--- /dev/null
+From a94ba8e8129cd67eb9b49e25deae3661d8ba5558 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 10:44:27 -0800
+Subject: altera-stapl: altera_get_note: prevent write beyond end of 'key'
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Axtens <dja@axtens.net>
+
+[ Upstream commit 3745488e9d599916a0b40d45d3f30e3d4720288e ]
+
+altera_get_note is called from altera_init, where key is kzalloc(33).
+
+When the allocation functions are annotated to allow the compiler to see
+the sizes of objects, and with FORTIFY_SOURCE, we see:
+
+In file included from drivers/misc/altera-stapl/altera.c:14:0:
+In function ‘strlcpy’,
+ inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5:
+include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter
+ __write_overflow();
+ ^~~~~~~~~~~~~~~~~~
+
+That refers to this code in altera_get_note:
+
+ if (key != NULL)
+ strlcpy(key, &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i)])],
+ length);
+
+The error triggers because the length of 'key' is 33, but the copy
+uses length supplied as the 'length' parameter, which is always
+256. Split the size parameter into key_len and val_len, and use the
+appropriate length depending on what is being copied.
+
+Detected by compiler error, only compile-tested.
+
+Cc: "Igor M. Liplianin" <liplianin@netup.ru>
+Signed-off-by: Daniel Axtens <dja@axtens.net>
+Link: https://lore.kernel.org/r/20200120074344.504-2-dja@axtens.net
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/202002251042.D898E67AC@keescook
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/altera-stapl/altera.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c
+index 25e5f24b3fecd..5bdf574723144 100644
+--- a/drivers/misc/altera-stapl/altera.c
++++ b/drivers/misc/altera-stapl/altera.c
+@@ -2112,8 +2112,8 @@ static int altera_execute(struct altera_state *astate,
+ return status;
+ }
+
+-static int altera_get_note(u8 *p, s32 program_size,
+- s32 *offset, char *key, char *value, int length)
++static int altera_get_note(u8 *p, s32 program_size, s32 *offset,
++ char *key, char *value, int keylen, int vallen)
+ /*
+ * Gets key and value of NOTE fields in the JBC file.
+ * Can be called in two modes: if offset pointer is NULL,
+@@ -2170,7 +2170,7 @@ static int altera_get_note(u8 *p, s32 program_size,
+ &p[note_table + (8 * i) + 4])];
+
+ if (value != NULL)
+- strlcpy(value, value_ptr, length);
++ strlcpy(value, value_ptr, vallen);
+
+ }
+ }
+@@ -2189,13 +2189,13 @@ static int altera_get_note(u8 *p, s32 program_size,
+ strlcpy(key, &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i)])],
+- length);
++ keylen);
+
+ if (value != NULL)
+ strlcpy(value, &p[note_strings +
+ get_unaligned_be32(
+ &p[note_table + (8 * i) + 4])],
+- length);
++ vallen);
+
+ *offset = i + 1;
+ }
+@@ -2449,7 +2449,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw)
+ __func__, (format_version == 2) ? "Jam STAPL" :
+ "pre-standardized Jam 1.1");
+ while (altera_get_note((u8 *)fw->data, fw->size,
+- &offset, key, value, 256) == 0)
++ &offset, key, value, 32, 256) == 0)
+ printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n",
+ __func__, key, value);
+ }
+--
+2.20.1
+
--- /dev/null
+From 806763dbb160ae9e34aa26ac87d012c3c5acc836 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 28 Jan 2020 12:11:47 +0530
+Subject: ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 27f13774654ea6bd0b6fc9b97cce8d19e5735661 ]
+
+'dma-ranges' in a PCI bridge node does correctly set dma masks for PCI
+devices not described in the DT. Certain DRA7 platforms (e.g., DRA76)
+has RAM above 32-bit boundary (accessible with LPAE config) though the
+PCIe bridge will be able to access only 32-bits. Add 'dma-ranges'
+property in PCIe RC DT nodes to indicate the host bridge can access
+only 32 bits.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dra7.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index 953f0ffce2a90..6481d2b7d6b6f 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -184,6 +184,7 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x20013000 0x13000 0 0xffed000>;
++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+@@ -238,6 +239,7 @@
+ device_type = "pci";
+ ranges = <0x81000000 0 0 0x03000 0 0x00010000
+ 0x82000000 0 0x30013000 0x13000 0 0xffed000>;
++ dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>;
+ bus-range = <0x00 0xff>;
+ #interrupt-cells = <1>;
+ num-lanes = <1>;
+--
+2.20.1
+
--- /dev/null
+From acec6e0df7d832467fbe54a1bcf93de6e150153b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2020 18:21:26 +0200
+Subject: ARM: dts: dra7-l4: mark timer13-16 as pwm capable
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 00a39c92c8ab94727f021297d1748531af113fcd ]
+
+DMTimers 13 - 16 are PWM capable and also can be used for CPTS input
+signals generation. Hence, mark them as "ti,timer-pwm".
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Reviewed-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dra7-l4.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi
+index c3954e34835b8..3ae4f6358da41 100644
+--- a/arch/arm/boot/dts/dra7-l4.dtsi
++++ b/arch/arm/boot/dts/dra7-l4.dtsi
+@@ -3413,6 +3413,7 @@
+ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER13_CLKCTRL 24>;
+ clock-names = "fck";
+ interrupts = <GIC_SPI 339 IRQ_TYPE_LEVEL_HIGH>;
++ ti,timer-pwm;
+ };
+ };
+
+@@ -3441,6 +3442,7 @@
+ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER14_CLKCTRL 24>;
+ clock-names = "fck";
+ interrupts = <GIC_SPI 340 IRQ_TYPE_LEVEL_HIGH>;
++ ti,timer-pwm;
+ };
+ };
+
+@@ -3469,6 +3471,7 @@
+ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER15_CLKCTRL 24>;
+ clock-names = "fck";
+ interrupts = <GIC_SPI 341 IRQ_TYPE_LEVEL_HIGH>;
++ ti,timer-pwm;
+ };
+ };
+
+@@ -3497,6 +3500,7 @@
+ clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER16_CLKCTRL 24>;
+ clock-names = "fck";
+ interrupts = <GIC_SPI 342 IRQ_TYPE_LEVEL_HIGH>;
++ ti,timer-pwm;
+ };
+ };
+
+--
+2.20.1
+
--- /dev/null
+From c94a2266db03612e2ff69ac493a220821fbd4c10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Feb 2020 13:11:46 +0100
+Subject: ASoC: meson: g12a: add tohdmitx reset
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 22946f37557e27697aabc8e4f62642bfe4a17fd8 ]
+
+Reset the g12a hdmi codec glue on probe. This ensure a sane startup state.
+
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20200221121146.1498427-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/meson/g12a-tohdmitx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/soc/meson/g12a-tohdmitx.c b/sound/soc/meson/g12a-tohdmitx.c
+index 9cfbd343a00c8..8a0db28a6a406 100644
+--- a/sound/soc/meson/g12a-tohdmitx.c
++++ b/sound/soc/meson/g12a-tohdmitx.c
+@@ -8,6 +8,7 @@
+ #include <linux/module.h>
+ #include <sound/pcm_params.h>
+ #include <linux/regmap.h>
++#include <linux/reset.h>
+ #include <sound/soc.h>
+ #include <sound/soc-dai.h>
+
+@@ -378,6 +379,11 @@ static int g12a_tohdmitx_probe(struct platform_device *pdev)
+ struct device *dev = &pdev->dev;
+ void __iomem *regs;
+ struct regmap *map;
++ int ret;
++
++ ret = device_reset(dev);
++ if (ret)
++ return ret;
+
+ regs = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(regs))
+--
+2.20.1
+
--- /dev/null
+From 80f30119be05fd59bccc5cb82b47879ad73480d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Mar 2020 11:24:06 +0100
+Subject: ASoC: stm32: sai: manage rebind issue
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+[ Upstream commit 0d6defc7e0e437a9fd53622f7fd85740f38d5693 ]
+
+The commit e894efef9ac7 ("ASoC: core: add support to card rebind")
+allows to rebind the sound card after a rebind of one of its component.
+With this commit, the sound card is actually rebound,
+but may be no more functional. The following problems have been seen
+with STM32 SAI driver.
+
+1) DMA channel is not requested:
+
+With the sound card rebind the simplified call sequence is:
+stm32_sai_sub_probe
+ snd_soc_register_component
+ snd_soc_try_rebind_card
+ snd_soc_instantiate_card
+ devm_snd_dmaengine_pcm_register
+
+The problem occurs because the pcm must be registered,
+before snd_soc_instantiate_card() is called.
+
+Modify SAI driver, to change the call sequence as follows:
+stm32_sai_sub_probe
+ devm_snd_dmaengine_pcm_register
+ snd_soc_register_component
+ snd_soc_try_rebind_card
+
+2) DMA channel is not released:
+
+dma_release_channel() is not called when
+devm_dmaengine_pcm_release() is executed.
+This occurs because SND_DMAENGINE_PCM_DRV_NAME component,
+has already been released through devm_component_release().
+
+devm_dmaengine_pcm_release() should be called before
+devm_component_release() to avoid this problem.
+
+Call snd_dmaengine_pcm_unregister() and snd_soc_unregister_component()
+explicitly from SAI driver, to have the right sequence.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Message-Id: <20200304102406.8093-1-olivier.moysan@st.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index 30bcd5d3a32a8..10eb4b8e8e7ee 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -1543,20 +1543,20 @@ static int stm32_sai_sub_probe(struct platform_device *pdev)
+ return ret;
+ }
+
+- ret = devm_snd_soc_register_component(&pdev->dev, &stm32_component,
+- &sai->cpu_dai_drv, 1);
++ ret = snd_dmaengine_pcm_register(&pdev->dev, conf, 0);
++ if (ret) {
++ dev_err(&pdev->dev, "Could not register pcm dma\n");
++ return ret;
++ }
++
++ ret = snd_soc_register_component(&pdev->dev, &stm32_component,
++ &sai->cpu_dai_drv, 1);
+ if (ret)
+ return ret;
+
+ if (STM_SAI_PROTOCOL_IS_SPDIF(sai))
+ conf = &stm32_sai_pcm_config_spdif;
+
+- ret = devm_snd_dmaengine_pcm_register(&pdev->dev, conf, 0);
+- if (ret) {
+- dev_err(&pdev->dev, "Could not register pcm dma\n");
+- return ret;
+- }
+-
+ return 0;
+ }
+
+@@ -1565,6 +1565,8 @@ static int stm32_sai_sub_remove(struct platform_device *pdev)
+ struct stm32_sai_sub_data *sai = dev_get_drvdata(&pdev->dev);
+
+ clk_unprepare(sai->pdata->pclk);
++ snd_dmaengine_pcm_unregister(&pdev->dev);
++ snd_soc_unregister_component(&pdev->dev);
+
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 97f0aaf0914f0fae477af28bcc8839763313a0ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Mar 2020 11:53:09 +0100
+Subject: binderfs: use refcount for binder control devices too
+
+From: Christian Brauner <christian.brauner@ubuntu.com>
+
+[ Upstream commit 211b64e4b5b6bd5fdc19cd525c2cc9a90e6b0ec9 ]
+
+Binderfs binder-control devices are cleaned up via binderfs_evict_inode
+too() which will use refcount_dec_and_test(). However, we missed to set
+the refcount for binderfs binder-control devices and so we underflowed
+when the binderfs instance got unmounted. Pretty obvious oversight and
+should have been part of the more general UAF fix. The good news is that
+having test cases (suprisingly) helps.
+
+Technically, we could detect that we're about to cleanup the
+binder-control dentry in binderfs_evict_inode() and then simply clean it
+up. But that makes the assumption that the binder driver itself will
+never make use of a binderfs binder-control device after the binderfs
+instance it belongs to has been unmounted and the superblock for it been
+destroyed. While it is unlikely to ever come to this let's be on the
+safe side. Performance-wise this also really doesn't matter since the
+binder-control device is only every really when creating the binderfs
+filesystem or creating additional binder devices. Both operations are
+pretty rare.
+
+Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
+Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
+Acked-by: Todd Kjos <tkjos@google.com>
+Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/android/binderfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c
+index 110e41f920c27..f303106b3362b 100644
+--- a/drivers/android/binderfs.c
++++ b/drivers/android/binderfs.c
+@@ -448,6 +448,7 @@ static int binderfs_binder_ctl_create(struct super_block *sb)
+ inode->i_uid = info->root_uid;
+ inode->i_gid = info->root_gid;
+
++ refcount_set(&device->ref, 1);
+ device->binderfs_inode = inode;
+ device->miscdev.minor = minor;
+
+--
+2.20.1
+
--- /dev/null
+From 7008bdfa9d538e90697820b8a40ee35d962f824f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Mar 2020 13:27:31 +0100
+Subject: block, bfq: fix overwrite of bfq_group pointer in
+ bfq_find_set_group()
+
+From: Carlo Nonato <carlo.nonato95@gmail.com>
+
+[ Upstream commit 14afc59361976c0ba39e3a9589c3eaa43ebc7e1d ]
+
+The bfq_find_set_group() function takes as input a blkcg (which represents
+a cgroup) and retrieves the corresponding bfq_group, then it updates the
+bfq internal group hierarchy (see comments inside the function for why
+this is needed) and finally it returns the bfq_group.
+In the hierarchy update cycle, the pointer holding the correct bfq_group
+that has to be returned is mistakenly used to traverse the hierarchy
+bottom to top, meaning that in each iteration it gets overwritten with the
+parent of the current group. Since the update cycle stops at root's
+children (depth = 2), the overwrite becomes a problem only if the blkcg
+describes a cgroup at a hierarchy level deeper than that (depth > 2). In
+this case the root's child that happens to be also an ancestor of the
+correct bfq_group is returned. The main consequence is that processes
+contained in a cgroup at depth greater than 2 are wrongly placed in the
+group described above by BFQ.
+
+This commits fixes this problem by using a different bfq_group pointer in
+the update cycle in order to avoid the overwrite of the variable holding
+the original group reference.
+
+Reported-by: Kwon Je Oh <kwonje.oh2@gmail.com>
+Signed-off-by: Carlo Nonato <carlo.nonato95@gmail.com>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-cgroup.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c
+index d0e36d6522649..86cd718e0380b 100644
+--- a/block/bfq-cgroup.c
++++ b/block/bfq-cgroup.c
+@@ -593,12 +593,13 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd,
+ */
+ entity = &bfqg->entity;
+ for_each_entity(entity) {
+- bfqg = container_of(entity, struct bfq_group, entity);
+- if (bfqg != bfqd->root_group) {
+- parent = bfqg_parent(bfqg);
++ struct bfq_group *curr_bfqg = container_of(entity,
++ struct bfq_group, entity);
++ if (curr_bfqg != bfqd->root_group) {
++ parent = bfqg_parent(curr_bfqg);
+ if (!parent)
+ parent = bfqd->root_group;
+- bfq_group_set_parent(bfqg, parent);
++ bfq_group_set_parent(curr_bfqg, parent);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2bc2fb6a1171526b4c72ffdd249f34f8d02862ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2020 23:59:32 -0600
+Subject: cifs: add missing mount option to /proc/mounts
+
+From: Steve French <stfrench@microsoft.com>
+
+[ Upstream commit ec57010acd03428a749d2600bf09bd537eaae993 ]
+
+We were not displaying the mount option "signloosely" in /proc/mounts
+for cifs mounts which some users found confusing recently
+
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifsfs.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 637624ab6e464..115f063497ffa 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -530,6 +530,8 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
+
+ if (tcon->seal)
+ seq_puts(s, ",seal");
++ else if (tcon->ses->server->ignore_signature)
++ seq_puts(s, ",signloosely");
+ if (tcon->nocase)
+ seq_puts(s, ",nocase");
+ if (tcon->local_lease)
+--
+2.20.1
+
--- /dev/null
+From 930c25c6958222b5a4034b09743092929d659fa7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2020 19:49:35 -0300
+Subject: cifs: fix potential mismatch of UNC paths
+
+From: Paulo Alcantara (SUSE) <pc@cjr.nz>
+
+[ Upstream commit 154255233830e1e4dd0d99ac929a5dce588c0b81 ]
+
+Ensure that full_path is an UNC path that contains '\\' as delimiter,
+which is required by cifs_build_devname().
+
+The build_path_from_dentry_optional_prefix() function may return a
+path with '/' as delimiter when using SMB1 UNIX extensions, for
+example.
+
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Acked-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/cifs_dfs_ref.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
+index 606f26d862dc1..cc3ada12848d9 100644
+--- a/fs/cifs/cifs_dfs_ref.c
++++ b/fs/cifs/cifs_dfs_ref.c
+@@ -324,6 +324,8 @@ static struct vfsmount *cifs_dfs_do_automount(struct dentry *mntpt)
+ if (full_path == NULL)
+ goto cdda_exit;
+
++ convert_delimiter(full_path, '\\');
++
+ cifs_dbg(FYI, "%s: full_path: %s\n", __func__, full_path);
+
+ if (!cifs_sb_master_tlink(cifs_sb)) {
+--
+2.20.1
+
--- /dev/null
+From 4782806e6fb744cf003602a71dc874583e2eaa2d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2020 18:00:53 -0500
+Subject: dm bio record: save/restore bi_end_io and bi_integrity
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+[ Upstream commit 1b17159e52bb31f982f82a6278acd7fab1d3f67b ]
+
+Also, save/restore __bi_remaining in case the bio was used in a
+BIO_CHAIN (e.g. due to blk_queue_split).
+
+Suggested-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-bio-record.h | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/drivers/md/dm-bio-record.h b/drivers/md/dm-bio-record.h
+index c82578af56a5b..2ea0360108e1d 100644
+--- a/drivers/md/dm-bio-record.h
++++ b/drivers/md/dm-bio-record.h
+@@ -20,8 +20,13 @@
+ struct dm_bio_details {
+ struct gendisk *bi_disk;
+ u8 bi_partno;
++ int __bi_remaining;
+ unsigned long bi_flags;
+ struct bvec_iter bi_iter;
++ bio_end_io_t *bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++ struct bio_integrity_payload *bi_integrity;
++#endif
+ };
+
+ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio)
+@@ -30,6 +35,11 @@ static inline void dm_bio_record(struct dm_bio_details *bd, struct bio *bio)
+ bd->bi_partno = bio->bi_partno;
+ bd->bi_flags = bio->bi_flags;
+ bd->bi_iter = bio->bi_iter;
++ bd->__bi_remaining = atomic_read(&bio->__bi_remaining);
++ bd->bi_end_io = bio->bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++ bd->bi_integrity = bio_integrity(bio);
++#endif
+ }
+
+ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio)
+@@ -38,6 +48,11 @@ static inline void dm_bio_restore(struct dm_bio_details *bd, struct bio *bio)
+ bio->bi_partno = bd->bi_partno;
+ bio->bi_flags = bd->bi_flags;
+ bio->bi_iter = bd->bi_iter;
++ atomic_set(&bio->__bi_remaining, bd->__bi_remaining);
++ bio->bi_end_io = bd->bi_end_io;
++#if defined(CONFIG_BLK_DEV_INTEGRITY)
++ bio->bi_integrity = bd->bi_integrity;
++#endif
+ }
+
+ #endif
+--
+2.20.1
+
--- /dev/null
+From b6f21d28bcb333457ef06e9be34c6a521898a2c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2020 18:11:53 -0500
+Subject: dm integrity: use dm_bio_record and dm_bio_restore
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+[ Upstream commit 248aa2645aa7fc9175d1107c2593cc90d4af5a4e ]
+
+In cases where dec_in_flight() has to requeue the integrity_bio_wait
+work to transfer the rest of the data, the bio's __bi_remaining might
+already have been decremented to 0, e.g.: if bio passed to underlying
+data device was split via blk_queue_split().
+
+Use dm_bio_{record,restore} rather than effectively open-coding them in
+dm-integrity -- these methods now manage __bi_remaining too.
+
+Depends-on: f7f0b057a9c1 ("dm bio record: save/restore bi_end_io and bi_integrity")
+Reported-by: Daniel Glöckner <dg@emlix.com>
+Suggested-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/dm-integrity.c | 32 +++++++++-----------------------
+ 1 file changed, 9 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 57ac603f37410..145bc2e7eaf01 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -6,6 +6,8 @@
+ * This file is released under the GPL.
+ */
+
++#include "dm-bio-record.h"
++
+ #include <linux/compiler.h>
+ #include <linux/module.h>
+ #include <linux/device-mapper.h>
+@@ -292,11 +294,7 @@ struct dm_integrity_io {
+
+ struct completion *completion;
+
+- struct gendisk *orig_bi_disk;
+- u8 orig_bi_partno;
+- bio_end_io_t *orig_bi_end_io;
+- struct bio_integrity_payload *orig_bi_integrity;
+- struct bvec_iter orig_bi_iter;
++ struct dm_bio_details bio_details;
+ };
+
+ struct journal_completion {
+@@ -1447,14 +1445,9 @@ static void integrity_end_io(struct bio *bio)
+ {
+ struct dm_integrity_io *dio = dm_per_bio_data(bio, sizeof(struct dm_integrity_io));
+
+- bio->bi_iter = dio->orig_bi_iter;
+- bio->bi_disk = dio->orig_bi_disk;
+- bio->bi_partno = dio->orig_bi_partno;
+- if (dio->orig_bi_integrity) {
+- bio->bi_integrity = dio->orig_bi_integrity;
++ dm_bio_restore(&dio->bio_details, bio);
++ if (bio->bi_integrity)
+ bio->bi_opf |= REQ_INTEGRITY;
+- }
+- bio->bi_end_io = dio->orig_bi_end_io;
+
+ if (dio->completion)
+ complete(dio->completion);
+@@ -1539,7 +1532,7 @@ static void integrity_metadata(struct work_struct *w)
+ }
+ }
+
+- __bio_for_each_segment(bv, bio, iter, dio->orig_bi_iter) {
++ __bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) {
+ unsigned pos;
+ char *mem, *checksums_ptr;
+
+@@ -1583,7 +1576,7 @@ static void integrity_metadata(struct work_struct *w)
+ if (likely(checksums != checksums_onstack))
+ kfree(checksums);
+ } else {
+- struct bio_integrity_payload *bip = dio->orig_bi_integrity;
++ struct bio_integrity_payload *bip = dio->bio_details.bi_integrity;
+
+ if (bip) {
+ struct bio_vec biv;
+@@ -2002,20 +1995,13 @@ static void dm_integrity_map_continue(struct dm_integrity_io *dio, bool from_map
+ } else
+ dio->completion = NULL;
+
+- dio->orig_bi_iter = bio->bi_iter;
+-
+- dio->orig_bi_disk = bio->bi_disk;
+- dio->orig_bi_partno = bio->bi_partno;
++ dm_bio_record(&dio->bio_details, bio);
+ bio_set_dev(bio, ic->dev->bdev);
+-
+- dio->orig_bi_integrity = bio_integrity(bio);
+ bio->bi_integrity = NULL;
+ bio->bi_opf &= ~REQ_INTEGRITY;
+-
+- dio->orig_bi_end_io = bio->bi_end_io;
+ bio->bi_end_io = integrity_end_io;
+-
+ bio->bi_iter.bi_size = dio->range.n_sectors << SECTOR_SHIFT;
++
+ generic_make_request(bio);
+
+ if (need_sync_io) {
+--
+2.20.1
+
--- /dev/null
+From ac29bbe86c1ccdc7c0384c606a27f839d5ba7623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 26 Feb 2020 13:45:10 +0800
+Subject: drivers/perf: arm_pmu_acpi: Fix incorrect checking of gicc pointer
+
+From: luanshi <zhangliguang@linux.alibaba.com>
+
+[ Upstream commit 3ba52ad55b533760a1f65836aa0ec9d35e36bb4f ]
+
+Fix bogus NULL checks on the return value of acpi_cpu_get_madt_gicc()
+by checking for a 0 'gicc->performance_interrupt' value instead.
+
+Signed-off-by: Liguang Zhang <zhangliguang@linux.alibaba.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_pmu_acpi.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/perf/arm_pmu_acpi.c b/drivers/perf/arm_pmu_acpi.c
+index acce8781c456c..f5c7a845cd7bf 100644
+--- a/drivers/perf/arm_pmu_acpi.c
++++ b/drivers/perf/arm_pmu_acpi.c
+@@ -24,8 +24,6 @@ static int arm_pmu_acpi_register_irq(int cpu)
+ int gsi, trigger;
+
+ gicc = acpi_cpu_get_madt_gicc(cpu);
+- if (WARN_ON(!gicc))
+- return -EINVAL;
+
+ gsi = gicc->performance_interrupt;
+
+@@ -64,11 +62,10 @@ static void arm_pmu_acpi_unregister_irq(int cpu)
+ int gsi;
+
+ gicc = acpi_cpu_get_madt_gicc(cpu);
+- if (!gicc)
+- return;
+
+ gsi = gicc->performance_interrupt;
+- acpi_unregister_gsi(gsi);
++ if (gsi)
++ acpi_unregister_gsi(gsi);
+ }
+
+ #if IS_ENABLED(CONFIG_ARM_SPE_PMU)
+--
+2.20.1
+
--- /dev/null
+From dc04bc398b3ebf38ba7581996796a41d2779b632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2020 20:56:43 +0800
+Subject: drivers/perf: fsl_imx8_ddr: Correct the CLEAR bit definition
+
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+
+[ Upstream commit 049d919168458ac54e7fad27cd156a958b042d2f ]
+
+When disabling a counter from ddr_perf_event_stop(), the counter value
+is reset to 0 at the same time.
+
+Preserve the counter value by performing a read-modify-write of the
+PMU register and clearing only the enable bit.
+
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/fsl_imx8_ddr_perf.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
+index 0e51baa48b149..6eef47de8fccc 100644
+--- a/drivers/perf/fsl_imx8_ddr_perf.c
++++ b/drivers/perf/fsl_imx8_ddr_perf.c
+@@ -327,9 +327,10 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,
+
+ if (enable) {
+ /*
+- * must disable first, then enable again
+- * otherwise, cycle counter will not work
+- * if previous state is enabled.
++ * cycle counter is special which should firstly write 0 then
++ * write 1 into CLEAR bit to clear it. Other counters only
++ * need write 0 into CLEAR bit and it turns out to be 1 by
++ * hardware. Below enable flow is harmless for all counters.
+ */
+ writel(0, pmu->base + reg);
+ val = CNTL_EN | CNTL_CLEAR;
+@@ -337,7 +338,8 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,
+ writel(val, pmu->base + reg);
+ } else {
+ /* Disable counter */
+- writel(0, pmu->base + reg);
++ val = readl_relaxed(pmu->base + reg) & CNTL_EN_MASK;
++ writel(val, pmu->base + reg);
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e448618696a33e6dcea76fb7a37c953e0ca8f380 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2020 11:16:14 -0500
+Subject: drm/amd/display: Clear link settings on MST disable connector
+
+From: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+
+[ Upstream commit 5ac7fd2f597b88ee81f4748ee50cab06192a8dc3 ]
+
+[Why]
+If we have a single MST display and we disconnect it, we dont disable that
+link. This causes the old link settings to still exist
+
+Now on a replug for MST we think its a link loss and will try to reallocate
+mst payload which will fail, throwing warning below.
+
+[ 129.374192] [drm] Failed to updateMST allocation table forpipe idx:0
+[ 129.374206] ------------[ cut here ]------------
+[ 129.374284] WARNING: CPU: 14 PID: 1710 at
+drivers/gpu/drm/amd/amdgpu/../dal-dev/dc/core/dc_link.c:3153
+dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu]
+
+[ 129.374285] Modules linked in: amdgpu(OE) amd_iommu_v2 gpu_sched ttm
+drm_kms_helper drm fb_sys_fops syscopyarea sysfillrect sysimgblt
+binfmt_misc nls_iso8859_1 edac_mce_amd snd_hda_codec_realtek
+snd_hda_codec_generic ledtrig_audio kvm snd_hda_codec_hdmi snd_hda_intel
+snd_intel_nhlt snd_hda_codec irqbypass snd_hda_core snd_hwdep snd_pcm
+snd_seq_midi snd_seq_midi_event snd_rawmidi crct10dif_pclmul snd_seq
+crc32_pclmul ghash_clmulni_intel snd_seq_device snd_timer snd aesni_intel
+eeepc_wmi crypto_simd asus_wmi joydev cryptd sparse_keymap input_leds
+soundcore video glue_helper wmi_bmof mxm_wmi k10temp ccp mac_hid
+sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4
+hid_generic usbhid hid igb i2c_algo_bit ahci dca i2c_piix4 libahci
+gpio_amdpt wmi gpio_generic
+
+[ 129.374318] CPU: 14 PID: 1710 Comm: kworker/14:2 Tainted: G W OE 5.4.0-rc7bhawan+ #480
+[ 129.374318] Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 0515 03/30/2017
+[ 129.374397] Workqueue: events dm_irq_work_func [amdgpu]
+[ 129.374468] RIP: 0010:dc_link_allocate_mst_payload+0x1f7/0x220 [amdgpu]
+[ 129.374470] Code: 52 20 e8 1c 63 ad f4 48 8b 5d d0 65 48 33 1c 25 28 00
+00 00 b8 01 00 00 00 75 16 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3
+<0f> 0b e9 fa fe ff ff e8 ed 5b d6 f3 41 0f b6 b6 c4 02 00 00 48 c7
+[ 129.374471] RSP: 0018:ffff9f9141e7fcc0 EFLAGS: 00010246
+[ 129.374472] RAX: 0000000000000000 RBX: ffff91ef0762f800 RCX: 0000000000000000
+[ 129.374473] RDX: 0000000000000005 RSI: ffffffffc0c4a988 RDI: 0000000000000004
+[ 129.374474] RBP: ffff9f9141e7fd10 R08: 0000000000000005 R09: 0000000000000000
+[ 129.374475] R10: 0000000000000002 R11: 0000000000000001 R12: ffff91eebd510c00
+[ 129.374475] R13: ffff91eebd510e58 R14: ffff91ef052c01b8 R15: 0000000000000006
+[ 129.374476] FS: 0000000000000000(0000) GS:ffff91ef0ef80000(0000) knlGS:0000000000000000
+[ 129.374477] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 129.374478] CR2: 000055623ea01d50 CR3: 0000000408a8c000 CR4: 00000000003406e0
+[ 129.374479] Call Trace:
+[ 129.374550] dc_link_reallocate_mst_payload+0x12e/0x150 [amdgpu]
+[ 129.374617] dc_link_handle_hpd_rx_irq+0x6d4/0x6e0 [amdgpu]
+[ 129.374693] handle_hpd_rx_irq+0x77/0x310 [amdgpu]
+[ 129.374768] dm_irq_work_func+0x53/0x70 [amdgpu]
+[ 129.374774] process_one_work+0x1fd/0x3f0
+[ 129.374776] worker_thread+0x255/0x410
+[ 129.374778] kthread+0x121/0x140
+[ 129.374780] ? process_one_work+0x3f0/0x3f0
+[ 129.374781] ? kthread_park+0x90/0x90
+[ 129.374785] ret_from_fork+0x22/0x40
+
+[How]
+when we disable MST we should clear the cur link settings (lane_count=0 is
+good enough). This will cause us to not reallocate payloads earlier than
+expected and not throw the warning
+
+Signed-off-by: Bhawanpreet Lakha <Bhawanpreet.Lakha@amd.com>
+Reviewed-by: Hersen Wu <hersenxs.wu@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+index 16218a202b591..28a6c7b2ef4bb 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -379,6 +379,7 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr,
+ aconnector->dc_sink);
+ dc_sink_release(aconnector->dc_sink);
+ aconnector->dc_sink = NULL;
++ aconnector->dc_link->cur_link_settings.lane_count = 0;
+ }
+
+ drm_connector_unregister(connector);
+--
+2.20.1
+
--- /dev/null
+From e8a5ee75900d6205465a9c79811fc852b63041a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Feb 2020 12:26:19 -0500
+Subject: drm/amd/display: fix dcc swath size calculations on dcn1
+
+From: Josip Pavic <Josip.Pavic@amd.com>
+
+[ Upstream commit a0275dfc82c9034eefbeffd556cca6dd239d7925 ]
+
+[Why]
+Swath sizes are being calculated incorrectly. The horizontal swath size
+should be the product of block height, viewport width, and bytes per
+element, but the calculation uses viewport height instead of width. The
+vertical swath size is similarly incorrectly calculated. The effect of
+this is that we report the wrong DCC caps.
+
+[How]
+Use viewport width in the horizontal swath size calculation and viewport
+height in the vertical swath size calculation.
+
+Signed-off-by: Josip Pavic <Josip.Pavic@amd.com>
+Reviewed-by: Aric Cyr <Aric.Cyr@amd.com>
+Acked-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
+index a02c10e23e0d6..d163388c99a06 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hubbub.c
+@@ -840,8 +840,8 @@ static void hubbub1_det_request_size(
+
+ hubbub1_get_blk256_size(&blk256_width, &blk256_height, bpe);
+
+- swath_bytes_horz_wc = height * blk256_height * bpe;
+- swath_bytes_vert_wc = width * blk256_width * bpe;
++ swath_bytes_horz_wc = width * blk256_height * bpe;
++ swath_bytes_vert_wc = height * blk256_width * bpe;
+
+ *req128_horz_wc = (2 * swath_bytes_horz_wc <= detile_buf_size) ?
+ false : /* full 256B request */
+--
+2.20.1
+
--- /dev/null
+From be03a3809f82a07a52ee4217947ba7d852e8c1bc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Feb 2020 14:24:42 +0800
+Subject: drm/amdgpu: clean wptr on wb when gpu recovery
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yintian Tao <yttao@amd.com>
+
+[ Upstream commit 2ab7e274b86739f4ceed5d94b6879f2d07b2802f ]
+
+The TDR will be randomly failed due to compute ring
+test failure. If the compute ring wptr & 0x7ff(ring_buf_mask)
+is 0x100 then after map mqd the compute ring rptr will be
+synced with 0x100. And the ring test packet size is also 0x100.
+Then after invocation of amdgpu_ring_commit, the cp will not
+really handle the packet on the ring buffer because rptr is equal to wptr.
+
+Signed-off-by: Yintian Tao <yttao@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Monk Liu <Monk.Liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 1 +
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 2816d03297385..14417cebe38ba 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -3555,6 +3555,7 @@ static int gfx_v10_0_kcq_init_queue(struct amdgpu_ring *ring)
+
+ /* reset ring buffer */
+ ring->wptr = 0;
++ atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0);
+ amdgpu_ring_clear_ring(ring);
+ } else {
+ amdgpu_ring_clear_ring(ring);
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index d85e1e559c826..40034efa64bbc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -3756,6 +3756,7 @@ static int gfx_v9_0_kcq_init_queue(struct amdgpu_ring *ring)
+
+ /* reset ring buffer */
+ ring->wptr = 0;
++ atomic64_set((atomic64_t *)&adev->wb.wb[ring->wptr_offs], 0);
+ amdgpu_ring_clear_ring(ring);
+ } else {
+ amdgpu_ring_clear_ring(ring);
+--
+2.20.1
+
--- /dev/null
+From 20969b2437f0d48d2fd4743ea1456fa3e003ee7d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2020 13:30:12 +0100
+Subject: drm/exynos: dsi: fix workaround for the legacy clock name
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit c0fd99d659ba5582e09625c7a985d63fc2ca74b5 ]
+
+Writing to the built-in strings arrays doesn't work if driver is loaded
+as kernel module. This is also considered as a bad pattern. Fix this by
+adding a call to clk_get() with legacy clock name. This fixes following
+kernel oops if driver is loaded as module:
+
+Unable to handle kernel paging request at virtual address bf047978
+ pgd = (ptrval)
+ [bf047978] *pgd=59344811, *pte=5903c6df, *ppte=5903c65f
+ Internal error: Oops: 80f [#1] SMP ARM
+ Modules linked in: mc exynosdrm(+) analogix_dp rtc_s3c exynos_ppmu i2c_gpio
+ CPU: 1 PID: 212 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219 #326
+ videodev: Linux video capture interface: v2.00
+ Hardware name: Samsung Exynos (Flattened Device Tree)
+ PC is at exynos_dsi_probe+0x1f0/0x384 [exynosdrm]
+ LR is at exynos_dsi_probe+0x1dc/0x384 [exynosdrm]
+ ...
+ Process systemd-udevd (pid: 212, stack limit = 0x(ptrval))
+ ...
+ [<bf03cf14>] (exynos_dsi_probe [exynosdrm]) from [<c09b1ca0>] (platform_drv_probe+0x6c/0xa4)
+ [<c09b1ca0>] (platform_drv_probe) from [<c09afcb8>] (really_probe+0x210/0x350)
+ [<c09afcb8>] (really_probe) from [<c09aff74>] (driver_probe_device+0x60/0x1a0)
+ [<c09aff74>] (driver_probe_device) from [<c09b0254>] (device_driver_attach+0x58/0x60)
+ [<c09b0254>] (device_driver_attach) from [<c09b02dc>] (__driver_attach+0x80/0xbc)
+ [<c09b02dc>] (__driver_attach) from [<c09ade00>] (bus_for_each_dev+0x68/0xb4)
+ [<c09ade00>] (bus_for_each_dev) from [<c09aefd8>] (bus_add_driver+0x130/0x1e8)
+ [<c09aefd8>] (bus_add_driver) from [<c09b0d64>] (driver_register+0x78/0x110)
+ [<c09b0d64>] (driver_register) from [<bf038558>] (exynos_drm_init+0xe8/0x11c [exynosdrm])
+ [<bf038558>] (exynos_drm_init [exynosdrm]) from [<c0302fa8>] (do_one_initcall+0x50/0x220)
+ [<c0302fa8>] (do_one_initcall) from [<c03dd02c>] (do_init_module+0x60/0x210)
+ [<c03dd02c>] (do_init_module) from [<c03dbf44>] (load_module+0x1c0c/0x2310)
+ [<c03dbf44>] (load_module) from [<c03dc85c>] (sys_finit_module+0xac/0xbc)
+ [<c03dc85c>] (sys_finit_module) from [<c0301000>] (ret_fast_syscall+0x0/0x54)
+ Exception stack(0xd979bfa8 to 0xd979bff0)
+ ...
+ ---[ end trace db16efe05faab470 ]---
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_dsi.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+index 2767408c4750e..8ed94c9948008 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+@@ -1765,9 +1765,10 @@ static int exynos_dsi_probe(struct platform_device *pdev)
+ dsi->clks[i] = devm_clk_get(dev, clk_names[i]);
+ if (IS_ERR(dsi->clks[i])) {
+ if (strcmp(clk_names[i], "sclk_mipi") == 0) {
+- strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME);
+- i--;
+- continue;
++ dsi->clks[i] = devm_clk_get(dev,
++ OLD_SCLK_MIPI_CLK_NAME);
++ if (!IS_ERR(dsi->clks[i]))
++ continue;
+ }
+
+ dev_info(dev, "failed to get the clock: %s\n",
+--
+2.20.1
+
--- /dev/null
+From 91d3a96e7187eea4d13ac3d57682a75bbceff495 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 27 Feb 2020 08:06:37 +0100
+Subject: drm/exynos: dsi: propagate error value and silence meaningless
+ warning
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 0a9d1e3f3f038785ebc72d53f1c409d07f6b4ff5 ]
+
+Properly propagate error value from devm_regulator_bulk_get() and don't
+confuse user with meaningless warning about failure in getting regulators
+in case of deferred probe.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_drm_dsi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+index 6926cee91b367..2767408c4750e 100644
+--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
++++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+@@ -1750,8 +1750,9 @@ static int exynos_dsi_probe(struct platform_device *pdev)
+ ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(dsi->supplies),
+ dsi->supplies);
+ if (ret) {
+- dev_info(dev, "failed to get regulators: %d\n", ret);
+- return -EPROBE_DEFER;
++ if (ret != -EPROBE_DEFER)
++ dev_info(dev, "failed to get regulators: %d\n", ret);
++ return ret;
+ }
+
+ dsi->clks = devm_kcalloc(dev,
+--
+2.20.1
+
--- /dev/null
+From 4d57aba39b61cef1c3f6e31fc6e308b1dbbbb25f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2020 13:57:26 +0100
+Subject: drm/exynos: hdmi: don't leak enable HDMI_EN regulator if probe fails
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 3b6a9b19ab652efac7ad4c392add6f1235019568 ]
+
+Move enabling and disabling HDMI_EN optional regulator to probe() function
+to keep track on the regulator status. This fixes following warning if
+probe() fails (for example when I2C DDC adapter cannot be yet gathered
+due to the missing driver). This fixes following warning observed on
+Arndale5250 board with multi_v7_defconfig:
+
+[drm] Failed to get ddc i2c adapter by node
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 214 at drivers/regulator/core.c:2051 _regulator_put+0x16c/0x184
+Modules linked in: ...
+CPU: 0 PID: 214 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219-00040-g38af1dfafdbb #7570
+Hardware name: Samsung Exynos (Flattened Device Tree)
+[<c0312258>] (unwind_backtrace) from [<c030cc10>] (show_stack+0x10/0x14)
+[<c030cc10>] (show_stack) from [<c0f0d3a0>] (dump_stack+0xcc/0xe0)
+[<c0f0d3a0>] (dump_stack) from [<c0346a58>] (__warn+0xe0/0xf8)
+[<c0346a58>] (__warn) from [<c0346b20>] (warn_slowpath_fmt+0xb0/0xb8)
+[<c0346b20>] (warn_slowpath_fmt) from [<c0893f58>] (_regulator_put+0x16c/0x184)
+[<c0893f58>] (_regulator_put) from [<c0893f8c>] (regulator_put+0x1c/0x2c)
+[<c0893f8c>] (regulator_put) from [<c09b2664>] (release_nodes+0x17c/0x200)
+[<c09b2664>] (release_nodes) from [<c09aebe8>] (really_probe+0x10c/0x350)
+[<c09aebe8>] (really_probe) from [<c09aefa8>] (driver_probe_device+0x60/0x1a0)
+[<c09aefa8>] (driver_probe_device) from [<c09af288>] (device_driver_attach+0x58/0x60)
+[<c09af288>] (device_driver_attach) from [<c09af310>] (__driver_attach+0x80/0xbc)
+[<c09af310>] (__driver_attach) from [<c09ace34>] (bus_for_each_dev+0x68/0xb4)
+[<c09ace34>] (bus_for_each_dev) from [<c09ae00c>] (bus_add_driver+0x130/0x1e8)
+[<c09ae00c>] (bus_add_driver) from [<c09afd98>] (driver_register+0x78/0x110)
+[<c09afd98>] (driver_register) from [<bf139558>] (exynos_drm_init+0xe8/0x11c [exynosdrm])
+[<bf139558>] (exynos_drm_init [exynosdrm]) from [<c0302fa8>] (do_one_initcall+0x50/0x220)
+[<c0302fa8>] (do_one_initcall) from [<c03dc02c>] (do_init_module+0x60/0x210)
+[<c03dc02c>] (do_init_module) from [<c03daf44>] (load_module+0x1c0c/0x2310)
+[<c03daf44>] (load_module) from [<c03db85c>] (sys_finit_module+0xac/0xbc)
+[<c03db85c>] (sys_finit_module) from [<c0301000>] (ret_fast_syscall+0x0/0x54)
+Exception stack(0xecca3fa8 to 0xecca3ff0)
+...
+---[ end trace 276c91214635905c ]---
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Andrzej Hajda <a.hajda@samsung.com>
+Signed-off-by: Inki Dae <inki.dae@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/exynos/exynos_hdmi.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
+index 09aa73c0f2add..0073a2b3b80a2 100644
+--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
++++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
+@@ -1802,18 +1802,10 @@ static int hdmi_resources_init(struct hdmi_context *hdata)
+
+ hdata->reg_hdmi_en = devm_regulator_get_optional(dev, "hdmi-en");
+
+- if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV) {
++ if (PTR_ERR(hdata->reg_hdmi_en) != -ENODEV)
+ if (IS_ERR(hdata->reg_hdmi_en))
+ return PTR_ERR(hdata->reg_hdmi_en);
+
+- ret = regulator_enable(hdata->reg_hdmi_en);
+- if (ret) {
+- DRM_DEV_ERROR(dev,
+- "failed to enable hdmi-en regulator\n");
+- return ret;
+- }
+- }
+-
+ return hdmi_bridge_init(hdata);
+ }
+
+@@ -2020,6 +2012,15 @@ static int hdmi_probe(struct platform_device *pdev)
+ }
+ }
+
++ if (!IS_ERR(hdata->reg_hdmi_en)) {
++ ret = regulator_enable(hdata->reg_hdmi_en);
++ if (ret) {
++ DRM_DEV_ERROR(dev,
++ "failed to enable hdmi-en regulator\n");
++ goto err_hdmiphy;
++ }
++ }
++
+ pm_runtime_enable(dev);
+
+ audio_infoframe = &hdata->audio.infoframe;
+@@ -2044,7 +2045,8 @@ static int hdmi_probe(struct platform_device *pdev)
+
+ err_rpm_disable:
+ pm_runtime_disable(dev);
+-
++ if (!IS_ERR(hdata->reg_hdmi_en))
++ regulator_disable(hdata->reg_hdmi_en);
+ err_hdmiphy:
+ if (hdata->hdmiphy_port)
+ put_device(&hdata->hdmiphy_port->dev);
+--
+2.20.1
+
--- /dev/null
+From b43d4c78a3da947d6e7a5056a9f3cd5424aeff02 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 7 Feb 2020 15:23:51 +1100
+Subject: drm/mediatek: Find the cursor plane instead of hard coding it
+
+From: Evan Benn <evanbenn@chromium.org>
+
+[ Upstream commit 318caac7c81cdf5806df30c3d72385659a5f0f53 ]
+
+The cursor and primary planes were hard coded.
+Now search for them for passing to drm_crtc_init_with_planes
+
+Signed-off-by: Evan Benn <evanbenn@chromium.org>
+Reviewed-by: Sean Paul <seanpaul@chromium.org>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+index e6c049f4f08bb..f9455f2724d23 100644
+--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c
+@@ -496,10 +496,18 @@ static const struct drm_crtc_helper_funcs mtk_crtc_helper_funcs = {
+
+ static int mtk_drm_crtc_init(struct drm_device *drm,
+ struct mtk_drm_crtc *mtk_crtc,
+- struct drm_plane *primary,
+- struct drm_plane *cursor, unsigned int pipe)
++ unsigned int pipe)
+ {
+- int ret;
++ struct drm_plane *primary = NULL;
++ struct drm_plane *cursor = NULL;
++ int i, ret;
++
++ for (i = 0; i < mtk_crtc->layer_nr; i++) {
++ if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_PRIMARY)
++ primary = &mtk_crtc->planes[i];
++ else if (mtk_crtc->planes[i].type == DRM_PLANE_TYPE_CURSOR)
++ cursor = &mtk_crtc->planes[i];
++ }
+
+ ret = drm_crtc_init_with_planes(drm, &mtk_crtc->base, primary, cursor,
+ &mtk_crtc_funcs, NULL);
+@@ -608,9 +616,7 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev,
+ return ret;
+ }
+
+- ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, &mtk_crtc->planes[0],
+- mtk_crtc->layer_nr > 1 ? &mtk_crtc->planes[1] :
+- NULL, pipe);
++ ret = mtk_drm_crtc_init(drm_dev, mtk_crtc, pipe);
+ if (ret < 0)
+ return ret;
+
+--
+2.20.1
+
--- /dev/null
+From f651fd683ccd456bf4cdf9e1fbc89f8d9e839f86 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Mar 2020 23:13:11 +0100
+Subject: parse-maintainers: Mark as executable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+
+[ Upstream commit 611d61f9ac99dc9e1494473fb90117a960a89dfa ]
+
+This makes the script more convenient to run.
+
+Signed-off-by: Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/parse-maintainers.pl | 0
+ 1 file changed, 0 insertions(+), 0 deletions(-)
+ mode change 100644 => 100755 scripts/parse-maintainers.pl
+
+diff --git a/scripts/parse-maintainers.pl b/scripts/parse-maintainers.pl
+old mode 100644
+new mode 100755
+--
+2.20.1
+
--- /dev/null
+From 1058c08014232a815473b7f4cac6aaca7dbe1d7a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 21:08:01 +0200
+Subject: phy: ti: gmii-sel: do not fail in case of gmii
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit 58aa7729310db04ffcc022c98002dd8fcb486c58 ]
+
+The "gmii" PHY interface mode is supported on TI AM335x/437x/5xx SoCs, so
+don't fail if it's selected.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-gmii-sel.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
+index e998e9cd8d1f8..1c536fc03c83c 100644
+--- a/drivers/phy/ti/phy-gmii-sel.c
++++ b/drivers/phy/ti/phy-gmii-sel.c
+@@ -80,6 +80,7 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode)
+ break;
+
+ case PHY_INTERFACE_MODE_MII:
++ case PHY_INTERFACE_MODE_GMII:
+ gmii_sel_mode = AM33XX_GMII_SEL_MODE_MII;
+ break;
+
+--
+2.20.1
+
--- /dev/null
+From 7a0ee32674b7f6e22eae75da131190877b1d9376 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 21:08:00 +0200
+Subject: phy: ti: gmii-sel: fix set of copy-paste errors
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+[ Upstream commit eefed634eb61e4094b9fb8183cb8d43b26838517 ]
+
+- under PHY_INTERFACE_MODE_MII the 'mode' func parameter is assigned
+instead of 'gmii_sel_mode' and it's working only because the default value
+'gmii_sel_mode' is set to 0.
+
+- console outputs use 'rgmii_id' and 'mode' values to print PHY mode
+instead of using 'submode' value which is representing PHY interface mode
+now.
+
+This patch fixes above two cases.
+
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/ti/phy-gmii-sel.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/phy/ti/phy-gmii-sel.c b/drivers/phy/ti/phy-gmii-sel.c
+index a28bd15297f53..e998e9cd8d1f8 100644
+--- a/drivers/phy/ti/phy-gmii-sel.c
++++ b/drivers/phy/ti/phy-gmii-sel.c
+@@ -80,20 +80,19 @@ static int phy_gmii_sel_mode(struct phy *phy, enum phy_mode mode, int submode)
+ break;
+
+ case PHY_INTERFACE_MODE_MII:
+- mode = AM33XX_GMII_SEL_MODE_MII;
++ gmii_sel_mode = AM33XX_GMII_SEL_MODE_MII;
+ break;
+
+ default:
+- dev_warn(dev,
+- "port%u: unsupported mode: \"%s\". Defaulting to MII.\n",
+- if_phy->id, phy_modes(rgmii_id));
++ dev_warn(dev, "port%u: unsupported mode: \"%s\"\n",
++ if_phy->id, phy_modes(submode));
+ return -EINVAL;
+ }
+
+ if_phy->phy_if_mode = submode;
+
+ dev_dbg(dev, "%s id:%u mode:%u rgmii_id:%d rmii_clk_ext:%d\n",
+- __func__, if_phy->id, mode, rgmii_id,
++ __func__, if_phy->id, submode, rgmii_id,
+ if_phy->rmii_clock_external);
+
+ regfield = if_phy->fields[PHY_GMII_SEL_PORT_MODE];
+--
+2.20.1
+
--- /dev/null
+From 607e194abaedc7c5cc4aa6da5ee630433227d0be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Feb 2020 17:01:32 +0530
+Subject: powerpc: Include .BTF section
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+[ Upstream commit cb0cc635c7a9fa8a3a0f75d4d896721819c63add ]
+
+Selecting CONFIG_DEBUG_INFO_BTF results in the below warning from ld:
+ ld: warning: orphan section `.BTF' from `.btf.vmlinux.bin.o' being placed in section `.BTF'
+
+Include .BTF section in vmlinux explicitly to fix the same.
+
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200220113132.857132-1-naveen.n.rao@linux.vnet.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/vmlinux.lds.S | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 060a1acd7c6d7..4638d28633888 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -326,6 +326,12 @@ SECTIONS
+ *(.branch_lt)
+ }
+
++#ifdef CONFIG_DEBUG_INFO_BTF
++ .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) {
++ *(.BTF)
++ }
++#endif
++
+ .opd : AT(ADDR(.opd) - LOAD_OFFSET) {
+ __start_opd = .;
+ KEEP(*(.opd))
+--
+2.20.1
+
--- /dev/null
+From 333cca5736fc678c16356b03d76c784eca6288b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Mar 2020 10:37:16 -0400
+Subject: Revert "drm/fbdev: Fallback to non tiled mode if all tiles not
+ present"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit f053c83ad5c88427644e06746bfddcefa409c27d ]
+
+This reverts commit f25c7a006cd1 ("drm/fbdev: Fallback to non tiled mode
+if all tiles not present"). The commit causes flip done timeouts in CI.
+
+Below are the sample errors thrown in logs:
+
+[IGT] core_getversion: executing
+[IGT] core_getversion: exiting, ret=0
+Setting dangerous option reset - tainting kernel
+drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out
+drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out
+drm:drm_atomic_helper_wait_for_dependencies] ERROR [PLANE:92:plane 1B] flip_done timed out
+[drm:drm_atomic_helper_wait_for_flip_done] ERROR [CRTC:152:pipe B] flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] ERROR [PLANE:92:plane 1B] flip_done timed out
+[drm:drm_atomic_helper_wait_for_flip_done] ERROR [CRTC:152:pipe B] flip_done timed out
+Console: switching to colour frame buffer device 480x135
+[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CRTC:152:pipe B] flip_done timed out
+[drm:drm_atomic_helper_wait_for_dependencies] ERROR [CONNECTOR:299:DP-2] flip_done timed out
+
+Reverting the change for now to unblock CI execution.
+
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Manasi Navare <manasi.d.navare@intel.com>
+Signed-off-by: Uma Shankar <uma.shankar@intel.com>
+Fixes: f25c7a006cd1 ("drm/fbdev: Fallback to non tiled mode if all tiles not present")
+Closes: https://gitlab.freedesktop.org/drm/intel/issues/6
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20191123091840.32382-1-uma.shankar@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_client_modeset.c | 72 ----------------------------
+ 1 file changed, 72 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_client_modeset.c b/drivers/gpu/drm/drm_client_modeset.c
+index 18cb88b9105e4..bf1bdb0aac19b 100644
+--- a/drivers/gpu/drm/drm_client_modeset.c
++++ b/drivers/gpu/drm/drm_client_modeset.c
+@@ -114,33 +114,6 @@ drm_client_find_modeset(struct drm_client_dev *client, struct drm_crtc *crtc)
+ return NULL;
+ }
+
+-static struct drm_display_mode *
+-drm_connector_get_tiled_mode(struct drm_connector *connector)
+-{
+- struct drm_display_mode *mode;
+-
+- list_for_each_entry(mode, &connector->modes, head) {
+- if (mode->hdisplay == connector->tile_h_size &&
+- mode->vdisplay == connector->tile_v_size)
+- return mode;
+- }
+- return NULL;
+-}
+-
+-static struct drm_display_mode *
+-drm_connector_fallback_non_tiled_mode(struct drm_connector *connector)
+-{
+- struct drm_display_mode *mode;
+-
+- list_for_each_entry(mode, &connector->modes, head) {
+- if (mode->hdisplay == connector->tile_h_size &&
+- mode->vdisplay == connector->tile_v_size)
+- continue;
+- return mode;
+- }
+- return NULL;
+-}
+-
+ static struct drm_display_mode *
+ drm_connector_has_preferred_mode(struct drm_connector *connector, int width, int height)
+ {
+@@ -375,15 +348,8 @@ static bool drm_client_target_preferred(struct drm_connector **connectors,
+ struct drm_connector *connector;
+ u64 conn_configured = 0;
+ int tile_pass = 0;
+- int num_tiled_conns = 0;
+ int i;
+
+- for (i = 0; i < connector_count; i++) {
+- if (connectors[i]->has_tile &&
+- connectors[i]->status == connector_status_connected)
+- num_tiled_conns++;
+- }
+-
+ retry:
+ for (i = 0; i < connector_count; i++) {
+ connector = connectors[i];
+@@ -433,28 +399,6 @@ static bool drm_client_target_preferred(struct drm_connector **connectors,
+ list_for_each_entry(modes[i], &connector->modes, head)
+ break;
+ }
+- /*
+- * In case of tiled mode if all tiles not present fallback to
+- * first available non tiled mode.
+- * After all tiles are present, try to find the tiled mode
+- * for all and if tiled mode not present due to fbcon size
+- * limitations, use first non tiled mode only for
+- * tile 0,0 and set to no mode for all other tiles.
+- */
+- if (connector->has_tile) {
+- if (num_tiled_conns <
+- connector->num_h_tile * connector->num_v_tile ||
+- (connector->tile_h_loc == 0 &&
+- connector->tile_v_loc == 0 &&
+- !drm_connector_get_tiled_mode(connector))) {
+- DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
+- connector->base.id);
+- modes[i] = drm_connector_fallback_non_tiled_mode(connector);
+- } else {
+- modes[i] = drm_connector_get_tiled_mode(connector);
+- }
+- }
+-
+ DRM_DEBUG_KMS("found mode %s\n", modes[i] ? modes[i]->name :
+ "none");
+ conn_configured |= BIT_ULL(i);
+@@ -572,7 +516,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ bool fallback = true, ret = true;
+ int num_connectors_enabled = 0;
+ int num_connectors_detected = 0;
+- int num_tiled_conns = 0;
+ struct drm_modeset_acquire_ctx ctx;
+
+ if (!drm_drv_uses_atomic_modeset(dev))
+@@ -590,11 +533,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ memcpy(save_enabled, enabled, count);
+ mask = GENMASK(count - 1, 0);
+ conn_configured = 0;
+- for (i = 0; i < count; i++) {
+- if (connectors[i]->has_tile &&
+- connectors[i]->status == connector_status_connected)
+- num_tiled_conns++;
+- }
+ retry:
+ conn_seq = conn_configured;
+ for (i = 0; i < count; i++) {
+@@ -694,16 +632,6 @@ static bool drm_client_firmware_config(struct drm_client_dev *client,
+ connector->name);
+ modes[i] = &connector->state->crtc->mode;
+ }
+- /*
+- * In case of tiled modes, if all tiles are not present
+- * then fallback to a non tiled mode.
+- */
+- if (connector->has_tile &&
+- num_tiled_conns < connector->num_h_tile * connector->num_v_tile) {
+- DRM_DEBUG_KMS("Falling back to non tiled mode on Connector %d\n",
+- connector->base.id);
+- modes[i] = drm_connector_fallback_non_tiled_mode(connector);
+- }
+ crtcs[i] = new_crtc;
+
+ DRM_DEBUG_KMS("connector %s on [CRTC:%d:%s]: %dx%d%s\n",
+--
+2.20.1
+
--- /dev/null
+From c39fa0c7fa0a602a9eed3ad3e4bac9201d268fac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Feb 2020 10:47:54 +0800
+Subject: riscv: avoid the PIC offset of static percpu data in module beyond 2G
+ limits
+
+From: Vincent Chen <vincent.chen@sifive.com>
+
+[ Upstream commit 0cff8bff7af886af0923d5c91776cd51603e531f ]
+
+The compiler uses the PIC-relative method to access static variables
+instead of GOT when the code model is PIC. Therefore, the limitation of
+the access range from the instruction to the symbol address is +-2GB.
+Under this circumstance, the kernel cannot load a kernel module if this
+module has static per-CPU symbols declared by DEFINE_PER_CPU(). The reason
+is that kernel relocates the .data..percpu section of the kernel module to
+the end of kernel's .data..percpu. Hence, the distance between the per-CPU
+symbols and the instruction will exceed the 2GB limits. To solve this
+problem, the kernel should place the loaded module in the memory area
+[&_end-2G, VMALLOC_END].
+
+Signed-off-by: Vincent Chen <vincent.chen@sifive.com>
+Suggested-by: Alexandre Ghiti <alex@ghiti.fr>
+Suggested-by: Anup Patel <anup@brainfault.org>
+Tested-by: Alexandre Ghiti <alex@ghiti.fr>
+Tested-by: Carlos de Paula <me@carlosedp.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/module.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
+index 70bb94ae61c59..6bf5b16743843 100644
+--- a/arch/riscv/kernel/module.c
++++ b/arch/riscv/kernel/module.c
+@@ -8,6 +8,10 @@
+ #include <linux/err.h>
+ #include <linux/errno.h>
+ #include <linux/moduleloader.h>
++#include <linux/vmalloc.h>
++#include <linux/sizes.h>
++#include <asm/pgtable.h>
++#include <asm/sections.h>
+
+ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v)
+ {
+@@ -386,3 +390,15 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
+
+ return 0;
+ }
++
++#if defined(CONFIG_MMU) && defined(CONFIG_64BIT)
++#define VMALLOC_MODULE_START \
++ max(PFN_ALIGN((unsigned long)&_end - SZ_2G), VMALLOC_START)
++void *module_alloc(unsigned long size)
++{
++ return __vmalloc_node_range(size, 1, VMALLOC_MODULE_START,
++ VMALLOC_END, GFP_KERNEL,
++ PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
++ __builtin_return_address(0));
++}
++#endif
+--
+2.20.1
+
--- /dev/null
+From 432e764c11e82aac647fba6f51981bd7ae9e0452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2020 00:28:47 -0500
+Subject: riscv: Fix range looking for kernel image memblock
+
+From: Alexandre Ghiti <alex@ghiti.fr>
+
+[ Upstream commit a160eed4b783d7b250a32f7e5787c9867abc5686 ]
+
+When looking for the memblock where the kernel lives, we should check
+that the memory range associated to the memblock entirely comprises the
+kernel image and not only intersects with it.
+
+Signed-off-by: Alexandre Ghiti <alex@ghiti.fr>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index 573463d1c799a..f5d813c1304da 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -98,7 +98,7 @@ void __init setup_bootmem(void)
+ for_each_memblock(memory, reg) {
+ phys_addr_t end = reg->base + reg->size;
+
+- if (reg->base <= vmlinux_end && vmlinux_end <= end) {
++ if (reg->base <= vmlinux_start && vmlinux_end <= end) {
+ mem_size = min(reg->size, (phys_addr_t)-PAGE_OFFSET);
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From 95ae8ec9d324fb6605f29597c831997fa5212792 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 Feb 2020 19:34:24 +0900
+Subject: riscv: Force flat memory model with no-mmu
+
+From: Damien Le Moal <damien.lemoal@wdc.com>
+
+[ Upstream commit aa2734202acc506d09c8e641db4da161f902df27 ]
+
+Compilation errors trigger if ARCH_SPARSEMEM_ENABLE is enabled for
+a nommu kernel. Since the sparsemem model does not make sense anyway
+for the nommu case, do not allow selecting this option to always use
+the flatmem model.
+
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
+index ade9699aa0dd6..a0fa4be94a68e 100644
+--- a/arch/riscv/Kconfig
++++ b/arch/riscv/Kconfig
+@@ -101,6 +101,7 @@ config ARCH_FLATMEM_ENABLE
+
+ config ARCH_SPARSEMEM_ENABLE
+ def_bool y
++ depends on MMU
+ select SPARSEMEM_VMEMMAP_ENABLE
+
+ config ARCH_SELECT_MEMORY_MODEL
+--
+2.20.1
+
locks-fix-a-potential-use-after-free-problem-when-wa.patch
locks-reinstate-locks_delete_block-optimization.patch
+spi-spi-omap2-mcspi-handle-dma-size-restriction-on-a.patch
+spi-spi-omap2-mcspi-support-probe-deferral-for-dma-c.patch
+drm-mediatek-find-the-cursor-plane-instead-of-hard-c.patch
+phy-ti-gmii-sel-fix-set-of-copy-paste-errors.patch
+phy-ti-gmii-sel-do-not-fail-in-case-of-gmii.patch
+arm-dts-dra7-l4-mark-timer13-16-as-pwm-capable.patch
+asoc-meson-g12a-add-tohdmitx-reset.patch
+spi-qup-call-spi_qup_pm_resume_runtime-before-suspen.patch
+powerpc-include-.btf-section.patch
+cifs-fix-potential-mismatch-of-unc-paths.patch
+cifs-add-missing-mount-option-to-proc-mounts.patch
+arm-dts-dra7-add-dma-ranges-property-to-pcie-rc-dt-n.patch
+spi-pxa2xx-add-cs-control-clock-quirk.patch
+spi-zynqmp-remove-entry-that-causes-a-cs-glitch.patch
+drm-exynos-dsi-propagate-error-value-and-silence-mea.patch
+drm-exynos-dsi-fix-workaround-for-the-legacy-clock-n.patch
+drm-exynos-hdmi-don-t-leak-enable-hdmi_en-regulator-.patch
+drivers-perf-fsl_imx8_ddr-correct-the-clear-bit-defi.patch
+drivers-perf-arm_pmu_acpi-fix-incorrect-checking-of-.patch
+altera-stapl-altera_get_note-prevent-write-beyond-en.patch
+dm-bio-record-save-restore-bi_end_io-and-bi_integrit.patch
+dm-integrity-use-dm_bio_record-and-dm_bio_restore.patch
+riscv-avoid-the-pic-offset-of-static-percpu-data-in-.patch
+asoc-stm32-sai-manage-rebind-issue.patch
+spi-spi_register_controller-free-bus-id-on-error-pat.patch
+riscv-force-flat-memory-model-with-no-mmu.patch
+riscv-fix-range-looking-for-kernel-image-memblock.patch
+drm-amdgpu-clean-wptr-on-wb-when-gpu-recovery.patch
+drm-amd-display-clear-link-settings-on-mst-disable-c.patch
+drm-amd-display-fix-dcc-swath-size-calculations-on-d.patch
+xenbus-req-body-should-be-updated-before-req-state.patch
+xenbus-req-err-should-be-updated-before-req-state.patch
+block-bfq-fix-overwrite-of-bfq_group-pointer-in-bfq_.patch
+parse-maintainers-mark-as-executable.patch
+binderfs-use-refcount-for-binder-control-devices-too.patch
+revert-drm-fbdev-fallback-to-non-tiled-mode-if-all-t.patch
--- /dev/null
+From eee52c668419324a8344053a9260b9187ed6ff2e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Feb 2020 14:37:00 -0800
+Subject: spi: pxa2xx: Add CS control clock quirk
+
+From: Evan Green <evgreen@chromium.org>
+
+[ Upstream commit 683f65ded66a9a7ff01ed7280804d2132ebfdf7e ]
+
+In some circumstances on Intel LPSS controllers, toggling the LPSS
+CS control register doesn't actually cause the CS line to toggle.
+This seems to be failure of dynamic clock gating that occurs after
+going through a suspend/resume transition, where the controller
+is sent through a reset transition. This ruins SPI transactions
+that either rely on delay_usecs, or toggle the CS line without
+sending data.
+
+Whenever CS is toggled, momentarily set the clock gating register
+to "Force On" to poke the controller into acting on CS.
+
+Signed-off-by: Rajat Jain <rajatja@google.com>
+Signed-off-by: Evan Green <evgreen@chromium.org>
+Link: https://lore.kernel.org/r/20200211223700.110252-1-rajatja@google.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx.c | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index 2fd843b18297d..7231456732068 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -68,6 +68,10 @@ MODULE_ALIAS("platform:pxa2xx-spi");
+ #define LPSS_CAPS_CS_EN_SHIFT 9
+ #define LPSS_CAPS_CS_EN_MASK (0xf << LPSS_CAPS_CS_EN_SHIFT)
+
++#define LPSS_PRIV_CLOCK_GATE 0x38
++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK 0x3
++#define LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON 0x3
++
+ struct lpss_config {
+ /* LPSS offset from drv_data->ioaddr */
+ unsigned offset;
+@@ -84,6 +88,8 @@ struct lpss_config {
+ unsigned cs_sel_shift;
+ unsigned cs_sel_mask;
+ unsigned cs_num;
++ /* Quirks */
++ unsigned cs_clk_stays_gated : 1;
+ };
+
+ /* Keep these sorted with enum pxa_ssp_type */
+@@ -154,6 +160,7 @@ static const struct lpss_config lpss_platforms[] = {
+ .tx_threshold_hi = 56,
+ .cs_sel_shift = 8,
+ .cs_sel_mask = 3 << 8,
++ .cs_clk_stays_gated = true,
+ },
+ };
+
+@@ -381,6 +388,22 @@ static void lpss_ssp_cs_control(struct spi_device *spi, bool enable)
+ else
+ value |= LPSS_CS_CONTROL_CS_HIGH;
+ __lpss_ssp_write_priv(drv_data, config->reg_cs_ctrl, value);
++ if (config->cs_clk_stays_gated) {
++ u32 clkgate;
++
++ /*
++ * Changing CS alone when dynamic clock gating is on won't
++ * actually flip CS at that time. This ruins SPI transfers
++ * that specify delays, or have no data. Toggle the clock mode
++ * to force on briefly to poke the CS pin to move.
++ */
++ clkgate = __lpss_ssp_read_priv(drv_data, LPSS_PRIV_CLOCK_GATE);
++ value = (clkgate & ~LPSS_PRIV_CLOCK_GATE_CLK_CTL_MASK) |
++ LPSS_PRIV_CLOCK_GATE_CLK_CTL_FORCE_ON;
++
++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, value);
++ __lpss_ssp_write_priv(drv_data, LPSS_PRIV_CLOCK_GATE, clkgate);
++ }
+ }
+
+ static void cs_assert(struct spi_device *spi)
+--
+2.20.1
+
--- /dev/null
+From 517e14e000223eb076cb6c4403872f2653510c8b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Feb 2020 13:13:40 +0530
+Subject: spi: qup: call spi_qup_pm_resume_runtime before suspending
+
+From: Yuji Sasaki <sasakiy@chromium.org>
+
+[ Upstream commit 136b5cd2e2f97581ae560cff0db2a3b5369112da ]
+
+spi_qup_suspend() will cause synchronous external abort when
+runtime suspend is enabled and applied, as it tries to
+access SPI controller register while clock is already disabled
+in spi_qup_pm_suspend_runtime().
+
+Signed-off-by: Yuji sasaki <sasakiy@chromium.org>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20200214074340.2286170-1-vkoul@kernel.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-qup.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index 2f559e5311002..fa8079fbea77a 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -1217,6 +1217,11 @@ static int spi_qup_suspend(struct device *device)
+ struct spi_qup *controller = spi_master_get_devdata(master);
+ int ret;
+
++ if (pm_runtime_suspended(device)) {
++ ret = spi_qup_pm_resume_runtime(device);
++ if (ret)
++ return ret;
++ }
+ ret = spi_master_suspend(master);
+ if (ret)
+ return ret;
+@@ -1225,10 +1230,8 @@ static int spi_qup_suspend(struct device *device)
+ if (ret)
+ return ret;
+
+- if (!pm_runtime_suspended(device)) {
+- clk_disable_unprepare(controller->cclk);
+- clk_disable_unprepare(controller->iclk);
+- }
++ clk_disable_unprepare(controller->cclk);
++ clk_disable_unprepare(controller->iclk);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From dcafe026ee3cf57fe27a16f8426ac1eb21dc113e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Feb 2020 18:18:15 +0530
+Subject: spi: spi-omap2-mcspi: Handle DMA size restriction on AM65x
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit e4e8276a4f652be2c7bb783a0155d4adb85f5d7d ]
+
+On AM654, McSPI can only support 4K - 1 bytes per transfer when DMA is
+enabled. Therefore populate master->max_transfer_size callback to
+inform client drivers of this restriction when DMA channels are
+available.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20200204124816.16735-2-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-omap2-mcspi.c | 26 +++++++++++++++++++
+ include/linux/platform_data/spi-omap2-mcspi.h | 1 +
+ 2 files changed, 27 insertions(+)
+
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index 848e03e5f42d5..8e435da730996 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -130,6 +130,7 @@ struct omap2_mcspi {
+ int fifo_depth;
+ bool slave_aborted;
+ unsigned int pin_dir:1;
++ size_t max_xfer_len;
+ };
+
+ struct omap2_mcspi_cs {
+@@ -1316,6 +1317,18 @@ static bool omap2_mcspi_can_dma(struct spi_master *master,
+ return (xfer->len >= DMA_MIN_BYTES);
+ }
+
++static size_t omap2_mcspi_max_xfer_size(struct spi_device *spi)
++{
++ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
++ struct omap2_mcspi_dma *mcspi_dma =
++ &mcspi->dma_channels[spi->chip_select];
++
++ if (mcspi->max_xfer_len && mcspi_dma->dma_rx)
++ return mcspi->max_xfer_len;
++
++ return SIZE_MAX;
++}
++
+ static int omap2_mcspi_controller_setup(struct omap2_mcspi *mcspi)
+ {
+ struct spi_master *master = mcspi->master;
+@@ -1384,6 +1397,11 @@ static struct omap2_mcspi_platform_config omap4_pdata = {
+ .regs_offset = OMAP4_MCSPI_REG_OFFSET,
+ };
+
++static struct omap2_mcspi_platform_config am654_pdata = {
++ .regs_offset = OMAP4_MCSPI_REG_OFFSET,
++ .max_xfer_len = SZ_4K - 1,
++};
++
+ static const struct of_device_id omap_mcspi_of_match[] = {
+ {
+ .compatible = "ti,omap2-mcspi",
+@@ -1393,6 +1411,10 @@ static const struct of_device_id omap_mcspi_of_match[] = {
+ .compatible = "ti,omap4-mcspi",
+ .data = &omap4_pdata,
+ },
++ {
++ .compatible = "ti,am654-mcspi",
++ .data = &am654_pdata,
++ },
+ { },
+ };
+ MODULE_DEVICE_TABLE(of, omap_mcspi_of_match);
+@@ -1450,6 +1472,10 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
+ mcspi->pin_dir = pdata->pin_dir;
+ }
+ regs_offset = pdata->regs_offset;
++ if (pdata->max_xfer_len) {
++ mcspi->max_xfer_len = pdata->max_xfer_len;
++ master->max_transfer_size = omap2_mcspi_max_xfer_size;
++ }
+
+ r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ mcspi->base = devm_ioremap_resource(&pdev->dev, r);
+diff --git a/include/linux/platform_data/spi-omap2-mcspi.h b/include/linux/platform_data/spi-omap2-mcspi.h
+index 0bf9fddb83064..3b400b1919a9b 100644
+--- a/include/linux/platform_data/spi-omap2-mcspi.h
++++ b/include/linux/platform_data/spi-omap2-mcspi.h
+@@ -11,6 +11,7 @@ struct omap2_mcspi_platform_config {
+ unsigned short num_cs;
+ unsigned int regs_offset;
+ unsigned int pin_dir:1;
++ size_t max_xfer_len;
+ };
+
+ struct omap2_mcspi_device_config {
+--
+2.20.1
+
--- /dev/null
+From 4a5cab8e7888d5a0bc4ab7143a5405c89256b7de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 4 Feb 2020 18:18:16 +0530
+Subject: spi: spi-omap2-mcspi: Support probe deferral for DMA channels
+
+From: Vignesh Raghavendra <vigneshr@ti.com>
+
+[ Upstream commit 32f2fc5dc3992b4b60cc6b1a6a31be605cc9c3a2 ]
+
+dma_request_channel() can return -EPROBE_DEFER, if DMA driver is not
+ready. Currently driver just falls back to PIO mode on probe deferral.
+Fix this by requesting all required channels during probe and
+propagating EPROBE_DEFER error code.
+
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Link: https://lore.kernel.org/r/20200204124816.16735-3-vigneshr@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-omap2-mcspi.c | 77 +++++++++++++++++------------------
+ 1 file changed, 38 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c
+index 8e435da730996..cfb64e5a7d45d 100644
+--- a/drivers/spi/spi-omap2-mcspi.c
++++ b/drivers/spi/spi-omap2-mcspi.c
+@@ -986,20 +986,12 @@ static int omap2_mcspi_setup_transfer(struct spi_device *spi,
+ * Note that we currently allow DMA only if we get a channel
+ * for both rx and tx. Otherwise we'll do PIO for both rx and tx.
+ */
+-static int omap2_mcspi_request_dma(struct spi_device *spi)
++static int omap2_mcspi_request_dma(struct omap2_mcspi *mcspi,
++ struct omap2_mcspi_dma *mcspi_dma)
+ {
+- struct spi_master *master = spi->master;
+- struct omap2_mcspi *mcspi;
+- struct omap2_mcspi_dma *mcspi_dma;
+ int ret = 0;
+
+- mcspi = spi_master_get_devdata(master);
+- mcspi_dma = mcspi->dma_channels + spi->chip_select;
+-
+- init_completion(&mcspi_dma->dma_rx_completion);
+- init_completion(&mcspi_dma->dma_tx_completion);
+-
+- mcspi_dma->dma_rx = dma_request_chan(&master->dev,
++ mcspi_dma->dma_rx = dma_request_chan(mcspi->dev,
+ mcspi_dma->dma_rx_ch_name);
+ if (IS_ERR(mcspi_dma->dma_rx)) {
+ ret = PTR_ERR(mcspi_dma->dma_rx);
+@@ -1007,7 +999,7 @@ static int omap2_mcspi_request_dma(struct spi_device *spi)
+ goto no_dma;
+ }
+
+- mcspi_dma->dma_tx = dma_request_chan(&master->dev,
++ mcspi_dma->dma_tx = dma_request_chan(mcspi->dev,
+ mcspi_dma->dma_tx_ch_name);
+ if (IS_ERR(mcspi_dma->dma_tx)) {
+ ret = PTR_ERR(mcspi_dma->dma_tx);
+@@ -1016,20 +1008,40 @@ static int omap2_mcspi_request_dma(struct spi_device *spi)
+ mcspi_dma->dma_rx = NULL;
+ }
+
++ init_completion(&mcspi_dma->dma_rx_completion);
++ init_completion(&mcspi_dma->dma_tx_completion);
++
+ no_dma:
+ return ret;
+ }
+
++static void omap2_mcspi_release_dma(struct spi_master *master)
++{
++ struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
++ struct omap2_mcspi_dma *mcspi_dma;
++ int i;
++
++ for (i = 0; i < master->num_chipselect; i++) {
++ mcspi_dma = &mcspi->dma_channels[i];
++
++ if (mcspi_dma->dma_rx) {
++ dma_release_channel(mcspi_dma->dma_rx);
++ mcspi_dma->dma_rx = NULL;
++ }
++ if (mcspi_dma->dma_tx) {
++ dma_release_channel(mcspi_dma->dma_tx);
++ mcspi_dma->dma_tx = NULL;
++ }
++ }
++}
++
+ static int omap2_mcspi_setup(struct spi_device *spi)
+ {
+ int ret;
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master);
+ struct omap2_mcspi_regs *ctx = &mcspi->ctx;
+- struct omap2_mcspi_dma *mcspi_dma;
+ struct omap2_mcspi_cs *cs = spi->controller_state;
+
+- mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+-
+ if (!cs) {
+ cs = kzalloc(sizeof *cs, GFP_KERNEL);
+ if (!cs)
+@@ -1054,13 +1066,6 @@ static int omap2_mcspi_setup(struct spi_device *spi)
+ }
+ }
+
+- if (!mcspi_dma->dma_rx || !mcspi_dma->dma_tx) {
+- ret = omap2_mcspi_request_dma(spi);
+- if (ret)
+- dev_warn(&spi->dev, "not using DMA for McSPI (%d)\n",
+- ret);
+- }
+-
+ ret = pm_runtime_get_sync(mcspi->dev);
+ if (ret < 0) {
+ pm_runtime_put_noidle(mcspi->dev);
+@@ -1077,12 +1082,8 @@ static int omap2_mcspi_setup(struct spi_device *spi)
+
+ static void omap2_mcspi_cleanup(struct spi_device *spi)
+ {
+- struct omap2_mcspi *mcspi;
+- struct omap2_mcspi_dma *mcspi_dma;
+ struct omap2_mcspi_cs *cs;
+
+- mcspi = spi_master_get_devdata(spi->master);
+-
+ if (spi->controller_state) {
+ /* Unlink controller state from context save list */
+ cs = spi->controller_state;
+@@ -1091,19 +1092,6 @@ static void omap2_mcspi_cleanup(struct spi_device *spi)
+ kfree(cs);
+ }
+
+- if (spi->chip_select < spi->master->num_chipselect) {
+- mcspi_dma = &mcspi->dma_channels[spi->chip_select];
+-
+- if (mcspi_dma->dma_rx) {
+- dma_release_channel(mcspi_dma->dma_rx);
+- mcspi_dma->dma_rx = NULL;
+- }
+- if (mcspi_dma->dma_tx) {
+- dma_release_channel(mcspi_dma->dma_tx);
+- mcspi_dma->dma_tx = NULL;
+- }
+- }
+-
+ if (gpio_is_valid(spi->cs_gpio))
+ gpio_free(spi->cs_gpio);
+ }
+@@ -1314,6 +1302,9 @@ static bool omap2_mcspi_can_dma(struct spi_master *master,
+ if (spi_controller_is_slave(master))
+ return true;
+
++ master->dma_rx = mcspi_dma->dma_rx;
++ master->dma_tx = mcspi_dma->dma_tx;
++
+ return (xfer->len >= DMA_MIN_BYTES);
+ }
+
+@@ -1501,6 +1492,11 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
+ for (i = 0; i < master->num_chipselect; i++) {
+ sprintf(mcspi->dma_channels[i].dma_rx_ch_name, "rx%d", i);
+ sprintf(mcspi->dma_channels[i].dma_tx_ch_name, "tx%d", i);
++
++ status = omap2_mcspi_request_dma(mcspi,
++ &mcspi->dma_channels[i]);
++ if (status == -EPROBE_DEFER)
++ goto free_master;
+ }
+
+ status = platform_get_irq(pdev, 0);
+@@ -1538,6 +1534,7 @@ static int omap2_mcspi_probe(struct platform_device *pdev)
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ free_master:
++ omap2_mcspi_release_dma(master);
+ spi_master_put(master);
+ return status;
+ }
+@@ -1547,6 +1544,8 @@ static int omap2_mcspi_remove(struct platform_device *pdev)
+ struct spi_master *master = platform_get_drvdata(pdev);
+ struct omap2_mcspi *mcspi = spi_master_get_devdata(master);
+
++ omap2_mcspi_release_dma(master);
++
+ pm_runtime_dont_use_autosuspend(mcspi->dev);
+ pm_runtime_put_sync(mcspi->dev);
+ pm_runtime_disable(&pdev->dev);
+--
+2.20.1
+
--- /dev/null
+From e4115c1a3514a5628fa362bca8b65c9c23e562c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Mar 2020 13:17:40 +0200
+Subject: spi: spi_register_controller(): free bus id on error paths
+
+From: Aaro Koskinen <aaro.koskinen@nokia.com>
+
+[ Upstream commit f9981d4f50b475d7dbb70f3022b87a3c8bba9fd6 ]
+
+Some error paths leave the bus id allocated. As a result the IDR
+allocation will fail after a deferred probe. Fix by freeing the bus id
+always on error.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
+Message-Id: <20200304111740.27915-1-aaro.koskinen@nokia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi.c | 32 +++++++++++++++-----------------
+ 1 file changed, 15 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 26b91ee0855dc..c186d3a944cd0 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2452,7 +2452,7 @@ int spi_register_controller(struct spi_controller *ctlr)
+ if (ctlr->use_gpio_descriptors) {
+ status = spi_get_gpio_descs(ctlr);
+ if (status)
+- return status;
++ goto free_bus_id;
+ /*
+ * A controller using GPIO descriptors always
+ * supports SPI_CS_HIGH if need be.
+@@ -2462,7 +2462,7 @@ int spi_register_controller(struct spi_controller *ctlr)
+ /* Legacy code path for GPIOs from DT */
+ status = of_spi_get_gpio_numbers(ctlr);
+ if (status)
+- return status;
++ goto free_bus_id;
+ }
+ }
+
+@@ -2470,17 +2470,14 @@ int spi_register_controller(struct spi_controller *ctlr)
+ * Even if it's just one always-selected device, there must
+ * be at least one chipselect.
+ */
+- if (!ctlr->num_chipselect)
+- return -EINVAL;
++ if (!ctlr->num_chipselect) {
++ status = -EINVAL;
++ goto free_bus_id;
++ }
+
+ status = device_add(&ctlr->dev);
+- if (status < 0) {
+- /* free bus id */
+- mutex_lock(&board_lock);
+- idr_remove(&spi_master_idr, ctlr->bus_num);
+- mutex_unlock(&board_lock);
+- goto done;
+- }
++ if (status < 0)
++ goto free_bus_id;
+ dev_dbg(dev, "registered %s %s\n",
+ spi_controller_is_slave(ctlr) ? "slave" : "master",
+ dev_name(&ctlr->dev));
+@@ -2496,11 +2493,7 @@ int spi_register_controller(struct spi_controller *ctlr)
+ status = spi_controller_initialize_queue(ctlr);
+ if (status) {
+ device_del(&ctlr->dev);
+- /* free bus id */
+- mutex_lock(&board_lock);
+- idr_remove(&spi_master_idr, ctlr->bus_num);
+- mutex_unlock(&board_lock);
+- goto done;
++ goto free_bus_id;
+ }
+ }
+ /* add statistics */
+@@ -2515,7 +2508,12 @@ int spi_register_controller(struct spi_controller *ctlr)
+ /* Register devices from the device tree and ACPI */
+ of_register_spi_devices(ctlr);
+ acpi_register_spi_devices(ctlr);
+-done:
++ return status;
++
++free_bus_id:
++ mutex_lock(&board_lock);
++ idr_remove(&spi_master_idr, ctlr->bus_num);
++ mutex_unlock(&board_lock);
+ return status;
+ }
+ EXPORT_SYMBOL_GPL(spi_register_controller);
+--
+2.20.1
+
--- /dev/null
+From 2eb0e9abad3828710857a17d0f6fbb46ef16435c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 24 Feb 2020 17:26:43 +0100
+Subject: spi/zynqmp: remove entry that causes a cs glitch
+
+From: Thommy Jakobsson <thommyj@gmail.com>
+
+[ Upstream commit 5dd8304981ecffa77bb72b1c57c4be5dfe6cfae9 ]
+
+In the public interface for chipselect, there is always an entry
+commented as "Dummy generic FIFO entry" pushed down to the fifo right
+after the activate/deactivate command. The dummy entry is 0x0,
+irregardless if the intention was to activate or deactive the cs. This
+causes the cs line to glitch rather than beeing activated in the case
+when there was an activate command.
+
+This has been observed on oscilloscope, and have caused problems for at
+least one specific flash device type connected to the qspi port. After
+the change the glitch is gone and cs goes active when intended.
+
+The reason why this worked before (except for the glitch) was because
+when sending the actual data, the CS bits are once again set. Since
+most flashes uses mode 0, there is always a half clk period anyway for
+cs to clk active setup time. If someone would rely on timing from a
+chip_select call to a transfer_one, it would fail though.
+
+It is unknown why the dummy entry was there in the first place, git log
+seems to be of no help in this case. The reference manual gives no
+indication of the necessity of this. In fact the lower 8 bits are a
+setup (or hold in case of deactivate) time expressed in cycles. So this
+should not be needed to fulfill any setup/hold timings.
+
+Signed-off-by: Thommy Jakobsson <thommyj@gmail.com>
+Reviewed-by: Naga Sureshkumar Relli <naga.sureshkumar.relli@xilinx.com>
+Link: https://lore.kernel.org/r/20200224162643.29102-1-thommyj@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-zynqmp-gqspi.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
+index 60c4de4e44856..7412a3042a8d2 100644
+--- a/drivers/spi/spi-zynqmp-gqspi.c
++++ b/drivers/spi/spi-zynqmp-gqspi.c
+@@ -401,9 +401,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high)
+
+ zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry);
+
+- /* Dummy generic FIFO entry */
+- zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0);
+-
+ /* Manually start the generic FIFO command */
+ zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST,
+ zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) |
+--
+2.20.1
+
--- /dev/null
+From dc16d34ff869afe15bc9feacdd969ef8b2ca091e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 14:14:22 -0800
+Subject: xenbus: req->body should be updated before req->state
+
+From: Dongli Zhang <dongli.zhang@oracle.com>
+
+[ Upstream commit 1b6a51e86cce38cf4d48ce9c242120283ae2f603 ]
+
+The req->body should be updated before req->state is updated and the
+order should be guaranteed by a barrier.
+
+Otherwise, read_reply() might return req->body = NULL.
+
+Below is sample callstack when the issue is reproduced on purpose by
+reordering the updates of req->body and req->state and adding delay in
+code between updates of req->state and req->body.
+
+[ 22.356105] general protection fault: 0000 [#1] SMP PTI
+[ 22.361185] CPU: 2 PID: 52 Comm: xenwatch Not tainted 5.5.0xen+ #6
+[ 22.366727] Hardware name: Xen HVM domU, BIOS ...
+[ 22.372245] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60
+... ...
+[ 22.392163] RSP: 0018:ffffb2d64023fdf0 EFLAGS: 00010246
+[ 22.395933] RAX: 0000000000000000 RBX: 75746e7562755f6d RCX: 0000000000000000
+[ 22.400871] RDX: 0000000000000000 RSI: ffffb2d64023fdfc RDI: 75746e7562755f6d
+[ 22.405874] RBP: 0000000000000000 R08: 00000000000001e8 R09: 0000000000cdcdcd
+[ 22.410945] R10: ffffb2d6402ffe00 R11: ffff9d95395eaeb0 R12: ffff9d9535935000
+[ 22.417613] R13: ffff9d9526d4a000 R14: ffff9d9526f4f340 R15: ffff9d9537654000
+[ 22.423726] FS: 0000000000000000(0000) GS:ffff9d953bc80000(0000) knlGS:0000000000000000
+[ 22.429898] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 22.434342] CR2: 000000c4206a9000 CR3: 00000001ea3fc002 CR4: 00000000001606e0
+[ 22.439645] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 22.444941] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 22.450342] Call Trace:
+[ 22.452509] simple_strtoull+0x27/0x70
+[ 22.455572] xenbus_transaction_start+0x31/0x50
+[ 22.459104] netback_changed+0x76c/0xcc1 [xen_netfront]
+[ 22.463279] ? find_watch+0x40/0x40
+[ 22.466156] xenwatch_thread+0xb4/0x150
+[ 22.469309] ? wait_woken+0x80/0x80
+[ 22.472198] kthread+0x10e/0x130
+[ 22.474925] ? kthread_park+0x80/0x80
+[ 22.477946] ret_from_fork+0x35/0x40
+[ 22.480968] Modules linked in: xen_kbdfront xen_fbfront(+) xen_netfront xen_blkfront
+[ 22.486783] ---[ end trace a9222030a747c3f7 ]---
+[ 22.490424] RIP: 0010:_parse_integer_fixup_radix+0x6/0x60
+
+The virt_rmb() is added in the 'true' path of test_reply(). The "while"
+is changed to "do while" so that test_reply() is used as a read memory
+barrier.
+
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Link: https://lore.kernel.org/r/20200303221423.21962-1-dongli.zhang@oracle.com
+Reviewed-by: Julien Grall <jgrall@amazon.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_comms.c | 2 ++
+ drivers/xen/xenbus/xenbus_xs.c | 9 ++++++---
+ 2 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
+index d239fc3c5e3de..852ed161fc2a7 100644
+--- a/drivers/xen/xenbus/xenbus_comms.c
++++ b/drivers/xen/xenbus/xenbus_comms.c
+@@ -313,6 +313,8 @@ static int process_msg(void)
+ req->msg.type = state.msg.type;
+ req->msg.len = state.msg.len;
+ req->body = state.body;
++ /* write body, then update state */
++ virt_wmb();
+ req->state = xb_req_state_got_reply;
+ req->cb(req);
+ } else
+diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
+index ddc18da61834e..3a06eb699f333 100644
+--- a/drivers/xen/xenbus/xenbus_xs.c
++++ b/drivers/xen/xenbus/xenbus_xs.c
+@@ -191,8 +191,11 @@ static bool xenbus_ok(void)
+
+ static bool test_reply(struct xb_req_data *req)
+ {
+- if (req->state == xb_req_state_got_reply || !xenbus_ok())
++ if (req->state == xb_req_state_got_reply || !xenbus_ok()) {
++ /* read req->state before all other fields */
++ virt_rmb();
+ return true;
++ }
+
+ /* Make sure to reread req->state each time. */
+ barrier();
+@@ -202,7 +205,7 @@ static bool test_reply(struct xb_req_data *req)
+
+ static void *read_reply(struct xb_req_data *req)
+ {
+- while (req->state != xb_req_state_got_reply) {
++ do {
+ wait_event(req->wq, test_reply(req));
+
+ if (!xenbus_ok())
+@@ -216,7 +219,7 @@ static void *read_reply(struct xb_req_data *req)
+ if (req->err)
+ return ERR_PTR(req->err);
+
+- }
++ } while (req->state != xb_req_state_got_reply);
+
+ return req->body;
+ }
+--
+2.20.1
+
--- /dev/null
+From dbab2544e7a1fff0172bc7d8c3840dc3a07bf65c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Mar 2020 14:14:23 -0800
+Subject: xenbus: req->err should be updated before req->state
+
+From: Dongli Zhang <dongli.zhang@oracle.com>
+
+[ Upstream commit 8130b9d5b5abf26f9927b487c15319a187775f34 ]
+
+This patch adds the barrier to guarantee that req->err is always updated
+before req->state.
+
+Otherwise, read_reply() would not return ERR_PTR(req->err) but
+req->body, when process_writes()->xb_write() is failed.
+
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Link: https://lore.kernel.org/r/20200303221423.21962-2-dongli.zhang@oracle.com
+Reviewed-by: Julien Grall <jgrall@amazon.com>
+Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/xen/xenbus/xenbus_comms.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/xen/xenbus/xenbus_comms.c b/drivers/xen/xenbus/xenbus_comms.c
+index 852ed161fc2a7..eb5151fc8efab 100644
+--- a/drivers/xen/xenbus/xenbus_comms.c
++++ b/drivers/xen/xenbus/xenbus_comms.c
+@@ -397,6 +397,8 @@ static int process_writes(void)
+ if (state.req->state == xb_req_state_aborted)
+ kfree(state.req);
+ else {
++ /* write err, then update state */
++ virt_wmb();
+ state.req->state = xb_req_state_got_reply;
+ wake_up(&state.req->wq);
+ }
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
