patch
+can-can_dropped_invalid_skb-ensure-an-initialized-headroom-in-outgoing-can-sk_buffs.patch
+gpiolib-acpi-turn-dmi_system_id-table-into-a-generic-quirk-table.patch
+gpiolib-acpi-add-honor_wakeup-module-option-quirk-mechanism.patch
+pstore-ram-regularize-prz-label-allocation-lifetime.patch
+staging-vt6656-set-usb_set_intfdata-on-driver-fail.patch
+staging-vt6656-fix-non-zero-logical-return-of-usb_control_msg.patch
+usb-cdns3-should-not-use-the-same-dev_id-for-shared-interrupt-handler.patch
+usb-ohci-da8xx-ensure-error-return-on-variable-error-is-set.patch
+usb-pd-tcpm-bad-warning-size-pps-adapters.patch
+usb-serial-option-add-zlp-support-for-0x1bc7-0x9010.patch
+usb-musb-fix-idling-for-suspend-after-disconnect-interrupt.patch
+usb-musb-disable-pullup-at-init.patch
+usb-musb-dma-correct-parameter-passed-to-irq-handler.patch
+staging-comedi-adv_pci1710-fix-ai-channels-16-31-for-pci-1713.patch
+staging-vt6656-correct-return-of-vnt_init_registers.patch
+staging-vt6656-limit-reg-output-to-block-size.patch
+staging-rtl8188eu-add-device-code-for-tp-link-tl-wn727n-v5.21.patch
+serdev-don-t-claim-unsupported-acpi-serial-devices.patch
+iommu-vt-d-fix-adding-non-pci-devices-to-intel-iommu.patch
+tty-link-tty-and-port-before-configuring-it-as-console.patch
+tty-always-relink-the-port.patch
+arm64-move-__arch_want_sys_clone3-definition-to-uapi-headers.patch
+arm64-implement-copy_thread_tls.patch
+arm-implement-copy_thread_tls.patch
+parisc-implement-copy_thread_tls.patch
+riscv-implement-copy_thread_tls.patch
+xtensa-implement-copy_thread_tls.patch
+clone3-ensure-copy_thread_tls-is-implemented.patch
+um-implement-copy_thread_tls.patch
--- /dev/null
+From a9d3a9cedc1330c720e0ddde1978a8e7771da5ab Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 27 Dec 2019 17:00:54 +0000
+Subject: staging: comedi: adv_pci1710: fix AI channels 16-31 for PCI-1713
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit a9d3a9cedc1330c720e0ddde1978a8e7771da5ab upstream.
+
+The Advantech PCI-1713 has 32 analog input channels, but an incorrect
+bit-mask in the definition of the `PCI171X_MUX_CHANH(x)` and
+PCI171X_MUX_CHANL(x)` macros is causing channels 16 to 31 to be aliases
+of channels 0 to 15. Change the bit-mask value from 0xf to 0xff to fix
+it. Note that the channel numbers will have been range checked already,
+so the bit-mask isn't really needed.
+
+Fixes: 92c65e5553ed ("staging: comedi: adv_pci1710: define the mux control register bits")
+Reported-by: Dmytro Fil <monkdaf@gmail.com>
+Cc: <stable@vger.kernel.org> # v4.5+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://lore.kernel.org/r/20191227170054.32051-1-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/comedi/drivers/adv_pci1710.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -46,8 +46,8 @@
+ #define PCI171X_RANGE_UNI BIT(4)
+ #define PCI171X_RANGE_GAIN(x) (((x) & 0x7) << 0)
+ #define PCI171X_MUX_REG 0x04 /* W: A/D multiplexor control */
+-#define PCI171X_MUX_CHANH(x) (((x) & 0xf) << 8)
+-#define PCI171X_MUX_CHANL(x) (((x) & 0xf) << 0)
++#define PCI171X_MUX_CHANH(x) (((x) & 0xff) << 8)
++#define PCI171X_MUX_CHANL(x) (((x) & 0xff) << 0)
+ #define PCI171X_MUX_CHAN(x) (PCI171X_MUX_CHANH(x) | PCI171X_MUX_CHANL(x))
+ #define PCI171X_STATUS_REG 0x06 /* R: status register */
+ #define PCI171X_STATUS_IRQ BIT(11) /* 1=IRQ occurred */
--- /dev/null
+From 58dcc5bf4030cab548d5c98cd4cd3632a5444d5a Mon Sep 17 00:00:00 2001
+From: Michael Straube <straube.linux@gmail.com>
+Date: Sat, 28 Dec 2019 15:37:25 +0100
+Subject: staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
+
+From: Michael Straube <straube.linux@gmail.com>
+
+commit 58dcc5bf4030cab548d5c98cd4cd3632a5444d5a upstream.
+
+This device was added to the stand-alone driver on github.
+Add it to the staging driver as well.
+
+Link: https://github.com/lwfinger/rtl8188eu/commit/b9b537aa25a8
+Signed-off-by: Michael Straube <straube.linux@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191228143725.24455-1-straube.linux@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -37,6 +37,7 @@ static const struct usb_device_id rtw_us
+ {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */
+ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
++ {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */
+ {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ {} /* Terminating entry */
--- /dev/null
+From 7de6155c8968a3342d1bef3f7a2084d31ae6e4be Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 20 Dec 2019 21:15:09 +0000
+Subject: staging: vt6656: correct return of vnt_init_registers.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 7de6155c8968a3342d1bef3f7a2084d31ae6e4be upstream.
+
+The driver standard error returns remove bool false conditions.
+
+Cc: stable <stable@vger.kernel.org> # v5.3+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/072ec0b3-425f-277e-130c-1e3a116c90d6@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/main_usb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -950,7 +950,7 @@ static const struct ieee80211_ops vnt_ma
+
+ int vnt_init(struct vnt_private *priv)
+ {
+- if (!(vnt_init_registers(priv)))
++ if (vnt_init_registers(priv))
+ return -EAGAIN;
+
+ SET_IEEE80211_PERM_ADDR(priv->hw, priv->permanent_net_addr);
--- /dev/null
+From 58c3e681b04dd57c70d0dcb7b69fe52d043ff75a Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 20 Dec 2019 21:14:59 +0000
+Subject: staging: vt6656: Fix non zero logical return of, usb_control_msg
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 58c3e681b04dd57c70d0dcb7b69fe52d043ff75a upstream.
+
+Starting with commit 59608cb1de1856
+("staging: vt6656: clean function's error path in usbpipe.c")
+the usb control functions have returned errors throughout driver
+with only logical variable checking.
+
+However, usb_control_msg return the amount of bytes transferred
+this means that normal operation causes errors.
+
+Correct the return function so only return zero when transfer
+is successful.
+
+Cc: stable <stable@vger.kernel.org> # v5.3+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/08e88842-6f78-a2e3-a7a0-139fec960b2b@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/usbpipe.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vt6656/usbpipe.c
++++ b/drivers/staging/vt6656/usbpipe.c
+@@ -59,7 +59,9 @@ int vnt_control_out(struct vnt_private *
+
+ kfree(usb_buffer);
+
+- if (ret >= 0 && ret < (int)length)
++ if (ret == (int)length)
++ ret = 0;
++ else
+ ret = -EIO;
+
+ end_unlock:
+@@ -103,7 +105,9 @@ int vnt_control_in(struct vnt_private *p
+
+ kfree(usb_buffer);
+
+- if (ret >= 0 && ret < (int)length)
++ if (ret == (int)length)
++ ret = 0;
++ else
+ ret = -EIO;
+
+ end_unlock:
--- /dev/null
+From 69cc1f925e1aa74b96e2ace67e3453a50d091d2f Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 20 Dec 2019 21:15:24 +0000
+Subject: staging: vt6656: limit reg output to block size
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit 69cc1f925e1aa74b96e2ace67e3453a50d091d2f upstream.
+
+vnt_control_out appears to fail when BBREG is greater than 64 writes.
+
+Create new function that will relay an array in no larger than
+the indicated block size.
+
+It appears that this command has always failed but was ignored by
+driver until the introduction of error checking.
+
+Cc: stable <stable@vger.kernel.org> # v5.3+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/a41f0601-df46-ce6e-ab7c-35e697946e2a@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/baseband.c | 4 ++--
+ drivers/staging/vt6656/usbpipe.c | 17 +++++++++++++++++
+ drivers/staging/vt6656/usbpipe.h | 5 +++++
+ 3 files changed, 24 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/vt6656/baseband.c
++++ b/drivers/staging/vt6656/baseband.c
+@@ -449,8 +449,8 @@ int vnt_vt3184_init(struct vnt_private *
+
+ memcpy(array, addr, length);
+
+- ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE, 0,
+- MESSAGE_REQUEST_BBREG, length, array);
++ ret = vnt_control_out_blocks(priv, VNT_REG_BLOCK_SIZE,
++ MESSAGE_REQUEST_BBREG, length, array);
+ if (ret)
+ goto end;
+
+--- a/drivers/staging/vt6656/usbpipe.c
++++ b/drivers/staging/vt6656/usbpipe.c
+@@ -76,6 +76,23 @@ int vnt_control_out_u8(struct vnt_privat
+ reg_off, reg, sizeof(u8), &data);
+ }
+
++int vnt_control_out_blocks(struct vnt_private *priv,
++ u16 block, u8 reg, u16 length, u8 *data)
++{
++ int ret = 0, i;
++
++ for (i = 0; i < length; i += block) {
++ u16 len = min_t(int, length - i, block);
++
++ ret = vnt_control_out(priv, MESSAGE_TYPE_WRITE,
++ i, reg, len, data + i);
++ if (ret)
++ goto end;
++ }
++end:
++ return ret;
++}
++
+ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value,
+ u16 index, u16 length, u8 *buffer)
+ {
+--- a/drivers/staging/vt6656/usbpipe.h
++++ b/drivers/staging/vt6656/usbpipe.h
+@@ -18,6 +18,8 @@
+
+ #include "device.h"
+
++#define VNT_REG_BLOCK_SIZE 64
++
+ int vnt_control_out(struct vnt_private *priv, u8 request, u16 value,
+ u16 index, u16 length, u8 *buffer);
+ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value,
+@@ -26,6 +28,9 @@ int vnt_control_in(struct vnt_private *p
+ int vnt_control_out_u8(struct vnt_private *priv, u8 reg, u8 ref_off, u8 data);
+ int vnt_control_in_u8(struct vnt_private *priv, u8 reg, u8 reg_off, u8 *data);
+
++int vnt_control_out_blocks(struct vnt_private *priv,
++ u16 block, u8 reg, u16 len, u8 *data);
++
+ int vnt_start_interrupt_urb(struct vnt_private *priv);
+ int vnt_submit_rx_urb(struct vnt_private *priv, struct vnt_rcb *rcb);
+ int vnt_tx_context(struct vnt_private *priv,
--- /dev/null
+From c0bcf9f3f5b661d4ace2a64a79ef661edd2a4dc8 Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Fri, 20 Dec 2019 21:15:59 +0000
+Subject: staging: vt6656: set usb_set_intfdata on driver fail.
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit c0bcf9f3f5b661d4ace2a64a79ef661edd2a4dc8 upstream.
+
+intfdata will contain stale pointer when the device is detached after
+failed initialization when referenced in vt6656_disconnect
+
+Provide driver access to it here and NULL it.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Link: https://lore.kernel.org/r/6de448d7-d833-ef2e-dd7b-3ef9992fee0e@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/vt6656/device.h | 1 +
+ drivers/staging/vt6656/main_usb.c | 1 +
+ drivers/staging/vt6656/wcmd.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+--- a/drivers/staging/vt6656/device.h
++++ b/drivers/staging/vt6656/device.h
+@@ -259,6 +259,7 @@ struct vnt_private {
+ u8 mac_hw;
+ /* netdev */
+ struct usb_device *usb;
++ struct usb_interface *intf;
+
+ u64 tsf_time;
+ u8 rx_rate;
+--- a/drivers/staging/vt6656/main_usb.c
++++ b/drivers/staging/vt6656/main_usb.c
+@@ -993,6 +993,7 @@ vt6656_probe(struct usb_interface *intf,
+ priv = hw->priv;
+ priv->hw = hw;
+ priv->usb = udev;
++ priv->intf = intf;
+
+ vnt_set_options(priv);
+
+--- a/drivers/staging/vt6656/wcmd.c
++++ b/drivers/staging/vt6656/wcmd.c
+@@ -99,6 +99,7 @@ void vnt_run_command(struct work_struct
+ if (vnt_init(priv)) {
+ /* If fail all ends TODO retry */
+ dev_err(&priv->usb->dev, "failed to start\n");
++ usb_set_intfdata(priv->intf, NULL);
+ ieee80211_free_hw(priv->hw);
+ return;
+ }
--- /dev/null
+From 273f632912f1b24b642ba5b7eb5022e43a72f3b5 Mon Sep 17 00:00:00 2001
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Fri, 27 Dec 2019 17:44:34 +0000
+Subject: tty: always relink the port
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+commit 273f632912f1b24b642ba5b7eb5022e43a72f3b5 upstream.
+
+If the serial device is disconnected and reconnected, it re-enumerates
+properly but does not link it. fwiw, linking means just saving the port
+index, so allow it always as there is no harm in saving the same value
+again even if it tries to relink with the same port.
+
+Fixes: fb2b90014d78 ("tty: link tty and port before configuring it as console")
+Reported-by: Kenneth R. Crudup <kenny@panix.com>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191227174434.12057-1-sudipm.mukherjee@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/tty_port.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -89,8 +89,7 @@ void tty_port_link_device(struct tty_por
+ {
+ if (WARN_ON(index >= driver->num))
+ return;
+- if (!driver->ports[index])
+- driver->ports[index] = port;
++ driver->ports[index] = port;
+ }
+ EXPORT_SYMBOL_GPL(tty_port_link_device);
+
--- /dev/null
+From fb2b90014d782d80d7ebf663e50f96d8c507a73c Mon Sep 17 00:00:00 2001
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Date: Thu, 12 Dec 2019 13:16:02 +0000
+Subject: tty: link tty and port before configuring it as console
+
+From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+
+commit fb2b90014d782d80d7ebf663e50f96d8c507a73c upstream.
+
+There seems to be a race condition in tty drivers and I could see on
+many boot cycles a NULL pointer dereference as tty_init_dev() tries to
+do 'tty->port->itty = tty' even though tty->port is NULL.
+'tty->port' will be set by the driver and if the driver has not yet done
+it before we open the tty device we can get to this situation. By adding
+some extra debug prints, I noticed that:
+
+6.650130: uart_add_one_port
+6.663849: register_console
+6.664846: tty_open
+6.674391: tty_init_dev
+6.675456: tty_port_link_device
+
+uart_add_one_port() registers the console, as soon as it registers, the
+userspace tries to use it and that leads to tty_open() but
+uart_add_one_port() has not yet done tty_port_link_device() and so
+tty->port is not yet configured when control reaches tty_init_dev().
+
+Further look into the code and tty_port_link_device() is done by
+uart_add_one_port(). After registering the console uart_add_one_port()
+will call tty_port_register_device_attr_serdev() and
+tty_port_link_device() is called from this.
+
+Call add tty_port_link_device() before uart_configure_port() is done and
+add a check in tty_port_link_device() so that it only links the port if
+it has not been done yet.
+
+Suggested-by: Jiri Slaby <jslaby@suse.com>
+Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191212131602.29504-1-sudipm.mukherjee@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/serial_core.c | 1 +
+ drivers/tty/tty_port.c | 3 ++-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -2834,6 +2834,7 @@ int uart_add_one_port(struct uart_driver
+ if (uport->cons && uport->dev)
+ of_console_check(uport->dev->of_node, uport->cons->name, uport->line);
+
++ tty_port_link_device(port, drv->tty_driver, uport->line);
+ uart_configure_port(drv, state, uport);
+
+ port->console = uart_console(uport);
+--- a/drivers/tty/tty_port.c
++++ b/drivers/tty/tty_port.c
+@@ -89,7 +89,8 @@ void tty_port_link_device(struct tty_por
+ {
+ if (WARN_ON(index >= driver->num))
+ return;
+- driver->ports[index] = port;
++ if (!driver->ports[index])
++ driver->ports[index] = port;
+ }
+ EXPORT_SYMBOL_GPL(tty_port_link_device);
+
--- /dev/null
+From 457677c70c7672a4586b0b8abc396cc1ecdd376d Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Sat, 4 Jan 2020 13:39:30 +0100
+Subject: um: Implement copy_thread_tls
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit 457677c70c7672a4586b0b8abc396cc1ecdd376d upstream.
+
+This is required for clone3 which passes the TLS value through a
+struct rather than a register.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: linux-um@lists.infradead.org
+Cc: <stable@vger.kernel.org> # 5.3.x
+Link: https://lore.kernel.org/r/20200104123928.1048822-1-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/um/Kconfig | 1 +
+ arch/um/include/asm/ptrace-generic.h | 2 +-
+ arch/um/kernel/process.c | 6 +++---
+ arch/x86/um/tls_32.c | 6 ++----
+ arch/x86/um/tls_64.c | 7 +++----
+ 5 files changed, 10 insertions(+), 12 deletions(-)
+
+--- a/arch/um/Kconfig
++++ b/arch/um/Kconfig
+@@ -14,6 +14,7 @@ config UML
+ select HAVE_FUTEX_CMPXCHG if FUTEX
+ select HAVE_DEBUG_KMEMLEAK
+ select HAVE_DEBUG_BUGVERBOSE
++ select HAVE_COPY_THREAD_TLS
+ select GENERIC_IRQ_SHOW
+ select GENERIC_CPU_DEVICES
+ select GENERIC_CLOCKEVENTS
+--- a/arch/um/include/asm/ptrace-generic.h
++++ b/arch/um/include/asm/ptrace-generic.h
+@@ -36,7 +36,7 @@ extern long subarch_ptrace(struct task_s
+ extern unsigned long getreg(struct task_struct *child, int regno);
+ extern int putreg(struct task_struct *child, int regno, unsigned long value);
+
+-extern int arch_copy_tls(struct task_struct *new);
++extern int arch_set_tls(struct task_struct *new, unsigned long tls);
+ extern void clear_flushed_tls(struct task_struct *task);
+ extern int syscall_trace_enter(struct pt_regs *regs);
+ extern void syscall_trace_leave(struct pt_regs *regs);
+--- a/arch/um/kernel/process.c
++++ b/arch/um/kernel/process.c
+@@ -153,8 +153,8 @@ void fork_handler(void)
+ userspace(¤t->thread.regs.regs, current_thread_info()->aux_fp_regs);
+ }
+
+-int copy_thread(unsigned long clone_flags, unsigned long sp,
+- unsigned long arg, struct task_struct * p)
++int copy_thread_tls(unsigned long clone_flags, unsigned long sp,
++ unsigned long arg, struct task_struct * p, unsigned long tls)
+ {
+ void (*handler)(void);
+ int kthread = current->flags & PF_KTHREAD;
+@@ -188,7 +188,7 @@ int copy_thread(unsigned long clone_flag
+ * Set a new TLS for the child thread?
+ */
+ if (clone_flags & CLONE_SETTLS)
+- ret = arch_copy_tls(p);
++ ret = arch_set_tls(p, tls);
+ }
+
+ return ret;
+--- a/arch/x86/um/tls_32.c
++++ b/arch/x86/um/tls_32.c
+@@ -215,14 +215,12 @@ static int set_tls_entry(struct task_str
+ return 0;
+ }
+
+-int arch_copy_tls(struct task_struct *new)
++int arch_set_tls(struct task_struct *new, unsigned long tls)
+ {
+ struct user_desc info;
+ int idx, ret = -EFAULT;
+
+- if (copy_from_user(&info,
+- (void __user *) UPT_SI(&new->thread.regs.regs),
+- sizeof(info)))
++ if (copy_from_user(&info, (void __user *) tls, sizeof(info)))
+ goto out;
+
+ ret = -EINVAL;
+--- a/arch/x86/um/tls_64.c
++++ b/arch/x86/um/tls_64.c
+@@ -6,14 +6,13 @@ void clear_flushed_tls(struct task_struc
+ {
+ }
+
+-int arch_copy_tls(struct task_struct *t)
++int arch_set_tls(struct task_struct *t, unsigned long tls)
+ {
+ /*
+ * If CLONE_SETTLS is set, we need to save the thread id
+- * (which is argument 5, child_tid, of clone) so it can be set
+- * during context switches.
++ * so it can be set during context switches.
+ */
+- t->thread.arch.fs = t->thread.regs.regs.gp[R8 / sizeof(long)];
++ t->thread.arch.fs = tls;
+
+ return 0;
+ }
--- /dev/null
+From af58e1fca9840192f14b6f03c59595d64bff9127 Mon Sep 17 00:00:00 2001
+From: Peter Chen <peter.chen@nxp.com>
+Date: Fri, 27 Dec 2019 17:10:04 +0800
+Subject: usb: cdns3: should not use the same dev_id for shared interrupt handler
+
+From: Peter Chen <peter.chen@nxp.com>
+
+commit af58e1fca9840192f14b6f03c59595d64bff9127 upstream.
+
+Both drd and gadget interrupt handler use the struct cdns3 pointer as
+dev_id, it causes devm_free_irq at cdns3_gadget_exit doesn't free
+gadget's interrupt handler, it freed drd's handler. So, when the
+host interrupt occurs, the gadget's interrupt hanlder is still
+called, and causes below oops. To fix it, we use gadget's private
+data priv_dev as interrupt dev_id for gadget.
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000380
+Mem abort info:
+ ESR = 0x96000006
+ EC = 0x25: DABT (current EL), IL = 32 bits
+ SET = 0, FnV = 0
+ EA = 0, S1PTW = 0
+Data abort info:
+ ISV = 0, ISS = 0x00000006
+ CM = 0, WnR = 0
+user pgtable: 4k pages, 48-bit VAs, pgdp=0000000971d79000
+[0000000000000380] pgd=0000000971d6f003, pud=0000000971d6e003, pmd=0000000000000000
+Internal error: Oops: 96000006 [#1] PREEMPT SMP
+Modules linked in: mxc_jpeg_encdec crct10dif_ce fsl_imx8_ddr_perf
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.0-03486-g69f4e7d9c54a-dirty #254
+Hardware name: Freescale i.MX8QM MEK (DT)
+pstate: 00000085 (nzcv daIf -PAN -UAO)
+pc : cdns3_device_irq_handler+0x1c/0xb8
+lr : __handle_irq_event_percpu+0x78/0x2c0
+sp : ffff800010003e30
+x29: ffff800010003e30 x28: ffff8000129bb000
+x27: ffff8000126e9000 x26: ffff0008f61b5600
+x25: ffff800011fe1018 x24: ffff8000126ea120
+x23: ffff800010003f04 x22: 0000000000000000
+x21: 0000000000000093 x20: ffff0008f61b5600
+x19: ffff0008f5061a80 x18: 0000000000000000
+x17: 0000000000000000 x16: 0000000000000000
+x15: 0000000000000000 x14: 003d090000000000
+x13: 00003d0900000000 x12: 0000000000000000
+x11: 00003d0900000000 x10: 0000000000000040
+x9 : ffff800012708cb8 x8 : ffff800012708cb0
+x7 : ffff0008f7c7a9d0 x6 : 0000000000000000
+x5 : ffff0008f7c7a910 x4 : ffff8008ed359000
+x3 : ffff800010003f40 x2 : 0000000000000000
+x1 : ffff0008f5061a80 x0 : ffff800010161a60
+Call trace:
+ cdns3_device_irq_handler+0x1c/0xb8
+ __handle_irq_event_percpu+0x78/0x2c0
+ handle_irq_event_percpu+0x40/0x98
+ handle_irq_event+0x4c/0xd0
+ handle_fasteoi_irq+0xbc/0x168
+ generic_handle_irq+0x34/0x50
+ __handle_domain_irq+0x6c/0xc0
+ gic_handle_irq+0xd4/0x174
+ el1_irq+0xb8/0x180
+ arch_cpu_idle+0x3c/0x230
+ default_idle_call+0x38/0x40
+ do_idle+0x20c/0x298
+ cpu_startup_entry+0x28/0x48
+ rest_init+0xdc/0xe8
+ arch_call_rest_init+0x14/0x1c
+ start_kernel+0x48c/0x4b8
+Code: aa0103f3 aa1e03e0 d503201f f9409662 (f941c040)
+---[ end trace 091dcf4dee011b0e ]---
+Kernel panic - not syncing: Fatal exception in interrupt
+SMP: stopping secondary CPUs
+Kernel Offset: disabled
+CPU features: 0x0002,2100600c
+Memory Limit: none
+---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
+
+Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
+Cc: <stable@vger.kernel.org> #v5.4
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Link: https://lore.kernel.org/r/1577437804-18146-1-git-send-email-peter.chen@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/cdns3/gadget.c | 14 +++++---------
+ 1 file changed, 5 insertions(+), 9 deletions(-)
+
+--- a/drivers/usb/cdns3/gadget.c
++++ b/drivers/usb/cdns3/gadget.c
+@@ -1375,13 +1375,10 @@ static void cdns3_check_usb_interrupt_pr
+ */
+ static irqreturn_t cdns3_device_irq_handler(int irq, void *data)
+ {
+- struct cdns3_device *priv_dev;
+- struct cdns3 *cdns = data;
++ struct cdns3_device *priv_dev = data;
+ irqreturn_t ret = IRQ_NONE;
+ u32 reg;
+
+- priv_dev = cdns->gadget_dev;
+-
+ /* check USB device interrupt */
+ reg = readl(&priv_dev->regs->usb_ists);
+ if (reg) {
+@@ -1419,14 +1416,12 @@ static irqreturn_t cdns3_device_irq_hand
+ */
+ static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data)
+ {
+- struct cdns3_device *priv_dev;
+- struct cdns3 *cdns = data;
++ struct cdns3_device *priv_dev = data;
+ irqreturn_t ret = IRQ_NONE;
+ unsigned long flags;
+ int bit;
+ u32 reg;
+
+- priv_dev = cdns->gadget_dev;
+ spin_lock_irqsave(&priv_dev->lock, flags);
+
+ reg = readl(&priv_dev->regs->usb_ists);
+@@ -2539,7 +2534,7 @@ void cdns3_gadget_exit(struct cdns3 *cdn
+
+ priv_dev = cdns->gadget_dev;
+
+- devm_free_irq(cdns->dev, cdns->dev_irq, cdns);
++ devm_free_irq(cdns->dev, cdns->dev_irq, priv_dev);
+
+ pm_runtime_mark_last_busy(cdns->dev);
+ pm_runtime_put_autosuspend(cdns->dev);
+@@ -2710,7 +2705,8 @@ static int __cdns3_gadget_init(struct cd
+ ret = devm_request_threaded_irq(cdns->dev, cdns->dev_irq,
+ cdns3_device_irq_handler,
+ cdns3_device_thread_irq_handler,
+- IRQF_SHARED, dev_name(cdns->dev), cdns);
++ IRQF_SHARED, dev_name(cdns->dev),
++ cdns->gadget_dev);
+
+ if (ret)
+ goto err0;
--- /dev/null
+From 96a0c12843109e5c4d5eb1e09d915fdd0ce31d25 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Tue, 7 Jan 2020 09:26:25 -0600
+Subject: usb: musb: Disable pullup at init
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit 96a0c12843109e5c4d5eb1e09d915fdd0ce31d25 upstream.
+
+The pullup may be already enabled before the driver is initialized. This
+happens for instance on JZ4740.
+
+It has to be disabled at init time, as we cannot guarantee that a gadget
+driver will be bound to the UDC.
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Suggested-by: Bin Liu <b-liu@ti.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200107152625.857-3-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/musb/musb_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -2318,6 +2318,9 @@ musb_init_controller(struct device *dev,
+ musb_disable_interrupts(musb);
+ musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+
++ /* MUSB_POWER_SOFTCONN might be already set, JZ4740 does this. */
++ musb_writeb(musb->mregs, MUSB_POWER, 0);
++
+ /* Init IRQ workqueue before request_irq */
+ INIT_DELAYED_WORK(&musb->irq_work, musb_irq_work);
+ INIT_DELAYED_WORK(&musb->deassert_reset_work, musb_deassert_reset);
--- /dev/null
+From c80d0f4426c7fdc7efd6ae8d8b021dcfc89b4254 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Mon, 16 Dec 2019 10:18:43 -0600
+Subject: usb: musb: dma: Correct parameter passed to IRQ handler
+
+From: Paul Cercueil <paul@crapouillou.net>
+
+commit c80d0f4426c7fdc7efd6ae8d8b021dcfc89b4254 upstream.
+
+The IRQ handler was passed a pointer to a struct dma_controller, but the
+argument was then casted to a pointer to a struct musb_dma_controller.
+
+Fixes: 427c4f333474 ("usb: struct device - replace bus_id with dev_name(), dev_set_name()")
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Tested-by: Artur Rojek <contact@artur-rojek.eu>
+Cc: stable@vger.kernel.org
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20191216161844.772-2-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musbhsdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/usb/musb/musbhsdma.c
++++ b/drivers/usb/musb/musbhsdma.c
+@@ -425,7 +425,7 @@ struct dma_controller *musbhs_dma_contro
+ controller->controller.channel_abort = dma_channel_abort;
+
+ if (request_irq(irq, dma_controller_irq, 0,
+- dev_name(musb->controller), &controller->controller)) {
++ dev_name(musb->controller), controller)) {
+ dev_err(dev, "request_irq %d failed!\n", irq);
+ musb_dma_controller_destroy(&controller->controller);
+
--- /dev/null
+From 5fbf7a2534703fd71159d3d71504b0ad01b43394 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Tue, 7 Jan 2020 09:26:24 -0600
+Subject: usb: musb: fix idling for suspend after disconnect interrupt
+
+From: Tony Lindgren <tony@atomide.com>
+
+commit 5fbf7a2534703fd71159d3d71504b0ad01b43394 upstream.
+
+When disconnected as USB B-device, suspend interrupt should come before
+diconnect interrupt, because the DP/DM pins are shorter than the
+VBUS/GND pins on the USB connectors. But we sometimes get a suspend
+interrupt after disconnect interrupt. In that case we have devctl set to
+99 with VBUS still valid and musb_pm_runtime_check_session() wrongly
+thinks we have an active session. We have no other interrupts after
+disconnect coming in this case at least with the omap2430 glue.
+
+Let's fix the issue by checking the interrupt status again with
+delayed work for the devctl 99 case. In the suspend after disconnect
+case the devctl session bit has cleared by then and musb can idle.
+For a typical USB B-device connect case we just continue with normal
+interrupts.
+
+Fixes: 467d5c980709 ("usb: musb: Implement session bit based runtime PM for musb-core")
+
+Cc: Merlijn Wajer <merlijn@wizzup.org>
+Cc: Pavel Machek <pavel@ucw.cz>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Bin Liu <b-liu@ti.com>
+Link: https://lore.kernel.org/r/20200107152625.857-2-b-liu@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/musb/musb_core.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1840,6 +1840,9 @@ ATTRIBUTE_GROUPS(musb);
+ #define MUSB_QUIRK_B_INVALID_VBUS_91 (MUSB_DEVCTL_BDEVICE | \
+ (2 << MUSB_DEVCTL_VBUS_SHIFT) | \
+ MUSB_DEVCTL_SESSION)
++#define MUSB_QUIRK_B_DISCONNECT_99 (MUSB_DEVCTL_BDEVICE | \
++ (3 << MUSB_DEVCTL_VBUS_SHIFT) | \
++ MUSB_DEVCTL_SESSION)
+ #define MUSB_QUIRK_A_DISCONNECT_19 ((3 << MUSB_DEVCTL_VBUS_SHIFT) | \
+ MUSB_DEVCTL_SESSION)
+
+@@ -1862,6 +1865,11 @@ static void musb_pm_runtime_check_sessio
+ s = MUSB_DEVCTL_FSDEV | MUSB_DEVCTL_LSDEV |
+ MUSB_DEVCTL_HR;
+ switch (devctl & ~s) {
++ case MUSB_QUIRK_B_DISCONNECT_99:
++ musb_dbg(musb, "Poll devctl in case of suspend after disconnect\n");
++ schedule_delayed_work(&musb->irq_work,
++ msecs_to_jiffies(1000));
++ break;
+ case MUSB_QUIRK_B_INVALID_VBUS_91:
+ if (musb->quirk_retries && !musb->flush_irq_work) {
+ musb_dbg(musb,
--- /dev/null
+From ba9b40810bb43e6bf73b395012b98633c03f7f59 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 7 Jan 2020 12:39:01 +0000
+Subject: usb: ohci-da8xx: ensure error return on variable error is set
+
+From: Colin Ian King <colin.king@canonical.com>
+
+commit ba9b40810bb43e6bf73b395012b98633c03f7f59 upstream.
+
+Currently when an error occurs when calling devm_gpiod_get_optional or
+calling gpiod_to_irq it causes an uninitialized error return in variable
+'error' to be returned. Fix this by ensuring the error variable is set
+from da8xx_ohci->oc_gpio and oc_irq.
+
+Thanks to Dan Carpenter for spotting the uninitialized error in the
+gpiod_to_irq failure case.
+
+Addresses-Coverity: ("Uninitialized scalar variable")
+Fixes: d193abf1c913 ("usb: ohci-da8xx: add vbus and overcurrent gpios")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Link: https://lore.kernel.org/r/20200107123901.101190-1-colin.king@canonical.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/host/ohci-da8xx.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/ohci-da8xx.c
++++ b/drivers/usb/host/ohci-da8xx.c
+@@ -415,13 +415,17 @@ static int ohci_da8xx_probe(struct platf
+ }
+
+ da8xx_ohci->oc_gpio = devm_gpiod_get_optional(dev, "oc", GPIOD_IN);
+- if (IS_ERR(da8xx_ohci->oc_gpio))
++ if (IS_ERR(da8xx_ohci->oc_gpio)) {
++ error = PTR_ERR(da8xx_ohci->oc_gpio);
+ goto err;
++ }
+
+ if (da8xx_ohci->oc_gpio) {
+ oc_irq = gpiod_to_irq(da8xx_ohci->oc_gpio);
+- if (oc_irq < 0)
++ if (oc_irq < 0) {
++ error = oc_irq;
+ goto err;
++ }
+
+ error = devm_request_threaded_irq(dev, oc_irq, NULL,
+ ohci_da8xx_oc_thread, IRQF_TRIGGER_RISING |
--- /dev/null
+From c215e48e97d232249a33849fc46fc50311043e11 Mon Sep 17 00:00:00 2001
+From: Douglas Gilbert <dgilbert@interlog.com>
+Date: Sun, 29 Dec 2019 22:35:44 -0500
+Subject: USB-PD tcpm: bad warning+size, PPS adapters
+
+From: Douglas Gilbert <dgilbert@interlog.com>
+
+commit c215e48e97d232249a33849fc46fc50311043e11 upstream.
+
+Augmented Power Delivery Objects (A)PDO_s are used by USB-C
+PD power adapters to advertize the voltages and currents
+they support. There can be up to 7 PDO_s but before PPS
+(programmable power supply) there were seldom more than 4
+or 5. Recently Samsung released an optional PPS 45 Watt power
+adapter (EP-TA485) that has 7 PDO_s. It is for the Galaxy 10+
+tablet and charges it quicker than the adapter supplied at
+purchase. The EP-TA485 causes an overzealous WARN_ON to soil
+the log plus it miscalculates the number of bytes to read.
+
+So this bug has been there for some time but goes
+undetected for the majority of USB-C PD power adapters on
+the market today that have 6 or less PDO_s. That may soon
+change as more USB-C PD adapters with PPS come to market.
+
+Tested on a EP-TA485 and an older Lenovo PN: SA10M13950
+USB-C 65 Watt adapter (without PPS and has 4 PDO_s) plus
+several other PD power adapters.
+
+Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20191230033544.1809-1-dgilbert@interlog.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/typec/tcpm/tcpci.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/usb/typec/tcpm/tcpci.c
++++ b/drivers/usb/typec/tcpm/tcpci.c
+@@ -432,20 +432,30 @@ irqreturn_t tcpci_irq(struct tcpci *tcpc
+
+ if (status & TCPC_ALERT_RX_STATUS) {
+ struct pd_message msg;
+- unsigned int cnt;
++ unsigned int cnt, payload_cnt;
+ u16 header;
+
+ regmap_read(tcpci->regmap, TCPC_RX_BYTE_CNT, &cnt);
++ /*
++ * 'cnt' corresponds to READABLE_BYTE_COUNT in section 4.4.14
++ * of the TCPCI spec [Rev 2.0 Ver 1.0 October 2017] and is
++ * defined in table 4-36 as one greater than the number of
++ * bytes received. And that number includes the header. So:
++ */
++ if (cnt > 3)
++ payload_cnt = cnt - (1 + sizeof(msg.header));
++ else
++ payload_cnt = 0;
+
+ tcpci_read16(tcpci, TCPC_RX_HDR, &header);
+ msg.header = cpu_to_le16(header);
+
+- if (WARN_ON(cnt > sizeof(msg.payload)))
+- cnt = sizeof(msg.payload);
++ if (WARN_ON(payload_cnt > sizeof(msg.payload)))
++ payload_cnt = sizeof(msg.payload);
+
+- if (cnt > 0)
++ if (payload_cnt > 0)
+ regmap_raw_read(tcpci->regmap, TCPC_RX_DATA,
+- &msg.payload, cnt);
++ &msg.payload, payload_cnt);
+
+ /* Read complete, clear RX status alert bit */
+ tcpci_write16(tcpci, TCPC_ALERT, TCPC_ALERT_RX_STATUS);
--- /dev/null
+From 2438c3a19dec5e98905fd3ffcc2f24716aceda6b Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Thu, 19 Dec 2019 11:07:07 +0100
+Subject: USB: serial: option: add ZLP support for 0x1bc7/0x9010
+
+From: Daniele Palmas <dnlplm@gmail.com>
+
+commit 2438c3a19dec5e98905fd3ffcc2f24716aceda6b upstream.
+
+Telit FN980 flashing device 0x1bc7/0x9010 requires zero packet
+to be sent if out data size is is equal to the endpoint max size.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+[ johan: switch operands in conditional ]
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 8 ++++++++
+ drivers/usb/serial/usb-wwan.h | 1 +
+ drivers/usb/serial/usb_wwan.c | 4 ++++
+ 3 files changed, 13 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -567,6 +567,9 @@ static void option_instat_callback(struc
+ /* Interface must have two endpoints */
+ #define NUMEP2 BIT(16)
+
++/* Device needs ZLP */
++#define ZLP BIT(17)
++
+
+ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
+@@ -1198,6 +1201,8 @@ static const struct usb_device_id option
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
+ .driver_info = NCTRL(0) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */
++ .driver_info = NCTRL(0) | ZLP },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+@@ -2099,6 +2104,9 @@ static int option_attach(struct usb_seri
+ if (!(device_flags & NCTRL(iface_desc->bInterfaceNumber)))
+ data->use_send_setup = 1;
+
++ if (device_flags & ZLP)
++ data->use_zlp = 1;
++
+ spin_lock_init(&data->susp_lock);
+
+ usb_set_serial_data(serial, data);
+--- a/drivers/usb/serial/usb-wwan.h
++++ b/drivers/usb/serial/usb-wwan.h
+@@ -38,6 +38,7 @@ struct usb_wwan_intf_private {
+ spinlock_t susp_lock;
+ unsigned int suspended:1;
+ unsigned int use_send_setup:1;
++ unsigned int use_zlp:1;
+ int in_flight;
+ unsigned int open_ports;
+ void *private;
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -461,6 +461,7 @@ static struct urb *usb_wwan_setup_urb(st
+ void (*callback) (struct urb *))
+ {
+ struct usb_serial *serial = port->serial;
++ struct usb_wwan_intf_private *intfdata = usb_get_serial_data(serial);
+ struct urb *urb;
+
+ urb = usb_alloc_urb(0, GFP_KERNEL); /* No ISO */
+@@ -471,6 +472,9 @@ static struct urb *usb_wwan_setup_urb(st
+ usb_sndbulkpipe(serial->dev, endpoint) | dir,
+ buf, len, callback, ctx);
+
++ if (intfdata->use_zlp && dir == USB_DIR_OUT)
++ urb->transfer_flags |= URB_ZERO_PACKET;
++
+ return urb;
+ }
+
--- /dev/null
+From c346b94f8c5d1b7d637522c908209de93305a8eb Mon Sep 17 00:00:00 2001
+From: Amanieu d'Antras <amanieu@gmail.com>
+Date: Thu, 2 Jan 2020 18:24:12 +0100
+Subject: xtensa: Implement copy_thread_tls
+
+From: Amanieu d'Antras <amanieu@gmail.com>
+
+commit c346b94f8c5d1b7d637522c908209de93305a8eb upstream.
+
+This is required for clone3 which passes the TLS value through a
+struct rather than a register.
+
+Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
+Cc: linux-xtensa@linux-xtensa.org
+Cc: <stable@vger.kernel.org> # 5.3.x
+Link: https://lore.kernel.org/r/20200102172413.654385-7-amanieu@gmail.com
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/xtensa/Kconfig | 1 +
+ arch/xtensa/kernel/process.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/xtensa/Kconfig
++++ b/arch/xtensa/Kconfig
+@@ -22,6 +22,7 @@ config XTENSA
+ select HAVE_ARCH_JUMP_LABEL
+ select HAVE_ARCH_KASAN if MMU
+ select HAVE_ARCH_TRACEHOOK
++ select HAVE_COPY_THREAD_TLS
+ select HAVE_DEBUG_KMEMLEAK
+ select HAVE_DMA_CONTIGUOUS
+ select HAVE_EXIT_THREAD
+--- a/arch/xtensa/kernel/process.c
++++ b/arch/xtensa/kernel/process.c
+@@ -202,8 +202,9 @@ int arch_dup_task_struct(struct task_str
+ * involved. Much simpler to just not copy those live frames across.
+ */
+
+-int copy_thread(unsigned long clone_flags, unsigned long usp_thread_fn,
+- unsigned long thread_fn_arg, struct task_struct *p)
++int copy_thread_tls(unsigned long clone_flags, unsigned long usp_thread_fn,
++ unsigned long thread_fn_arg, struct task_struct *p,
++ unsigned long tls)
+ {
+ struct pt_regs *childregs = task_pt_regs(p);
+
+@@ -264,9 +265,8 @@ int copy_thread(unsigned long clone_flag
+ ®s->areg[XCHAL_NUM_AREGS - len/4], len);
+ }
+
+- /* The thread pointer is passed in the '4th argument' (= a5) */
+ if (clone_flags & CLONE_SETTLS)
+- childregs->threadptr = childregs->areg[5];
++ childregs->threadptr = tls;
+ } else {
+ p->thread.ra = MAKE_RA_FOR_CALL(
+ (unsigned long)ret_from_kernel_thread, 1);
projects / thirdparty / kernel / stable-queue.git / commitdiff
