--- /dev/null
+From ec73d03b2c40be59c0902ecd641669a671ccc537 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 17:34:32 +0300
+Subject: ACPI: platform: Unregister stale platform devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit cb0701acfa7e3fe9e919cf2aa2aa939b7fd603c2 ]
+
+When commit 68bdb6773289 ("ACPI: add support for ACPI reconfiguration
+notifiers") introduced reconfiguration notifiers, it missed the point
+that the ACPI table, which might be loaded and then unloaded via
+ConfigFS, could contain devices that were not enumerated by their
+parents.
+
+In such cases, the stale platform device is dangling in the system
+while the rest of the devices from the same table are already gone.
+
+Introduce acpi_platform_device_remove_notify() notifier that, in
+similar way to I²C or SPI buses, unregisters the platform devices
+on table removal event.
+
+Fixes: 68bdb6773289 ("ACPI: add support for ACPI reconfiguration notifiers")
+Depends-on: 00500147cbd3 ("drivers: Introduce device lookup variants by ACPI_COMPANION device")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+[ rjw: Changelog & function rename ]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/acpi_platform.c | 43 ++++++++++++++++++++++++++++++++++++
+ drivers/acpi/scan.c | 1 +
+ 2 files changed, 44 insertions(+)
+
+diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c
+index 00ec4f2bf0157..c05050f474cd3 100644
+--- a/drivers/acpi/acpi_platform.c
++++ b/drivers/acpi/acpi_platform.c
+@@ -31,6 +31,44 @@ static const struct acpi_device_id forbidden_id_list[] = {
+ {"", 0},
+ };
+
++static struct platform_device *acpi_platform_device_find_by_companion(struct acpi_device *adev)
++{
++ struct device *dev;
++
++ dev = bus_find_device_by_acpi_dev(&platform_bus_type, adev);
++ return dev ? to_platform_device(dev) : NULL;
++}
++
++static int acpi_platform_device_remove_notify(struct notifier_block *nb,
++ unsigned long value, void *arg)
++{
++ struct acpi_device *adev = arg;
++ struct platform_device *pdev;
++
++ switch (value) {
++ case ACPI_RECONFIG_DEVICE_ADD:
++ /* Nothing to do here */
++ break;
++ case ACPI_RECONFIG_DEVICE_REMOVE:
++ if (!acpi_device_enumerated(adev))
++ break;
++
++ pdev = acpi_platform_device_find_by_companion(adev);
++ if (!pdev)
++ break;
++
++ platform_device_unregister(pdev);
++ put_device(&pdev->dev);
++ break;
++ }
++
++ return NOTIFY_OK;
++}
++
++static struct notifier_block acpi_platform_notifier = {
++ .notifier_call = acpi_platform_device_remove_notify,
++};
++
+ static void acpi_platform_fill_resource(struct acpi_device *adev,
+ const struct resource *src, struct resource *dest)
+ {
+@@ -130,3 +168,8 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev,
+ return pdev;
+ }
+ EXPORT_SYMBOL_GPL(acpi_create_platform_device);
++
++void __init acpi_platform_init(void)
++{
++ acpi_reconfig_notifier_register(&acpi_platform_notifier);
++}
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index aad6be5c0af0a..915650bf519f8 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -2174,6 +2174,7 @@ int __init acpi_scan_init(void)
+ acpi_pci_root_init();
+ acpi_pci_link_init();
+ acpi_processor_init();
++ acpi_platform_init();
+ acpi_lpss_init();
+ acpi_apd_init();
+ acpi_cmos_rtc_init();
+--
+2.20.1
+
--- /dev/null
+From 41fadd5ebf1a3bdb7aabca63bd5d937d0ea34bb8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 09:12:18 +0000
+Subject: afs: Remove set but not used variables 'before', 'after'
+
+From: zhengbin <zhengbin13@huawei.com>
+
+[ Upstream commit 51590df4f3306cb1f43dca54e3ccdd121ab89594 ]
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+fs/afs/dir_edit.c: In function afs_set_contig_bits:
+fs/afs/dir_edit.c:75:20: warning: variable after set but not used [-Wunused-but-set-variable]
+fs/afs/dir_edit.c: In function afs_set_contig_bits:
+fs/afs/dir_edit.c:75:12: warning: variable before set but not used [-Wunused-but-set-variable]
+fs/afs/dir_edit.c: In function afs_clear_contig_bits:
+fs/afs/dir_edit.c:100:20: warning: variable after set but not used [-Wunused-but-set-variable]
+fs/afs/dir_edit.c: In function afs_clear_contig_bits:
+fs/afs/dir_edit.c:100:12: warning: variable before set but not used [-Wunused-but-set-variable]
+
+They are never used since commit 63a4681ff39c.
+
+Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/afs/dir_edit.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c
+index d4fbe5f85f1b2..b108528bf010d 100644
+--- a/fs/afs/dir_edit.c
++++ b/fs/afs/dir_edit.c
+@@ -68,13 +68,11 @@ static int afs_find_contig_bits(union afs_xdr_dir_block *block, unsigned int nr_
+ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ int bit, unsigned int nr_slots)
+ {
+- u64 mask, before, after;
++ u64 mask;
+
+ mask = (1 << nr_slots) - 1;
+ mask <<= bit;
+
+- before = *(u64 *)block->hdr.bitmap;
+-
+ block->hdr.bitmap[0] |= (u8)(mask >> 0 * 8);
+ block->hdr.bitmap[1] |= (u8)(mask >> 1 * 8);
+ block->hdr.bitmap[2] |= (u8)(mask >> 2 * 8);
+@@ -83,8 +81,6 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ block->hdr.bitmap[5] |= (u8)(mask >> 5 * 8);
+ block->hdr.bitmap[6] |= (u8)(mask >> 6 * 8);
+ block->hdr.bitmap[7] |= (u8)(mask >> 7 * 8);
+-
+- after = *(u64 *)block->hdr.bitmap;
+ }
+
+ /*
+@@ -93,13 +89,11 @@ static void afs_set_contig_bits(union afs_xdr_dir_block *block,
+ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
+ int bit, unsigned int nr_slots)
+ {
+- u64 mask, before, after;
++ u64 mask;
+
+ mask = (1 << nr_slots) - 1;
+ mask <<= bit;
+
+- before = *(u64 *)block->hdr.bitmap;
+-
+ block->hdr.bitmap[0] &= ~(u8)(mask >> 0 * 8);
+ block->hdr.bitmap[1] &= ~(u8)(mask >> 1 * 8);
+ block->hdr.bitmap[2] &= ~(u8)(mask >> 2 * 8);
+@@ -108,8 +102,6 @@ static void afs_clear_contig_bits(union afs_xdr_dir_block *block,
+ block->hdr.bitmap[5] &= ~(u8)(mask >> 5 * 8);
+ block->hdr.bitmap[6] &= ~(u8)(mask >> 6 * 8);
+ block->hdr.bitmap[7] &= ~(u8)(mask >> 7 * 8);
+-
+- after = *(u64 *)block->hdr.bitmap;
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 764fc8591bc9488933954b2df153bd841a48e819 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 10:09:01 +0800
+Subject: block: fix memleak of bio integrity data
+
+From: Justin Tee <justin.tee@broadcom.com>
+
+[ Upstream commit ece841abbed2da71fa10710c687c9ce9efb6bf69 ]
+
+7c20f11680a4 ("bio-integrity: stop abusing bi_end_io") moves
+bio_integrity_free from bio_uninit() to bio_integrity_verify_fn()
+and bio_endio(). This way looks wrong because bio may be freed
+without calling bio_endio(), for example, blk_rq_unprep_clone() is
+called from dm_mq_queue_rq() when the underlying queue of dm-mpath
+is busy.
+
+So memory leak of bio integrity data is caused by commit 7c20f11680a4.
+
+Fixes this issue by re-adding bio_integrity_free() to bio_uninit().
+
+Fixes: 7c20f11680a4 ("bio-integrity: stop abusing bi_end_io")
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by Justin Tee <justin.tee@broadcom.com>
+
+Add commit log, and simplify/fix the original patch wroten by Justin.
+
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bio-integrity.c | 2 +-
+ block/bio.c | 3 +++
+ block/blk.h | 4 ++++
+ 3 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index fb95dbb21dd88..bf62c25cde8f4 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -87,7 +87,7 @@ EXPORT_SYMBOL(bio_integrity_alloc);
+ * Description: Used to free the integrity portion of a bio. Usually
+ * called from bio_free().
+ */
+-static void bio_integrity_free(struct bio *bio)
++void bio_integrity_free(struct bio *bio)
+ {
+ struct bio_integrity_payload *bip = bio_integrity(bio);
+ struct bio_set *bs = bio->bi_pool;
+diff --git a/block/bio.c b/block/bio.c
+index 906da3581a3e8..94d697217887a 100644
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -233,6 +233,9 @@ fallback:
+ void bio_uninit(struct bio *bio)
+ {
+ bio_disassociate_blkg(bio);
++
++ if (bio_integrity(bio))
++ bio_integrity_free(bio);
+ }
+ EXPORT_SYMBOL(bio_uninit);
+
+diff --git a/block/blk.h b/block/blk.h
+index ffea1691470e6..ee3d5664d9627 100644
+--- a/block/blk.h
++++ b/block/blk.h
+@@ -122,6 +122,7 @@ static inline void blk_rq_bio_prep(struct request *rq, struct bio *bio,
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+ void blk_flush_integrity(void);
+ bool __bio_integrity_endio(struct bio *);
++void bio_integrity_free(struct bio *bio);
+ static inline bool bio_integrity_endio(struct bio *bio)
+ {
+ if (bio_integrity(bio))
+@@ -167,6 +168,9 @@ static inline bool bio_integrity_endio(struct bio *bio)
+ {
+ return true;
+ }
++static inline void bio_integrity_free(struct bio *bio)
++{
++}
+ #endif /* CONFIG_BLK_DEV_INTEGRITY */
+
+ unsigned long blk_rq_timeout(unsigned long timeout);
+--
+2.20.1
+
--- /dev/null
+From cf82c2a6f0f11391d8b4a3f34391a6fd0e9a920b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 19 Nov 2019 17:35:36 +0100
+Subject: dma-direct: don't check swiotlb=force in dma_direct_map_resource
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 4268ac6ae5870af10a7417b22990d615f72f77e2 ]
+
+When mapping resources we can't just use swiotlb ram for bounce
+buffering. Switch to a direct dma_capable check instead.
+
+Fixes: cfced786969c ("dma-mapping: remove the default map_resource implementation")
+Reported-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/dma/direct.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
+index 8402b29c280f5..867fd72cb2605 100644
+--- a/kernel/dma/direct.c
++++ b/kernel/dma/direct.c
+@@ -375,7 +375,7 @@ dma_addr_t dma_direct_map_resource(struct device *dev, phys_addr_t paddr,
+ {
+ dma_addr_t dma_addr = paddr;
+
+- if (unlikely(!dma_direct_possible(dev, dma_addr, size))) {
++ if (unlikely(!dma_capable(dev, dma_addr, size))) {
+ report_addr(dev, dma_addr, size);
+ return DMA_MAPPING_ERROR;
+ }
+--
+2.20.1
+
--- /dev/null
+From 3e4ff63d1875092b73658b638876e03d6121a974 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 15:38:02 +0800
+Subject: dmaengine: ti: edma: fix missed failure handling
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ]
+
+When devm_kcalloc fails, it forgets to call edma_free_slot.
+Replace direct return with failure handler to fix it.
+
+Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ti/edma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ti/edma.c b/drivers/dma/ti/edma.c
+index ba7c4f07fcd6f..80b780e499711 100644
+--- a/drivers/dma/ti/edma.c
++++ b/drivers/dma/ti/edma.c
+@@ -2403,8 +2403,10 @@ static int edma_probe(struct platform_device *pdev)
+
+ ecc->tc_list = devm_kcalloc(dev, ecc->num_tc,
+ sizeof(*ecc->tc_list), GFP_KERNEL);
+- if (!ecc->tc_list)
+- return -ENOMEM;
++ if (!ecc->tc_list) {
++ ret = -ENOMEM;
++ goto err_reg1;
++ }
+
+ for (i = 0;; i++) {
+ ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs",
+--
+2.20.1
+
--- /dev/null
+From bdc90bb637bf99d48d1dff8640cb3ad874ce862e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 14:38:27 +0300
+Subject: dpaa2-eth: Fix minor bug in ethtool stats reporting
+
+From: Ioana Radulescu <ruxandra.radulescu@nxp.com>
+
+[ Upstream commit 4b177f065e7ec37399b18e18412a8c7b75f8f299 ]
+
+Don't print error message for a successful return value.
+
+Fixes: d84c3a4ded96 ("dpaa2-eth: Add new DPNI statistics counters")
+
+Signed-off-by: Ioana Radulescu <ruxandra.radulescu@nxp.com>
+Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
+index 0aa1c34019bbe..dc9a6c36cac02 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ethtool.c
+@@ -216,7 +216,7 @@ static void dpaa2_eth_get_ethtool_stats(struct net_device *net_dev,
+ if (err == -EINVAL)
+ /* Older firmware versions don't support all pages */
+ memset(&dpni_stats, 0, sizeof(dpni_stats));
+- else
++ else if (err)
+ netdev_warn(net_dev, "dpni_get_stats(%d) failed\n", j);
+
+ num_cnt = dpni_stats_page_size[j] / sizeof(u64);
+--
+2.20.1
+
--- /dev/null
+From 16ebbf56dd96d1e3cb3a93f1cda046b789a8ab1a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 16:37:50 +0200
+Subject: dpaa_eth: avoid timestamp read on error paths
+
+From: Madalin Bucur <madalin.bucur@nxp.com>
+
+[ Upstream commit 9a4f4f3a894ff4487f5597b7aabba9432b238292 ]
+
+The dpaa_cleanup_tx_fd() function is called by the frame transmit
+confirmation callback but also on several error paths. This function
+is reading the transmit timestamp value. Avoid reading an invalid
+timestamp value on the error paths.
+
+Fixes: 4664856e9ca2 ("dpaa_eth: add support for hardware timestamping")
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index 54ffc9d3b0a9b..fcbe01f61aa44 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -1600,13 +1600,15 @@ static int dpaa_eth_refill_bpools(struct dpaa_priv *priv)
+ * Skb freeing is not handled here.
+ *
+ * This function may be called on error paths in the Tx function, so guard
+- * against cases when not all fd relevant fields were filled in.
++ * against cases when not all fd relevant fields were filled in. To avoid
++ * reading the invalid transmission timestamp for the error paths set ts to
++ * false.
+ *
+ * Return the skb backpointer, since for S/G frames the buffer containing it
+ * gets freed here.
+ */
+ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+- const struct qm_fd *fd)
++ const struct qm_fd *fd, bool ts)
+ {
+ const enum dma_data_direction dma_dir = DMA_TO_DEVICE;
+ struct device *dev = priv->net_dev->dev.parent;
+@@ -1648,7 +1650,8 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ }
+
+ /* DMA unmapping is required before accessing the HW provided info */
+- if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
++ if (ts && priv->tx_tstamp &&
++ skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+ memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+
+ if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
+@@ -2116,7 +2119,7 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ if (likely(dpaa_xmit(priv, percpu_stats, queue_mapping, &fd) == 0))
+ return NETDEV_TX_OK;
+
+- dpaa_cleanup_tx_fd(priv, &fd);
++ dpaa_cleanup_tx_fd(priv, &fd, false);
+ skb_to_fd_failed:
+ enomem:
+ percpu_stats->tx_errors++;
+@@ -2162,7 +2165,7 @@ static void dpaa_tx_error(struct net_device *net_dev,
+
+ percpu_priv->stats.tx_errors++;
+
+- skb = dpaa_cleanup_tx_fd(priv, fd);
++ skb = dpaa_cleanup_tx_fd(priv, fd, false);
+ dev_kfree_skb(skb);
+ }
+
+@@ -2202,7 +2205,7 @@ static void dpaa_tx_conf(struct net_device *net_dev,
+
+ percpu_priv->tx_confirm++;
+
+- skb = dpaa_cleanup_tx_fd(priv, fd);
++ skb = dpaa_cleanup_tx_fd(priv, fd, true);
+
+ consume_skb(skb);
+ }
+@@ -2432,7 +2435,7 @@ static void egress_ern(struct qman_portal *portal,
+ percpu_priv->stats.tx_fifo_errors++;
+ count_ern(percpu_priv, msg);
+
+- skb = dpaa_cleanup_tx_fd(priv, fd);
++ skb = dpaa_cleanup_tx_fd(priv, fd, false);
+ dev_kfree_skb_any(skb);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 7202f40e26de424b47bbb5c66f8e67bbec4282dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 16:37:49 +0200
+Subject: dpaa_eth: perform DMA unmapping before read
+
+From: Madalin Bucur <madalin.bucur@nxp.com>
+
+[ Upstream commit c70fd3182caef014e6c628b412f81aa57a3ef9e4 ]
+
+DMA unmapping is required before accessing the HW provided timestamping
+information.
+
+Fixes: 4664856e9ca2 ("dpaa_eth: add support for hardware timestamping")
+Signed-off-by: Madalin Bucur <madalin.bucur@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/freescale/dpaa/dpaa_eth.c | 32 ++++++++++---------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+index b4b82b9c5cd6d..54ffc9d3b0a9b 100644
+--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+@@ -1620,18 +1620,6 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ skbh = (struct sk_buff **)phys_to_virt(addr);
+ skb = *skbh;
+
+- if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
+- memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+-
+- if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
+- &ns)) {
+- shhwtstamps.hwtstamp = ns_to_ktime(ns);
+- skb_tstamp_tx(skb, &shhwtstamps);
+- } else {
+- dev_warn(dev, "fman_port_get_tstamp failed!\n");
+- }
+- }
+-
+ if (unlikely(qm_fd_get_format(fd) == qm_fd_sg)) {
+ nr_frags = skb_shinfo(skb)->nr_frags;
+ dma_unmap_single(dev, addr,
+@@ -1654,14 +1642,28 @@ static struct sk_buff *dpaa_cleanup_tx_fd(const struct dpaa_priv *priv,
+ dma_unmap_page(dev, qm_sg_addr(&sgt[i]),
+ qm_sg_entry_get_len(&sgt[i]), dma_dir);
+ }
+-
+- /* Free the page frag that we allocated on Tx */
+- skb_free_frag(phys_to_virt(addr));
+ } else {
+ dma_unmap_single(dev, addr,
+ skb_tail_pointer(skb) - (u8 *)skbh, dma_dir);
+ }
+
++ /* DMA unmapping is required before accessing the HW provided info */
++ if (priv->tx_tstamp && skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
++ memset(&shhwtstamps, 0, sizeof(shhwtstamps));
++
++ if (!fman_port_get_tstamp(priv->mac_dev->port[TX], (void *)skbh,
++ &ns)) {
++ shhwtstamps.hwtstamp = ns_to_ktime(ns);
++ skb_tstamp_tx(skb, &shhwtstamps);
++ } else {
++ dev_warn(dev, "fman_port_get_tstamp failed!\n");
++ }
++ }
++
++ if (qm_fd_get_format(fd) == qm_fd_sg)
++ /* Free the page frag that we allocated on Tx */
++ skb_free_frag(phys_to_virt(addr));
++
+ return skb;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 17e22bd00b6a3b4bdd76a931d7e51a22a47edfd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 22:09:09 +0800
+Subject: drm/amdgpu: remove excess function parameter description
+
+From: yu kuai <yukuai3@huawei.com>
+
+[ Upstream commit d0580c09c65cff211f589a40e08eabc62da463fb ]
+
+Fixes gcc warning:
+
+drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c:431: warning: Excess function
+parameter 'sw' description in 'vcn_v2_5_disable_clock_gating'
+drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c:550: warning: Excess function
+parameter 'sw' description in 'vcn_v2_5_enable_clock_gating'
+
+Fixes: cbead2bdfcf1 ("drm/amdgpu: add VCN2.5 VCPU start and stop")
+Signed-off-by: yu kuai <yukuai3@huawei.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+index 395c2259f979b..9d778a0b2c5e2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c
+@@ -423,7 +423,6 @@ static void vcn_v2_5_mc_resume(struct amdgpu_device *adev)
+ * vcn_v2_5_disable_clock_gating - disable VCN clock gating
+ *
+ * @adev: amdgpu_device pointer
+- * @sw: enable SW clock gating
+ *
+ * Disable clock gating for VCN block
+ */
+@@ -542,7 +541,6 @@ static void vcn_v2_5_disable_clock_gating(struct amdgpu_device *adev)
+ * vcn_v2_5_enable_clock_gating - enable VCN clock gating
+ *
+ * @adev: amdgpu_device pointer
+- * @sw: enable SW clock gating
+ *
+ * Enable clock gating for VCN block
+ */
+--
+2.20.1
+
--- /dev/null
+From bbd4adb5153a4036c0ae3db4a77a108e75b1b4df Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 12:12:16 +0300
+Subject: drm/amdgpu/vi: silence an uninitialized variable warning
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 4ff17a1df7d550257972a838220a8af4611c8f2c ]
+
+Smatch complains that we need to initialized "*cap" otherwise it can
+lead to an uninitialized variable bug in the caller. This seems like a
+reasonable warning and it doesn't hurt to silence it at least.
+
+drivers/gpu/drm/amd/amdgpu/vi.c:767 vi_asic_reset_method() error: uninitialized symbol 'baco_reset'.
+
+Fixes: 425db2553e43 ("drm/amdgpu: expose BACO interfaces to upper level from PP")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/amd_powerplay.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+index fa8ad7db2b3a1..d306cc7119976 100644
+--- a/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
++++ b/drivers/gpu/drm/amd/powerplay/amd_powerplay.c
+@@ -1421,6 +1421,7 @@ static int pp_get_asic_baco_capability(void *handle, bool *cap)
+ {
+ struct pp_hwmgr *hwmgr = handle;
+
++ *cap = false;
+ if (!hwmgr)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 209a4ee9cb7d9b9cc751298c885606c3921f062e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Sep 2019 13:49:28 +0300
+Subject: drm: panel-lvds: Potential Oops in probe error handling
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit fb2ee9bf084bcaeff1e5be100decc0eacb4af2d5 ]
+
+The "lvds->backlight" pointer could be NULL in situations where
+of_parse_phandle() returns NULL. This code is cleaner if we use the
+managed devm_of_find_backlight() so the clean up is automatic.
+
+Fixes: 7c9dff5bd643 ("drm: panels: Add LVDS panel driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190911104928.GA15930@mwanda
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panel/panel-lvds.c | 21 ++++-----------------
+ 1 file changed, 4 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/panel/panel-lvds.c b/drivers/gpu/drm/panel/panel-lvds.c
+index ad47cc95459eb..bf5fcc3e53791 100644
+--- a/drivers/gpu/drm/panel/panel-lvds.c
++++ b/drivers/gpu/drm/panel/panel-lvds.c
+@@ -197,7 +197,6 @@ static int panel_lvds_parse_dt(struct panel_lvds *lvds)
+ static int panel_lvds_probe(struct platform_device *pdev)
+ {
+ struct panel_lvds *lvds;
+- struct device_node *np;
+ int ret;
+
+ lvds = devm_kzalloc(&pdev->dev, sizeof(*lvds), GFP_KERNEL);
+@@ -243,14 +242,9 @@ static int panel_lvds_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- np = of_parse_phandle(lvds->dev->of_node, "backlight", 0);
+- if (np) {
+- lvds->backlight = of_find_backlight_by_node(np);
+- of_node_put(np);
+-
+- if (!lvds->backlight)
+- return -EPROBE_DEFER;
+- }
++ lvds->backlight = devm_of_find_backlight(lvds->dev);
++ if (IS_ERR(lvds->backlight))
++ return PTR_ERR(lvds->backlight);
+
+ /*
+ * TODO: Handle all power supplies specified in the DT node in a generic
+@@ -266,14 +260,10 @@ static int panel_lvds_probe(struct platform_device *pdev)
+
+ ret = drm_panel_add(&lvds->panel);
+ if (ret < 0)
+- goto error;
++ return ret;
+
+ dev_set_drvdata(lvds->dev, lvds);
+ return 0;
+-
+-error:
+- put_device(&lvds->backlight->dev);
+- return ret;
+ }
+
+ static int panel_lvds_remove(struct platform_device *pdev)
+@@ -284,9 +274,6 @@ static int panel_lvds_remove(struct platform_device *pdev)
+
+ panel_lvds_disable(&lvds->panel);
+
+- if (lvds->backlight)
+- put_device(&lvds->backlight->dev);
+-
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From acce4a2e028d476b0cae5da56620b65ed2272bc1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 22 Aug 2019 10:32:18 +0100
+Subject: drm/panfrost: Add missing check for pfdev->regulator
+
+From: Steven Price <steven.price@arm.com>
+
+[ Upstream commit 52282163dfa651849e905886845bcf6850dd83c2 ]
+
+When modifying panfrost_devfreq_target() to support a device without a
+regulator defined I missed the check on the error path. Let's add it.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: e21dd290881b ("drm/panfrost: Enable devfreq to work without regulator")
+Signed-off-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190822093218.26014-1-steven.price@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/panfrost/panfrost_devfreq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/panfrost/panfrost_devfreq.c b/drivers/gpu/drm/panfrost/panfrost_devfreq.c
+index 12ff77dacc954..c1eb8cfe6aeb3 100644
+--- a/drivers/gpu/drm/panfrost/panfrost_devfreq.c
++++ b/drivers/gpu/drm/panfrost/panfrost_devfreq.c
+@@ -53,8 +53,10 @@ static int panfrost_devfreq_target(struct device *dev, unsigned long *freq,
+ if (err) {
+ dev_err(dev, "Cannot set frequency %lu (%d)\n", target_rate,
+ err);
+- regulator_set_voltage(pfdev->regulator, pfdev->devfreq.cur_volt,
+- pfdev->devfreq.cur_volt);
++ if (pfdev->regulator)
++ regulator_set_voltage(pfdev->regulator,
++ pfdev->devfreq.cur_volt,
++ pfdev->devfreq.cur_volt);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 3127d41488cd9ab55c99d6911f27caa6ddb9fc5d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 10:53:53 +1100
+Subject: drm/radeon: fix bad DMA from INTERRUPT_CNTL2
+
+From: Sam Bobroff <sbobroff@linux.ibm.com>
+
+[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ]
+
+The INTERRUPT_CNTL2 register expects a valid DMA address, but is
+currently set with a GPU MC address. This can cause problems on
+systems that detect the resulting DMA read from an invalid address
+(found on a Power8 guest).
+
+Instead, use the DMA address of the dummy page because it will always
+be safe.
+
+Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)")
+Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI")
+Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)")
+Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/radeon/cik.c | 4 ++--
+ drivers/gpu/drm/radeon/r600.c | 4 ++--
+ drivers/gpu/drm/radeon/si.c | 4 ++--
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index 62eab82a64f97..897442754fd03 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -6969,8 +6969,8 @@ static int cik_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* XXX this should actually be a bus address, not an MC address. same on older asics */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index e937cc01910d9..033bc466a862a 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3696,8 +3696,8 @@ int r600_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 05894d198a798..1d8efb0eefdb4 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -5997,8 +5997,8 @@ static int si_irq_init(struct radeon_device *rdev)
+ }
+
+ /* setup interrupt control */
+- /* set dummy read address to ring address */
+- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8);
++ /* set dummy read address to dummy page address */
++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8);
+ interrupt_cntl = RREG32(INTERRUPT_CNTL);
+ /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi
+ * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN
+--
+2.20.1
+
--- /dev/null
+From f281d42fd9620bcee0fd62dd0fb008af6d3f786d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2019 08:23:53 +0200
+Subject: drm: rcar_lvds: Fix color mismatches on R-Car H2 ES2.0 and later
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 3986457110a054466bf02f9c4a85aa2bba96177b ]
+
+Commit 5cca30ebe089be23 ("drm/rcar-du: Add LVDS_LANES quirk") states
+that LVDS lanes 1 and 3 are inverted on R-Car H2 ES1 only, and that the
+problem has been fixed in newer revisions.
+
+However, the code didn't take into account the actual hardware revision,
+thus applying the quirk also on newer hardware revisions, causing green
+color reversals.
+
+Fix this by applying the quirk when running on R-Car H2 ES1.x only.
+
+Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Fixes: 5cca30ebe089be23 ("drm/rcar-du: Add LVDS_LANES quirk")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Tested-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu>
+Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rcar-du/rcar_lvds.c | 28 +++++++++++++++++++++-------
+ 1 file changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds.c b/drivers/gpu/drm/rcar-du/rcar_lvds.c
+index 3fc7e6899cab5..50c11a7f0467f 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_lvds.c
++++ b/drivers/gpu/drm/rcar-du/rcar_lvds.c
+@@ -16,6 +16,7 @@
+ #include <linux/of_graph.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
++#include <linux/sys_soc.h>
+
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
+@@ -842,8 +843,23 @@ static int rcar_lvds_get_clocks(struct rcar_lvds *lvds)
+ return 0;
+ }
+
++static const struct rcar_lvds_device_info rcar_lvds_r8a7790es1_info = {
++ .gen = 2,
++ .quirks = RCAR_LVDS_QUIRK_LANES,
++ .pll_setup = rcar_lvds_pll_setup_gen2,
++};
++
++static const struct soc_device_attribute lvds_quirk_matches[] = {
++ {
++ .soc_id = "r8a7790", .revision = "ES1.*",
++ .data = &rcar_lvds_r8a7790es1_info,
++ },
++ { /* sentinel */ }
++};
++
+ static int rcar_lvds_probe(struct platform_device *pdev)
+ {
++ const struct soc_device_attribute *attr;
+ struct rcar_lvds *lvds;
+ struct resource *mem;
+ int ret;
+@@ -857,6 +873,10 @@ static int rcar_lvds_probe(struct platform_device *pdev)
+ lvds->dev = &pdev->dev;
+ lvds->info = of_device_get_match_data(&pdev->dev);
+
++ attr = soc_device_match(lvds_quirk_matches);
++ if (attr)
++ lvds->info = attr->data;
++
+ ret = rcar_lvds_parse_dt(lvds);
+ if (ret < 0)
+ return ret;
+@@ -893,12 +913,6 @@ static const struct rcar_lvds_device_info rcar_lvds_gen2_info = {
+ .pll_setup = rcar_lvds_pll_setup_gen2,
+ };
+
+-static const struct rcar_lvds_device_info rcar_lvds_r8a7790_info = {
+- .gen = 2,
+- .quirks = RCAR_LVDS_QUIRK_LANES,
+- .pll_setup = rcar_lvds_pll_setup_gen2,
+-};
+-
+ static const struct rcar_lvds_device_info rcar_lvds_gen3_info = {
+ .gen = 3,
+ .quirks = RCAR_LVDS_QUIRK_PWD,
+@@ -930,7 +944,7 @@ static const struct of_device_id rcar_lvds_of_table[] = {
+ { .compatible = "renesas,r8a7744-lvds", .data = &rcar_lvds_gen2_info },
+ { .compatible = "renesas,r8a774a1-lvds", .data = &rcar_lvds_gen3_info },
+ { .compatible = "renesas,r8a774c0-lvds", .data = &rcar_lvds_r8a77990_info },
+- { .compatible = "renesas,r8a7790-lvds", .data = &rcar_lvds_r8a7790_info },
++ { .compatible = "renesas,r8a7790-lvds", .data = &rcar_lvds_gen2_info },
+ { .compatible = "renesas,r8a7791-lvds", .data = &rcar_lvds_gen2_info },
+ { .compatible = "renesas,r8a7793-lvds", .data = &rcar_lvds_gen2_info },
+ { .compatible = "renesas,r8a7795-lvds", .data = &rcar_lvds_gen3_info },
+--
+2.20.1
+
--- /dev/null
+From a1ae96168a7d31e5fa1fd6283ffcd2d7f2d52c09 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 11:47:30 -0700
+Subject: drm/rockchip: Round up _before_ giving to the clock framework
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 287422a95fe28e05c1952de0472e0dfdffa6caae ]
+
+I'm embarassed to say that even though I've touched
+vop_crtc_mode_fixup() twice and I swear I tested it, there's still a
+stupid glaring bug in it. Specifically, on veyron_minnie (with all
+the latest display timings) we want to be setting our pixel clock to
+66,666,666.67 Hz and we tell userspace that's what we set, but we're
+actually choosing 66,000,000 Hz. This is confirmed by looking at the
+clock tree.
+
+The problem is that in drm_display_mode_from_videomode() we convert
+from Hz to kHz with:
+
+ dmode->clock = vm->pixelclock / 1000;
+
+...and drm_display_mode_from_videomode() is called from panel-simple
+when we have an "override_mode" like we do on veyron_minnie. See
+commit 123643e5c40a ("ARM: dts: rockchip: Specify
+rk3288-veyron-minnie's display timings").
+
+...so when the device tree specifies a clock of 66666667 for the panel
+then DRM translates that to 66666000. The clock framework will always
+pick a clock that is _lower_ than the one requested, so it will refuse
+to pick 66666667 and we'll end up at 66000000.
+
+While we could try to fix drm_display_mode_from_videomode() to round
+to the nearest kHz and it would fix our problem, it wouldn't help if
+the clock we actually needed was 60,000,001 Hz. We could
+alternatively have DRM always round up, but maybe this would break
+someone else who already baked in the assumption that DRM rounds down.
+Specifically note that clock drivers are not consistent about whether
+they round up or round down when you call clk_set_rate(). We know how
+Rockchip's clock driver works, but (for instance) you can see that on
+most Qualcomm clocks the default is clk_rcg2_ops which rounds up.
+
+Let's solve this by just adding 999 Hz before calling
+clk_round_rate(). This should be safe and work everywhere. As
+discussed in more detail in comments in the commit, Rockchip's PLLs
+are configured in a way that there shouldn't be another PLL setting
+that is only a few kHz off so we won't get mixed up.
+
+NOTE: if this is picked to stable, it's probably easiest to first pick
+commit 527e4ca3b6d1 ("drm/rockchip: Base adjustments of the mode based
+on prev adjustments") which shouldn't hurt in stable.
+
+Fixes: b59b8de31497 ("drm/rockchip: return a true clock rate to adjusted_mode")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191003114726.v2.1.Ib233b3e706cf6317858384264d5b0ed35657456e@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 37 +++++++++++++++++++--
+ 1 file changed, 34 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+index 613404f86668d..84e3decb17b1f 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+@@ -1040,10 +1040,41 @@ static bool vop_crtc_mode_fixup(struct drm_crtc *crtc,
+ struct drm_display_mode *adjusted_mode)
+ {
+ struct vop *vop = to_vop(crtc);
++ unsigned long rate;
+
+- adjusted_mode->clock =
+- DIV_ROUND_UP(clk_round_rate(vop->dclk,
+- adjusted_mode->clock * 1000), 1000);
++ /*
++ * Clock craziness.
++ *
++ * Key points:
++ *
++ * - DRM works in in kHz.
++ * - Clock framework works in Hz.
++ * - Rockchip's clock driver picks the clock rate that is the
++ * same _OR LOWER_ than the one requested.
++ *
++ * Action plan:
++ *
++ * 1. When DRM gives us a mode, we should add 999 Hz to it. That way
++ * if the clock we need is 60000001 Hz (~60 MHz) and DRM tells us to
++ * make 60000 kHz then the clock framework will actually give us
++ * the right clock.
++ *
++ * NOTE: if the PLL (maybe through a divider) could actually make
++ * a clock rate 999 Hz higher instead of the one we want then this
++ * could be a problem. Unfortunately there's not much we can do
++ * since it's baked into DRM to use kHz. It shouldn't matter in
++ * practice since Rockchip PLLs are controlled by tables and
++ * even if there is a divider in the middle I wouldn't expect PLL
++ * rates in the table that are just a few kHz different.
++ *
++ * 2. Get the clock framework to round the rate for us to tell us
++ * what it will actually make.
++ *
++ * 3. Store the rounded up rate so that we don't need to worry about
++ * this in the actual clk_set_rate().
++ */
++ rate = clk_round_rate(vop->dclk, adjusted_mode->clock * 1000 + 999);
++ adjusted_mode->clock = DIV_ROUND_UP(rate, 1000);
+
+ return true;
+ }
+--
+2.20.1
+
--- /dev/null
+From cf94fc4706a7a6a80c26e65463686f4b04c89c2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 16:25:22 +0000
+Subject: firmware: arm_scmi: Fix doorbell ring logic for !CONFIG_64BIT
+
+From: Sudeep Holla <sudeep.holla@arm.com>
+
+[ Upstream commit 7bd39bc6bfdf96f5df0f92199bbc1a3ee2f2adb8 ]
+
+The logic to ring the scmi performance fastchannel ignores the
+value read from the doorbell register in case of !CONFIG_64BIT.
+This bug also shows up as warning with '-Wunused-but-set-variable' gcc
+flag:
+
+drivers/firmware/arm_scmi/perf.c: In function scmi_perf_fc_ring_db:
+drivers/firmware/arm_scmi/perf.c:323:7: warning: variable val set but
+ not used [-Wunused-but-set-variable]
+
+Fix the same by aligning the logic with CONFIG_64BIT as used in the
+macro SCMI_PERF_FC_RING_DB().
+
+Fixes: 823839571d76 ("firmware: arm_scmi: Make use SCMI v2.0 fastchannel for performance protocol")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Reported-by: Zheng Yongjun <zhengyongjun3@huawei.com>
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/arm_scmi/perf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/arm_scmi/perf.c b/drivers/firmware/arm_scmi/perf.c
+index 4a8012e3cb8c3..601af4edad5e6 100644
+--- a/drivers/firmware/arm_scmi/perf.c
++++ b/drivers/firmware/arm_scmi/perf.c
+@@ -323,7 +323,7 @@ static void scmi_perf_fc_ring_db(struct scmi_fc_db_info *db)
+
+ if (db->mask)
+ val = ioread64_hi_lo(db->addr) & db->mask;
+- iowrite64_hi_lo(db->set, db->addr);
++ iowrite64_hi_lo(db->set | val, db->addr);
+ }
+ #endif
+ }
+--
+2.20.1
+
--- /dev/null
+From 64e395bd5f08a531070ee355d9df8f98d104c95e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 18:32:28 +0300
+Subject: firmware: imx: Remove call to devm_of_platform_populate
+
+From: Daniel Baluta <daniel.baluta@nxp.com>
+
+[ Upstream commit 0e4e8cc30a2940c57448af1376e40d3c0996fb29 ]
+
+IMX DSP device is created by SOF layer. The current call to
+devm_of_platform_populate is not needed and it doesn't produce
+any effects.
+
+Fixes: ffbf23d50353915d ("firmware: imx: Add DSP IPC protocol interface)
+Signed-off-by: Daniel Baluta <daniel.baluta@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/firmware/imx/imx-dsp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/firmware/imx/imx-dsp.c b/drivers/firmware/imx/imx-dsp.c
+index a43d2db5cbdb4..4265e9dbed84f 100644
+--- a/drivers/firmware/imx/imx-dsp.c
++++ b/drivers/firmware/imx/imx-dsp.c
+@@ -114,7 +114,7 @@ static int imx_dsp_probe(struct platform_device *pdev)
+
+ dev_info(dev, "NXP i.MX DSP IPC initialized\n");
+
+- return devm_of_platform_populate(dev);
++ return 0;
+ out:
+ kfree(chan_name);
+ for (j = 0; j < i; j++) {
+--
+2.20.1
+
--- /dev/null
+From 078de9baf84a407b2496aeae3539e7e267674a23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Dec 2019 21:28:31 +0100
+Subject: gpio: aspeed: avoid return type warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 11e299de3aced4ea23a9fb1fef6c983c8d516302 ]
+
+gcc has a hard time tracking whether BUG_ON(1) ends
+execution or not:
+
+drivers/gpio/gpio-aspeed-sgpio.c: In function 'bank_reg':
+drivers/gpio/gpio-aspeed-sgpio.c:112:1: error: control reaches end of non-void function [-Werror=return-type]
+
+Use the simpler BUG() that gcc knows cannot continue.
+
+Fixes: f8b410e3695a ("gpio: aspeed-sgpio: Rename and add Kconfig/Makefile")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/sgpio-aspeed.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/sgpio-aspeed.c b/drivers/gpio/sgpio-aspeed.c
+index 7e99860ca447e..8319812593e31 100644
+--- a/drivers/gpio/sgpio-aspeed.c
++++ b/drivers/gpio/sgpio-aspeed.c
+@@ -107,7 +107,7 @@ static void __iomem *bank_reg(struct aspeed_sgpio *gpio,
+ return gpio->base + bank->irq_regs + GPIO_IRQ_STATUS;
+ default:
+ /* acturally if code runs to here, it's an error case */
+- BUG_ON(1);
++ BUG();
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 38df26d5737ef9bdb7df22cabcae370927d81767 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 16:42:37 -0700
+Subject: hv_netvsc: flag software created hash value
+
+From: Stephen Hemminger <sthemmin@microsoft.com>
+
+[ Upstream commit df9f540ca74297a84bafacfa197e9347b20beea5 ]
+
+When the driver needs to create a hash value because it
+was not done at higher level, then the hash should be marked
+as a software not hardware hash.
+
+Fixes: f72860afa2e3 ("hv_netvsc: Exclude non-TCP port numbers from vRSS hashing")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hyperv/netvsc_drv.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index 78e3e689a733b..0dee358864f30 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -285,9 +285,9 @@ static inline u32 netvsc_get_hash(
+ else if (flow.basic.n_proto == htons(ETH_P_IPV6))
+ hash = jhash2((u32 *)&flow.addrs.v6addrs, 8, hashrnd);
+ else
+- hash = 0;
++ return 0;
+
+- skb_set_hash(skb, hash, PKT_HASH_TYPE_L3);
++ __skb_set_sw_hash(skb, hash, false);
+ }
+
+ return hash;
+@@ -795,8 +795,7 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net,
+ skb->protocol == htons(ETH_P_IP))
+ netvsc_comp_ipcsum(skb);
+
+- /* Do L4 checksum offload if enabled and present.
+- */
++ /* Do L4 checksum offload if enabled and present. */
+ if (csum_info && (net->features & NETIF_F_RXCSUM)) {
+ if (csum_info->receive.tcp_checksum_succeeded ||
+ csum_info->receive.udp_checksum_succeeded)
+--
+2.20.1
+
--- /dev/null
+From 6552c6b15eb4ceaa2bbe7f5d3ec3d61243505fc5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 14 Sep 2019 14:02:55 -0700
+Subject: hwrng: omap3-rom - Fix missing clock by probing with device tree
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 0c0ef9ea6f3f0d5979dc7b094b0a184c1a94716b ]
+
+Commit 0ed266d7ae5e ("clk: ti: omap3: cleanup unnecessary clock aliases")
+removed old omap3 clock framework aliases but caused omap3-rom-rng to
+stop working with clock not found error.
+
+Based on discussions on the mailing list it was requested by Tero Kristo
+that it would be best to fix this issue by probing omap3-rom-rng using
+device tree to provide a proper clk property. The other option would be
+to add back the missing clock alias, but that does not help moving things
+forward with removing old legacy platform_data.
+
+Let's also add a proper device tree binding and keep it together with
+the fix.
+
+Cc: devicetree@vger.kernel.org
+Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: Adam Ford <aford173@gmail.com>
+Cc: Pali Rohár <pali.rohar@gmail.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Sebastian Reichel <sre@kernel.org>
+Cc: Tero Kristo <t-kristo@ti.com>
+Fixes: 0ed266d7ae5e ("clk: ti: omap3: cleanup unnecessary clock aliases")
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../devicetree/bindings/rng/omap3_rom_rng.txt | 27 +++++++++++++++++++
+ arch/arm/boot/dts/omap3-n900.dts | 6 +++++
+ arch/arm/mach-omap2/pdata-quirks.c | 12 +--------
+ drivers/char/hw_random/omap3-rom-rng.c | 17 ++++++++++--
+ 4 files changed, 49 insertions(+), 13 deletions(-)
+ create mode 100644 Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+
+diff --git a/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+new file mode 100644
+index 0000000000000..f315c9723bd2a
+--- /dev/null
++++ b/Documentation/devicetree/bindings/rng/omap3_rom_rng.txt
+@@ -0,0 +1,27 @@
++OMAP ROM RNG driver binding
++
++Secure SoCs may provide RNG via secure ROM calls like Nokia N900 does. The
++implementation can depend on the SoC secure ROM used.
++
++- compatible:
++ Usage: required
++ Value type: <string>
++ Definition: must be "nokia,n900-rom-rng"
++
++- clocks:
++ Usage: required
++ Value type: <prop-encoded-array>
++ Definition: reference to the the RNG interface clock
++
++- clock-names:
++ Usage: required
++ Value type: <stringlist>
++ Definition: must be "ick"
++
++Example:
++
++ rom_rng: rng {
++ compatible = "nokia,n900-rom-rng";
++ clocks = <&rng_ick>;
++ clock-names = "ick";
++ };
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 84a5ade1e865b..63659880eeb3f 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -155,6 +155,12 @@
+ pwms = <&pwm9 0 26316 0>; /* 38000 Hz */
+ };
+
++ rom_rng: rng {
++ compatible = "nokia,n900-rom-rng";
++ clocks = <&rng_ick>;
++ clock-names = "ick";
++ };
++
+ /* controlled (enabled/disabled) directly by bcm2048 and wl1251 */
+ vctcxo: vctcxo {
+ compatible = "fixed-clock";
+diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
+index 33688e1d9acf9..247e3f8acffe6 100644
+--- a/arch/arm/mach-omap2/pdata-quirks.c
++++ b/arch/arm/mach-omap2/pdata-quirks.c
+@@ -268,14 +268,6 @@ static void __init am3517_evm_legacy_init(void)
+ am35xx_emac_reset();
+ }
+
+-static struct platform_device omap3_rom_rng_device = {
+- .name = "omap3-rom-rng",
+- .id = -1,
+- .dev = {
+- .platform_data = rx51_secure_rng_call,
+- },
+-};
+-
+ static void __init nokia_n900_legacy_init(void)
+ {
+ hsmmc2_internal_input_clk();
+@@ -291,9 +283,6 @@ static void __init nokia_n900_legacy_init(void)
+ pr_warn("RX-51: Not enabling ARM errata 430973 workaround\n");
+ pr_warn("Thumb binaries may crash randomly without this workaround\n");
+ }
+-
+- pr_info("RX-51: Registering OMAP3 HWRNG device\n");
+- platform_device_register(&omap3_rom_rng_device);
+ }
+ }
+
+@@ -538,6 +527,7 @@ static struct of_dev_auxdata omap_auxdata_lookup[] = {
+ OF_DEV_AUXDATA("ti,davinci_mdio", 0x5c030000, "davinci_mdio.0", NULL),
+ OF_DEV_AUXDATA("ti,am3517-emac", 0x5c000000, "davinci_emac.0",
+ &am35xx_emac_pdata),
++ OF_DEV_AUXDATA("nokia,n900-rom-rng", 0, NULL, rx51_secure_rng_call),
+ /* McBSP modules with sidetone core */
+ #if IS_ENABLED(CONFIG_SND_SOC_OMAP_MCBSP)
+ OF_DEV_AUXDATA("ti,omap3-mcbsp", 0x49022000, "49022000.mcbsp", &mcbsp_pdata),
+diff --git a/drivers/char/hw_random/omap3-rom-rng.c b/drivers/char/hw_random/omap3-rom-rng.c
+index 648e39ce6bd95..8df3cad7c97ae 100644
+--- a/drivers/char/hw_random/omap3-rom-rng.c
++++ b/drivers/char/hw_random/omap3-rom-rng.c
+@@ -20,6 +20,8 @@
+ #include <linux/workqueue.h>
+ #include <linux/clk.h>
+ #include <linux/err.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
+ #include <linux/platform_device.h>
+
+ #define RNG_RESET 0x01
+@@ -86,14 +88,18 @@ static int omap3_rom_rng_read(struct hwrng *rng, void *data, size_t max, bool w)
+
+ static struct hwrng omap3_rom_rng_ops = {
+ .name = "omap3-rom",
+- .read = omap3_rom_rng_read,
+ };
+
+ static int omap3_rom_rng_probe(struct platform_device *pdev)
+ {
+ int ret = 0;
+
+- pr_info("initializing\n");
++ omap3_rom_rng_ops.read = of_device_get_match_data(&pdev->dev);
++ if (!omap3_rom_rng_ops.read) {
++ dev_err(&pdev->dev, "missing rom code handler\n");
++
++ return -ENODEV;
++ }
+
+ omap3_rom_rng_call = pdev->dev.platform_data;
+ if (!omap3_rom_rng_call) {
+@@ -126,9 +132,16 @@ static int omap3_rom_rng_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static const struct of_device_id omap_rom_rng_match[] = {
++ { .compatible = "nokia,n900-rom-rng", .data = omap3_rom_rng_read, },
++ { /* sentinel */ },
++};
++MODULE_DEVICE_TABLE(of, omap_rom_rng_match);
++
+ static struct platform_driver omap3_rom_rng_driver = {
+ .driver = {
+ .name = "omap3-rom-rng",
++ .of_match_table = omap_rom_rng_match,
+ },
+ .probe = omap3_rom_rng_probe,
+ .remove = omap3_rom_rng_remove,
+--
+2.20.1
+
--- /dev/null
+From 15e8169a03ad96c282db6144dcfe6ef6f5114104 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 14:52:00 +0200
+Subject: i2c: stm32f7: report dma error during probe
+
+From: Alain Volmat <alain.volmat@st.com>
+
+[ Upstream commit d77eceb2de99f5d7e0c645bad15511fe1af59e09 ]
+
+Distinguish between the case where dma information is not provided
+within the DT and the case of an error during the dma init.
+Exit the probe with error in case of an error during dma init.
+
+Fixes: bb8822cbbc53 ("i2c: i2c-stm32: Add generic DMA API")
+Signed-off-by: Alain Volmat <alain.volmat@st.com>
+Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@st.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-stm32.c | 16 ++++++++--------
+ drivers/i2c/busses/i2c-stm32f7.c | 9 +++++++++
+ 2 files changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-stm32.c b/drivers/i2c/busses/i2c-stm32.c
+index 07d5dfce68d4c..1da347e6a3586 100644
+--- a/drivers/i2c/busses/i2c-stm32.c
++++ b/drivers/i2c/busses/i2c-stm32.c
+@@ -20,13 +20,13 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
+
+ dma = devm_kzalloc(dev, sizeof(*dma), GFP_KERNEL);
+ if (!dma)
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+
+ /* Request and configure I2C TX dma channel */
+- dma->chan_tx = dma_request_slave_channel(dev, "tx");
+- if (!dma->chan_tx) {
++ dma->chan_tx = dma_request_chan(dev, "tx");
++ if (IS_ERR(dma->chan_tx)) {
+ dev_dbg(dev, "can't request DMA tx channel\n");
+- ret = -EINVAL;
++ ret = PTR_ERR(dma->chan_tx);
+ goto fail_al;
+ }
+
+@@ -42,10 +42,10 @@ struct stm32_i2c_dma *stm32_i2c_dma_request(struct device *dev,
+ }
+
+ /* Request and configure I2C RX dma channel */
+- dma->chan_rx = dma_request_slave_channel(dev, "rx");
+- if (!dma->chan_rx) {
++ dma->chan_rx = dma_request_chan(dev, "rx");
++ if (IS_ERR(dma->chan_rx)) {
+ dev_err(dev, "can't request DMA rx channel\n");
+- ret = -EINVAL;
++ ret = PTR_ERR(dma->chan_rx);
+ goto fail_tx;
+ }
+
+@@ -75,7 +75,7 @@ fail_al:
+ devm_kfree(dev, dma);
+ dev_info(dev, "can't use DMA\n");
+
+- return NULL;
++ return ERR_PTR(ret);
+ }
+
+ void stm32_i2c_dma_free(struct stm32_i2c_dma *dma)
+diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c
+index b88fc9d79287b..b2634afe066d3 100644
+--- a/drivers/i2c/busses/i2c-stm32f7.c
++++ b/drivers/i2c/busses/i2c-stm32f7.c
+@@ -1955,6 +1955,15 @@ static int stm32f7_i2c_probe(struct platform_device *pdev)
+ i2c_dev->dma = stm32_i2c_dma_request(i2c_dev->dev, phy_addr,
+ STM32F7_I2C_TXDR,
+ STM32F7_I2C_RXDR);
++ if (PTR_ERR(i2c_dev->dma) == -ENODEV)
++ i2c_dev->dma = NULL;
++ else if (IS_ERR(i2c_dev->dma)) {
++ ret = PTR_ERR(i2c_dev->dma);
++ if (ret != -EPROBE_DEFER)
++ dev_err(&pdev->dev,
++ "Failed to request dma error %i\n", ret);
++ goto clk_free;
++ }
+
+ platform_set_drvdata(pdev, i2c_dev);
+
+--
+2.20.1
+
--- /dev/null
+From c169dbcea45e1ac5b5df81e1704fa569d3e92a82 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 11 Nov 2019 21:16:55 -0500
+Subject: kselftests: cgroup: Avoid the reuse of fd after it is deallocated
+
+From: Hewenliang <hewenliang4@huawei.com>
+
+[ Upstream commit d671fa6393d6788fc65555d4643b71cb3a361f36 ]
+
+It is necessary to set fd to -1 when inotify_add_watch() fails in
+cg_prepare_for_wait. Otherwise the fd which has been closed in
+cg_prepare_for_wait may be misused in other functions such as
+cg_enter_and_wait_for_frozen and cg_freeze_wait.
+
+Fixes: 5313bfe425c8 ("selftests: cgroup: add freezer controller self-tests")
+Signed-off-by: Hewenliang <hewenliang4@huawei.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/cgroup/test_freezer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/testing/selftests/cgroup/test_freezer.c b/tools/testing/selftests/cgroup/test_freezer.c
+index 0fc1b6d4b0f9c..62a27ab3c2f3e 100644
+--- a/tools/testing/selftests/cgroup/test_freezer.c
++++ b/tools/testing/selftests/cgroup/test_freezer.c
+@@ -72,6 +72,7 @@ static int cg_prepare_for_wait(const char *cgroup)
+ if (ret == -1) {
+ debug("Error: inotify_add_watch() failed\n");
+ close(fd);
++ fd = -1;
+ }
+
+ return fd;
+--
+2.20.1
+
--- /dev/null
+From ee0a7edb9bb190d0c48fa95125f4eeee8ed60ace Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 22:59:53 -0700
+Subject: libbpf: Don't use kernel-side u32 type in xsk.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andrii Nakryiko <andriin@fb.com>
+
+[ Upstream commit a566e35f1e8b4b3be1e96a804d1cca38b578167c ]
+
+u32 is a kernel-side typedef. User-space library is supposed to use __u32.
+This breaks Github's projection of libbpf. Do u32 -> __u32 fix.
+
+Fixes: 94ff9ebb49a5 ("libbpf: Fix compatibility for kernels without need_wakeup")
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Cc: Magnus Karlsson <magnus.karlsson@intel.com>
+Link: https://lore.kernel.org/bpf/20191029055953.2461336-1-andriin@fb.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/xsk.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index b29d37fba2b0e..0c7386b0e42e4 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -161,22 +161,22 @@ static void xsk_mmap_offsets_v1(struct xdp_mmap_offsets *off)
+ off->rx.producer = off_v1.rx.producer;
+ off->rx.consumer = off_v1.rx.consumer;
+ off->rx.desc = off_v1.rx.desc;
+- off->rx.flags = off_v1.rx.consumer + sizeof(u32);
++ off->rx.flags = off_v1.rx.consumer + sizeof(__u32);
+
+ off->tx.producer = off_v1.tx.producer;
+ off->tx.consumer = off_v1.tx.consumer;
+ off->tx.desc = off_v1.tx.desc;
+- off->tx.flags = off_v1.tx.consumer + sizeof(u32);
++ off->tx.flags = off_v1.tx.consumer + sizeof(__u32);
+
+ off->fr.producer = off_v1.fr.producer;
+ off->fr.consumer = off_v1.fr.consumer;
+ off->fr.desc = off_v1.fr.desc;
+- off->fr.flags = off_v1.fr.consumer + sizeof(u32);
++ off->fr.flags = off_v1.fr.consumer + sizeof(__u32);
+
+ off->cr.producer = off_v1.cr.producer;
+ off->cr.consumer = off_v1.cr.consumer;
+ off->cr.desc = off_v1.cr.desc;
+- off->cr.flags = off_v1.cr.consumer + sizeof(u32);
++ off->cr.flags = off_v1.cr.consumer + sizeof(__u32);
+ }
+
+ static int xsk_get_mmap_offsets(int fd, struct xdp_mmap_offsets *off)
+--
+2.20.1
+
--- /dev/null
+From 5dd831f3a879e0cc0605977ae8e623821cc65de6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 11:30:43 +0100
+Subject: mmc: core: fix wl1251 sdio quirks
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 16568b4a4f0c34bd35cfadac63303c7af7812764 ]
+
+wl1251 and wl1271 have different vendor id and device id.
+So we need to handle both with sdio quirks.
+
+Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/mmc/core/quirks.h | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h
+index 2d2d9ea8be4f3..3dba15bccce25 100644
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -119,7 +119,14 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = {
+ END_FIXUP
+ };
+
++
+ static const struct mmc_fixup sdio_fixup_methods[] = {
++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++ add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
++
++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251,
++ add_quirk, MMC_QUIRK_DISABLE_CD),
++
+ SDIO_FIXUP(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271,
+ add_quirk, MMC_QUIRK_NONSTD_FUNC_IF),
+
+--
+2.20.1
+
--- /dev/null
+From ff2dabbb2e5ec95d2f259e62cb097353abee742e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 11:30:42 +0100
+Subject: mmc: sdio: fix wl1251 vendor id
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit e5db673e7fe2f971ec82039a28dc0811c2100e87 ]
+
+v4.11-rc1 did introduce a patch series that rearranged the
+sdio quirks into a header file. Unfortunately this did forget
+to handle SDIO_VENDOR_ID_TI differently between wl1251 and
+wl1271 with the result that although the wl1251 was found on
+the sdio bus, the firmware did not load any more and there was
+no interface registration.
+
+This patch defines separate constants to be used by sdio quirks
+and drivers.
+
+Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mmc/sdio_ids.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h
+index d1a5d5df02f57..08b25c02b5a11 100644
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -71,6 +71,8 @@
+
+ #define SDIO_VENDOR_ID_TI 0x0097
+ #define SDIO_DEVICE_ID_TI_WL1271 0x4076
++#define SDIO_VENDOR_ID_TI_WL1251 0x104c
++#define SDIO_DEVICE_ID_TI_WL1251 0x9066
+
+ #define SDIO_VENDOR_ID_STE 0x0020
+ #define SDIO_DEVICE_ID_STE_CW1200 0x2280
+--
+2.20.1
+
--- /dev/null
+From 49abfef9756b7d87ebfd45f53a7d1843f99c3e30 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 16:21:41 +0100
+Subject: mt76: mt76u: rely on usb_interface instead of usb_dev
+
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+
+[ Upstream commit 80df01f4dc79abbed724bbe0851cab3fe8ad9d99 ]
+
+usb drivers are supposed to communicate using usb_interface instead
+mt76x{0,2}u is now registering through usb_device. Fix it by passing
+usb_intf device to mt76_alloc_device routine.
+
+Fixes: 112f980ac8926 ("mt76usb: use usb_dev private data")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Tested-By: Zero_Chaos <sidhayn@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mediatek/mt76/mt76.h | 3 ++-
+ drivers/net/wireless/mediatek/mt76/mt76x0/usb.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/mt76x2/usb.c | 2 +-
+ drivers/net/wireless/mediatek/mt76/usb.c | 12 +++++++++---
+ 4 files changed, 13 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76.h b/drivers/net/wireless/mediatek/mt76/mt76.h
+index 653cdcbaaea91..502814c26b33d 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76.h
++++ b/drivers/net/wireless/mediatek/mt76/mt76.h
+@@ -799,7 +799,8 @@ static inline int
+ mt76u_bulk_msg(struct mt76_dev *dev, void *data, int len, int *actual_len,
+ int timeout)
+ {
+- struct usb_device *udev = to_usb_device(dev->dev);
++ struct usb_interface *uintf = to_usb_interface(dev->dev);
++ struct usb_device *udev = interface_to_usbdev(uintf);
+ struct mt76_usb *usb = &dev->usb;
+ unsigned int pipe;
+
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+index 00a445d275998..65d404e614040 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x0/usb.c
+@@ -226,7 +226,7 @@ static int mt76x0u_probe(struct usb_interface *usb_intf,
+ u32 mac_rev;
+ int ret;
+
+- mdev = mt76_alloc_device(&usb_dev->dev, sizeof(*dev), &mt76x0u_ops,
++ mdev = mt76_alloc_device(&usb_intf->dev, sizeof(*dev), &mt76x0u_ops,
+ &drv_ops);
+ if (!mdev)
+ return -ENOMEM;
+diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
+index da5e0f9a8baeb..8b26c61081868 100644
+--- a/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/usb.c
+@@ -39,7 +39,7 @@ static int mt76x2u_probe(struct usb_interface *intf,
+ struct mt76_dev *mdev;
+ int err;
+
+- mdev = mt76_alloc_device(&udev->dev, sizeof(*dev), &mt76x2u_ops,
++ mdev = mt76_alloc_device(&intf->dev, sizeof(*dev), &mt76x2u_ops,
+ &drv_ops);
+ if (!mdev)
+ return -ENOMEM;
+diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
+index 20c6fe510e9db..05aa42bd98083 100644
+--- a/drivers/net/wireless/mediatek/mt76/usb.c
++++ b/drivers/net/wireless/mediatek/mt76/usb.c
+@@ -20,7 +20,8 @@ static int __mt76u_vendor_request(struct mt76_dev *dev, u8 req,
+ u8 req_type, u16 val, u16 offset,
+ void *buf, size_t len)
+ {
+- struct usb_device *udev = to_usb_device(dev->dev);
++ struct usb_interface *uintf = to_usb_interface(dev->dev);
++ struct usb_device *udev = interface_to_usbdev(uintf);
+ unsigned int pipe;
+ int i, ret;
+
+@@ -235,7 +236,8 @@ mt76u_rd_rp(struct mt76_dev *dev, u32 base,
+
+ static bool mt76u_check_sg(struct mt76_dev *dev)
+ {
+- struct usb_device *udev = to_usb_device(dev->dev);
++ struct usb_interface *uintf = to_usb_interface(dev->dev);
++ struct usb_device *udev = interface_to_usbdev(uintf);
+
+ return (!disable_usb_sg && udev->bus->sg_tablesize > 0 &&
+ (udev->bus->no_sg_constraint ||
+@@ -370,7 +372,8 @@ mt76u_fill_bulk_urb(struct mt76_dev *dev, int dir, int index,
+ struct urb *urb, usb_complete_t complete_fn,
+ void *context)
+ {
+- struct usb_device *udev = to_usb_device(dev->dev);
++ struct usb_interface *uintf = to_usb_interface(dev->dev);
++ struct usb_device *udev = interface_to_usbdev(uintf);
+ unsigned int pipe;
+
+ if (dir == USB_DIR_IN)
+@@ -952,6 +955,7 @@ int mt76u_init(struct mt76_dev *dev,
+ .rd_rp = mt76u_rd_rp,
+ .type = MT76_BUS_USB,
+ };
++ struct usb_device *udev = interface_to_usbdev(intf);
+ struct mt76_usb *usb = &dev->usb;
+
+ tasklet_init(&usb->rx_tasklet, mt76u_rx_tasklet, (unsigned long)dev);
+@@ -965,6 +969,8 @@ int mt76u_init(struct mt76_dev *dev,
+ dev->bus = &mt76u_ops;
+ dev->queue_ops = &usb_queue_ops;
+
++ dev_set_drvdata(&udev->dev, dev);
++
+ usb->sg_en = mt76u_check_sg(dev);
+
+ return mt76u_set_endpoints(intf, usb);
+--
+2.20.1
+
--- /dev/null
+From 33e947d4c0a5ad936eaaa749abb204bef3d1069e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 15:54:49 +0000
+Subject: net: axienet: Fix error return code in axienet_probe()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+[ Upstream commit eb34e98baf4ce269423948dacefea6747e963b48 ]
+
+In the DMA memory resource get failed case, the error is not
+set and 0 will be returned. Fix it by removing redundant check
+since devm_ioremap_resource() will handle it.
+
+Fixes: 28ef9ebdb64c ("net: axienet: make use of axistream-connected attribute optional")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@xilinx.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+index 676006f32f913..479325eeaf8a0 100644
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1790,10 +1790,6 @@ static int axienet_probe(struct platform_device *pdev)
+ /* Check for these resources directly on the Ethernet node. */
+ struct resource *res = platform_get_resource(pdev,
+ IORESOURCE_MEM, 1);
+- if (!res) {
+- dev_err(&pdev->dev, "unable to get DMA memory resource\n");
+- goto free_netdev;
+- }
+ lp->dma_regs = devm_ioremap_resource(&pdev->dev, res);
+ lp->rx_irq = platform_get_irq(pdev, 1);
+ lp->tx_irq = platform_get_irq(pdev, 0);
+--
+2.20.1
+
--- /dev/null
+From 4bc14fc85af0b8a0bbf57fd35ae7a93838d1aecb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 14:11:49 -0800
+Subject: net: neigh: use long type to store jiffies delta
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ]
+
+A difference of two unsigned long needs long storage.
+
+Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/neighbour.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index f2452496ad9f8..920784a9b7ffa 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2049,8 +2049,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
+ goto nla_put_failure;
+ {
+ unsigned long now = jiffies;
+- unsigned int flush_delta = now - tbl->last_flush;
+- unsigned int rand_delta = now - tbl->last_rand;
++ long flush_delta = now - tbl->last_flush;
++ long rand_delta = now - tbl->last_rand;
+ struct neigh_hash_table *nht;
+ struct ndt_config ndc = {
+ .ndtc_key_len = tbl->key_len,
+--
+2.20.1
+
--- /dev/null
+From b4924c9ea8d2c445acb979e5ba65a1b0f2524843 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Oct 2019 14:40:32 +0300
+Subject: net: netsec: Correct dma sync for XDP_TX frames
+
+From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+
+[ Upstream commit d9496f3ecfe4823c1e12aecbcc29220147fa012c ]
+
+bpf_xdp_adjust_head() can change the frame boundaries. Account for the
+potential shift properly by calculating the new offset before
+syncing the buffer to the device for XDP_TX
+
+Fixes: ba2b232108d3 ("net: netsec: add XDP support")
+Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/socionext/netsec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
+index f9e6744d8fd6e..41ddd8fff2a73 100644
+--- a/drivers/net/ethernet/socionext/netsec.c
++++ b/drivers/net/ethernet/socionext/netsec.c
+@@ -847,8 +847,8 @@ static u32 netsec_xdp_queue_one(struct netsec_priv *priv,
+ enum dma_data_direction dma_dir =
+ page_pool_get_dma_dir(rx_ring->page_pool);
+
+- dma_handle = page_pool_get_dma_addr(page) +
+- NETSEC_RXBUF_HEADROOM;
++ dma_handle = page_pool_get_dma_addr(page) + xdpf->headroom +
++ sizeof(*xdpf);
+ dma_sync_single_for_device(priv->dev, dma_handle, xdpf->len,
+ dma_dir);
+ tx_desc.buf_type = TYPE_NETSEC_XDP_TX;
+--
+2.20.1
+
--- /dev/null
+From 9ff09ea2800638eee6c53611fcda273e5324bc51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 22:23:53 +0800
+Subject: net: openvswitch: don't unlock mutex when changing the user_features
+ fails
+
+From: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+
+[ Upstream commit 4c76bf696a608ea5cc555fe97ec59a9033236604 ]
+
+Unlocking of a not locked mutex is not allowed.
+Other kernel thread may be in critical section while
+we unlock it because of setting user_feature fail.
+
+Fixes: 95a7233c4 ("net: openvswitch: Set OvS recirc_id from tc chain index")
+Cc: Paul Blakey <paulb@mellanox.com>
+Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+Tested-by: Greg Rose <gvrose8192@gmail.com>
+Acked-by: William Tu <u9012063@gmail.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/openvswitch/datapath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index 23f67b8fdeaae..3eed90bfa2bff 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -1667,6 +1667,7 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ ovs_dp_reset_user_features(skb, info);
+ }
+
++ ovs_unlock();
+ goto err_destroy_meters;
+ }
+
+@@ -1683,7 +1684,6 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)
+ return 0;
+
+ err_destroy_meters:
+- ovs_unlock();
+ ovs_meters_exit(dp);
+ err_destroy_ports_array:
+ kfree(dp->ports);
+--
+2.20.1
+
--- /dev/null
+From 9c486d1efafe8d7d3b4730109ea86185373032f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 15:57:07 +0200
+Subject: net-sysfs: Call dev_hold always in netdev_queue_add_kobject
+
+From: Jouni Hogander <jouni.hogander@unikie.com>
+
+[ Upstream commit e0b60903b434a7ee21ba8d8659f207ed84101e89 ]
+
+Dev_hold has to be called always in netdev_queue_add_kobject.
+Otherwise usage count drops below 0 in case of failure in
+kobject_init_and_add.
+
+Fixes: b8eb718348b8 ("net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: David Miller <davem@davemloft.net>
+Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/net-sysfs.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
+index b4db68e5caa9a..4c826b8bf9b1e 100644
+--- a/net/core/net-sysfs.c
++++ b/net/core/net-sysfs.c
+@@ -1462,14 +1462,17 @@ static int netdev_queue_add_kobject(struct net_device *dev, int index)
+ struct kobject *kobj = &queue->kobj;
+ int error = 0;
+
++ /* Kobject_put later will trigger netdev_queue_release call
++ * which decreases dev refcount: Take that reference here
++ */
++ dev_hold(queue->dev);
++
+ kobj->kset = dev->queues_kset;
+ error = kobject_init_and_add(kobj, &netdev_queue_ktype, NULL,
+ "tx-%u", index);
+ if (error)
+ goto err;
+
+- dev_hold(queue->dev);
+-
+ #ifdef CONFIG_BQL
+ error = sysfs_create_group(kobj, &dql_group);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From b7330e272f48e83a6976c6c9475da21438b350fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Dec 2019 18:52:40 +0530
+Subject: optee: Fix multi page dynamic shm pool alloc
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+[ Upstream commit 5a769f6ff439cedc547395a6dc78faa26108f741 ]
+
+optee_shm_register() expected pages to be passed as an array of page
+pointers rather than as an array of contiguous pages. So fix that via
+correctly passing pages as per expectation.
+
+Fixes: a249dd200d03 ("tee: optee: Fix dynamic shm pool allocations")
+Reported-by: Vincent Cao <vincent.t.cao@intel.com>
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Tested-by: Vincent Cao <vincent.t.cao@intel.com>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/shm_pool.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c
+index 0332a5301d613..d767eebf30bdd 100644
+--- a/drivers/tee/optee/shm_pool.c
++++ b/drivers/tee/optee/shm_pool.c
+@@ -28,9 +28,22 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm,
+ shm->size = PAGE_SIZE << order;
+
+ if (shm->flags & TEE_SHM_DMA_BUF) {
++ unsigned int nr_pages = 1 << order, i;
++ struct page **pages;
++
++ pages = kcalloc(nr_pages, sizeof(pages), GFP_KERNEL);
++ if (!pages)
++ return -ENOMEM;
++
++ for (i = 0; i < nr_pages; i++) {
++ pages[i] = page;
++ page++;
++ }
++
+ shm->flags |= TEE_SHM_REGISTER;
+- rc = optee_shm_register(shm->ctx, shm, &page, 1 << order,
++ rc = optee_shm_register(shm->ctx, shm, pages, nr_pages,
+ (unsigned long)shm->kaddr);
++ kfree(pages);
+ }
+
+ return rc;
+--
+2.20.1
+
--- /dev/null
+From 11e125e53edb5baea613ac8e6f289c647bf5a98a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 05:07:46 -0800
+Subject: packet: fix data-race in fanout_flow_is_huge()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ]
+
+KCSAN reported the following data-race [1]
+
+Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it.
+
+Since the report hinted about multiple cpus using the history
+concurrently, I added a test avoiding writing on it if the
+victim slot already contains the desired value.
+
+[1]
+
+BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover
+
+read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1:
+ fanout_flow_is_huge net/packet/af_packet.c:1303 [inline]
+ fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0:
+ fanout_flow_is_huge net/packet/af_packet.c:1306 [inline]
+ fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353
+ packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453
+ deliver_skb net/core/dev.c:1888 [inline]
+ dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958
+ xmit_one net/core/dev.c:3195 [inline]
+ dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215
+ __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792
+ dev_queue_xmit+0x21/0x30 net/core/dev.c:3825
+ neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530
+ neigh_output include/net/neighbour.h:511 [inline]
+ ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116
+ __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
+ __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
+ ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
+ NF_HOOK_COND include/linux/netfilter.h:294 [inline]
+ ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
+ dst_output include/net/dst.h:436 [inline]
+ ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179
+ ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795
+ udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173
+ udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471
+ inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
+ sock_sendmsg_nosec net/socket.c:637 [inline]
+ sock_sendmsg+0x9f/0xc0 net/socket.c:657
+ ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311
+ __sys_sendmmsg+0x123/0x350 net/socket.c:2413
+ __do_sys_sendmmsg net/socket.c:2442 [inline]
+ __se_sys_sendmmsg net/socket.c:2439 [inline]
+ __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439
+ do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Reported by Kernel Concurrency Sanitizer on:
+CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+
+Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/packet/af_packet.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 529d4ce945db7..118cd66b75163 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1296,15 +1296,21 @@ static void packet_sock_destruct(struct sock *sk)
+
+ static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb)
+ {
+- u32 rxhash;
++ u32 *history = po->rollover->history;
++ u32 victim, rxhash;
+ int i, count = 0;
+
+ rxhash = skb_get_hash(skb);
+ for (i = 0; i < ROLLOVER_HLEN; i++)
+- if (po->rollover->history[i] == rxhash)
++ if (READ_ONCE(history[i]) == rxhash)
+ count++;
+
+- po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash;
++ victim = prandom_u32() % ROLLOVER_HLEN;
++
++ /* Avoid dirtying the cache line if possible */
++ if (READ_ONCE(history[victim]) != rxhash)
++ WRITE_ONCE(history[victim], rxhash);
++
+ return count > (ROLLOVER_HLEN >> 1);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 441912e47cb267a1f558fcec7800ee1283d01180 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 12:19:25 +0800
+Subject: PCI: mobiveil: Fix csr_read()/write() build issue
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+[ Upstream commit 4906c05b87d44c19b225935e24d62e4480ca556d ]
+
+RISCV has csr_read()/write() macros in arch/riscv/include/asm/csr.h.
+
+The same function naming is used in the PCI mobiveil driver thus
+causing build error.
+
+Rename csr_[read,write][l,] to mobiveil_csr_read()/write() to fix it.
+
+drivers/pci/controller/pcie-mobiveil.c:238:69: error: macro "csr_read" passed 3 arguments, but takes just 1
+ static u32 csr_read(struct mobiveil_pcie *pcie, u32 off, size_t size)
+
+drivers/pci/controller/pcie-mobiveil.c:253:80: error: macro "csr_write" passed 4 arguments, but takes just 2
+ static void csr_write(struct mobiveil_pcie *pcie, u32 val, u32 off, size_t size)
+
+Fixes: bcbe0d9a8d93 ("PCI: mobiveil: Unify register accessors")
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Cc: Hou Zhiqiang <Zhiqiang.Hou@nxp.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Minghuan Lian <Minghuan.Lian@nxp.com>
+Cc: Subrahmanya Lingappa <l.subrahmanya@mobiveil.co.in>
+Cc: Andrew Murray <andrew.murray@arm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/controller/pcie-mobiveil.c | 119 +++++++++++++------------
+ 1 file changed, 62 insertions(+), 57 deletions(-)
+
+diff --git a/drivers/pci/controller/pcie-mobiveil.c b/drivers/pci/controller/pcie-mobiveil.c
+index a45a6447b01d9..32f37d08d5bc7 100644
+--- a/drivers/pci/controller/pcie-mobiveil.c
++++ b/drivers/pci/controller/pcie-mobiveil.c
+@@ -235,7 +235,7 @@ static int mobiveil_pcie_write(void __iomem *addr, int size, u32 val)
+ return PCIBIOS_SUCCESSFUL;
+ }
+
+-static u32 csr_read(struct mobiveil_pcie *pcie, u32 off, size_t size)
++static u32 mobiveil_csr_read(struct mobiveil_pcie *pcie, u32 off, size_t size)
+ {
+ void *addr;
+ u32 val;
+@@ -250,7 +250,8 @@ static u32 csr_read(struct mobiveil_pcie *pcie, u32 off, size_t size)
+ return val;
+ }
+
+-static void csr_write(struct mobiveil_pcie *pcie, u32 val, u32 off, size_t size)
++static void mobiveil_csr_write(struct mobiveil_pcie *pcie, u32 val, u32 off,
++ size_t size)
+ {
+ void *addr;
+ int ret;
+@@ -262,19 +263,19 @@ static void csr_write(struct mobiveil_pcie *pcie, u32 val, u32 off, size_t size)
+ dev_err(&pcie->pdev->dev, "write CSR address failed\n");
+ }
+
+-static u32 csr_readl(struct mobiveil_pcie *pcie, u32 off)
++static u32 mobiveil_csr_readl(struct mobiveil_pcie *pcie, u32 off)
+ {
+- return csr_read(pcie, off, 0x4);
++ return mobiveil_csr_read(pcie, off, 0x4);
+ }
+
+-static void csr_writel(struct mobiveil_pcie *pcie, u32 val, u32 off)
++static void mobiveil_csr_writel(struct mobiveil_pcie *pcie, u32 val, u32 off)
+ {
+- csr_write(pcie, val, off, 0x4);
++ mobiveil_csr_write(pcie, val, off, 0x4);
+ }
+
+ static bool mobiveil_pcie_link_up(struct mobiveil_pcie *pcie)
+ {
+- return (csr_readl(pcie, LTSSM_STATUS) &
++ return (mobiveil_csr_readl(pcie, LTSSM_STATUS) &
+ LTSSM_STATUS_L0_MASK) == LTSSM_STATUS_L0;
+ }
+
+@@ -323,7 +324,7 @@ static void __iomem *mobiveil_pcie_map_bus(struct pci_bus *bus,
+ PCI_SLOT(devfn) << PAB_DEVICE_SHIFT |
+ PCI_FUNC(devfn) << PAB_FUNCTION_SHIFT;
+
+- csr_writel(pcie, value, PAB_AXI_AMAP_PEX_WIN_L(WIN_NUM_0));
++ mobiveil_csr_writel(pcie, value, PAB_AXI_AMAP_PEX_WIN_L(WIN_NUM_0));
+
+ return pcie->config_axi_slave_base + where;
+ }
+@@ -353,13 +354,14 @@ static void mobiveil_pcie_isr(struct irq_desc *desc)
+ chained_irq_enter(chip, desc);
+
+ /* read INTx status */
+- val = csr_readl(pcie, PAB_INTP_AMBA_MISC_STAT);
+- mask = csr_readl(pcie, PAB_INTP_AMBA_MISC_ENB);
++ val = mobiveil_csr_readl(pcie, PAB_INTP_AMBA_MISC_STAT);
++ mask = mobiveil_csr_readl(pcie, PAB_INTP_AMBA_MISC_ENB);
+ intr_status = val & mask;
+
+ /* Handle INTx */
+ if (intr_status & PAB_INTP_INTX_MASK) {
+- shifted_status = csr_readl(pcie, PAB_INTP_AMBA_MISC_STAT);
++ shifted_status = mobiveil_csr_readl(pcie,
++ PAB_INTP_AMBA_MISC_STAT);
+ shifted_status &= PAB_INTP_INTX_MASK;
+ shifted_status >>= PAB_INTX_START;
+ do {
+@@ -373,12 +375,13 @@ static void mobiveil_pcie_isr(struct irq_desc *desc)
+ bit);
+
+ /* clear interrupt handled */
+- csr_writel(pcie, 1 << (PAB_INTX_START + bit),
+- PAB_INTP_AMBA_MISC_STAT);
++ mobiveil_csr_writel(pcie,
++ 1 << (PAB_INTX_START + bit),
++ PAB_INTP_AMBA_MISC_STAT);
+ }
+
+- shifted_status = csr_readl(pcie,
+- PAB_INTP_AMBA_MISC_STAT);
++ shifted_status = mobiveil_csr_readl(pcie,
++ PAB_INTP_AMBA_MISC_STAT);
+ shifted_status &= PAB_INTP_INTX_MASK;
+ shifted_status >>= PAB_INTX_START;
+ } while (shifted_status != 0);
+@@ -413,7 +416,7 @@ static void mobiveil_pcie_isr(struct irq_desc *desc)
+ }
+
+ /* Clear the interrupt status */
+- csr_writel(pcie, intr_status, PAB_INTP_AMBA_MISC_STAT);
++ mobiveil_csr_writel(pcie, intr_status, PAB_INTP_AMBA_MISC_STAT);
+ chained_irq_exit(chip, desc);
+ }
+
+@@ -474,24 +477,24 @@ static void program_ib_windows(struct mobiveil_pcie *pcie, int win_num,
+ return;
+ }
+
+- value = csr_readl(pcie, PAB_PEX_AMAP_CTRL(win_num));
++ value = mobiveil_csr_readl(pcie, PAB_PEX_AMAP_CTRL(win_num));
+ value &= ~(AMAP_CTRL_TYPE_MASK << AMAP_CTRL_TYPE_SHIFT | WIN_SIZE_MASK);
+ value |= type << AMAP_CTRL_TYPE_SHIFT | 1 << AMAP_CTRL_EN_SHIFT |
+ (lower_32_bits(size64) & WIN_SIZE_MASK);
+- csr_writel(pcie, value, PAB_PEX_AMAP_CTRL(win_num));
++ mobiveil_csr_writel(pcie, value, PAB_PEX_AMAP_CTRL(win_num));
+
+- csr_writel(pcie, upper_32_bits(size64),
+- PAB_EXT_PEX_AMAP_SIZEN(win_num));
++ mobiveil_csr_writel(pcie, upper_32_bits(size64),
++ PAB_EXT_PEX_AMAP_SIZEN(win_num));
+
+- csr_writel(pcie, lower_32_bits(cpu_addr),
+- PAB_PEX_AMAP_AXI_WIN(win_num));
+- csr_writel(pcie, upper_32_bits(cpu_addr),
+- PAB_EXT_PEX_AMAP_AXI_WIN(win_num));
++ mobiveil_csr_writel(pcie, lower_32_bits(cpu_addr),
++ PAB_PEX_AMAP_AXI_WIN(win_num));
++ mobiveil_csr_writel(pcie, upper_32_bits(cpu_addr),
++ PAB_EXT_PEX_AMAP_AXI_WIN(win_num));
+
+- csr_writel(pcie, lower_32_bits(pci_addr),
+- PAB_PEX_AMAP_PEX_WIN_L(win_num));
+- csr_writel(pcie, upper_32_bits(pci_addr),
+- PAB_PEX_AMAP_PEX_WIN_H(win_num));
++ mobiveil_csr_writel(pcie, lower_32_bits(pci_addr),
++ PAB_PEX_AMAP_PEX_WIN_L(win_num));
++ mobiveil_csr_writel(pcie, upper_32_bits(pci_addr),
++ PAB_PEX_AMAP_PEX_WIN_H(win_num));
+
+ pcie->ib_wins_configured++;
+ }
+@@ -515,27 +518,29 @@ static void program_ob_windows(struct mobiveil_pcie *pcie, int win_num,
+ * program Enable Bit to 1, Type Bit to (00) base 2, AXI Window Size Bit
+ * to 4 KB in PAB_AXI_AMAP_CTRL register
+ */
+- value = csr_readl(pcie, PAB_AXI_AMAP_CTRL(win_num));
++ value = mobiveil_csr_readl(pcie, PAB_AXI_AMAP_CTRL(win_num));
+ value &= ~(WIN_TYPE_MASK << WIN_TYPE_SHIFT | WIN_SIZE_MASK);
+ value |= 1 << WIN_ENABLE_SHIFT | type << WIN_TYPE_SHIFT |
+ (lower_32_bits(size64) & WIN_SIZE_MASK);
+- csr_writel(pcie, value, PAB_AXI_AMAP_CTRL(win_num));
++ mobiveil_csr_writel(pcie, value, PAB_AXI_AMAP_CTRL(win_num));
+
+- csr_writel(pcie, upper_32_bits(size64), PAB_EXT_AXI_AMAP_SIZE(win_num));
++ mobiveil_csr_writel(pcie, upper_32_bits(size64),
++ PAB_EXT_AXI_AMAP_SIZE(win_num));
+
+ /*
+ * program AXI window base with appropriate value in
+ * PAB_AXI_AMAP_AXI_WIN0 register
+ */
+- csr_writel(pcie, lower_32_bits(cpu_addr) & (~AXI_WINDOW_ALIGN_MASK),
+- PAB_AXI_AMAP_AXI_WIN(win_num));
+- csr_writel(pcie, upper_32_bits(cpu_addr),
+- PAB_EXT_AXI_AMAP_AXI_WIN(win_num));
++ mobiveil_csr_writel(pcie,
++ lower_32_bits(cpu_addr) & (~AXI_WINDOW_ALIGN_MASK),
++ PAB_AXI_AMAP_AXI_WIN(win_num));
++ mobiveil_csr_writel(pcie, upper_32_bits(cpu_addr),
++ PAB_EXT_AXI_AMAP_AXI_WIN(win_num));
+
+- csr_writel(pcie, lower_32_bits(pci_addr),
+- PAB_AXI_AMAP_PEX_WIN_L(win_num));
+- csr_writel(pcie, upper_32_bits(pci_addr),
+- PAB_AXI_AMAP_PEX_WIN_H(win_num));
++ mobiveil_csr_writel(pcie, lower_32_bits(pci_addr),
++ PAB_AXI_AMAP_PEX_WIN_L(win_num));
++ mobiveil_csr_writel(pcie, upper_32_bits(pci_addr),
++ PAB_AXI_AMAP_PEX_WIN_H(win_num));
+
+ pcie->ob_wins_configured++;
+ }
+@@ -579,42 +584,42 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
+ struct resource_entry *win;
+
+ /* setup bus numbers */
+- value = csr_readl(pcie, PCI_PRIMARY_BUS);
++ value = mobiveil_csr_readl(pcie, PCI_PRIMARY_BUS);
+ value &= 0xff000000;
+ value |= 0x00ff0100;
+- csr_writel(pcie, value, PCI_PRIMARY_BUS);
++ mobiveil_csr_writel(pcie, value, PCI_PRIMARY_BUS);
+
+ /*
+ * program Bus Master Enable Bit in Command Register in PAB Config
+ * Space
+ */
+- value = csr_readl(pcie, PCI_COMMAND);
++ value = mobiveil_csr_readl(pcie, PCI_COMMAND);
+ value |= PCI_COMMAND_IO | PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER;
+- csr_writel(pcie, value, PCI_COMMAND);
++ mobiveil_csr_writel(pcie, value, PCI_COMMAND);
+
+ /*
+ * program PIO Enable Bit to 1 (and PEX PIO Enable to 1) in PAB_CTRL
+ * register
+ */
+- pab_ctrl = csr_readl(pcie, PAB_CTRL);
++ pab_ctrl = mobiveil_csr_readl(pcie, PAB_CTRL);
+ pab_ctrl |= (1 << AMBA_PIO_ENABLE_SHIFT) | (1 << PEX_PIO_ENABLE_SHIFT);
+- csr_writel(pcie, pab_ctrl, PAB_CTRL);
++ mobiveil_csr_writel(pcie, pab_ctrl, PAB_CTRL);
+
+- csr_writel(pcie, (PAB_INTP_INTX_MASK | PAB_INTP_MSI_MASK),
+- PAB_INTP_AMBA_MISC_ENB);
++ mobiveil_csr_writel(pcie, (PAB_INTP_INTX_MASK | PAB_INTP_MSI_MASK),
++ PAB_INTP_AMBA_MISC_ENB);
+
+ /*
+ * program PIO Enable Bit to 1 and Config Window Enable Bit to 1 in
+ * PAB_AXI_PIO_CTRL Register
+ */
+- value = csr_readl(pcie, PAB_AXI_PIO_CTRL);
++ value = mobiveil_csr_readl(pcie, PAB_AXI_PIO_CTRL);
+ value |= APIO_EN_MASK;
+- csr_writel(pcie, value, PAB_AXI_PIO_CTRL);
++ mobiveil_csr_writel(pcie, value, PAB_AXI_PIO_CTRL);
+
+ /* Enable PCIe PIO master */
+- value = csr_readl(pcie, PAB_PEX_PIO_CTRL);
++ value = mobiveil_csr_readl(pcie, PAB_PEX_PIO_CTRL);
+ value |= 1 << PIO_ENABLE_SHIFT;
+- csr_writel(pcie, value, PAB_PEX_PIO_CTRL);
++ mobiveil_csr_writel(pcie, value, PAB_PEX_PIO_CTRL);
+
+ /*
+ * we'll program one outbound window for config reads and
+@@ -647,10 +652,10 @@ static int mobiveil_host_init(struct mobiveil_pcie *pcie)
+ }
+
+ /* fixup for PCIe class register */
+- value = csr_readl(pcie, PAB_INTP_AXI_PIO_CLASS);
++ value = mobiveil_csr_readl(pcie, PAB_INTP_AXI_PIO_CLASS);
+ value &= 0xff;
+ value |= (PCI_CLASS_BRIDGE_PCI << 16);
+- csr_writel(pcie, value, PAB_INTP_AXI_PIO_CLASS);
++ mobiveil_csr_writel(pcie, value, PAB_INTP_AXI_PIO_CLASS);
+
+ /* setup MSI hardware registers */
+ mobiveil_pcie_enable_msi(pcie);
+@@ -668,9 +673,9 @@ static void mobiveil_mask_intx_irq(struct irq_data *data)
+ pcie = irq_desc_get_chip_data(desc);
+ mask = 1 << ((data->hwirq + PAB_INTX_START) - 1);
+ raw_spin_lock_irqsave(&pcie->intx_mask_lock, flags);
+- shifted_val = csr_readl(pcie, PAB_INTP_AMBA_MISC_ENB);
++ shifted_val = mobiveil_csr_readl(pcie, PAB_INTP_AMBA_MISC_ENB);
+ shifted_val &= ~mask;
+- csr_writel(pcie, shifted_val, PAB_INTP_AMBA_MISC_ENB);
++ mobiveil_csr_writel(pcie, shifted_val, PAB_INTP_AMBA_MISC_ENB);
+ raw_spin_unlock_irqrestore(&pcie->intx_mask_lock, flags);
+ }
+
+@@ -684,9 +689,9 @@ static void mobiveil_unmask_intx_irq(struct irq_data *data)
+ pcie = irq_desc_get_chip_data(desc);
+ mask = 1 << ((data->hwirq + PAB_INTX_START) - 1);
+ raw_spin_lock_irqsave(&pcie->intx_mask_lock, flags);
+- shifted_val = csr_readl(pcie, PAB_INTP_AMBA_MISC_ENB);
++ shifted_val = mobiveil_csr_readl(pcie, PAB_INTP_AMBA_MISC_ENB);
+ shifted_val |= mask;
+- csr_writel(pcie, shifted_val, PAB_INTP_AMBA_MISC_ENB);
++ mobiveil_csr_writel(pcie, shifted_val, PAB_INTP_AMBA_MISC_ENB);
+ raw_spin_unlock_irqrestore(&pcie->intx_mask_lock, flags);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8a5baf08b889d168a9f685558578dfe25d458731 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Dec 2019 08:49:19 +0000
+Subject: phy/rockchip: inno-hdmi: round clock rate down to closest 1000 Hz
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+[ Upstream commit 4f510aa10468954b1da4e94689c38ac6ea8d3627 ]
+
+Commit 287422a95fe2 ("drm/rockchip: Round up _before_ giving to the clock framework")
+changed what rate clk_round_rate() is called with, an additional 999 Hz
+added to the requsted mode clock. This has caused a regression on RK3328
+and presumably also on RK3228 because the inno-hdmi-phy clock requires an
+exact match of the requested rate in the pre pll config table.
+
+When an exact match is not found the parent clock rate (24MHz) is returned
+to the clk_round_rate() caller. This cause wrong pixel clock to be used and
+result in no-signal when configuring a mode on RK3328.
+
+Fix this by rounding the rate down to closest 1000 Hz in round_rate func,
+this allows an exact match to be found in pre pll config table.
+
+Fixes: 287422a95fe2 ("drm/rockchip: Round up _before_ giving to the clock framework")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
+index 2b97fb1185a00..9ca20c947283d 100644
+--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
++++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
+@@ -603,6 +603,8 @@ static long inno_hdmi_phy_rk3228_clk_round_rate(struct clk_hw *hw,
+ {
+ const struct pre_pll_config *cfg = pre_pll_cfg_table;
+
++ rate = (rate / 1000) * 1000;
++
+ for (; cfg->pixclock != 0; cfg++)
+ if (cfg->pixclock == rate && !cfg->fracdiv)
+ break;
+@@ -755,6 +757,8 @@ static long inno_hdmi_phy_rk3328_clk_round_rate(struct clk_hw *hw,
+ {
+ const struct pre_pll_config *cfg = pre_pll_cfg_table;
+
++ rate = (rate / 1000) * 1000;
++
+ for (; cfg->pixclock != 0; cfg++)
+ if (cfg->pixclock == rate)
+ break;
+--
+2.20.1
+
--- /dev/null
+From a4997c0ee67f224c15c70b422a4e89b89a090ea0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 30 Nov 2019 21:08:42 +0800
+Subject: platform/chrome: wilco_ec: fix use after free issue
+
+From: Wen Yang <wenyang@linux.alibaba.com>
+
+[ Upstream commit 856a0a6e2d09d31fd8f00cc1fc6645196a509d56 ]
+
+This is caused by dereferencing 'dev_data' after put_device() in
+the telem_device_remove() function.
+This patch just moves the put_device() down a bit to avoid this
+issue.
+
+Fixes: 1210d1e6bad1 ("platform/chrome: wilco_ec: Add telemetry char device interface")
+Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
+Cc: Benson Leung <bleung@chromium.org>
+Cc: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Cc: Nick Crews <ncrews@chromium.org>
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/chrome/wilco_ec/telemetry.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/chrome/wilco_ec/telemetry.c b/drivers/platform/chrome/wilco_ec/telemetry.c
+index b9d03c33d8dc1..1176d543191af 100644
+--- a/drivers/platform/chrome/wilco_ec/telemetry.c
++++ b/drivers/platform/chrome/wilco_ec/telemetry.c
+@@ -406,8 +406,8 @@ static int telem_device_remove(struct platform_device *pdev)
+ struct telem_device_data *dev_data = platform_get_drvdata(pdev);
+
+ cdev_device_del(&dev_data->cdev, &dev_data->dev);
+- put_device(&dev_data->dev);
+ ida_simple_remove(&telem_ida, MINOR(dev_data->dev.devt));
++ put_device(&dev_data->dev);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From b5f88b99bec27e3b92c7d164cee0dad643dee1a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 15:35:24 +0300
+Subject: power: supply: bd70528: Add MODULE_ALIAS to allow module auto loading
+
+From: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+
+[ Upstream commit 9480029fe5c24d482efad38dc631bd555fc7afe2 ]
+
+The bd70528 charger driver is probed by MFD driver. Add MODULE_ALIAS
+in order to allow udev to load the module when MFD sub-device cell for
+charger is added.
+
+Fixes: f8c7f7ddd8ef0 ("power: supply: Initial support for ROHM BD70528 PMIC charger block")
+Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/bd70528-charger.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/power/supply/bd70528-charger.c b/drivers/power/supply/bd70528-charger.c
+index 1bb32b7226d74..b8e1ec106627f 100644
+--- a/drivers/power/supply/bd70528-charger.c
++++ b/drivers/power/supply/bd70528-charger.c
+@@ -741,3 +741,4 @@ module_platform_driver(bd70528_power);
+ MODULE_AUTHOR("Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>");
+ MODULE_DESCRIPTION("BD70528 power-supply driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:bd70528-power");
+--
+2.20.1
+
--- /dev/null
+From b05b099cf51286d1717388693acf98a7bc9607b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 14 Oct 2019 15:53:03 +0200
+Subject: pwm: sun4i: Fix incorrect calculation of duty_cycle/period
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit 50cc7e3e4f26e3bf5ed74a8d061195c4d2161b8b ]
+
+Since 5.4-rc1, pwm_apply_state calls ->get_state after ->apply
+if available, and this revealed an issue with integer precision
+when calculating duty_cycle and period for the currently set
+state in ->get_state callback.
+
+This issue manifested in broken backlight on several Allwinner
+based devices.
+
+Previously this worked, because ->apply updated the passed state
+directly.
+
+Fixes: deb9c462f4e53 ("pwm: sun4i: Don't update the state for the caller of pwm_apply_state")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-sun4i.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-sun4i.c b/drivers/pwm/pwm-sun4i.c
+index 6f5840a1a82dc..05273725a9fff 100644
+--- a/drivers/pwm/pwm-sun4i.c
++++ b/drivers/pwm/pwm-sun4i.c
+@@ -137,10 +137,10 @@ static void sun4i_pwm_get_state(struct pwm_chip *chip,
+
+ val = sun4i_pwm_readl(sun4i_pwm, PWM_CH_PRD(pwm->hwpwm));
+
+- tmp = prescaler * NSEC_PER_SEC * PWM_REG_DTY(val);
++ tmp = (u64)prescaler * NSEC_PER_SEC * PWM_REG_DTY(val);
+ state->duty_cycle = DIV_ROUND_CLOSEST_ULL(tmp, clk_rate);
+
+- tmp = prescaler * NSEC_PER_SEC * PWM_REG_PRD(val);
++ tmp = (u64)prescaler * NSEC_PER_SEC * PWM_REG_PRD(val);
+ state->period = DIV_ROUND_CLOSEST_ULL(tmp, clk_rate);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From af8a2c1910ae9f34100e998423d0ac2fb4f1b54a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 17:26:34 +0300
+Subject: rcu: Fix uninitialized variable in nocb_gp_wait()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit b8889c9c89a2655a231dfed93cc9bdca0930ea67 ]
+
+We never set this to false. This probably doesn't affect most people's
+runtime because GCC will automatically initialize it to false at certain
+common optimization levels. But that behavior is related to a bug in
+GCC and obviously should not be relied on.
+
+Fixes: 5d6742b37727 ("rcu/nocb: Use rcu_segcblist for no-CBs CPUs")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/rcu/tree_plugin.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index 2defc7fe74c39..fa08d55f7040c 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -1946,7 +1946,7 @@ static void nocb_gp_wait(struct rcu_data *my_rdp)
+ int __maybe_unused cpu = my_rdp->cpu;
+ unsigned long cur_gp_seq;
+ unsigned long flags;
+- bool gotcbs;
++ bool gotcbs = false;
+ unsigned long j = jiffies;
+ bool needwait_gp = false; // This prevents actual uninitialized use.
+ bool needwake;
+--
+2.20.1
+
--- /dev/null
+From 3fbbf46aa494fdd2f448766d1101b9d0281f321c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 15:14:52 +0300
+Subject: regulator: bd70528: Add MODULE_ALIAS to allow module auto loading
+
+From: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+
+[ Upstream commit 55d5f62c3fa005a6a8010363d7d1855909ceefbc ]
+
+The bd70528 regulator driver is probed by MFD driver. Add MODULE_ALIAS
+in order to allow udev to load the module when MFD sub-device cell for
+regulators is added.
+
+Fixes: 99ea37bd1e7d7 ("regulator: bd70528: Support ROHM BD70528 regulator block")
+Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Link: https://lore.kernel.org/r/20191023121452.GA1812@localhost.localdomain
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/bd70528-regulator.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/regulator/bd70528-regulator.c b/drivers/regulator/bd70528-regulator.c
+index 6041839ec38ca..5bf8a2dc5fe77 100644
+--- a/drivers/regulator/bd70528-regulator.c
++++ b/drivers/regulator/bd70528-regulator.c
+@@ -285,3 +285,4 @@ module_platform_driver(bd70528_regulator);
+ MODULE_AUTHOR("Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>");
+ MODULE_DESCRIPTION("BD70528 voltage regulator driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:bd70528-pmic");
+--
+2.20.1
+
--- /dev/null
+From 05cfcb9e346d18acfb33f70b271f3a7460a527f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 18:47:01 +0100
+Subject: rt2800: remove errornous duplicate condition
+
+From: Daniel Golle <daniel@makrotopia.org>
+
+[ Upstream commit a1f7c2cabf701a17b1a05d6526bbdadc3d05e05c ]
+
+On 2019-10-28 06:07, wbob wrote:
+> Hello Roman,
+>
+> while reading around drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+> I stumbled on what I think is an edit of yours made in error in march
+> 2017:
+>
+> https://github.com/torvalds/linux/commit/41977e86#diff-dae5dc10da180f3b055809a48118e18aR5281
+>
+> RT6352 in line 5281 should not have been introduced as the "else if"
+> below line 5291 can then not take effect for a RT6352 device. Another
+> possibility is for line 5291 to be not for RT6352, but this seems
+> very unlikely. Are you able to clarify still after this substantial time?
+>
+> 5277: static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+> ...
+> 5279: } else if (rt2x00_rt(rt2x00dev, RT5390) ||
+> 5280: rt2x00_rt(rt2x00dev, RT5392) ||
+> 5281: rt2x00_rt(rt2x00dev, RT6352)) {
+> ...
+> 5291: } else if (rt2x00_rt(rt2x00dev, RT6352)) {
+> ...
+
+Hence remove errornous line 5281 to make the driver actually
+execute the correct initialization routine for MT7620 chips.
+
+As it was requested by Stanislaw Gruszka remove setting values of
+MIMO_PS_CFG and TX_PIN_CFG. MIMO_PS_CFG is responsible for MIMO
+power-safe mode (which is disabled), hence we can drop setting it.
+TX_PIN_CFG is set correctly in other functions, and as setting this
+value breaks some devices, rather don't set it here during init, but
+only modify it later on.
+
+Fixes: 41977e86c984 ("rt2x00: add support for MT7620")
+Reported-by: wbob <wbob@jify.de>
+Reported-by: Roman Yeryomin <roman@advem.lv>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+index f1cdcd61c54a5..c99f1912e2660 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5839,8 +5839,7 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+ rt2800_register_write(rt2x00dev, TX_TXBF_CFG_0, 0x8000fc21);
+ rt2800_register_write(rt2x00dev, TX_TXBF_CFG_3, 0x00009c40);
+ } else if (rt2x00_rt(rt2x00dev, RT5390) ||
+- rt2x00_rt(rt2x00dev, RT5392) ||
+- rt2x00_rt(rt2x00dev, RT6352)) {
++ rt2x00_rt(rt2x00dev, RT5392)) {
+ rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+@@ -5854,8 +5853,6 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
+ rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
+ rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+- rt2800_register_write(rt2x00dev, MIMO_PS_CFG, 0x00000002);
+- rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x00150F0F);
+ rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
+ rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
+ rt2800_register_write(rt2x00dev, TX1_BB_GAIN_ATTEN, 0x0);
+--
+2.20.1
+
--- /dev/null
+From 8c5e916d2e07ee2a4c1bb23f6bfc2aff6e5cc8a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 08:34:18 +0000
+Subject: rtc: bd70528: fix module alias to autoload module
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit afe19a7ae8b6b6032d04d3895ebd5bbac7fe9f30 ]
+
+The module alias platform tag contains a spelling mistake. Fix it.
+
+Fixes: f33506abbcdd ("rtc: bd70528: Add MODULE ALIAS to autoload module")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Link: https://lore.kernel.org/r/20191106083418.159045-1-colin.king@canonical.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/rtc/rtc-bd70528.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/rtc/rtc-bd70528.c b/drivers/rtc/rtc-bd70528.c
+index ddfef4d43bab7..627037aa66a80 100644
+--- a/drivers/rtc/rtc-bd70528.c
++++ b/drivers/rtc/rtc-bd70528.c
+@@ -491,4 +491,4 @@ module_platform_driver(bd70528_rtc);
+ MODULE_AUTHOR("Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>");
+ MODULE_DESCRIPTION("BD70528 RTC driver");
+ MODULE_LICENSE("GPL");
+-MODULE_ALIAS("platofrm:bd70528-rtc");
++MODULE_ALIAS("platform:bd70528-rtc");
+--
+2.20.1
+
--- /dev/null
+From 170428ed0de40e95953026ba70a874eb5635d445 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 5 Dec 2019 14:33:04 +0100
+Subject: s390/qeth: fix dangling IO buffers after halt/clear
+
+From: Julian Wiedmann <jwi@linux.ibm.com>
+
+[ Upstream commit f9e50b02a99c3ebbaa30690e8d5be28a5c2624eb ]
+
+The cio layer's intparm logic does not align itself well with how qeth
+manages cmd IOs. When an active IO gets terminated via halt/clear, the
+corresponding IRQ's intparm does not reflect the cmd buffer but rather
+the intparm that was passed to ccw_device_halt() / ccw_device_clear().
+This behaviour was recently clarified in
+commit b91d9e67e50b ("s390/cio: fix intparm documentation").
+
+As a result, qeth_irq() currently doesn't cancel a cmd that was
+terminated via halt/clear. This primarily causes us to leak
+card->read_cmd after the qeth device is removed, since our IO path still
+holds a refcount for this cmd.
+
+For qeth this means that we need to keep track of which IO is pending on
+a device ('active_cmd'), and use this as the intparm when calling
+halt/clear. Otherwise qeth_irq() can't match the subsequent IRQ to its
+cmd buffer.
+Since we now keep track of the _expected_ intparm, we can also detect
+any mismatch; this would constitute a bug somewhere in the lower layers.
+In this case cancel the active cmd - we effectively "lost" the IRQ and
+should not expect any further notification for this IO.
+
+Fixes: 405548959cc7 ("s390/qeth: add support for dynamically allocated cmds")
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/net/qeth_core.h | 3 ++
+ drivers/s390/net/qeth_core_main.c | 71 ++++++++++++++++++++++---------
+ drivers/s390/net/qeth_core_mpc.h | 14 ------
+ drivers/s390/net/qeth_l2_main.c | 12 +++---
+ drivers/s390/net/qeth_l3_main.c | 13 +++---
+ 5 files changed, 67 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 65e31df37b1f6..820f2c29376c0 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -620,6 +620,7 @@ struct qeth_ipato {
+
+ struct qeth_channel {
+ struct ccw_device *ccwdev;
++ struct qeth_cmd_buffer *active_cmd;
+ enum qeth_channel_states state;
+ atomic_t irq_pending;
+ };
+@@ -1024,6 +1025,8 @@ int qeth_do_run_thread(struct qeth_card *, unsigned long);
+ void qeth_clear_thread_start_bit(struct qeth_card *, unsigned long);
+ void qeth_clear_thread_running_bit(struct qeth_card *, unsigned long);
+ int qeth_core_hardsetup_card(struct qeth_card *card, bool *carrier_ok);
++int qeth_stop_channel(struct qeth_channel *channel);
++
+ void qeth_print_status_message(struct qeth_card *);
+ int qeth_init_qdio_queues(struct qeth_card *);
+ int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *,
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 5be4d800e4baa..23852888eb2ca 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -515,7 +515,9 @@ static int __qeth_issue_next_read(struct qeth_card *card)
+
+ QETH_CARD_TEXT(card, 6, "noirqpnd");
+ rc = ccw_device_start(channel->ccwdev, ccw, (addr_t) iob, 0, 0);
+- if (rc) {
++ if (!rc) {
++ channel->active_cmd = iob;
++ } else {
+ QETH_DBF_MESSAGE(2, "error %i on device %x when starting next read ccw!\n",
+ rc, CARD_DEVID(card));
+ atomic_set(&channel->irq_pending, 0);
+@@ -986,8 +988,21 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ QETH_CARD_TEXT(card, 5, "data");
+ }
+
+- if (qeth_intparm_is_iob(intparm))
+- iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
++ if (intparm == 0) {
++ QETH_CARD_TEXT(card, 5, "irqunsol");
++ } else if ((addr_t)intparm != (addr_t)channel->active_cmd) {
++ QETH_CARD_TEXT(card, 5, "irqunexp");
++
++ dev_err(&cdev->dev,
++ "Received IRQ with intparm %lx, expected %px\n",
++ intparm, channel->active_cmd);
++ if (channel->active_cmd)
++ qeth_cancel_cmd(channel->active_cmd, -EIO);
++ } else {
++ iob = (struct qeth_cmd_buffer *) (addr_t)intparm;
++ }
++
++ channel->active_cmd = NULL;
+
+ rc = qeth_check_irb_error(card, cdev, irb);
+ if (rc) {
+@@ -1007,15 +1022,10 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ if (irb->scsw.cmd.fctl & (SCSW_FCTL_HALT_FUNC))
+ channel->state = CH_STATE_HALTED;
+
+- if (intparm == QETH_CLEAR_CHANNEL_PARM) {
+- QETH_CARD_TEXT(card, 6, "clrchpar");
+- /* we don't have to handle this further */
+- intparm = 0;
+- }
+- if (intparm == QETH_HALT_CHANNEL_PARM) {
+- QETH_CARD_TEXT(card, 6, "hltchpar");
+- /* we don't have to handle this further */
+- intparm = 0;
++ if (iob && (irb->scsw.cmd.fctl & (SCSW_FCTL_CLEAR_FUNC |
++ SCSW_FCTL_HALT_FUNC))) {
++ qeth_cancel_cmd(iob, -ECANCELED);
++ iob = NULL;
+ }
+
+ cstat = irb->scsw.cmd.cstat;
+@@ -1408,7 +1418,7 @@ static int qeth_clear_channel(struct qeth_card *card,
+
+ QETH_CARD_TEXT(card, 3, "clearch");
+ spin_lock_irq(get_ccwdev_lock(channel->ccwdev));
+- rc = ccw_device_clear(channel->ccwdev, QETH_CLEAR_CHANNEL_PARM);
++ rc = ccw_device_clear(channel->ccwdev, (addr_t)channel->active_cmd);
+ spin_unlock_irq(get_ccwdev_lock(channel->ccwdev));
+
+ if (rc)
+@@ -1430,7 +1440,7 @@ static int qeth_halt_channel(struct qeth_card *card,
+
+ QETH_CARD_TEXT(card, 3, "haltch");
+ spin_lock_irq(get_ccwdev_lock(channel->ccwdev));
+- rc = ccw_device_halt(channel->ccwdev, QETH_HALT_CHANNEL_PARM);
++ rc = ccw_device_halt(channel->ccwdev, (addr_t)channel->active_cmd);
+ spin_unlock_irq(get_ccwdev_lock(channel->ccwdev));
+
+ if (rc)
+@@ -1444,6 +1454,25 @@ static int qeth_halt_channel(struct qeth_card *card,
+ return 0;
+ }
+
++int qeth_stop_channel(struct qeth_channel *channel)
++{
++ struct ccw_device *cdev = channel->ccwdev;
++ int rc;
++
++ rc = ccw_device_set_offline(cdev);
++
++ spin_lock_irq(get_ccwdev_lock(cdev));
++ if (channel->active_cmd) {
++ dev_err(&cdev->dev, "Stopped channel while cmd %px was still active\n",
++ channel->active_cmd);
++ channel->active_cmd = NULL;
++ }
++ spin_unlock_irq(get_ccwdev_lock(cdev));
++
++ return rc;
++}
++EXPORT_SYMBOL_GPL(qeth_stop_channel);
++
+ static int qeth_halt_channels(struct qeth_card *card)
+ {
+ int rc1 = 0, rc2 = 0, rc3 = 0;
+@@ -1747,6 +1776,8 @@ static int qeth_send_control_data(struct qeth_card *card,
+ spin_lock_irq(get_ccwdev_lock(channel->ccwdev));
+ rc = ccw_device_start_timeout(channel->ccwdev, __ccw_from_cmd(iob),
+ (addr_t) iob, 0, 0, timeout);
++ if (!rc)
++ channel->active_cmd = iob;
+ spin_unlock_irq(get_ccwdev_lock(channel->ccwdev));
+ if (rc) {
+ QETH_DBF_MESSAGE(2, "qeth_send_control_data on device %x: ccw_device_start rc = %i\n",
+@@ -4625,12 +4656,12 @@ EXPORT_SYMBOL_GPL(qeth_vm_request_mac);
+
+ static void qeth_determine_capabilities(struct qeth_card *card)
+ {
++ struct qeth_channel *channel = &card->data;
++ struct ccw_device *ddev = channel->ccwdev;
+ int rc;
+- struct ccw_device *ddev;
+ int ddev_offline = 0;
+
+ QETH_CARD_TEXT(card, 2, "detcapab");
+- ddev = CARD_DDEV(card);
+ if (!ddev->online) {
+ ddev_offline = 1;
+ rc = ccw_device_set_online(ddev);
+@@ -4669,7 +4700,7 @@ static void qeth_determine_capabilities(struct qeth_card *card)
+
+ out_offline:
+ if (ddev_offline == 1)
+- ccw_device_set_offline(ddev);
++ qeth_stop_channel(channel);
+ out:
+ return;
+ }
+@@ -4870,9 +4901,9 @@ retry:
+ QETH_DBF_MESSAGE(2, "Retrying to do IDX activates on device %x.\n",
+ CARD_DEVID(card));
+ rc = qeth_qdio_clear_card(card, !IS_IQD(card));
+- ccw_device_set_offline(CARD_DDEV(card));
+- ccw_device_set_offline(CARD_WDEV(card));
+- ccw_device_set_offline(CARD_RDEV(card));
++ qeth_stop_channel(&card->data);
++ qeth_stop_channel(&card->write);
++ qeth_stop_channel(&card->read);
+ qdio_free(CARD_DDEV(card));
+ rc = ccw_device_set_online(CARD_RDEV(card));
+ if (rc)
+diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h
+index b7c17b5c823b2..65038539b324b 100644
+--- a/drivers/s390/net/qeth_core_mpc.h
++++ b/drivers/s390/net/qeth_core_mpc.h
+@@ -28,20 +28,6 @@ extern unsigned char IPA_PDU_HEADER[];
+ #define QETH_TIMEOUT (10 * HZ)
+ #define QETH_IPA_TIMEOUT (45 * HZ)
+
+-#define QETH_CLEAR_CHANNEL_PARM -10
+-#define QETH_HALT_CHANNEL_PARM -11
+-
+-static inline bool qeth_intparm_is_iob(unsigned long intparm)
+-{
+- switch (intparm) {
+- case QETH_CLEAR_CHANNEL_PARM:
+- case QETH_HALT_CHANNEL_PARM:
+- case 0:
+- return false;
+- }
+- return true;
+-}
+-
+ /*****************************************************************************/
+ /* IP Assist related definitions */
+ /*****************************************************************************/
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 11e3292c0adfc..59e220749ad1f 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -877,9 +877,9 @@ static int qeth_l2_set_online(struct ccwgroup_device *gdev)
+
+ out_remove:
+ qeth_l2_stop_card(card);
+- ccw_device_set_offline(CARD_DDEV(card));
+- ccw_device_set_offline(CARD_WDEV(card));
+- ccw_device_set_offline(CARD_RDEV(card));
++ qeth_stop_channel(&card->data);
++ qeth_stop_channel(&card->write);
++ qeth_stop_channel(&card->read);
+ qdio_free(CARD_DDEV(card));
+
+ mutex_unlock(&card->conf_mutex);
+@@ -910,9 +910,9 @@ static int __qeth_l2_set_offline(struct ccwgroup_device *cgdev,
+ rtnl_unlock();
+
+ qeth_l2_stop_card(card);
+- rc = ccw_device_set_offline(CARD_DDEV(card));
+- rc2 = ccw_device_set_offline(CARD_WDEV(card));
+- rc3 = ccw_device_set_offline(CARD_RDEV(card));
++ rc = qeth_stop_channel(&card->data);
++ rc2 = qeth_stop_channel(&card->write);
++ rc3 = qeth_stop_channel(&card->read);
+ if (!rc)
+ rc = (rc2) ? rc2 : rc3;
+ if (rc)
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 5152970a9aa4b..a1c23e998f977 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -2383,9 +2383,9 @@ static int qeth_l3_set_online(struct ccwgroup_device *gdev)
+ return 0;
+ out_remove:
+ qeth_l3_stop_card(card);
+- ccw_device_set_offline(CARD_DDEV(card));
+- ccw_device_set_offline(CARD_WDEV(card));
+- ccw_device_set_offline(CARD_RDEV(card));
++ qeth_stop_channel(&card->data);
++ qeth_stop_channel(&card->write);
++ qeth_stop_channel(&card->read);
+ qdio_free(CARD_DDEV(card));
+
+ mutex_unlock(&card->conf_mutex);
+@@ -2421,9 +2421,10 @@ static int __qeth_l3_set_offline(struct ccwgroup_device *cgdev,
+ call_netdevice_notifiers(NETDEV_REBOOT, card->dev);
+ rtnl_unlock();
+ }
+- rc = ccw_device_set_offline(CARD_DDEV(card));
+- rc2 = ccw_device_set_offline(CARD_WDEV(card));
+- rc3 = ccw_device_set_offline(CARD_RDEV(card));
++
++ rc = qeth_stop_channel(&card->data);
++ rc2 = qeth_stop_channel(&card->write);
++ rc3 = qeth_stop_channel(&card->read);
+ if (!rc)
+ rc = (rc2) ? rc2 : rc3;
+ if (rc)
+--
+2.20.1
+
--- /dev/null
+From 91b66c74d4f3fcc5782c97b901fb1c33ae8df0c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 18 Nov 2019 14:21:19 +0100
+Subject: sched/cpufreq: Move the cfs_rq_util_change() call to
+ cpufreq_update_util()
+
+From: Vincent Guittot <vincent.guittot@linaro.org>
+
+[ Upstream commit bef69dd87828ef5d8ecdab8d857cd3a33cf98675 ]
+
+update_cfs_rq_load_avg() calls cfs_rq_util_change() every time PELT decays,
+which might be inefficient when the cpufreq driver has rate limitation.
+
+When a task is attached on a CPU, we have this call path:
+
+update_load_avg()
+ update_cfs_rq_load_avg()
+ cfs_rq_util_change -- > trig frequency update
+ attach_entity_load_avg()
+ cfs_rq_util_change -- > trig frequency update
+
+The 1st frequency update will not take into account the utilization of the
+newly attached task and the 2nd one might be discarded because of rate
+limitation of the cpufreq driver.
+
+update_cfs_rq_load_avg() is only called by update_blocked_averages()
+and update_load_avg() so we can move the call to
+cfs_rq_util_change/cpufreq_update_util() into these two functions.
+
+It's also interesting to note that update_load_avg() already calls
+cfs_rq_util_change() directly for the !SMP case.
+
+This change will also ensure that cpufreq_update_util() is called even
+when there is no more CFS rq in the leaf_cfs_rq_list to update, but only
+IRQ, RT or DL PELT signals.
+
+[ mingo: Minor updates. ]
+
+Reported-by: Doug Smythies <dsmythies@telus.net>
+Tested-by: Doug Smythies <dsmythies@telus.net>
+Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: juri.lelli@redhat.com
+Cc: linux-pm@vger.kernel.org
+Cc: mgorman@suse.de
+Cc: rostedt@goodmis.org
+Cc: sargun@sargun.me
+Cc: srinivas.pandruvada@linux.intel.com
+Cc: tj@kernel.org
+Cc: xiexiuqi@huawei.com
+Cc: xiezhipeng1@huawei.com
+Fixes: 039ae8bcf7a5 ("sched/fair: Fix O(nr_cgroups) in the load balancing path")
+Link: https://lkml.kernel.org/r/1574083279-799-1-git-send-email-vincent.guittot@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/fair.c | 111 +++++++++++++++++++++++++-------------------
+ 1 file changed, 62 insertions(+), 49 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 2b7034e6fa241..c87a798d14562 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -3504,9 +3504,6 @@ update_cfs_rq_load_avg(u64 now, struct cfs_rq *cfs_rq)
+ cfs_rq->load_last_update_time_copy = sa->last_update_time;
+ #endif
+
+- if (decayed)
+- cfs_rq_util_change(cfs_rq, 0);
+-
+ return decayed;
+ }
+
+@@ -3616,8 +3613,12 @@ static inline void update_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *s
+ attach_entity_load_avg(cfs_rq, se, SCHED_CPUFREQ_MIGRATION);
+ update_tg_load_avg(cfs_rq, 0);
+
+- } else if (decayed && (flags & UPDATE_TG))
+- update_tg_load_avg(cfs_rq, 0);
++ } else if (decayed) {
++ cfs_rq_util_change(cfs_rq, 0);
++
++ if (flags & UPDATE_TG)
++ update_tg_load_avg(cfs_rq, 0);
++ }
+ }
+
+ #ifndef CONFIG_64BIT
+@@ -7517,6 +7518,28 @@ static inline bool others_have_blocked(struct rq *rq) { return false; }
+ static inline void update_blocked_load_status(struct rq *rq, bool has_blocked) {}
+ #endif
+
++static bool __update_blocked_others(struct rq *rq, bool *done)
++{
++ const struct sched_class *curr_class;
++ u64 now = rq_clock_pelt(rq);
++ bool decayed;
++
++ /*
++ * update_load_avg() can call cpufreq_update_util(). Make sure that RT,
++ * DL and IRQ signals have been updated before updating CFS.
++ */
++ curr_class = rq->curr->sched_class;
++
++ decayed = update_rt_rq_load_avg(now, rq, curr_class == &rt_sched_class) |
++ update_dl_rq_load_avg(now, rq, curr_class == &dl_sched_class) |
++ update_irq_load_avg(rq, 0);
++
++ if (others_have_blocked(rq))
++ *done = false;
++
++ return decayed;
++}
++
+ #ifdef CONFIG_FAIR_GROUP_SCHED
+
+ static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq)
+@@ -7536,29 +7559,11 @@ static inline bool cfs_rq_is_decayed(struct cfs_rq *cfs_rq)
+ return true;
+ }
+
+-static void update_blocked_averages(int cpu)
++static bool __update_blocked_fair(struct rq *rq, bool *done)
+ {
+- struct rq *rq = cpu_rq(cpu);
+ struct cfs_rq *cfs_rq, *pos;
+- const struct sched_class *curr_class;
+- struct rq_flags rf;
+- bool done = true;
+-
+- rq_lock_irqsave(rq, &rf);
+- update_rq_clock(rq);
+-
+- /*
+- * update_cfs_rq_load_avg() can call cpufreq_update_util(). Make sure
+- * that RT, DL and IRQ signals have been updated before updating CFS.
+- */
+- curr_class = rq->curr->sched_class;
+- update_rt_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &rt_sched_class);
+- update_dl_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &dl_sched_class);
+- update_irq_load_avg(rq, 0);
+-
+- /* Don't need periodic decay once load/util_avg are null */
+- if (others_have_blocked(rq))
+- done = false;
++ bool decayed = false;
++ int cpu = cpu_of(rq);
+
+ /*
+ * Iterates the task_group tree in a bottom up fashion, see
+@@ -7567,9 +7572,13 @@ static void update_blocked_averages(int cpu)
+ for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) {
+ struct sched_entity *se;
+
+- if (update_cfs_rq_load_avg(cfs_rq_clock_pelt(cfs_rq), cfs_rq))
++ if (update_cfs_rq_load_avg(cfs_rq_clock_pelt(cfs_rq), cfs_rq)) {
+ update_tg_load_avg(cfs_rq, 0);
+
++ if (cfs_rq == &rq->cfs)
++ decayed = true;
++ }
++
+ /* Propagate pending load changes to the parent, if any: */
+ se = cfs_rq->tg->se[cpu];
+ if (se && !skip_blocked_update(se))
+@@ -7584,11 +7593,10 @@ static void update_blocked_averages(int cpu)
+
+ /* Don't need periodic decay once load/util_avg are null */
+ if (cfs_rq_has_blocked(cfs_rq))
+- done = false;
++ *done = false;
+ }
+
+- update_blocked_load_status(rq, !done);
+- rq_unlock_irqrestore(rq, &rf);
++ return decayed;
+ }
+
+ /*
+@@ -7638,29 +7646,16 @@ static unsigned long task_h_load(struct task_struct *p)
+ cfs_rq_load_avg(cfs_rq) + 1);
+ }
+ #else
+-static inline void update_blocked_averages(int cpu)
++static bool __update_blocked_fair(struct rq *rq, bool *done)
+ {
+- struct rq *rq = cpu_rq(cpu);
+ struct cfs_rq *cfs_rq = &rq->cfs;
+- const struct sched_class *curr_class;
+- struct rq_flags rf;
+-
+- rq_lock_irqsave(rq, &rf);
+- update_rq_clock(rq);
+-
+- /*
+- * update_cfs_rq_load_avg() can call cpufreq_update_util(). Make sure
+- * that RT, DL and IRQ signals have been updated before updating CFS.
+- */
+- curr_class = rq->curr->sched_class;
+- update_rt_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &rt_sched_class);
+- update_dl_rq_load_avg(rq_clock_pelt(rq), rq, curr_class == &dl_sched_class);
+- update_irq_load_avg(rq, 0);
++ bool decayed;
+
+- update_cfs_rq_load_avg(cfs_rq_clock_pelt(cfs_rq), cfs_rq);
++ decayed = update_cfs_rq_load_avg(cfs_rq_clock_pelt(cfs_rq), cfs_rq);
++ if (cfs_rq_has_blocked(cfs_rq))
++ *done = false;
+
+- update_blocked_load_status(rq, cfs_rq_has_blocked(cfs_rq) || others_have_blocked(rq));
+- rq_unlock_irqrestore(rq, &rf);
++ return decayed;
+ }
+
+ static unsigned long task_h_load(struct task_struct *p)
+@@ -7669,6 +7664,24 @@ static unsigned long task_h_load(struct task_struct *p)
+ }
+ #endif
+
++static void update_blocked_averages(int cpu)
++{
++ bool decayed = false, done = true;
++ struct rq *rq = cpu_rq(cpu);
++ struct rq_flags rf;
++
++ rq_lock_irqsave(rq, &rf);
++ update_rq_clock(rq);
++
++ decayed |= __update_blocked_others(rq, &done);
++ decayed |= __update_blocked_fair(rq, &done);
++
++ update_blocked_load_status(rq, !done);
++ if (decayed)
++ cpufreq_update_util(rq, 0);
++ rq_unlock_irqrestore(rq, &rf);
++}
++
+ /********** Helpers for find_busiest_group ************************/
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 3734a414456883f59c88cf46b2de3c7d98111343 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 14:22:45 +0000
+Subject: scsi: ufs: delete redundant function ufshcd_def_desc_sizes()
+
+From: Bean Huo <beanhuo@micron.com>
+
+[ Upstream commit 059efd847a4097c67817782d8ff65397e369e69b ]
+
+There is no need to call ufshcd_def_desc_sizes() in ufshcd_init(), since
+descriptor lengths will be checked and initialized later in
+ufshcd_init_desc_sizes().
+
+Fixes: a4b0e8a4e92b1b(scsi: ufs: Factor out ufshcd_read_desc_param)
+Link: https://lore.kernel.org/r/BN7PR08MB5684A3ACE214C3D4792CE729DB610@BN7PR08MB5684.namprd08.prod.outlook.com
+Signed-off-by: Bean Huo <beanhuo@micron.com>
+Acked-by: Avri Altman <avri.altman.wdc.com>
+Reviewed-by: Can Guo <cang@codeaurora.org>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 25a6a25b17a28..1e38bb967871d 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -6779,23 +6779,13 @@ static void ufshcd_init_desc_sizes(struct ufs_hba *hba)
+ &hba->desc_size.geom_desc);
+ if (err)
+ hba->desc_size.geom_desc = QUERY_DESC_GEOMETRY_DEF_SIZE;
++
+ err = ufshcd_read_desc_length(hba, QUERY_DESC_IDN_HEALTH, 0,
+ &hba->desc_size.hlth_desc);
+ if (err)
+ hba->desc_size.hlth_desc = QUERY_DESC_HEALTH_DEF_SIZE;
+ }
+
+-static void ufshcd_def_desc_sizes(struct ufs_hba *hba)
+-{
+- hba->desc_size.dev_desc = QUERY_DESC_DEVICE_DEF_SIZE;
+- hba->desc_size.pwr_desc = QUERY_DESC_POWER_DEF_SIZE;
+- hba->desc_size.interc_desc = QUERY_DESC_INTERCONNECT_DEF_SIZE;
+- hba->desc_size.conf_desc = QUERY_DESC_CONFIGURATION_DEF_SIZE;
+- hba->desc_size.unit_desc = QUERY_DESC_UNIT_DEF_SIZE;
+- hba->desc_size.geom_desc = QUERY_DESC_GEOMETRY_DEF_SIZE;
+- hba->desc_size.hlth_desc = QUERY_DESC_HEALTH_DEF_SIZE;
+-}
+-
+ static struct ufs_ref_clk ufs_ref_clk_freqs[] = {
+ {19200000, REF_CLK_FREQ_19_2_MHZ},
+ {26000000, REF_CLK_FREQ_26_MHZ},
+@@ -8283,9 +8273,6 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq)
+ hba->mmio_base = mmio_base;
+ hba->irq = irq;
+
+- /* Set descriptor lengths to specification defaults */
+- ufshcd_def_desc_sizes(hba);
+-
+ err = ufshcd_hba_init(hba);
+ if (err)
+ goto out_error;
+--
+2.20.1
+
--- /dev/null
+From 7d69fa1326bf69157ebda97e49e0a9a4dc9be7e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 12:46:08 -0700
+Subject: selftests: gen_kselftest_tar.sh: Do not clobber kselftest/
+
+From: Kees Cook <keescook@chromium.org>
+
+[ Upstream commit ea1bf0bb18c0bd627d7b551196453ff2fff44225 ]
+
+The default installation location for gen_kselftest_tar.sh was still
+"kselftest/" which collides with the existing directory. Instead, this
+moves the installation target into "kselftest_install/kselftest/" and
+adjusts the tar creation accordingly. This also adjusts indentation and
+logic to be consistent.
+
+Fixes: 42d46e57ec97 ("selftests: Extract single-test shell logic from lib.mk")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/gen_kselftest_tar.sh | 21 ++++++++++-------
+ tools/testing/selftests/kselftest_install.sh | 24 ++++++++++----------
+ 2 files changed, 25 insertions(+), 20 deletions(-)
+
+diff --git a/tools/testing/selftests/gen_kselftest_tar.sh b/tools/testing/selftests/gen_kselftest_tar.sh
+index a27e2eec35867..8b2b6088540d4 100755
+--- a/tools/testing/selftests/gen_kselftest_tar.sh
++++ b/tools/testing/selftests/gen_kselftest_tar.sh
+@@ -38,16 +38,21 @@ main()
+ esac
+ fi
+
+- install_dir=./kselftest
++ # Create working directory.
++ dest=`pwd`
++ install_work="$dest"/kselftest_install
++ install_name=kselftest
++ install_dir="$install_work"/"$install_name"
++ mkdir -p "$install_dir"
+
+-# Run install using INSTALL_KSFT_PATH override to generate install
+-# directory
+-./kselftest_install.sh
+-tar $copts kselftest${ext} $install_dir
+-echo "Kselftest archive kselftest${ext} created!"
++ # Run install using INSTALL_KSFT_PATH override to generate install
++ # directory
++ ./kselftest_install.sh "$install_dir"
++ (cd "$install_work"; tar $copts "$dest"/kselftest${ext} $install_name)
++ echo "Kselftest archive kselftest${ext} created!"
+
+-# clean up install directory
+-rm -rf kselftest
++ # clean up top-level install work directory
++ rm -rf "$install_work"
+ }
+
+ main "$@"
+diff --git a/tools/testing/selftests/kselftest_install.sh b/tools/testing/selftests/kselftest_install.sh
+index e2e1911d62d50..407af7da70372 100755
+--- a/tools/testing/selftests/kselftest_install.sh
++++ b/tools/testing/selftests/kselftest_install.sh
+@@ -6,30 +6,30 @@
+ # Author: Shuah Khan <shuahkh@osg.samsung.com>
+ # Copyright (C) 2015 Samsung Electronics Co., Ltd.
+
+-install_loc=`pwd`
+-
+ main()
+ {
+- if [ $(basename $install_loc) != "selftests" ]; then
++ base_dir=`pwd`
++ install_dir="$base_dir"/kselftest_install
++
++ # Make sure we're in the selftests top-level directory.
++ if [ $(basename "$base_dir") != "selftests" ]; then
+ echo "$0: Please run it in selftests directory ..."
+ exit 1;
+ fi
++
++ # Only allow installation into an existing location.
+ if [ "$#" -eq 0 ]; then
+- echo "$0: Installing in default location - $install_loc ..."
++ echo "$0: Installing in default location - $install_dir ..."
+ elif [ ! -d "$1" ]; then
+ echo "$0: $1 doesn't exist!!"
+ exit 1;
+ else
+- install_loc=$1
+- echo "$0: Installing in specified location - $install_loc ..."
++ install_dir="$1"
++ echo "$0: Installing in specified location - $install_dir ..."
+ fi
+
+- install_dir=$install_loc/kselftest_install
+-
+-# Create install directory
+- mkdir -p $install_dir
+-# Build tests
+- KSFT_INSTALL_PATH=$install_dir make install
++ # Build tests
++ KSFT_INSTALL_PATH="$install_dir" make install
+ }
+
+ main "$@"
+--
+2.20.1
+
gpiolib-no-need-to-call-gpiochip_remove_pin_ranges-twice.patch
rtw88-fix-beaconing-mode-rsvd_page-memory-violation-issue.patch
rtw88-fix-error-handling-when-setup-efuse-info.patch
+drm-panfrost-add-missing-check-for-pfdev-regulator.patch
+drm-panel-lvds-potential-oops-in-probe-error-handlin.patch
+drm-amdgpu-remove-excess-function-parameter-descript.patch
+hwrng-omap3-rom-fix-missing-clock-by-probing-with-de.patch
+dpaa2-eth-fix-minor-bug-in-ethtool-stats-reporting.patch
+drm-rockchip-round-up-_before_-giving-to-the-clock-f.patch
+software-node-get-reference-to-parent-swnode-in-get_.patch
+pci-mobiveil-fix-csr_read-write-build-issue.patch
+drm-rcar_lvds-fix-color-mismatches-on-r-car-h2-es2.0.patch
+net-netsec-correct-dma-sync-for-xdp_tx-frames.patch
+acpi-platform-unregister-stale-platform-devices.patch
+pwm-sun4i-fix-incorrect-calculation-of-duty_cycle-pe.patch
+regulator-bd70528-add-module_alias-to-allow-module-a.patch
+drm-amdgpu-vi-silence-an-uninitialized-variable-warn.patch
+power-supply-bd70528-add-module_alias-to-allow-modul.patch
+firmware-imx-remove-call-to-devm_of_platform_populat.patch
+libbpf-don-t-use-kernel-side-u32-type-in-xsk.c.patch
+rcu-fix-uninitialized-variable-in-nocb_gp_wait.patch
+dpaa_eth-perform-dma-unmapping-before-read.patch
+dpaa_eth-avoid-timestamp-read-on-error-paths.patch
+scsi-ufs-delete-redundant-function-ufshcd_def_desc_s.patch
+net-openvswitch-don-t-unlock-mutex-when-changing-the.patch
+hv_netvsc-flag-software-created-hash-value.patch
+rt2800-remove-errornous-duplicate-condition.patch
+net-neigh-use-long-type-to-store-jiffies-delta.patch
+net-axienet-fix-error-return-code-in-axienet_probe.patch
+selftests-gen_kselftest_tar.sh-do-not-clobber-kselft.patch
+rtc-bd70528-fix-module-alias-to-autoload-module.patch
+packet-fix-data-race-in-fanout_flow_is_huge.patch
+i2c-stm32f7-report-dma-error-during-probe.patch
+kselftests-cgroup-avoid-the-reuse-of-fd-after-it-is-.patch
+firmware-arm_scmi-fix-doorbell-ring-logic-for-config.patch
+mmc-sdio-fix-wl1251-vendor-id.patch
+mmc-core-fix-wl1251-sdio-quirks.patch
+tee-optee-fix-dynamic-shm-pool-allocations.patch
+tee-optee-fix-device-enumeration-error-handling.patch
+workqueue-add-rcu-annotation-for-pwq-list-walk.patch
+sunrpc-fix-another-issue-with-mic-buffer-space.patch
+sched-cpufreq-move-the-cfs_rq_util_change-call-to-cp.patch
+mt76-mt76u-rely-on-usb_interface-instead-of-usb_dev.patch
+dma-direct-don-t-check-swiotlb-force-in-dma_direct_m.patch
+afs-remove-set-but-not-used-variables-before-after.patch
+dmaengine-ti-edma-fix-missed-failure-handling.patch
+drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch
+xdp-fix-cleanup-on-map-free-for-devmap_hash-map-type.patch
+platform-chrome-wilco_ec-fix-use-after-free-issue.patch
+block-fix-memleak-of-bio-integrity-data.patch
+s390-qeth-fix-dangling-io-buffers-after-halt-clear.patch
+net-sysfs-call-dev_hold-always-in-netdev_queue_add_k.patch
+gpio-aspeed-avoid-return-type-warning.patch
+phy-rockchip-inno-hdmi-round-clock-rate-down-to-clos.patch
+optee-fix-multi-page-dynamic-shm-pool-alloc.patch
--- /dev/null
+From aa8501a2971fa0a7fa690a5035a73e7b87d94765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 15:32:08 +0300
+Subject: software node: Get reference to parent swnode in get_parent op
+
+From: Sakari Ailus <sakari.ailus@linux.intel.com>
+
+[ Upstream commit 51c100a651a471fcb8ead1ecc1224471eb0d61b9 ]
+
+The software_node_get_parent() returned a pointer to the parent swnode,
+but did not take a reference to it, leading the caller to put a reference
+that was not taken. Take that reference now.
+
+Fixes: 59abd83672f7 ("drivers: base: Introducing software nodes to the firmware node framework")
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/swnode.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
+index a1f3f0994f9f9..d5b4905e2adbd 100644
+--- a/drivers/base/swnode.c
++++ b/drivers/base/swnode.c
+@@ -520,7 +520,10 @@ software_node_get_parent(const struct fwnode_handle *fwnode)
+ {
+ struct swnode *swnode = to_swnode(fwnode);
+
+- return swnode ? (swnode->parent ? &swnode->parent->fwnode : NULL) : NULL;
++ if (!swnode || !swnode->parent)
++ return NULL;
++
++ return fwnode_handle_get(&swnode->parent->fwnode);
+ }
+
+ static struct fwnode_handle *
+--
+2.20.1
+
--- /dev/null
+From 67c4fe8ca06fefa17326c999f8552363626b25c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 08:39:07 -0500
+Subject: SUNRPC: Fix another issue with MIC buffer space
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit e8d70b321ecc9b23d09b8df63e38a2f73160c209 ]
+
+xdr_shrink_pagelen() BUG's when @len is larger than buf->page_len.
+This can happen when xdr_buf_read_mic() is given an xdr_buf with
+a small page array (like, only a few bytes).
+
+Instead, just cap the number of bytes that xdr_shrink_pagelen()
+will move.
+
+Fixes: 5f1bc39979d ("SUNRPC: Fix buffer handling of GSS MIC ... ")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sunrpc/xdr.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 14ba9e72a2049..f3104be8ff5dc 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -436,13 +436,12 @@ xdr_shrink_bufhead(struct xdr_buf *buf, size_t len)
+ }
+
+ /**
+- * xdr_shrink_pagelen
++ * xdr_shrink_pagelen - shrinks buf->pages by up to @len bytes
+ * @buf: xdr_buf
+ * @len: bytes to remove from buf->pages
+ *
+- * Shrinks XDR buffer's page array buf->pages by
+- * 'len' bytes. The extra data is not lost, but is instead
+- * moved into the tail.
++ * The extra data is not lost, but is instead moved into buf->tail.
++ * Returns the actual number of bytes moved.
+ */
+ static unsigned int
+ xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
+@@ -455,8 +454,8 @@ xdr_shrink_pagelen(struct xdr_buf *buf, size_t len)
+
+ result = 0;
+ tail = buf->tail;
+- BUG_ON (len > pglen);
+-
++ if (len > buf->page_len)
++ len = buf-> page_len;
+ tailbuf_len = buf->buflen - buf->head->iov_len - buf->page_len;
+
+ /* Shift the tail first */
+--
+2.20.1
+
--- /dev/null
+From cedeef2976d2ae0173705e886a7af4ffe508c7a5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 16:48:28 +0100
+Subject: tee: optee: fix device enumeration error handling
+
+From: Jens Wiklander <jens.wiklander@linaro.org>
+
+[ Upstream commit 03212e347f9443e524d6383c6806ac08295c1fb0 ]
+
+Prior to this patch in optee_probe() when optee_enumerate_devices() was
+called the struct optee was fully initialized. If
+optee_enumerate_devices() returns an error optee_probe() is supposed to
+clean up and free the struct optee completely, but will at this late
+stage need to call optee_remove() instead. This isn't done and thus
+freeing the struct optee prematurely.
+
+With this patch the call to optee_enumerate_devices() is done after
+optee_probe() has returned successfully and in case
+optee_enumerate_devices() fails everything is cleaned up with a call to
+optee_remove().
+
+Fixes: c3fa24af9244 ("tee: optee: add TEE bus device enumeration support")
+Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/core.c | 20 ++++++++++++--------
+ 1 file changed, 12 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
+index 1854a3db73457..b830e0a87fbac 100644
+--- a/drivers/tee/optee/core.c
++++ b/drivers/tee/optee/core.c
+@@ -643,11 +643,6 @@ static struct optee *optee_probe(struct device_node *np)
+ if (optee->sec_caps & OPTEE_SMC_SEC_CAP_DYNAMIC_SHM)
+ pr_info("dynamic shared memory is enabled\n");
+
+- rc = optee_enumerate_devices();
+- if (rc)
+- goto err;
+-
+- pr_info("initialized driver\n");
+ return optee;
+ err:
+ if (optee) {
+@@ -702,9 +697,10 @@ static struct optee *optee_svc;
+
+ static int __init optee_driver_init(void)
+ {
+- struct device_node *fw_np;
+- struct device_node *np;
+- struct optee *optee;
++ struct device_node *fw_np = NULL;
++ struct device_node *np = NULL;
++ struct optee *optee = NULL;
++ int rc = 0;
+
+ /* Node is supposed to be below /firmware */
+ fw_np = of_find_node_by_name(NULL, "firmware");
+@@ -723,6 +719,14 @@ static int __init optee_driver_init(void)
+ if (IS_ERR(optee))
+ return PTR_ERR(optee);
+
++ rc = optee_enumerate_devices();
++ if (rc) {
++ optee_remove(optee);
++ return rc;
++ }
++
++ pr_info("initialized driver\n");
++
+ optee_svc = optee;
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From ba3ae5298faa36d107835ef96b79c16d012dff0c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 8 Nov 2019 16:57:14 +0530
+Subject: tee: optee: Fix dynamic shm pool allocations
+
+From: Sumit Garg <sumit.garg@linaro.org>
+
+[ Upstream commit a249dd200d03791cab23e47571f3e13d9c72af6c ]
+
+In case of dynamic shared memory pool, kernel memory allocated using
+dmabuf_mgr pool needs to be registered with OP-TEE prior to its usage
+during optee_open_session() or optee_invoke_func().
+
+So fix dmabuf_mgr pool allocations via an additional call to
+optee_shm_register().
+
+Also, allow kernel pages to be registered as shared memory with OP-TEE.
+
+Fixes: 9733b072a12a ("optee: allow to work without static shared memory")
+Signed-off-by: Sumit Garg <sumit.garg@linaro.org>
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/call.c | 7 +++++++
+ drivers/tee/optee/shm_pool.c | 12 +++++++++++-
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
+index 13b0269a0abc2..cf2367ba08d63 100644
+--- a/drivers/tee/optee/call.c
++++ b/drivers/tee/optee/call.c
+@@ -554,6 +554,13 @@ static int check_mem_type(unsigned long start, size_t num_pages)
+ struct mm_struct *mm = current->mm;
+ int rc;
+
++ /*
++ * Allow kernel address to register with OP-TEE as kernel
++ * pages are configured as normal memory only.
++ */
++ if (virt_addr_valid(start))
++ return 0;
++
+ down_read(&mm->mmap_sem);
+ rc = __check_mem_type(find_vma(mm, start),
+ start + num_pages * PAGE_SIZE);
+diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c
+index de1d9b8fad904..0332a5301d613 100644
+--- a/drivers/tee/optee/shm_pool.c
++++ b/drivers/tee/optee/shm_pool.c
+@@ -17,6 +17,7 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm,
+ {
+ unsigned int order = get_order(size);
+ struct page *page;
++ int rc = 0;
+
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+ if (!page)
+@@ -26,12 +27,21 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm,
+ shm->paddr = page_to_phys(page);
+ shm->size = PAGE_SIZE << order;
+
+- return 0;
++ if (shm->flags & TEE_SHM_DMA_BUF) {
++ shm->flags |= TEE_SHM_REGISTER;
++ rc = optee_shm_register(shm->ctx, shm, &page, 1 << order,
++ (unsigned long)shm->kaddr);
++ }
++
++ return rc;
+ }
+
+ static void pool_op_free(struct tee_shm_pool_mgr *poolm,
+ struct tee_shm *shm)
+ {
++ if (shm->flags & TEE_SHM_DMA_BUF)
++ optee_shm_unregister(shm->ctx, shm);
++
+ free_pages((unsigned long)shm->kaddr, get_order(shm->size));
+ shm->kaddr = NULL;
+ }
+--
+2.20.1
+
--- /dev/null
+From f4a3e8199ae708aed6efab06da5dcf93264a2ec3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 15 Nov 2019 19:01:25 +0100
+Subject: workqueue: Add RCU annotation for pwq list walk
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 49e9d1a9faf2f71fdfd80a30697ee9a15070626d ]
+
+An additional check has been recently added to ensure that a RCU related lock
+is held while the RCU list is iterated.
+The `pwqs' are sometimes iterated without a RCU lock but with the &wq->mutex
+acquired leading to a warning.
+
+Teach list_for_each_entry_rcu() that the RCU usage is okay if &wq->mutex
+is acquired during the list traversal.
+
+Fixes: 28875945ba98d ("rcu: Add support for consolidated-RCU reader checking")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 649687622654b..e9c63b79e03f4 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -425,7 +425,8 @@ static void workqueue_sysfs_unregister(struct workqueue_struct *wq);
+ * ignored.
+ */
+ #define for_each_pwq(pwq, wq) \
+- list_for_each_entry_rcu((pwq), &(wq)->pwqs, pwqs_node) \
++ list_for_each_entry_rcu((pwq), &(wq)->pwqs, pwqs_node, \
++ lockdep_is_held(&wq->mutex)) \
+ if (({ assert_rcu_or_wq_mutex(wq); false; })) { } \
+ else
+
+--
+2.20.1
+
--- /dev/null
+From 474b4ee5a5f377f38c28ffd67a005b27f214ef23 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Nov 2019 14:36:12 +0100
+Subject: xdp: Fix cleanup on map free for devmap_hash map type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 071cdecec57fb5d5df78e6a12114ad7bccea5b0e ]
+
+Tetsuo pointed out that it was not only the device unregister hook that was
+broken for devmap_hash types, it was also cleanup on map free. So better
+fix this as well.
+
+While we're at it, there's no reason to allocate the netdev_map array for
+DEVMAP_HASH, so skip that and adjust the cost accordingly.
+
+Fixes: 6f9d451ab1a3 ("xdp: Add devmap_hash map type for looking up devices by hashed index")
+Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: John Fastabend <john.fastabend@gmail.com>
+Link: https://lore.kernel.org/bpf/20191121133612.430414-1-toke@redhat.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/devmap.c | 74 ++++++++++++++++++++++++++++-----------------
+ 1 file changed, 46 insertions(+), 28 deletions(-)
+
+diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
+index 3867864cdc2fb..3d3d61b5985b0 100644
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -74,7 +74,7 @@ struct bpf_dtab_netdev {
+
+ struct bpf_dtab {
+ struct bpf_map map;
+- struct bpf_dtab_netdev **netdev_map;
++ struct bpf_dtab_netdev **netdev_map; /* DEVMAP type only */
+ struct list_head __percpu *flush_list;
+ struct list_head list;
+
+@@ -101,6 +101,12 @@ static struct hlist_head *dev_map_create_hash(unsigned int entries)
+ return hash;
+ }
+
++static inline struct hlist_head *dev_map_index_hash(struct bpf_dtab *dtab,
++ int idx)
++{
++ return &dtab->dev_index_head[idx & (dtab->n_buckets - 1)];
++}
++
+ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
+ {
+ int err, cpu;
+@@ -120,8 +126,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
+ bpf_map_init_from_attr(&dtab->map, attr);
+
+ /* make sure page count doesn't overflow */
+- cost = (u64) dtab->map.max_entries * sizeof(struct bpf_dtab_netdev *);
+- cost += sizeof(struct list_head) * num_possible_cpus();
++ cost = (u64) sizeof(struct list_head) * num_possible_cpus();
+
+ if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+ dtab->n_buckets = roundup_pow_of_two(dtab->map.max_entries);
+@@ -129,6 +134,8 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
+ if (!dtab->n_buckets) /* Overflow check */
+ return -EINVAL;
+ cost += (u64) sizeof(struct hlist_head) * dtab->n_buckets;
++ } else {
++ cost += (u64) dtab->map.max_entries * sizeof(struct bpf_dtab_netdev *);
+ }
+
+ /* if map size is larger than memlock limit, reject it */
+@@ -143,24 +150,22 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
+ for_each_possible_cpu(cpu)
+ INIT_LIST_HEAD(per_cpu_ptr(dtab->flush_list, cpu));
+
+- dtab->netdev_map = bpf_map_area_alloc(dtab->map.max_entries *
+- sizeof(struct bpf_dtab_netdev *),
+- dtab->map.numa_node);
+- if (!dtab->netdev_map)
+- goto free_percpu;
+-
+ if (attr->map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
+ dtab->dev_index_head = dev_map_create_hash(dtab->n_buckets);
+ if (!dtab->dev_index_head)
+- goto free_map_area;
++ goto free_percpu;
+
+ spin_lock_init(&dtab->index_lock);
++ } else {
++ dtab->netdev_map = bpf_map_area_alloc(dtab->map.max_entries *
++ sizeof(struct bpf_dtab_netdev *),
++ dtab->map.numa_node);
++ if (!dtab->netdev_map)
++ goto free_percpu;
+ }
+
+ return 0;
+
+-free_map_area:
+- bpf_map_area_free(dtab->netdev_map);
+ free_percpu:
+ free_percpu(dtab->flush_list);
+ free_charge:
+@@ -228,21 +233,40 @@ static void dev_map_free(struct bpf_map *map)
+ cond_resched();
+ }
+
+- for (i = 0; i < dtab->map.max_entries; i++) {
+- struct bpf_dtab_netdev *dev;
++ if (dtab->map.map_type == BPF_MAP_TYPE_DEVMAP_HASH) {
++ for (i = 0; i < dtab->n_buckets; i++) {
++ struct bpf_dtab_netdev *dev;
++ struct hlist_head *head;
++ struct hlist_node *next;
+
+- dev = dtab->netdev_map[i];
+- if (!dev)
+- continue;
++ head = dev_map_index_hash(dtab, i);
+
+- free_percpu(dev->bulkq);
+- dev_put(dev->dev);
+- kfree(dev);
++ hlist_for_each_entry_safe(dev, next, head, index_hlist) {
++ hlist_del_rcu(&dev->index_hlist);
++ free_percpu(dev->bulkq);
++ dev_put(dev->dev);
++ kfree(dev);
++ }
++ }
++
++ kfree(dtab->dev_index_head);
++ } else {
++ for (i = 0; i < dtab->map.max_entries; i++) {
++ struct bpf_dtab_netdev *dev;
++
++ dev = dtab->netdev_map[i];
++ if (!dev)
++ continue;
++
++ free_percpu(dev->bulkq);
++ dev_put(dev->dev);
++ kfree(dev);
++ }
++
++ bpf_map_area_free(dtab->netdev_map);
+ }
+
+ free_percpu(dtab->flush_list);
+- bpf_map_area_free(dtab->netdev_map);
+- kfree(dtab->dev_index_head);
+ kfree(dtab);
+ }
+
+@@ -263,12 +287,6 @@ static int dev_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
+ return 0;
+ }
+
+-static inline struct hlist_head *dev_map_index_hash(struct bpf_dtab *dtab,
+- int idx)
+-{
+- return &dtab->dev_index_head[idx & (dtab->n_buckets - 1)];
+-}
+-
+ struct bpf_dtab_netdev *__dev_map_hash_lookup_elem(struct bpf_map *map, u32 key)
+ {
+ struct bpf_dtab *dtab = container_of(map, struct bpf_dtab, map);
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
