--- /dev/null
+From 12838d63a3d41bf4f04f29892452a1e14b1c19ce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 08:24:06 +0200
+Subject: ALSA: hda/realtek - Add a model for Thinkpad T570 without DAC
+ workaround
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 399c01aa49e548c82d40f8161915a5941dd3c60e ]
+
+We fixed the regression of the speaker volume for some Thinkpad models
+(e.g. T570) by the commit 54947cd64c1b ("ALSA: hda/realtek - Fix
+speaker output regression on Thinkpad T570"). Essentially it fixes
+the DAC / pin pairing by a static table. It was confirmed and merged
+to stable kernel later.
+
+Now, interestingly, we got another regression report for the very same
+model (T570) about the similar problem, and the commit above was the
+culprit. That is, by some reason, there are devices that prefer the
+DAC1, and another device DAC2!
+
+Unfortunately those have the same ID and we have no idea what can
+differentiate, in this patch, a new fixup model "tpt470-dock-fix" is
+provided, so that users with such a machine can apply it manually.
+When model=tpt470-dock-fix option is passed to snd-hda-intel module,
+it avoids the fixed DAC pairing and the DAC1 is assigned to the
+speaker like the earlier versions.
+
+Fixes: 54947cd64c1b ("ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570")
+BugLink: https://apibugzilla.suse.com/show_bug.cgi?id=1172017
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200526062406.9799-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 36 +++++++++++++++++++++++++----------
+ 1 file changed, 26 insertions(+), 10 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 09a37d4c81ec..34cda0accbd8 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5152,18 +5152,9 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ { 0x19, 0x21a11010 }, /* dock mic */
+ { }
+ };
+- /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
+- * the speaker output becomes too low by some reason on Thinkpads with
+- * ALC298 codec
+- */
+- static hda_nid_t preferred_pairs[] = {
+- 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
+- 0
+- };
+ struct alc_spec *spec = codec->spec;
+
+ if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+- spec->gen.preferred_dacs = preferred_pairs;
+ spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
+ snd_hda_apply_pincfgs(codec, pincfgs);
+ } else if (action == HDA_FIXUP_ACT_INIT) {
+@@ -5176,6 +5167,23 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
+ }
+ }
+
++static void alc_fixup_tpt470_dacs(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
++ * the speaker output becomes too low by some reason on Thinkpads with
++ * ALC298 codec
++ */
++ static hda_nid_t preferred_pairs[] = {
++ 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
++ 0
++ };
++ struct alc_spec *spec = codec->spec;
++
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ spec->gen.preferred_dacs = preferred_pairs;
++}
++
+ static void alc_shutup_dell_xps13(struct hda_codec *codec)
+ {
+ struct alc_spec *spec = codec->spec;
+@@ -5708,6 +5716,7 @@ enum {
+ ALC700_FIXUP_INTEL_REFERENCE,
+ ALC274_FIXUP_DELL_BIND_DACS,
+ ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
++ ALC298_FIXUP_TPT470_DOCK_FIX,
+ ALC298_FIXUP_TPT470_DOCK,
+ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+ ALC255_FIXUP_DELL_HEADSET_MIC,
+@@ -6605,12 +6614,18 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC274_FIXUP_DELL_BIND_DACS
+ },
+- [ALC298_FIXUP_TPT470_DOCK] = {
++ [ALC298_FIXUP_TPT470_DOCK_FIX] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc_fixup_tpt470_dock,
+ .chained = true,
+ .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE
+ },
++ [ALC298_FIXUP_TPT470_DOCK] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_tpt470_dacs,
++ .chained = true,
++ .chain_id = ALC298_FIXUP_TPT470_DOCK_FIX
++ },
+ [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+@@ -7173,6 +7188,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ {.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+ {.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
+ {.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
++ {.id = ALC298_FIXUP_TPT470_DOCK_FIX, .name = "tpt470-dock-fix"},
+ {.id = ALC298_FIXUP_TPT470_DOCK, .name = "tpt470-dock"},
+ {.id = ALC233_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"},
+ {.id = ALC700_FIXUP_INTEL_REFERENCE, .name = "alc700-ref"},
+--
+2.25.1
+
--- /dev/null
+From b78d18f5f491cf58db7d71eebbbac4a7bee64edd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 14:10:26 +0800
+Subject: ALSA: hda/realtek - Add new codec supported for ALC287
+
+From: Kailang Yang <kailang@realtek.com>
+
+[ Upstream commit 630e36126e420e1756378b3427b42711ce0b9ddd ]
+
+Enable new codec supported for ALC287.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/dcf5ce5507104d0589a917cbb71dc3c6@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 34cda0accbd8..b06f7d52faad 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -387,6 +387,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ case 0x10ec0282:
+ case 0x10ec0283:
+ case 0x10ec0286:
++ case 0x10ec0287:
+ case 0x10ec0288:
+ case 0x10ec0285:
+ case 0x10ec0298:
+@@ -7840,6 +7841,7 @@ static int patch_alc269(struct hda_codec *codec)
+ case 0x10ec0215:
+ case 0x10ec0245:
+ case 0x10ec0285:
++ case 0x10ec0287:
+ case 0x10ec0289:
+ spec->codec_variant = ALC269_TYPE_ALC215;
+ spec->shutup = alc225_shutup;
+@@ -8978,6 +8980,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ HDA_CODEC_ENTRY(0x10ec0284, "ALC284", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0285, "ALC285", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0286, "ALC286", patch_alc269),
++ HDA_CODEC_ENTRY(0x10ec0287, "ALC287", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0288, "ALC288", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0289, "ALC289", patch_alc269),
+ HDA_CODEC_ENTRY(0x10ec0290, "ALC290", patch_alc269),
+--
+2.25.1
+
--- /dev/null
+From 818b9caa713cae4903479217e1e420791e607b40 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 00:39:21 +0000
+Subject: ALSA: hwdep: fix a left shifting 1 by 31 UB bug
+
+From: Changming Liu <liu.changm@northeastern.edu>
+
+[ Upstream commit fb8cd6481ffd126f35e9e146a0dcf0c4e8899f2e ]
+
+The "info.index" variable can be 31 in "1 << info.index".
+This might trigger an undefined behavior since 1 is signed.
+
+Fix this by casting 1 to 1u just to be sure "1u << 31" is defined.
+
+Signed-off-by: Changming Liu <liu.changm@northeastern.edu>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/BL0PR06MB4548170B842CB055C9AF695DE5B00@BL0PR06MB4548.namprd06.prod.outlook.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/hwdep.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
+index 26e71cf05f1e..600ab2eb1b50 100644
+--- a/sound/core/hwdep.c
++++ b/sound/core/hwdep.c
+@@ -231,12 +231,12 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
+ if (info.index >= 32)
+ return -EINVAL;
+ /* check whether the dsp was already loaded */
+- if (hw->dsp_loaded & (1 << info.index))
++ if (hw->dsp_loaded & (1u << info.index))
+ return -EBUSY;
+ err = hw->ops.dsp_load(hw, &info);
+ if (err < 0)
+ return err;
+- hw->dsp_loaded |= (1 << info.index);
++ hw->dsp_loaded |= (1u << info.index);
+ return 0;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 08a73d0a196cd6feeb8442113d33e0a17f378149 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 14:26:13 +0800
+Subject: ALSA: usb-audio: mixer: volume quirk for ESS Technology Asus USB DAC
+
+From: Chris Chiu <chiu@endlessm.com>
+
+[ Upstream commit 4020d1ccbe55bdf67b31d718d2400506eaf4b43f ]
+
+The Asus USB DAC is a USB type-C audio dongle for connecting to
+the headset and headphone. The volume minimum value -23040 which
+is 0xa600 in hexadecimal with the resolution value 1 indicates
+this should be endianness issue caused by the firmware bug. Add
+a volume quirk to fix the volume control problem.
+
+Also fixes this warning:
+ Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
+ [5] FU [Headset Capture Volume] ch = 1, val = -23040/0/1
+ Warning! Unlikely big volume range (=23040), cval->res is probably wrong.
+ [7] FU [Headset Playback Volume] ch = 1, val = -23040/0/1
+
+Signed-off-by: Chris Chiu <chiu@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200526062613.55401-1-chiu@endlessm.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 7a5c665cf4e4..8a0211131fc6 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1186,6 +1186,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ cval->res = 384;
+ }
+ break;
++ case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */
++ if ((strstr(kctl->id.name, "Playback Volume") != NULL) ||
++ strstr(kctl->id.name, "Capture Volume") != NULL) {
++ cval->min >>= 8;
++ cval->max = 0;
++ cval->res = 1;
++ }
++ break;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 08cda6b5e9b3c2bae851d2ad3b01cfb43483b930 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 26 May 2020 10:28:10 +0200
+Subject: ALSA: usb-audio: Quirks for Gigabyte TRX40 Aorus Master onboard audio
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 7f5ad9c9003425175f46c94df380e8c9e558cfb5 ]
+
+Gigabyte TRX40 Aorus Master is equipped with two USB-audio devices,
+a Realtek ALC1220-VB codec (USB ID 0414:a001) and an ESS SABRE9218 DAC
+(USB ID 0414:a000). The latter serves solely for the headphone output
+on the front panel while the former serves for the rest I/Os (mostly
+for the I/Os in the rear panel but also including the front mic).
+
+Both chips do work more or less with the unmodified USB-audio driver,
+but there are a few glitches. The ALC1220-VB returns an error for an
+inquiry to some jacks, as already seen on other TRX40-based mobos.
+However this machine has a slightly incompatible configuration, hence
+the existing mapping cannot be used as is.
+
+Meanwhile the ESS chip seems working without any quirk. But since
+both audio devices don't provide any specific names, both cards appear
+as "USB-Audio", and it's quite confusing for users.
+
+This patch is an attempt to overcome those issues:
+
+- The specific mapping table for ALC1220-VB is provided, reducing the
+ non-working nodes and renaming the badly chosen controls.
+ The connector map isn't needed here unlike other TRX40 quirks.
+
+- For both USB IDs (0414:a000 and 0414:a001), provide specific card
+ name strings, so that user-space can identify more easily; and more
+ importantly, UCM profile can be applied to each.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20200526082810.29506-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/mixer_maps.c | 19 +++++++++++++++++++
+ sound/usb/quirks-table.h | 25 +++++++++++++++++++++++++
+ 2 files changed, 44 insertions(+)
+
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index d7a8b23b335b..10323e6f7f97 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -401,6 +401,21 @@ static const struct usbmix_connector_map trx40_mobo_connector_map[] = {
+ {}
+ };
+
++/* Rear panel + front mic on Gigabyte TRX40 Aorus Master with ALC1220-VB */
++static const struct usbmix_name_map aorus_master_alc1220vb_map[] = {
++ { 17, NULL }, /* OT, IEC958?, disabled */
++ { 19, NULL, 12 }, /* FU, Input Gain Pad - broken response, disabled */
++ { 16, "Line Out" }, /* OT */
++ { 22, "Line Out Playback" }, /* FU */
++ { 7, "Line" }, /* IT */
++ { 19, "Line Capture" }, /* FU */
++ { 8, "Mic" }, /* IT */
++ { 20, "Mic Capture" }, /* FU */
++ { 9, "Front Mic" }, /* IT */
++ { 21, "Front Mic Capture" }, /* FU */
++ {}
++};
++
+ /*
+ * Control map entries
+ */
+@@ -520,6 +535,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
++ { /* Gigabyte TRX40 Aorus Master (rear panel + front mic) */
++ .id = USB_ID(0x0414, 0xa001),
++ .map = aorus_master_alc1220vb_map,
++ },
+ { /* Gigabyte TRX40 Aorus Pro WiFi */
+ .id = USB_ID(0x0414, 0xa002),
+ .map = trx40_mobo_map,
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 4f8a2b98e090..b798eae0a785 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3415,4 +3415,29 @@ ALC1220_VB_DESKTOP(0x0db0, 0x543d), /* MSI TRX40 */
+ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* Asrock TRX40 Creator */
+ #undef ALC1220_VB_DESKTOP
+
++/* Two entries for Gigabyte TRX40 Aorus Master:
++ * TRX40 Aorus Master has two USB-audio devices, one for the front headphone
++ * with ESS SABRE9218 DAC chip, while another for the rest I/O (the rear
++ * panel and the front mic) with Realtek ALC1220-VB.
++ * Here we provide two distinct names for making UCM profiles easier.
++ */
++{
++ USB_DEVICE(0x0414, 0xa000),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "Gigabyte",
++ .product_name = "Aorus Master Front Headphone",
++ .profile_name = "Gigabyte-Aorus-Master-Front-Headphone",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++{
++ USB_DEVICE(0x0414, 0xa001),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .vendor_name = "Gigabyte",
++ .product_name = "Aorus Master Main Audio",
++ .profile_name = "Gigabyte-Aorus-Master-Main-Audio",
++ .ifnum = QUIRK_NO_INTERFACE
++ }
++},
++
+ #undef USB_DEVICE_VENDOR_SPEC
+--
+2.25.1
+
--- /dev/null
+From cc2054f88d0010f3c05f6243a200a965e9070f69 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Feb 2019 00:56:58 +0100
+Subject: ARM: 8843/1: use unified assembler in headers
+
+From: Stefan Agner <stefan@agner.ch>
+
+[ Upstream commit c001899a5d6c2d7a0f3b75b2307ddef137fb46a6 ]
+
+Use unified assembler syntax (UAL) in headers. Divided syntax is
+considered deprecated. This will also allow to build the kernel
+using LLVM's integrated assembler.
+
+Signed-off-by: Stefan Agner <stefan@agner.ch>
+Acked-by: Nicolas Pitre <nico@linaro.org>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 12 ++++++------
+ arch/arm/include/asm/vfpmacros.h | 8 ++++----
+ arch/arm/lib/bitops.h | 8 ++++----
+ 3 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 88286dd483ff..965224d14e6c 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -374,9 +374,9 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .macro usraccoff, instr, reg, ptr, inc, off, cond, abort, t=TUSER()
+ 9999:
+ .if \inc == 1
+- \instr\cond\()b\()\t\().w \reg, [\ptr, #\off]
++ \instr\()b\t\cond\().w \reg, [\ptr, #\off]
+ .elseif \inc == 4
+- \instr\cond\()\t\().w \reg, [\ptr, #\off]
++ \instr\t\cond\().w \reg, [\ptr, #\off]
+ .else
+ .error "Unsupported inc macro argument"
+ .endif
+@@ -415,9 +415,9 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .rept \rept
+ 9999:
+ .if \inc == 1
+- \instr\cond\()b\()\t \reg, [\ptr], #\inc
++ \instr\()b\t\cond \reg, [\ptr], #\inc
+ .elseif \inc == 4
+- \instr\cond\()\t \reg, [\ptr], #\inc
++ \instr\t\cond \reg, [\ptr], #\inc
+ .else
+ .error "Unsupported inc macro argument"
+ .endif
+@@ -458,7 +458,7 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+ #ifndef CONFIG_CPU_USE_DOMAINS
+ adds \tmp, \addr, #\size - 1
+- sbcccs \tmp, \tmp, \limit
++ sbcscc \tmp, \tmp, \limit
+ bcs \bad
+ #ifdef CONFIG_CPU_SPECTRE
+ movcs \addr, #0
+@@ -472,7 +472,7 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ sub \tmp, \limit, #1
+ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+- subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+ movlo \addr, #0 @ if (tmp < 0) addr = NULL
+ csdb
+ #endif
+diff --git a/arch/arm/include/asm/vfpmacros.h b/arch/arm/include/asm/vfpmacros.h
+index ef5dfedacd8d..628c336e8e3b 100644
+--- a/arch/arm/include/asm/vfpmacros.h
++++ b/arch/arm/include/asm/vfpmacros.h
+@@ -29,13 +29,13 @@
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+ tst \tmp, #HWCAP_VFPD32
+- ldcnel p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
++ ldclne p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
+ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+ cmp \tmp, #2 @ 32 x 64bit registers?
+- ldceql p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
++ ldcleq p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31}
+ addne \base, \base, #32*4 @ step over unused register space
+ #endif
+ #endif
+@@ -53,13 +53,13 @@
+ ldr \tmp, =elf_hwcap @ may not have MVFR regs
+ ldr \tmp, [\tmp, #0]
+ tst \tmp, #HWCAP_VFPD32
+- stcnel p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
++ stclne p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
+ addeq \base, \base, #32*4 @ step over unused register space
+ #else
+ VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0
+ and \tmp, \tmp, #MVFR0_A_SIMD_MASK @ A_SIMD field
+ cmp \tmp, #2 @ 32 x 64bit registers?
+- stceql p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
++ stcleq p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31}
+ addne \base, \base, #32*4 @ step over unused register space
+ #endif
+ #endif
+diff --git a/arch/arm/lib/bitops.h b/arch/arm/lib/bitops.h
+index 93cddab73072..95bd35991288 100644
+--- a/arch/arm/lib/bitops.h
++++ b/arch/arm/lib/bitops.h
+@@ -7,7 +7,7 @@
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ mov r2, #1
+ and r3, r0, #31 @ Get bit offset
+ mov r0, r0, lsr #5
+@@ -32,7 +32,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ mov r2, #1
+ and r3, r0, #31 @ Get bit offset
+ mov r0, r0, lsr #5
+@@ -62,7 +62,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ and r2, r0, #31
+ mov r0, r0, lsr #5
+ mov r3, #1
+@@ -89,7 +89,7 @@ ENDPROC(\name )
+ ENTRY( \name )
+ UNWIND( .fnstart )
+ ands ip, r1, #3
+- strneb r1, [ip] @ assert word-aligned
++ strbne r1, [ip] @ assert word-aligned
+ and r3, r0, #31
+ mov r0, r0, lsr #5
+ save_and_disable_irqs ip
+--
+2.25.1
+
--- /dev/null
+From 1cae4190448481871e4cfcfd6ff460fe1655a144 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 20:36:11 +0100
+Subject: ARM: 8970/1: decompressor: increase tag size
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Łukasz Stelmach <l.stelmach@samsung.com>
+
+[ Upstream commit 2c962369d72f286659e6446919f88d69b943cb4d ]
+
+The size field of the tag header structure is supposed to be set to the
+size of a tag structure including the header.
+
+Fixes: c772568788b5f0 ("ARM: add additional table to compressed kernel")
+Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/compressed/vmlinux.lds.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/compressed/vmlinux.lds.S b/arch/arm/boot/compressed/vmlinux.lds.S
+index 2b963d8e76dd..89a8f7588c78 100644
+--- a/arch/arm/boot/compressed/vmlinux.lds.S
++++ b/arch/arm/boot/compressed/vmlinux.lds.S
+@@ -46,7 +46,7 @@ SECTIONS
+ }
+ .table : ALIGN(4) {
+ _table_start = .;
+- LONG(ZIMAGE_MAGIC(2))
++ LONG(ZIMAGE_MAGIC(4))
+ LONG(ZIMAGE_MAGIC(0x5a534c4b))
+ LONG(ZIMAGE_MAGIC(__piggy_size_addr - _start))
+ LONG(ZIMAGE_MAGIC(_kernel_bss_size))
+--
+2.25.1
+
--- /dev/null
+From 92aad733c0451ced2c7c04e093569a7b2388fa79 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 20 May 2020 16:30:42 +1200
+Subject: ARM: dts: bcm: HR2: Fix PPI interrupt types
+
+From: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+
+[ Upstream commit be0ec060b54f0481fb95d59086c1484a949c903c ]
+
+These error messages are output when booting on a BCM HR2 system:
+ GIC: PPI11 is secure or misconfigured
+ GIC: PPI13 is secure or misconfigured
+
+Per ARM documentation these interrupts are triggered on a rising edge.
+See ARM Cortex A-9 MPCore Technical Reference Manual, Revision r4p1,
+Section 3.3.8 Interrupt Configuration Registers.
+
+The same issue was resolved for NSP systems in commit 5f1aa51c7a1e
+("ARM: dts: NSP: Fix PPI interrupt types").
+
+Fixes: b9099ec754b5 ("ARM: dts: Add Broadcom Hurricane 2 DTS include file")
+Signed-off-by: Hamish Martin <hamish.martin@alliedtelesis.co.nz>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm-hr2.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/bcm-hr2.dtsi b/arch/arm/boot/dts/bcm-hr2.dtsi
+index e4d49731287f..e35398cc60a0 100644
+--- a/arch/arm/boot/dts/bcm-hr2.dtsi
++++ b/arch/arm/boot/dts/bcm-hr2.dtsi
+@@ -75,7 +75,7 @@
+ timer@20200 {
+ compatible = "arm,cortex-a9-global-timer";
+ reg = <0x20200 0x100>;
+- interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>;
+ clocks = <&periph_clk>;
+ };
+
+@@ -83,7 +83,7 @@
+ compatible = "arm,cortex-a9-twd-timer";
+ reg = <0x20600 0x20>;
+ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(1) |
+- IRQ_TYPE_LEVEL_HIGH)>;
++ IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&periph_clk>;
+ };
+
+@@ -91,7 +91,7 @@
+ compatible = "arm,cortex-a9-twd-wdt";
+ reg = <0x20620 0x20>;
+ interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(1) |
+- IRQ_TYPE_LEVEL_HIGH)>;
++ IRQ_TYPE_EDGE_RISING)>;
+ clocks = <&periph_clk>;
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 1bc5cf5d0ecc44fef173f2b7e35113d29dfc6920 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Apr 2020 14:35:22 +0200
+Subject: ARM: dts: bcm2835-rpi-zero-w: Fix led polarity
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincent Stehlé <vincent.stehle@laposte.net>
+
+[ Upstream commit 58bb90ab415562eededb932455046924e65df342 ]
+
+The status "ACT" led on the Raspberry Pi Zero W is on when GPIO 47 is low.
+
+This has been verified on a board and somewhat confirmed by both the GPIO
+name ("STATUS_LED_N") and the reduced schematics [1].
+
+[1]: https://www.raspberrypi.org/documentation/hardware/raspberrypi/schematics/rpi_SCH_ZeroW_1p1_reduced.pdf
+
+Fixes: 2c7c040c73e9 ("ARM: dts: bcm2835: Add Raspberry Pi Zero W")
+Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
+Cc: Stefan Wahren <stefan.wahren@i2se.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+index 5fcadb9cf992..9f7145b1cc5e 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-zero-w.dts
+@@ -25,7 +25,7 @@
+
+ leds {
+ act {
+- gpios = <&gpio 47 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio 47 GPIO_ACTIVE_LOW>;
+ };
+ };
+
+--
+2.25.1
+
--- /dev/null
+From a17859d7b20fa375fe515336891bab92858a41d5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 14 May 2020 19:02:37 +0200
+Subject: ARM: dts/imx6q-bx50v3: Set display interface clock parents
+
+From: Robert Beckett <bob.beckett@collabora.com>
+
+[ Upstream commit 665e7c73a7724a393b4ec92d1ae1e029925ef2b7 ]
+
+Avoid LDB and IPU DI clocks both using the same parent. LDB requires
+pasthrough clock to avoid breaking timing while IPU DI does not.
+
+Force IPU DI clocks to use IMX6QDL_CLK_PLL2_PFD0_352M as parent
+and LDB to use IMX6QDL_CLK_PLL5_VIDEO_DIV.
+
+This fixes an issue where attempting atomic modeset while using
+HDMI and display port at the same time causes LDB clock programming
+to destroy the programming of HDMI that was done during the same
+modeset.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Robert Beckett <bob.beckett@collabora.com>
+[Use IMX6QDL_CLK_PLL2_PFD0_352M instead of IMX6QDL_CLK_PLL2_PFD2_396M
+ originally chosen by Robert Beckett to avoid affecting eMMC clock
+ by DRM atomic updates]
+Signed-off-by: Ian Ray <ian.ray@ge.com>
+[Squash Robert's and Ian's commits for bisectability, update patch
+ description and add stable tag]
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6q-b450v3.dts | 7 -------
+ arch/arm/boot/dts/imx6q-b650v3.dts | 7 -------
+ arch/arm/boot/dts/imx6q-b850v3.dts | 11 -----------
+ arch/arm/boot/dts/imx6q-bx50v3.dtsi | 15 +++++++++++++++
+ 4 files changed, 15 insertions(+), 25 deletions(-)
+
+diff --git a/arch/arm/boot/dts/imx6q-b450v3.dts b/arch/arm/boot/dts/imx6q-b450v3.dts
+index 3ec58500e9c2..25bf45659737 100644
+--- a/arch/arm/boot/dts/imx6q-b450v3.dts
++++ b/arch/arm/boot/dts/imx6q-b450v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b650v3.dts b/arch/arm/boot/dts/imx6q-b650v3.dts
+index 5650a9b11091..0326711a8700 100644
+--- a/arch/arm/boot/dts/imx6q-b650v3.dts
++++ b/arch/arm/boot/dts/imx6q-b650v3.dts
+@@ -65,13 +65,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
+- <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
+-};
+-
+ &ldb {
+ status = "okay";
+
+diff --git a/arch/arm/boot/dts/imx6q-b850v3.dts b/arch/arm/boot/dts/imx6q-b850v3.dts
+index 044a5bebe1c5..612f782ddaaa 100644
+--- a/arch/arm/boot/dts/imx6q-b850v3.dts
++++ b/arch/arm/boot/dts/imx6q-b850v3.dts
+@@ -53,17 +53,6 @@
+ };
+ };
+
+-&clks {
+- assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
+- <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
+- <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
+- <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>;
+- assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>,
+- <&clks IMX6QDL_CLK_PLL2_PFD2_396M>;
+-};
+-
+ &ldb {
+ fsl,dual-channel;
+ status = "okay";
+diff --git a/arch/arm/boot/dts/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+index d3cba09be0cb..c1f554348187 100644
+--- a/arch/arm/boot/dts/imx6q-bx50v3.dtsi
++++ b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
+@@ -391,3 +391,18 @@
+ #interrupt-cells = <1>;
+ };
+ };
++
++&clks {
++ assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
++ <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU1_DI1_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>,
++ <&clks IMX6QDL_CLK_IPU2_DI1_PRE_SEL>;
++ assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
++ <&clks IMX6QDL_CLK_PLL2_PFD0_352M>;
++};
+--
+2.25.1
+
--- /dev/null
+From 626f2aa8fe0012c3e5cdadda4fdc54d28945fe4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:03:54 +0100
+Subject: ARM: uaccess: consolidate uaccess asm to asm/uaccess-asm.h
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 747ffc2fcf969eff9309d7f2d1d61cb8b9e1bb40 ]
+
+Consolidate the user access assembly code to asm/uaccess-asm.h. This
+moves the csdb, check_uaccess, uaccess_mask_range_ptr, uaccess_enable,
+uaccess_disable, uaccess_save, uaccess_restore macros, and creates two
+new ones for exception entry and exit - uaccess_entry and uaccess_exit.
+
+This makes the uaccess_save and uaccess_restore macros private to
+asm/uaccess-asm.h.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/assembler.h | 75 +-------------------
+ arch/arm/include/asm/uaccess-asm.h | 106 +++++++++++++++++++++++++++++
+ arch/arm/kernel/entry-armv.S | 11 +--
+ arch/arm/kernel/entry-header.S | 9 +--
+ 4 files changed, 112 insertions(+), 89 deletions(-)
+ create mode 100644 arch/arm/include/asm/uaccess-asm.h
+
+diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
+index 965224d14e6c..1935b580f0e8 100644
+--- a/arch/arm/include/asm/assembler.h
++++ b/arch/arm/include/asm/assembler.h
+@@ -21,11 +21,11 @@
+ #endif
+
+ #include <asm/ptrace.h>
+-#include <asm/domain.h>
+ #include <asm/opcodes-virt.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/page.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+
+ #define IOMEM(x) (x)
+
+@@ -447,79 +447,6 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
+ .size \name , . - \name
+ .endm
+
+- .macro csdb
+-#ifdef CONFIG_THUMB2_KERNEL
+- .inst.w 0xf3af8014
+-#else
+- .inst 0xe320f014
+-#endif
+- .endm
+-
+- .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
+-#ifndef CONFIG_CPU_USE_DOMAINS
+- adds \tmp, \addr, #\size - 1
+- sbcscc \tmp, \tmp, \limit
+- bcs \bad
+-#ifdef CONFIG_CPU_SPECTRE
+- movcs \addr, #0
+- csdb
+-#endif
+-#endif
+- .endm
+-
+- .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
+-#ifdef CONFIG_CPU_SPECTRE
+- sub \tmp, \limit, #1
+- subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
+- addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
+- subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
+- movlo \addr, #0 @ if (tmp < 0) addr = NULL
+- csdb
+-#endif
+- .endm
+-
+- .macro uaccess_disable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_DISABLE
+- mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_enable, tmp, isb=1
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- /*
+- * Whenever we re-enter userspace, the domains should always be
+- * set appropriately.
+- */
+- mov \tmp, #DACR_UACCESS_ENABLE
+- mcr p15, 0, \tmp, c3, c0, 0
+- .if \isb
+- instr_sync
+- .endif
+-#endif
+- .endm
+-
+- .macro uaccess_save, tmp
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- mrc p15, 0, \tmp, c3, c0, 0
+- str \tmp, [sp, #SVC_DACR]
+-#endif
+- .endm
+-
+- .macro uaccess_restore
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- ldr r0, [sp, #SVC_DACR]
+- mcr p15, 0, r0, c3, c0, 0
+-#endif
+- .endm
+-
+ .irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo
+ .macro ret\c, reg
+ #if __LINUX_ARM_ARCH__ < 6
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+new file mode 100644
+index 000000000000..d475e3e8145d
+--- /dev/null
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -0,0 +1,106 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++
++#ifndef __ASM_UACCESS_ASM_H__
++#define __ASM_UACCESS_ASM_H__
++
++#include <asm/asm-offsets.h>
++#include <asm/domain.h>
++#include <asm/memory.h>
++#include <asm/thread_info.h>
++
++ .macro csdb
++#ifdef CONFIG_THUMB2_KERNEL
++ .inst.w 0xf3af8014
++#else
++ .inst 0xe320f014
++#endif
++ .endm
++
++ .macro check_uaccess, addr:req, size:req, limit:req, tmp:req, bad:req
++#ifndef CONFIG_CPU_USE_DOMAINS
++ adds \tmp, \addr, #\size - 1
++ sbcscc \tmp, \tmp, \limit
++ bcs \bad
++#ifdef CONFIG_CPU_SPECTRE
++ movcs \addr, #0
++ csdb
++#endif
++#endif
++ .endm
++
++ .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req
++#ifdef CONFIG_CPU_SPECTRE
++ sub \tmp, \limit, #1
++ subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr
++ addhs \tmp, \tmp, #1 @ if (tmp >= 0) {
++ subshs \tmp, \tmp, \size @ tmp = limit - (addr + size) }
++ movlo \addr, #0 @ if (tmp < 0) addr = NULL
++ csdb
++#endif
++ .endm
++
++ .macro uaccess_disable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp, c3, c0, 0 @ Set domain register
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++ .macro uaccess_enable, tmp, isb=1
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ /*
++ * Whenever we re-enter userspace, the domains should always be
++ * set appropriately.
++ */
++ mov \tmp, #DACR_UACCESS_ENABLE
++ mcr p15, 0, \tmp, c3, c0, 0
++ .if \isb
++ instr_sync
++ .endif
++#endif
++ .endm
++
++ .macro uaccess_save, tmp
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ mrc p15, 0, \tmp, c3, c0, 0
++ str \tmp, [sp, #SVC_DACR]
++#endif
++ .endm
++
++ .macro uaccess_restore
++#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++ ldr r0, [sp, #SVC_DACR]
++ mcr p15, 0, r0, c3, c0, 0
++#endif
++ .endm
++
++ /*
++ * Save the address limit on entry to a privileged exception and
++ * if using PAN, save and disable usermode access.
++ */
++ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
++ ldr \tmp0, [\tsk, #TI_ADDR_LIMIT]
++ mov \tmp1, #TASK_SIZE
++ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ str \tmp0, [sp, #SVC_ADDR_LIMIT]
++ uaccess_save \tmp0
++ .if \disable
++ uaccess_disable \tmp0
++ .endif
++ .endm
++
++ /* Restore the user access state previously saved by uaccess_entry */
++ .macro uaccess_exit, tsk, tmp0, tmp1
++ ldr \tmp1, [sp, #SVC_ADDR_LIMIT]
++ uaccess_restore
++ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ .endm
++
++#endif /* __ASM_UACCESS_ASM_H__ */
+diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
+index e85a3af9ddeb..89e551eebff1 100644
+--- a/arch/arm/kernel/entry-armv.S
++++ b/arch/arm/kernel/entry-armv.S
+@@ -30,6 +30,7 @@
+ #include <asm/unistd.h>
+ #include <asm/tls.h>
+ #include <asm/system_info.h>
++#include <asm/uaccess-asm.h>
+
+ #include "entry-header.S"
+ #include <asm/entry-macro-multi.S>
+@@ -182,15 +183,7 @@ ENDPROC(__und_invalid)
+ stmia r7, {r2 - r6}
+
+ get_thread_info tsk
+- ldr r0, [tsk, #TI_ADDR_LIMIT]
+- mov r1, #TASK_SIZE
+- str r1, [tsk, #TI_ADDR_LIMIT]
+- str r0, [sp, #SVC_ADDR_LIMIT]
+-
+- uaccess_save r0
+- .if \uaccess
+- uaccess_disable r0
+- .endif
++ uaccess_entry tsk, r0, r1, r2, \uaccess
+
+ .if \trace
+ #ifdef CONFIG_TRACE_IRQFLAGS
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index 62db1c9746cb..7b595f2d4a28 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -6,6 +6,7 @@
+ #include <asm/asm-offsets.h>
+ #include <asm/errno.h>
+ #include <asm/thread_info.h>
++#include <asm/uaccess-asm.h>
+ #include <asm/v7m.h>
+
+ @ Bad Abort numbers
+@@ -217,9 +218,7 @@
+ blne trace_hardirqs_off
+ #endif
+ .endif
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode SVC restore
+@@ -263,9 +262,7 @@
+ @ on the stack remains correct).
+ @
+ .macro svc_exit_via_fiq
+- ldr r1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
+- str r1, [tsk, #TI_ADDR_LIMIT]
++ uaccess_exit tsk, r0, r1
+ #ifndef CONFIG_THUMB2_KERNEL
+ @ ARM mode restore
+ mov r0, sp
+--
+2.25.1
+
--- /dev/null
+From 2bfe686d9356e30e91953937550bf5d771b44ab5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:24:07 +0100
+Subject: ARM: uaccess: fix DACR mismatch with nested exceptions
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 71f8af1110101facfad68989ff91f88f8e2c3e22 ]
+
+Tomas Paukrt reports that his SAM9X60 based system (ARM926, ARMv5TJ)
+fails to fix up alignment faults, eventually resulting in a kernel
+oops.
+
+The problem occurs when using CONFIG_CPU_USE_DOMAINS with commit
+e6978e4bf181 ("ARM: save and reset the address limit when entering an
+exception"). This is because the address limit is set back to
+TASK_SIZE on exception entry, and, although it is restored on exception
+exit, the domain register is not.
+
+Hence, this sequence can occur:
+
+ interrupt
+ pt_regs->addr_limit = addr_limit // USER_DS
+ addr_limit = USER_DS
+ alignment exception
+ __probe_kernel_read()
+ old_fs = get_fs() // USER_DS
+ set_fs(KERNEL_DS)
+ addr_limit = KERNEL_DS
+ dacr.kernel = DOMAIN_MANAGER
+ interrupt
+ pt_regs->addr_limit = addr_limit // KERNEL_DS
+ addr_limit = USER_DS
+ alignment exception
+ __probe_kernel_read()
+ old_fs = get_fs() // USER_DS
+ set_fs(KERNEL_DS)
+ addr_limit = KERNEL_DS
+ dacr.kernel = DOMAIN_MANAGER
+ ...
+ set_fs(old_fs)
+ addr_limit = USER_DS
+ dacr.kernel = DOMAIN_CLIENT
+ ...
+ addr_limit = pt_regs->addr_limit // KERNEL_DS
+ interrupt returns
+
+At this point, addr_limit is correctly restored to KERNEL_DS for
+__probe_kernel_read() to continue execution, but dacr.kernel is not,
+it has been reset by the set_fs(old_fs) to DOMAIN_CLIENT.
+
+This would not have happened prior to the mentioned commit, because
+addr_limit would remain KERNEL_DS, so get_fs() would have returned
+KERNEL_DS, and so would correctly nest.
+
+This commit fixes the problem by also saving the DACR on exception
+entry if either CONFIG_CPU_SW_DOMAIN_PAN or CONFIG_CPU_USE_DOMAINS are
+enabled, and resetting the DACR appropriately on exception entry to
+match addr_limit and PAN settings.
+
+Fixes: e6978e4bf181 ("ARM: save and reset the address limit when entering an exception")
+Reported-by: Tomas Paukrt <tomas.paukrt@advantech.cz>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess-asm.h | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+index e46468b91eaa..907571fd05c6 100644
+--- a/arch/arm/include/asm/uaccess-asm.h
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -67,15 +67,21 @@
+ #endif
+ .endm
+
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
++#if defined(CONFIG_CPU_SW_DOMAIN_PAN) || defined(CONFIG_CPU_USE_DOMAINS)
+ #define DACR(x...) x
+ #else
+ #define DACR(x...)
+ #endif
+
+ /*
+- * Save the address limit on entry to a privileged exception and
+- * if using PAN, save and disable usermode access.
++ * Save the address limit on entry to a privileged exception.
++ *
++ * If we are using the DACR for kernel access by the user accessors
++ * (CONFIG_CPU_USE_DOMAINS=y), always reset the DACR kernel domain
++ * back to client mode, whether or not \disable is set.
++ *
++ * If we are using SW PAN, set the DACR user domain to no access
++ * if \disable is set.
+ */
+ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
+ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT]
+@@ -84,8 +90,17 @@
+ DACR( mrc p15, 0, \tmp0, c3, c0, 0)
+ DACR( str \tmp0, [sp, #SVC_DACR])
+ str \tmp1, [sp, #SVC_ADDR_LIMIT]
+- .if \disable
+- uaccess_disable \tmp0
++ .if \disable && IS_ENABLED(CONFIG_CPU_SW_DOMAIN_PAN)
++ /* kernel=client, user=no access */
++ mov \tmp2, #DACR_UACCESS_DISABLE
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
++ .elseif IS_ENABLED(CONFIG_CPU_USE_DOMAINS)
++ /* kernel=client */
++ bic \tmp2, \tmp0, #domain_mask(DOMAIN_KERNEL)
++ orr \tmp2, \tmp2, #domain_val(DOMAIN_KERNEL, DOMAIN_CLIENT)
++ mcr p15, 0, \tmp2, c3, c0, 0
++ instr_sync
+ .endif
+ .endm
+
+--
+2.25.1
+
--- /dev/null
+From dba4e981dc9b60c8302d1f804b5982d66f6c2181 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 May 2020 13:14:09 +0100
+Subject: ARM: uaccess: integrate uaccess_save and uaccess_restore
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 8ede890b0bcebe8c760aacfe20e934d98c3dc6aa ]
+
+Integrate uaccess_save / uaccess_restore macros into the new
+uaccess_entry / uaccess_exit macros respectively.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/include/asm/uaccess-asm.h | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/arch/arm/include/asm/uaccess-asm.h b/arch/arm/include/asm/uaccess-asm.h
+index d475e3e8145d..e46468b91eaa 100644
+--- a/arch/arm/include/asm/uaccess-asm.h
++++ b/arch/arm/include/asm/uaccess-asm.h
+@@ -67,30 +67,23 @@
+ #endif
+ .endm
+
+- .macro uaccess_save, tmp
+ #ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- mrc p15, 0, \tmp, c3, c0, 0
+- str \tmp, [sp, #SVC_DACR]
+-#endif
+- .endm
+-
+- .macro uaccess_restore
+-#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+- ldr r0, [sp, #SVC_DACR]
+- mcr p15, 0, r0, c3, c0, 0
++#define DACR(x...) x
++#else
++#define DACR(x...)
+ #endif
+- .endm
+
+ /*
+ * Save the address limit on entry to a privileged exception and
+ * if using PAN, save and disable usermode access.
+ */
+ .macro uaccess_entry, tsk, tmp0, tmp1, tmp2, disable
+- ldr \tmp0, [\tsk, #TI_ADDR_LIMIT]
+- mov \tmp1, #TASK_SIZE
+- str \tmp1, [\tsk, #TI_ADDR_LIMIT]
+- str \tmp0, [sp, #SVC_ADDR_LIMIT]
+- uaccess_save \tmp0
++ ldr \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ mov \tmp2, #TASK_SIZE
++ str \tmp2, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mrc p15, 0, \tmp0, c3, c0, 0)
++ DACR( str \tmp0, [sp, #SVC_DACR])
++ str \tmp1, [sp, #SVC_ADDR_LIMIT]
+ .if \disable
+ uaccess_disable \tmp0
+ .endif
+@@ -99,8 +92,11 @@
+ /* Restore the user access state previously saved by uaccess_entry */
+ .macro uaccess_exit, tsk, tmp0, tmp1
+ ldr \tmp1, [sp, #SVC_ADDR_LIMIT]
+- uaccess_restore
++ DACR( ldr \tmp0, [sp, #SVC_DACR])
+ str \tmp1, [\tsk, #TI_ADDR_LIMIT]
++ DACR( mcr p15, 0, \tmp0, c3, c0, 0)
+ .endm
+
++#undef DACR
++
+ #endif /* __ASM_UACCESS_ASM_H__ */
+--
+2.25.1
+
--- /dev/null
+From a2be018b8d2cf0e47e563535438f33f2e31af727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 May 2020 12:56:15 -0500
+Subject: exec: Always set cap_ambient in cap_bprm_set_creds
+
+From: Eric W. Biederman <ebiederm@xmission.com>
+
+[ Upstream commit a4ae32c71fe90794127b32d26d7ad795813b502e ]
+
+An invariant of cap_bprm_set_creds is that every field in the new cred
+structure that cap_bprm_set_creds might set, needs to be set every
+time to ensure the fields does not get a stale value.
+
+The field cap_ambient is not set every time cap_bprm_set_creds is
+called, which means that if there is a suid or sgid script with an
+interpreter that has neither the suid nor the sgid bits set the
+interpreter should be able to accept ambient credentials.
+Unfortuantely because cap_ambient is not reset to it's original value
+the interpreter can not accept ambient credentials.
+
+Given that the ambient capability set is expected to be controlled by
+the caller, I don't think this is particularly serious. But it is
+definitely worth fixing so the code works correctly.
+
+I have tested to verify my reading of the code is correct and the
+interpreter of a sgid can receive ambient capabilities with this
+change and cannot receive ambient capabilities without this change.
+
+Cc: stable@vger.kernel.org
+Cc: Andy Lutomirski <luto@kernel.org>
+Fixes: 58319057b784 ("capabilities: ambient capabilities")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ security/commoncap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 3023b4ad38a7..f86557a8e43f 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -819,6 +819,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
+ int ret;
+ kuid_t root_uid;
+
++ new->cap_ambient = old->cap_ambient;
+ if (WARN_ON(!cap_ambient_invariant_ok(old)))
+ return -EPERM;
+
+--
+2.25.1
+
--- /dev/null
+From 574ceac58f59e850d54c92b51e38f50bfb30a698 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:52 -0700
+Subject: fs/binfmt_elf.c: allocate initialized memory in
+ fill_thread_core_info()
+
+From: Alexander Potapenko <glider@google.com>
+
+[ Upstream commit 1d605416fb7175e1adf094251466caa52093b413 ]
+
+KMSAN reported uninitialized data being written to disk when dumping
+core. As a result, several kilobytes of kmalloc memory may be written
+to the core file and then read by a non-privileged user.
+
+Reported-by: sam <sunhaoyl@outlook.com>
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com
+Link: https://github.com/google/kmsan/issues/76
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/binfmt_elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index e7fd0b5b9234..975dd0dbc252 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1766,7 +1766,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
+ (!regset->active || regset->active(t->task, regset) > 0)) {
+ int ret;
+ size_t size = regset_size(t->task, regset);
+- void *data = kmalloc(size, GFP_KERNEL);
++ void *data = kzalloc(size, GFP_KERNEL);
+ if (unlikely(!data))
+ return 0;
+ ret = regset->get(t->task, regset,
+--
+2.25.1
+
--- /dev/null
+From 7974ffcbdd28b81fc13de53f771a3a0830438bce Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 29 Apr 2020 15:56:54 +0200
+Subject: gpio: exar: Fix bad handling for ida_simple_get error path
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit 333830aa149a87cabeb5d30fbcf12eecc8040d2c ]
+
+The commit 7ecced0934e5 ("gpio: exar: add a check for the return value
+of ida_simple_get fails") added a goto jump to the common error
+handler for ida_simple_get() error, but this is wrong in two ways:
+it doesn't set the proper return code and, more badly, it invokes
+ida_simple_remove() with a negative index that shall lead to a kernel
+panic via BUG_ON().
+
+This patch addresses those two issues.
+
+Fixes: 7ecced0934e5 ("gpio: exar: add a check for the return value of ida_simple_get fails")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpio-exar.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpio/gpio-exar.c b/drivers/gpio/gpio-exar.c
+index a09d2f9ebacc..695c19901eff 100644
+--- a/drivers/gpio/gpio-exar.c
++++ b/drivers/gpio/gpio-exar.c
+@@ -148,8 +148,10 @@ static int gpio_exar_probe(struct platform_device *pdev)
+ mutex_init(&exar_gpio->lock);
+
+ index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
+- if (index < 0)
+- goto err_destroy;
++ if (index < 0) {
++ ret = index;
++ goto err_mutex_destroy;
++ }
+
+ sprintf(exar_gpio->name, "exar_gpio%d", index);
+ exar_gpio->gpio_chip.label = exar_gpio->name;
+@@ -176,6 +178,7 @@ static int gpio_exar_probe(struct platform_device *pdev)
+
+ err_destroy:
+ ida_simple_remove(&ida_index, index);
++err_mutex_destroy:
+ mutex_destroy(&exar_gpio->lock);
+ return ret;
+ }
+--
+2.25.1
+
--- /dev/null
+From 3fb4b53b53003cfbd43e5b49da2c3d24f83c0a8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:47:05 +0300
+Subject: IB/ipoib: Fix double free of skb in case of multicast traffic in CM
+ mode
+
+From: Valentine Fatiev <valentinef@mellanox.com>
+
+[ Upstream commit 1acba6a817852d4aa7916d5c4f2c82f702ee9224 ]
+
+When connected mode is set, and we have connected and datagram traffic in
+parallel, ipoib might crash with double free of datagram skb.
+
+The current mechanism assumes that the order in the completion queue is
+the same as the order of sent packets for all QPs. Order is kept only for
+specific QP, in case of mixed UD and CM traffic we have few QPs (one UD and
+few CM's) in parallel.
+
+The problem:
+----------------------------------------------------------
+
+Transmit queue:
+-----------------
+UD skb pointer kept in queue itself, CM skb kept in spearate queue and
+uses transmit queue as a placeholder to count the number of total
+transmitted packets.
+
+0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127
+------------------------------------------------------------
+NL ud1 UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ...........
+------------------------------------------------------------
+ ^ ^
+ tail head
+
+Completion queue (problematic scenario) - the order not the same as in
+the transmit queue:
+
+ 1 2 3 4 5 6 7 8 9
+------------------------------------
+ ud1 CM1 UD2 ud3 cm2 cm3 ud4 cm4 ud5
+------------------------------------
+
+1. CM1 'wc' processing
+ - skb freed in cm separate ring.
+ - tx_tail of transmit queue increased although UD2 is not freed.
+ Now driver assumes UD2 index is already freed and it could be used for
+ new transmitted skb.
+
+0 1 2 3 4 5 6 7 8 9 10 11 12 13 .........127
+------------------------------------------------------------
+NL NL UD2 CM1 ud3 cm2 cm3 ud4 cm4 ud5 NL NL NL ...........
+------------------------------------------------------------
+ ^ ^ ^
+ (Bad)tail head
+(Bad - Could be used for new SKB)
+
+In this case (due to heavy load) UD2 skb pointer could be replaced by new
+transmitted packet UD_NEW, as the driver assumes its free. At this point
+we will have to process two 'wc' with same index but we have only one
+pointer to free.
+
+During second attempt to free the same skb we will have NULL pointer
+exception.
+
+2. UD2 'wc' processing
+ - skb freed according the index we got from 'wc', but it was already
+ overwritten by mistake. So actually the skb that was released is the
+ skb of the new transmitted packet and not the original one.
+
+3. UD_NEW 'wc' processing
+ - attempt to free already freed skb. NUll pointer exception.
+
+The fix:
+-----------------------------------------------------------------------
+
+The fix is to stop using the UD ring as a placeholder for CM packets, the
+cyclic ring variables tx_head and tx_tail will manage the UD tx_ring, a
+new cyclic variables global_tx_head and global_tx_tail are introduced for
+managing and counting the overall outstanding sent packets, then the send
+queue will be stopped and waken based on these variables only.
+
+Note that no locking is needed since global_tx_head is updated in the xmit
+flow and global_tx_tail is updated in the NAPI flow only. A previous
+attempt tried to use one variable to count the outstanding sent packets,
+but it did not work since xmit and NAPI flows can run at the same time and
+the counter will be updated wrongly. Thus, we use the same simple cyclic
+head and tail scheme that we have today for the UD tx_ring.
+
+Fixes: 2c104ea68350 ("IB/ipoib: Get rid of the tx_outstanding variable in all modes")
+Link: https://lore.kernel.org/r/20200527134705.480068-1-leon@kernel.org
+Signed-off-by: Valentine Fatiev <valentinef@mellanox.com>
+Signed-off-by: Alaa Hleihel <alaa@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Acked-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/ulp/ipoib/ipoib.h | 4 ++++
+ drivers/infiniband/ulp/ipoib/ipoib_cm.c | 15 +++++++++------
+ drivers/infiniband/ulp/ipoib/ipoib_ib.c | 9 +++++++--
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 10 ++++++----
+ 4 files changed, 26 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
+index b22d02c9de90..85267bbf4836 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -377,8 +377,12 @@ struct ipoib_dev_priv {
+ struct ipoib_rx_buf *rx_ring;
+
+ struct ipoib_tx_buf *tx_ring;
++ /* cyclic ring variables for managing tx_ring, for UD only */
+ unsigned int tx_head;
+ unsigned int tx_tail;
++ /* cyclic ring variables for counting overall outstanding send WRs */
++ unsigned int global_tx_head;
++ unsigned int global_tx_tail;
+ struct ib_sge tx_sge[MAX_SKB_FRAGS + 1];
+ struct ib_ud_wr tx_wr;
+ struct ib_wc send_wc[MAX_SEND_CQE];
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index aa9dcfc36cd3..196f1e6b5396 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -756,7 +756,8 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ return;
+ }
+
+- if ((priv->tx_head - priv->tx_tail) == ipoib_sendq_size - 1) {
++ if ((priv->global_tx_head - priv->global_tx_tail) ==
++ ipoib_sendq_size - 1) {
+ ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+ tx->qp->qp_num);
+ netif_stop_queue(dev);
+@@ -786,7 +787,7 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ } else {
+ netif_trans_update(dev);
+ ++tx->tx_head;
+- ++priv->tx_head;
++ ++priv->global_tx_head;
+ }
+ }
+
+@@ -820,10 +821,11 @@ void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
+ netif_tx_lock(dev);
+
+ ++tx->tx_tail;
+- ++priv->tx_tail;
++ ++priv->global_tx_tail;
+
+ if (unlikely(netif_queue_stopped(dev) &&
+- (priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1 &&
++ ((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)))
+ netif_wake_queue(dev);
+
+@@ -1233,8 +1235,9 @@ timeout:
+ dev_kfree_skb_any(tx_req->skb);
+ netif_tx_lock_bh(p->dev);
+ ++p->tx_tail;
+- ++priv->tx_tail;
+- if (unlikely(priv->tx_head - priv->tx_tail == ipoib_sendq_size >> 1) &&
++ ++priv->global_tx_tail;
++ if (unlikely((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ netif_queue_stopped(p->dev) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags))
+ netif_wake_queue(p->dev);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index 9006a13af1de..0f2e80f54d33 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -406,9 +406,11 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
+ dev_kfree_skb_any(tx_req->skb);
+
+ ++priv->tx_tail;
++ ++priv->global_tx_tail;
+
+ if (unlikely(netif_queue_stopped(dev) &&
+- ((priv->tx_head - priv->tx_tail) <= ipoib_sendq_size >> 1) &&
++ ((priv->global_tx_head - priv->global_tx_tail) <=
++ ipoib_sendq_size >> 1) &&
+ test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags)))
+ netif_wake_queue(dev);
+
+@@ -633,7 +635,8 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+ else
+ priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM;
+ /* increase the tx_head after send success, but use it for queue state */
+- if (priv->tx_head - priv->tx_tail == ipoib_sendq_size - 1) {
++ if ((priv->global_tx_head - priv->global_tx_tail) ==
++ ipoib_sendq_size - 1) {
+ ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n");
+ netif_stop_queue(dev);
+ }
+@@ -661,6 +664,7 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb,
+
+ rc = priv->tx_head;
+ ++priv->tx_head;
++ ++priv->global_tx_head;
+ }
+ return rc;
+ }
+@@ -807,6 +811,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
+ ipoib_dma_unmap_tx(priv, tx_req);
+ dev_kfree_skb_any(tx_req->skb);
+ ++priv->tx_tail;
++ ++priv->global_tx_tail;
+ }
+
+ for (i = 0; i < ipoib_recvq_size; ++i) {
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index d8cb5bbe6eb5..6093e8268583 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1188,9 +1188,11 @@ static void ipoib_timeout(struct net_device *dev)
+
+ ipoib_warn(priv, "transmit timeout: latency %d msecs\n",
+ jiffies_to_msecs(jiffies - dev_trans_start(dev)));
+- ipoib_warn(priv, "queue stopped %d, tx_head %u, tx_tail %u\n",
+- netif_queue_stopped(dev),
+- priv->tx_head, priv->tx_tail);
++ ipoib_warn(priv,
++ "queue stopped %d, tx_head %u, tx_tail %u, global_tx_head %u, global_tx_tail %u\n",
++ netif_queue_stopped(dev), priv->tx_head, priv->tx_tail,
++ priv->global_tx_head, priv->global_tx_tail);
++
+ /* XXX reset QP, etc. */
+ }
+
+@@ -1705,7 +1707,7 @@ static int ipoib_dev_init_default(struct net_device *dev)
+ goto out_rx_ring_cleanup;
+ }
+
+- /* priv->tx_head, tx_tail & tx_outstanding are already 0 */
++ /* priv->tx_head, tx_tail and global_tx_tail/head are already 0 */
+
+ if (ipoib_transport_dev_init(dev, priv->ca)) {
+ pr_warn("%s: ipoib_transport_dev_init failed\n",
+--
+2.25.1
+
--- /dev/null
+From 82988841769c0228f9a78f7d965b8b9c2fb2aa4d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 May 2020 23:13:28 -0400
+Subject: IB/qib: Call kobject_put() when kobject_init_and_add() fails
+
+From: Kaike Wan <kaike.wan@intel.com>
+
+[ Upstream commit a35cd6447effd5c239b564c80fa109d05ff3d114 ]
+
+When kobject_init_and_add() returns an error in the function
+qib_create_port_files(), the function kobject_put() is not called for the
+corresponding kobject, which potentially leads to memory leak.
+
+This patch fixes the issue by calling kobject_put() even if
+kobject_init_and_add() fails. In addition, the ppd->diagc_kobj is released
+along with other kobjects when the sysfs is unregistered.
+
+Fixes: f931551bafe1 ("IB/qib: Add new qib driver for QLogic PCIe InfiniBand adapters")
+Link: https://lore.kernel.org/r/20200512031328.189865.48627.stgit@awfm-01.aw.intel.com
+Cc: <stable@vger.kernel.org>
+Suggested-by: Lin Yi <teroincn@gmail.com>
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/qib/qib_sysfs.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index d831f3e61ae8..2626205780ee 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -756,7 +756,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping linkcontrol sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail;
++ goto bail_link;
+ }
+ kobject_uevent(&ppd->pport_kobj, KOBJ_ADD);
+
+@@ -766,7 +766,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping sl2vl sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_link;
++ goto bail_sl;
+ }
+ kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD);
+
+@@ -776,7 +776,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping diag_counters sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_sl;
++ goto bail_diagc;
+ }
+ kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD);
+
+@@ -789,7 +789,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
+ qib_dev_err(dd,
+ "Skipping Congestion Control sysfs info, (err %d) port %u\n",
+ ret, port_num);
+- goto bail_diagc;
++ goto bail_cc;
+ }
+
+ kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD);
+@@ -871,6 +871,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd)
+ &cc_table_bin_attr);
+ kobject_put(&ppd->pport_cc_kobj);
+ }
++ kobject_put(&ppd->diagc_kobj);
+ kobject_put(&ppd->sl2vl_kobj);
+ kobject_put(&ppd->pport_kobj);
+ }
+--
+2.25.1
+
--- /dev/null
+From d331da392d8acbafc3ba8b3795bd945353e18769 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:55 -0700
+Subject: include/asm-generic/topology.h: guard cpumask_of_node() macro
+ argument
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 4377748c7b5187c3342a60fa2ceb60c8a57a8488 ]
+
+drivers/hwmon/amd_energy.c:195:15: error: invalid operands to binary expression ('void' and 'int')
+ (channel - data->nr_cpus));
+ ~~~~~~~~~^~~~~~~~~~~~~~~~~
+include/asm-generic/topology.h:51:42: note: expanded from macro 'cpumask_of_node'
+ #define cpumask_of_node(node) ((void)node, cpu_online_mask)
+ ^~~~
+include/linux/cpumask.h:618:72: note: expanded from macro 'cpumask_first_and'
+ #define cpumask_first_and(src1p, src2p) cpumask_next_and(-1, (src1p), (src2p))
+ ^~~~~
+
+Fixes: f0b848ce6fe9 ("cpumask: Introduce cpumask_of_{node,pcibus} to replace {node,pcibus}_to_cpumask")
+Fixes: 8abee9566b7e ("hwmon: Add amd_energy driver to report energy counters")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Guenter Roeck <linux@roeck-us.net>
+Link: http://lkml.kernel.org/r/20200527134623.930247-1-arnd@arndb.de
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/topology.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h
+index 238873739550..5aa8705df87e 100644
+--- a/include/asm-generic/topology.h
++++ b/include/asm-generic/topology.h
+@@ -48,7 +48,7 @@
+ #ifdef CONFIG_NEED_MULTIPLE_NODES
+ #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask)
+ #else
+- #define cpumask_of_node(node) ((void)node, cpu_online_mask)
++ #define cpumask_of_node(node) ((void)(node), cpu_online_mask)
+ #endif
+ #endif
+ #ifndef pcibus_to_node
+--
+2.25.1
+
--- /dev/null
+From 2862caab8a3badd4bb62a8573566b1594ac7a3c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 13:58:42 -0700
+Subject: Input: dlink-dir685-touchkeys - fix a typo in driver name
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 38347374ae3f1ec4df56dd688bd603a64e79a0ed ]
+
+According to the file name and Kconfig, a 'k' is missing in this driver
+name. It should be "dlink-dir685-touchkeys".
+
+Fixes: 131b3de7016b ("Input: add D-Link DIR-685 touchkeys driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20200412213937.5287-1-christophe.jaillet@wanadoo.fr
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/keyboard/dlink-dir685-touchkeys.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/dlink-dir685-touchkeys.c b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+index 88e321b76397..6fe4062e3ac2 100644
+--- a/drivers/input/keyboard/dlink-dir685-touchkeys.c
++++ b/drivers/input/keyboard/dlink-dir685-touchkeys.c
+@@ -142,7 +142,7 @@ MODULE_DEVICE_TABLE(of, dir685_tk_of_match);
+
+ static struct i2c_driver dir685_tk_i2c_driver = {
+ .driver = {
+- .name = "dlin-dir685-touchkeys",
++ .name = "dlink-dir685-touchkeys",
+ .of_match_table = of_match_ptr(dir685_tk_of_match),
+ },
+ .probe = dir685_tk_probe,
+--
+2.25.1
+
--- /dev/null
+From c07a61377e8d3beaf81ba3ee26d18d1a06905e8e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 13:45:12 -0700
+Subject: Input: evdev - call input_flush_device() on release(), not flush()
+
+From: Brendan Shanks <bshanks@codeweavers.com>
+
+[ Upstream commit 09264098ff153f60866039d60b31d39b66f55a31 ]
+
+input_flush_device() should only be called once the struct file is being
+released and no open descriptors remain, but evdev_flush() was calling
+it whenever a file descriptor was closed.
+
+This caused uploaded force-feedback effects to be erased when a process
+did a dup()/close() on the event FD, called system(), etc.
+
+Call input_flush_device() from evdev_release() instead.
+
+Reported-by: Mathieu Maret <mathieu.maret@gmail.com>
+Signed-off-by: Brendan Shanks <bshanks@codeweavers.com>
+Link: https://lore.kernel.org/r/20200421231003.7935-1-bshanks@codeweavers.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/evdev.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
+index 4263e905cafb..3362dcb3ec0e 100644
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -348,20 +348,6 @@ static int evdev_fasync(int fd, struct file *file, int on)
+ return fasync_helper(fd, file, on, &client->fasync);
+ }
+
+-static int evdev_flush(struct file *file, fl_owner_t id)
+-{
+- struct evdev_client *client = file->private_data;
+- struct evdev *evdev = client->evdev;
+-
+- mutex_lock(&evdev->mutex);
+-
+- if (evdev->exist && !client->revoked)
+- input_flush_device(&evdev->handle, file);
+-
+- mutex_unlock(&evdev->mutex);
+- return 0;
+-}
+-
+ static void evdev_free(struct device *dev)
+ {
+ struct evdev *evdev = container_of(dev, struct evdev, dev);
+@@ -475,6 +461,10 @@ static int evdev_release(struct inode *inode, struct file *file)
+ unsigned int i;
+
+ mutex_lock(&evdev->mutex);
++
++ if (evdev->exist && !client->revoked)
++ input_flush_device(&evdev->handle, file);
++
+ evdev_ungrab(evdev, client);
+ mutex_unlock(&evdev->mutex);
+
+@@ -1336,7 +1326,6 @@ static const struct file_operations evdev_fops = {
+ .compat_ioctl = evdev_ioctl_compat,
+ #endif
+ .fasync = evdev_fasync,
+- .flush = evdev_flush,
+ .llseek = no_llseek,
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 775e655beff957b41051db31179def211cac7523 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Apr 2020 10:02:19 -0700
+Subject: Input: i8042 - add ThinkPad S230u to i8042 nomux list
+
+From: Kevin Locke <kevin@kevinlocke.name>
+
+[ Upstream commit 18931506465a762ffd3f4803d36a18d336a67da9 ]
+
+On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version
+"GDETC1WW (1.81 ) 06/27/2019", whether booted in UEFI or Legacy/CSM mode
+the keyboard, Synaptics TouchPad, and TrackPoint either do not function
+or stop functioning a few minutes after boot. This problem has been
+noted before, perhaps only occurring on BIOS 1.57 and
+later.[1][2][3][4][5]
+
+This model does not have an external PS/2 port, so mux does not appear
+to be useful.
+
+Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago
+and although the [BIOS changelog] notes "Fixed an issue of UEFI
+touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be
+insufficient.
+
+Adding 33474HU to the nomux list avoids the issue on my system.
+
+[1]: https://bugs.launchpad.net/bugs/1210748
+[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425
+[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200
+[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115
+[5]: https://forums.lenovo.com/topic/findpost/27/1337119
+[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt
+
+Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/feb8a8339a67025dab3850e6377eb6f3a0e782ba.1587400635.git.kevin@kevinlocke.name
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 0d0f977a2f39..8bf38eded1ef 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -545,6 +545,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5738"),
+ },
+ },
++ {
++ /* Lenovo ThinkPad Twist S230u */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ },
++ },
+ { }
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 09cfa40b245d95defa8b0f811e2b917e701f1f11 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 18:07:20 -0700
+Subject: Input: i8042 - add ThinkPad S230u to i8042 reset list
+
+From: Kevin Locke <kevin@kevinlocke.name>
+
+[ Upstream commit 2712c91a54a1058d55c284152b4d93c979b67be6 ]
+
+On the Lenovo ThinkPad Twist S230u (3347-4HU) with BIOS version
+"GDETC1WW (1.81 ) 06/27/2019", the keyboard, Synaptics TouchPad, and
+TrackPoint either do not function or stop functioning a few minutes
+after boot. This problem has been noted before, perhaps only occurring
+with BIOS 1.57 and later.[1][2][3][4][5]
+
+Odds of a BIOS fix appear to be low: 1.57 was released over 6 years ago
+and although the [BIOS changelog] notes "Fixed an issue of UEFI
+touchpad/trackpoint/keyboard/touchscreen" in 1.58, it appears to be
+insufficient.
+
+Setting i8042.reset=1 or adding 33474HU to the reset list avoids the
+issue on my system from either warm or cold boot.
+
+[1]: https://bugs.launchpad.net/bugs/1210748
+[2]: https://bbs.archlinux.org/viewtopic.php?pid=1360425
+[3]: https://forums.linuxmint.com/viewtopic.php?f=46&t=41200
+[4]: https://forums.linuxmint.com/viewtopic.php?f=49&t=157115
+[5]: https://forums.lenovo.com/topic/findpost/27/1337119
+[BIOS changelog]: https://download.lenovo.com/pccbbs/mobiles/gduj33uc.txt
+
+Signed-off-by: Kevin Locke <kevin@kevinlocke.name>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/94f384b0f75f90f71425d7dce7ac82c59ddb87a8.1587702636.git.kevin@kevinlocke.name
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 8bf38eded1ef..ad357f79c7d6 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -673,6 +673,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+ },
+ },
++ {
++ /* Lenovo ThinkPad Twist S230u */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
++ },
++ },
+ { }
+ };
+
+--
+2.25.1
+
--- /dev/null
+From e13a45307c7cd56bd30b8ed0857170c74be149e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Apr 2020 16:09:53 -0700
+Subject: Input: synaptics-rmi4 - fix error return code in rmi_driver_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit 5caab2da63207d6d631007f592f5219459e3454d ]
+
+Fix to return a negative error code from the input_register_device()
+error handling case instead of 0, as done elsewhere in this function.
+
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Link: https://lore.kernel.org/r/20200428134948.78343-1-weiyongjun1@huawei.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 24a1ff34964c..ac6a20f7afdf 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -1213,7 +1213,8 @@ static int rmi_driver_probe(struct device *dev)
+ if (data->input) {
+ rmi_driver_set_input_name(rmi_dev, data->input);
+ if (!rmi_dev->xport->input) {
+- if (input_register_device(data->input)) {
++ retval = input_register_device(data->input);
++ if (retval) {
+ dev_err(dev, "%s: Failed to register input device.\n",
+ __func__);
+ goto err_destroy_functions;
+--
+2.25.1
+
--- /dev/null
+From 43dc02dc0d140d308e694016a2dc5de317700534 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 27 Apr 2020 18:08:58 -0700
+Subject: Input: synaptics-rmi4 - really fix attn_data use-after-free
+
+From: Evan Green <evgreen@chromium.org>
+
+[ Upstream commit d5a5e5b5fa7b86c05bf073acc0ba98fa280174ec ]
+
+Fix a use-after-free noticed by running with KASAN enabled. If
+rmi_irq_fn() is run twice in a row, then rmi_f11_attention() (among
+others) will end up reading from drvdata->attn_data.data, which was
+freed and left dangling in rmi_irq_fn().
+
+Commit 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by
+KASAN") correctly identified and analyzed this bug. However the attempted
+fix only NULLed out a local variable, missing the fact that
+drvdata->attn_data is a struct, not a pointer.
+
+NULL out the correct pointer in the driver data to prevent the attention
+functions from copying from it.
+
+Fixes: 55edde9fff1a ("Input: synaptics-rmi4 - prevent UAF reported by KASAN")
+Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data")
+Signed-off-by: Evan Green <evgreen@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200427145537.1.Ic8f898e0147beeee2c005ee7b20f1aebdef1e7eb@changeid
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/rmi4/rmi_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
+index 162526a0d463..24a1ff34964c 100644
+--- a/drivers/input/rmi4/rmi_driver.c
++++ b/drivers/input/rmi4/rmi_driver.c
+@@ -208,7 +208,7 @@ static irqreturn_t rmi_irq_fn(int irq, void *dev_id)
+
+ if (count) {
+ kfree(attn_data.data);
+- attn_data.data = NULL;
++ drvdata->attn_data.data = NULL;
+ }
+
+ if (!kfifo_is_empty(&drvdata->attn_fifo))
+--
+2.25.1
+
--- /dev/null
+From 6f2b998a61b5d9400184c0e8b36d468153acc818 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 18 Apr 2020 21:17:12 -0700
+Subject: Input: usbtouchscreen - add support for BonXeon TP
+
+From: James Hilliard <james.hilliard1@gmail.com>
+
+[ Upstream commit e3b4f94ef52ae1592cbe199bd38dbdc0d58b2217 ]
+
+Based on available information this uses the singletouch irtouch
+protocol. This is tested and confirmed to be fully functional on
+the BonXeon TP hardware I have.
+
+Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
+Link: https://lore.kernel.org/r/20200413184217.55700-1-james.hilliard1@gmail.com
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/touchscreen/usbtouchscreen.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index 48304e26f988..d939c1798518 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -195,6 +195,7 @@ static const struct usb_device_id usbtouch_devices[] = {
+ #endif
+
+ #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH
++ {USB_DEVICE(0x255e, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
+ {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES},
+--
+2.25.1
+
--- /dev/null
+From 4fa246bb05ff50ad613ca5754083493bcbed7d1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Apr 2020 14:13:09 -0700
+Subject: Input: xpad - add custom init packet for Xbox One S controllers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Łukasz Patron <priv.luk@gmail.com>
+
+[ Upstream commit 764f7f911bf72450c51eb74cbb262ad9933741d8 ]
+
+Sending [ 0x05, 0x20, 0x00, 0x0f, 0x06 ] packet for Xbox One S controllers
+fixes an issue where controller is stuck in Bluetooth mode and not sending
+any inputs.
+
+Signed-off-by: Łukasz Patron <priv.luk@gmail.com>
+Reviewed-by: Cameron Gutman <aicommander@gmail.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20200422075206.18229-1-priv.luk@gmail.com
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/joystick/xpad.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index aa4e431cbcd3..9adc72d65c63 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -472,6 +472,16 @@ static const u8 xboxone_fw2015_init[] = {
+ 0x05, 0x20, 0x00, 0x01, 0x00
+ };
+
++/*
++ * This packet is required for Xbox One S (0x045e:0x02ea)
++ * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to
++ * initialize the controller that was previously used in
++ * Bluetooth mode.
++ */
++static const u8 xboxone_s_init[] = {
++ 0x05, 0x20, 0x00, 0x0f, 0x06
++};
++
+ /*
+ * This packet is required for the Titanfall 2 Xbox One pads
+ * (0x0e6f:0x0165) to finish initialization and for Hori pads
+@@ -530,6 +540,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
+ XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
+ XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
++ XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init),
++ XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
+ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
+ XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+--
+2.25.1
+
--- /dev/null
+From baf24e7e9af017ee500007aa7226a6fc5510c1a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 16:00:19 -0500
+Subject: iommu: Fix reference count leak in iommu_group_alloc.
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit 7cc31613734c4870ae32f5265d576ef296621343 ]
+
+kobject_init_and_add() takes reference even when it fails.
+Thus, when kobject_init_and_add() returns an error,
+kobject_put() must be called to properly clean up the kobject.
+
+Fixes: d72e31c93746 ("iommu: IOMMU Groups")
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Link: https://lore.kernel.org/r/20200527210020.6522-1-wu000273@umn.edu
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 00e1c908cd8e..85ef6c9bc898 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -392,7 +392,7 @@ struct iommu_group *iommu_group_alloc(void)
+ NULL, "%d", group->id);
+ if (ret) {
+ ida_simple_remove(&iommu_group_ida, group->id);
+- kfree(group);
++ kobject_put(&group->kobj);
+ return ERR_PTR(ret);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From a18cf1f4292f38562f6b5b09a14a6097b777cfa8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 May 2020 16:03:09 +0800
+Subject: libceph: ignore pool overlay and cache logic on redirects
+
+From: Jerry Lee <leisurelysw24@gmail.com>
+
+[ Upstream commit 890bd0f8997ae6ac0a367dd5146154a3963306dd ]
+
+OSD client should ignore cache/overlay flag if got redirect reply.
+Otherwise, the client hangs when the cache tier is in forward mode.
+
+[ idryomov: Redirects are effectively deprecated and no longer
+ used or tested. The original tiering modes based on redirects
+ are inherently flawed because redirects can race and reorder,
+ potentially resulting in data corruption. The new proxy and
+ readproxy tiering modes should be used instead of forward and
+ readforward. Still marking for stable as obviously correct,
+ though. ]
+
+Cc: stable@vger.kernel.org
+URL: https://tracker.ceph.com/issues/23296
+URL: https://tracker.ceph.com/issues/36406
+Signed-off-by: Jerry Lee <leisurelysw24@gmail.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ceph/osd_client.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 76c41a84550e..b8c4aea42917 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -3540,7 +3540,9 @@ static void handle_reply(struct ceph_osd *osd, struct ceph_msg *msg)
+ * supported.
+ */
+ req->r_t.target_oloc.pool = m.redirect.oloc.pool;
+- req->r_flags |= CEPH_OSD_FLAG_REDIRECTED;
++ req->r_flags |= CEPH_OSD_FLAG_REDIRECTED |
++ CEPH_OSD_FLAG_IGNORE_OVERLAY |
++ CEPH_OSD_FLAG_IGNORE_CACHE;
+ req->r_tid = 0;
+ __submit_request(req, false);
+ goto out_unlock_osdc;
+--
+2.25.1
+
--- /dev/null
+From ac6d29d7d8fa2ee620e9e7604c840f6e6c593cf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 22:20:47 -0700
+Subject: mm: remove VM_BUG_ON(PageSlab()) from page_mapcount()
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 6988f31d558aa8c744464a7f6d91d34ada48ad12 ]
+
+Replace superfluous VM_BUG_ON() with comment about correct usage.
+
+Technically reverts commit 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to
+page_mapcount()"), but context lines have changed.
+
+Function isolate_migratepages_block() runs some checks out of lru_lock
+when choose pages for migration. After checking PageLRU() it checks
+extra page references by comparing page_count() and page_mapcount().
+Between these two checks page could be removed from lru, freed and taken
+by slab.
+
+As a result this race triggers VM_BUG_ON(PageSlab()) in page_mapcount().
+Race window is tiny. For certain workload this happens around once a
+year.
+
+ page:ffffea0105ca9380 count:1 mapcount:0 mapping:ffff88ff7712c180 index:0x0 compound_mapcount: 0
+ flags: 0x500000000008100(slab|head)
+ raw: 0500000000008100 dead000000000100 dead000000000200 ffff88ff7712c180
+ raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
+ page dumped because: VM_BUG_ON_PAGE(PageSlab(page))
+ ------------[ cut here ]------------
+ kernel BUG at ./include/linux/mm.h:628!
+ invalid opcode: 0000 [#1] SMP NOPTI
+ CPU: 77 PID: 504 Comm: kcompactd1 Tainted: G W 4.19.109-27 #1
+ Hardware name: Yandex T175-N41-Y3N/MY81-EX0-Y3N, BIOS R05 06/20/2019
+ RIP: 0010:isolate_migratepages_block+0x986/0x9b0
+
+The code in isolate_migratepages_block() was added in commit
+119d6d59dcc0 ("mm, compaction: avoid isolating pinned pages") before
+adding VM_BUG_ON into page_mapcount().
+
+This race has been predicted in 2015 by Vlastimil Babka (see link
+below).
+
+[akpm@linux-foundation.org: comment tweaks, per Hugh]
+Fixes: 1d148e218a0d ("mm: add VM_BUG_ON_PAGE() to page_mapcount()")
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Acked-by: Hugh Dickins <hughd@google.com>
+Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
+Acked-by: Vlastimil Babka <vbabka@suse.cz>
+Cc: David Rientjes <rientjes@google.com>
+Cc: <stable@vger.kernel.org>
+Link: http://lkml.kernel.org/r/159032779896.957378.7852761411265662220.stgit@buzz
+Link: https://lore.kernel.org/lkml/557710E1.6060103@suse.cz/
+Link: https://lore.kernel.org/linux-mm/158937872515.474360.5066096871639561424.stgit@buzz/T/ (v1)
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mm.h | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 45f10f5896b7..b1092046ebef 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -602,6 +602,11 @@ static inline void *kvcalloc(size_t n, size_t size, gfp_t flags)
+
+ extern void kvfree(const void *addr);
+
++/*
++ * Mapcount of compound page as a whole, does not include mapped sub-pages.
++ *
++ * Must be called only for compound pages or any their tail sub-pages.
++ */
+ static inline int compound_mapcount(struct page *page)
+ {
+ VM_BUG_ON_PAGE(!PageCompound(page), page);
+@@ -621,10 +626,16 @@ static inline void page_mapcount_reset(struct page *page)
+
+ int __page_mapcount(struct page *page);
+
++/*
++ * Mapcount of 0-order page; when compound sub-page, includes
++ * compound_mapcount().
++ *
++ * Result is undefined for pages which cannot be mapped into userspace.
++ * For example SLAB or special types of pages. See function page_has_type().
++ * They use this place in struct page differently.
++ */
+ static inline int page_mapcount(struct page *page)
+ {
+- VM_BUG_ON_PAGE(PageSlab(page), page);
+-
+ if (unlikely(PageCompound(page)))
+ return __page_mapcount(page);
+ return atomic_read(&page->_mapcount) + 1;
+--
+2.25.1
+
--- /dev/null
+From 69f88171caf368b7b3311895f582ae649b6e50f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 09:29:25 +0000
+Subject: mmc: block: Fix use-after-free issue for rpmb
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Peng Hao <richard.peng@oppo.com>
+
+[ Upstream commit 202500d21654874aa03243e91f96de153ec61860 ]
+
+The data structure member “rpmb->md” was passed to a call of the function
+“mmc_blk_put” after a call of the function “put_device”. Reorder these
+function calls to keep the data accesses consistent.
+
+Fixes: 1c87f7357849 ("mmc: block: Fix bug when removing RPMB chardev ")
+Signed-off-by: Peng Hao <richard.peng@oppo.com>
+Cc: stable@vger.kernel.org
+[Uffe: Fixed up mangled patch and updated commit message]
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/block.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
+index 23bcdbba0cab..c723a1e54b18 100644
+--- a/drivers/mmc/core/block.c
++++ b/drivers/mmc/core/block.c
+@@ -2485,8 +2485,8 @@ static int mmc_rpmb_chrdev_release(struct inode *inode, struct file *filp)
+ struct mmc_rpmb_data *rpmb = container_of(inode->i_cdev,
+ struct mmc_rpmb_data, chrdev);
+
+- put_device(&rpmb->dev);
+ mmc_blk_put(rpmb->md);
++ put_device(&rpmb->dev);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 8b865cd05874ad7d9233a6e331c45f072d7ee676 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 22:04:57 -0500
+Subject: RDMA/pvrdma: Fix missing pci disable in pvrdma_pci_probe()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Qiushi Wu <wu000273@umn.edu>
+
+[ Upstream commit db857e6ae548f0f4f4a0f63fffeeedf3cca21f9d ]
+
+In function pvrdma_pci_probe(), pdev was not disabled in one error
+path. Thus replace the jump target “err_free_device” by
+"err_disable_pdev".
+
+Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
+Link: https://lore.kernel.org/r/20200523030457.16160-1-wu000273@umn.edu
+Signed-off-by: Qiushi Wu <wu000273@umn.edu>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+index ed99f0a08dc4..0a414c5329ce 100644
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -833,7 +833,7 @@ static int pvrdma_pci_probe(struct pci_dev *pdev,
+ !(pci_resource_flags(pdev, 1) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "PCI BAR region not MMIO\n");
+ ret = -ENOMEM;
+- goto err_free_device;
++ goto err_disable_pdev;
+ }
+
+ ret = pci_request_regions(pdev, DRV_NAME);
+--
+2.25.1
+
riscv-stacktrace-fix-undefined-reference-to-walk_sta.patch
cifs-fix-null-pointer-check-in-cifs_read.patch
samples-bpf-fix-build-error.patch
+input-usbtouchscreen-add-support-for-bonxeon-tp.patch
+input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch
+input-evdev-call-input_flush_device-on-release-not-f.patch
+input-xpad-add-custom-init-packet-for-xbox-one-s-con.patch
+input-dlink-dir685-touchkeys-fix-a-typo-in-driver-na.patch
+input-i8042-add-thinkpad-s230u-to-i8042-reset-list.patch
+input-synaptics-rmi4-really-fix-attn_data-use-after-.patch
+input-synaptics-rmi4-fix-error-return-code-in-rmi_dr.patch
+arm-8970-1-decompressor-increase-tag-size.patch
+arm-8843-1-use-unified-assembler-in-headers.patch
+arm-uaccess-consolidate-uaccess-asm-to-asm-uaccess-a.patch
+arm-uaccess-integrate-uaccess_save-and-uaccess_resto.patch
+arm-uaccess-fix-dacr-mismatch-with-nested-exceptions.patch
+gpio-exar-fix-bad-handling-for-ida_simple_get-error-.patch
+ib-qib-call-kobject_put-when-kobject_init_and_add-fa.patch
+arm-dts-imx6q-bx50v3-set-display-interface-clock-par.patch
+arm-dts-bcm2835-rpi-zero-w-fix-led-polarity.patch
+arm-dts-bcm-hr2-fix-ppi-interrupt-types.patch
+mmc-block-fix-use-after-free-issue-for-rpmb.patch
+rdma-pvrdma-fix-missing-pci-disable-in-pvrdma_pci_pr.patch
+alsa-hwdep-fix-a-left-shifting-1-by-31-ub-bug.patch
+alsa-hda-realtek-add-a-model-for-thinkpad-t570-witho.patch
+alsa-usb-audio-mixer-volume-quirk-for-ess-technology.patch
+exec-always-set-cap_ambient-in-cap_bprm_set_creds.patch
+alsa-usb-audio-quirks-for-gigabyte-trx40-aorus-maste.patch
+alsa-hda-realtek-add-new-codec-supported-for-alc287.patch
+libceph-ignore-pool-overlay-and-cache-logic-on-redir.patch
+ib-ipoib-fix-double-free-of-skb-in-case-of-multicast.patch
+mm-remove-vm_bug_on-pageslab-from-page_mapcount.patch
+fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch
+include-asm-generic-topology.h-guard-cpumask_of_node.patch
+iommu-fix-reference-count-leak-in-iommu_group_alloc.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
