--- /dev/null
+From a40b3eaf82cdd8a9e954b27aa3a25f6294822087 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:01:34 +0200
+Subject: ALSA: hda/realtek - fixup for yet another Intel reference board
+
+From: PeiSen Hou <pshou@realtek.com.tw>
+
+[ Upstream commit 5734e509d5d515c187f642937ef2de1e58d7715d ]
+
+Add headset_jack for the intel reference board support with
+10ec:1230.
+
+Signed-off-by: PeiSen Hou <pshou@realtek.com.tw>
+Link: https://lore.kernel.org/r/20200716090134.9811-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 34d75102b596f..bf205621d7ac1 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7546,6 +7546,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC),
+ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE),
++ SND_PCI_QUIRK(0x10ec, 0x1230, "Intel Reference board", ALC225_FIXUP_HEADSET_JACK),
+ SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
+ SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC),
+ SND_PCI_QUIRK(0x144d, 0xc169, "Samsung Notebook 9 Pen (NP930SBE-K01US)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET),
+--
+2.25.1
+
--- /dev/null
+From 269643cb64fe94fe9938bf4a107919dd826235fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 11:47:40 -0700
+Subject: ARM: dts: n900: remove mmc1 card detect gpio
+
+From: Merlijn Wajer <merlijn@wizzup.org>
+
+[ Upstream commit ed3e98e919aaaa47e9d9f8a40c3f6f4a22577842 ]
+
+Instead, expose the key via the input framework, as SW_MACHINE_COVER
+
+The chip-detect GPIO is actually detecting if the cover is closed.
+Technically it's possible to use the SD card with open cover. The
+only downside is risk of battery falling out and user being able
+to physically remove the card.
+
+The behaviour of SD card not being available when the device is
+open is unexpected and creates more problems than it solves. There
+is a high chance, that more people accidentally break their rootfs
+by opening the case without physically removing the card.
+
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Merlijn Wajer <merlijn@wizzup.org>
+Link: https://lore.kernel.org/r/20200612125402.18393-3-merlijn@wizzup.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/omap3-n900.dts | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts
+index 7f2ddb78da5fa..4227da71cc626 100644
+--- a/arch/arm/boot/dts/omap3-n900.dts
++++ b/arch/arm/boot/dts/omap3-n900.dts
+@@ -105,6 +105,14 @@
+ linux,code = <SW_FRONT_PROXIMITY>;
+ linux,can-disable;
+ };
++
++ machine_cover {
++ label = "Machine Cover";
++ gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */
++ linux,input-type = <EV_SW>;
++ linux,code = <SW_MACHINE_COVER>;
++ linux,can-disable;
++ };
+ };
+
+ isp1707: isp1707 {
+@@ -814,10 +822,6 @@
+ pinctrl-0 = <&mmc1_pins>;
+ vmmc-supply = <&vmmc1>;
+ bus-width = <4>;
+- /* For debugging, it is often good idea to remove this GPIO.
+- It means you can remove back cover (to reboot by removing
+- battery) and still use the MMC card. */
+- cd-gpios = <&gpio6 0 GPIO_ACTIVE_LOW>; /* 160 */
+ };
+
+ /* most boards use vaux3, only some old versions use vmmc2 instead */
+--
+2.25.1
+
--- /dev/null
+From 691ca4eefc16c0037cd1aa4b30cfd39749e6d4c3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 Feb 2020 12:12:26 +0000
+Subject: arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ]
+
+Rather than open-code test_tsk_thread_flag() at each callsite, simply
+replace the couple of offenders with calls to test_tsk_thread_flag()
+directly.
+
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kernel/debug-monitors.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 7569deb1eac17..d64a3c1e1b6ba 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -396,14 +396,14 @@ void user_rewind_single_step(struct task_struct *task)
+ * If single step is active for this thread, then set SPSR.SS
+ * to 1 to avoid returning to the active-pending state.
+ */
+- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ set_regs_spsr_ss(task_pt_regs(task));
+ }
+ NOKPROBE_SYMBOL(user_rewind_single_step);
+
+ void user_fastforward_single_step(struct task_struct *task)
+ {
+- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP))
++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP))
+ clear_regs_spsr_ss(task_pt_regs(task));
+ }
+
+--
+2.25.1
+
--- /dev/null
+From a7650e34e2b15ad712a9ae6cb1bd9d325c1b9c4c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 12:28:16 +0100
+Subject: asm-generic/mmiowb: Allow mmiowb_set_pending() when preemptible()
+
+From: Will Deacon <will@kernel.org>
+
+[ Upstream commit bd024e82e4cd95c7f1a475a55f99871936c2b2db ]
+
+Although mmiowb() is concerned only with serialising MMIO writes occuring
+in contexts where a spinlock is held, the call to mmiowb_set_pending()
+from the MMIO write accessors can occur in preemptible contexts, such
+as during driver probe() functions where ordering between CPUs is not
+usually a concern, assuming that the task migration path provides the
+necessary ordering guarantees.
+
+Unfortunately, the default implementation of mmiowb_set_pending() is not
+preempt-safe, as it makes use of a a per-cpu variable to track its
+internal state. This has been reported to generate the following splat
+on riscv:
+
+ | BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1
+ | caller is regmap_mmio_write32le+0x1c/0x46
+ | CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.8.0-rc3-hfu+ #1
+ | Call Trace:
+ | walk_stackframe+0x0/0x7a
+ | dump_stack+0x6e/0x88
+ | regmap_mmio_write32le+0x18/0x46
+ | check_preemption_disabled+0xa4/0xaa
+ | regmap_mmio_write32le+0x18/0x46
+ | regmap_mmio_write+0x26/0x44
+ | regmap_write+0x28/0x48
+ | sifive_gpio_probe+0xc0/0x1da
+
+Although it's possible to fix the driver in this case, other splats have
+been seen from other drivers, including the infamous 8250 UART, and so
+it's better to address this problem in the mmiowb core itself.
+
+Fix mmiowb_set_pending() by using the raw_cpu_ptr() to get at the mmiowb
+state and then only updating the 'mmiowb_pending' field if we are not
+preemptible (i.e. we have a non-zero nesting count).
+
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Paul Walmsley <paul.walmsley@sifive.com>
+Cc: Guo Ren <guoren@kernel.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Reported-by: Palmer Dabbelt <palmer@dabbelt.com>
+Reported-by: Emil Renner Berthing <kernel@esmil.dk>
+Tested-by: Emil Renner Berthing <kernel@esmil.dk>
+Reviewed-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Acked-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Link: https://lore.kernel.org/r/20200716112816.7356-1-will@kernel.org
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/asm-generic/mmiowb.h | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/include/asm-generic/mmiowb.h b/include/asm-generic/mmiowb.h
+index 9439ff037b2d1..5698fca3bf560 100644
+--- a/include/asm-generic/mmiowb.h
++++ b/include/asm-generic/mmiowb.h
+@@ -27,7 +27,7 @@
+ #include <asm/smp.h>
+
+ DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state);
+-#define __mmiowb_state() this_cpu_ptr(&__mmiowb_state)
++#define __mmiowb_state() raw_cpu_ptr(&__mmiowb_state)
+ #else
+ #define __mmiowb_state() arch_mmiowb_state()
+ #endif /* arch_mmiowb_state */
+@@ -35,7 +35,9 @@ DECLARE_PER_CPU(struct mmiowb_state, __mmiowb_state);
+ static inline void mmiowb_set_pending(void)
+ {
+ struct mmiowb_state *ms = __mmiowb_state();
+- ms->mmiowb_pending = ms->nesting_count;
++
++ if (likely(ms->nesting_count))
++ ms->mmiowb_pending = ms->nesting_count;
+ }
+
+ static inline void mmiowb_spin_lock(void)
+--
+2.25.1
+
--- /dev/null
+From 598e6346493f0ccd8bdb9d5cd6dc5c1977a24a81 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 16:09:18 +0800
+Subject: ASoC: Intel: bytcht_es8316: Add missed put_device()
+
+From: Jing Xiangfeng <jingxiangfeng@huawei.com>
+
+[ Upstream commit b3df80ab6d147d4738be242e1c91e5fdbb6b03ef ]
+
+snd_byt_cht_es8316_mc_probe() misses to call put_device() in an error
+path. Add the missed function call to fix it.
+
+Fixes: ba49cf6f8e4a ("ASoC: Intel: bytcht_es8316: Add quirk for inverted jack detect")
+Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20200714080918.148196-1-jingxiangfeng@huawei.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 54e97455d7f66..ed332177b0f9d 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -548,8 +548,10 @@ static int snd_byt_cht_es8316_mc_probe(struct platform_device *pdev)
+
+ if (cnt) {
+ ret = device_add_properties(codec_dev, props);
+- if (ret)
++ if (ret) {
++ put_device(codec_dev);
+ return ret;
++ }
+ }
+
+ devm_acpi_dev_add_driver_gpios(codec_dev, byt_cht_es8316_gpios);
+--
+2.25.1
+
--- /dev/null
+From 9bbe402bbe949ef45a3eda8a9f54db9a30a1d3eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 09:59:31 -0400
+Subject: ax88172a: fix ax88172a_unbind() failures
+
+From: George Kennedy <george.kennedy@oracle.com>
+
+[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ]
+
+If ax88172a_unbind() fails, make sure that the return code is
+less than zero so that cleanup is done properly and avoid UAF.
+
+Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers")
+Signed-off-by: George Kennedy <george.kennedy@oracle.com>
+Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/ax88172a.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
+index af3994e0853b5..6101d82102e79 100644
+--- a/drivers/net/usb/ax88172a.c
++++ b/drivers/net/usb/ax88172a.c
+@@ -198,6 +198,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
+ ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
+ if (ret < ETH_ALEN) {
+ netdev_err(dev->net, "Failed to read MAC address: %d\n", ret);
++ ret = -EIO;
+ goto free;
+ }
+ memcpy(dev->net->dev_addr, buf, ETH_ALEN);
+--
+2.25.1
+
--- /dev/null
+From 48f86270657f17c5345c95f943301bb1f33f3d46 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 20:48:25 -0400
+Subject: bnxt_en: Fix completion ring sizing with TPA enabled.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 27640ce68d21e556b66bc5fa022aacd26e53c947 ]
+
+The current completion ring sizing formula is wrong with TPA enabled.
+The formula assumes that the number of TPA completions are bound by the
+RX ring size, but that's not true. TPA_START completions are immediately
+recycled so they are not bound by the RX ring size. We must add
+bp->max_tpa to the worst case maximum RX and TPA completions.
+
+The completion ring can overflow because of this mistake. This will
+cause hardware to disable the completion ring when this happens,
+leading to RX and TX traffic to stall on that ring. This issue is
+generally exposed only when the RX ring size is set very small.
+
+Fix the formula by adding bp->max_tpa to the number of RX completions
+if TPA is enabled.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.");
+Reviewed-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index b5147bd6cba6d..2cbfe0cd7eefa 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -3423,7 +3423,7 @@ void bnxt_set_tpa_flags(struct bnxt *bp)
+ */
+ void bnxt_set_ring_params(struct bnxt *bp)
+ {
+- u32 ring_size, rx_size, rx_space;
++ u32 ring_size, rx_size, rx_space, max_rx_cmpl;
+ u32 agg_factor = 0, agg_ring_size = 0;
+
+ /* 8 for CRC and VLAN */
+@@ -3479,7 +3479,15 @@ void bnxt_set_ring_params(struct bnxt *bp)
+ bp->tx_nr_pages = bnxt_calc_nr_ring_pages(ring_size, TX_DESC_CNT);
+ bp->tx_ring_mask = (bp->tx_nr_pages * TX_DESC_CNT) - 1;
+
+- ring_size = bp->rx_ring_size * (2 + agg_factor) + bp->tx_ring_size;
++ max_rx_cmpl = bp->rx_ring_size;
++ /* MAX TPA needs to be added because TPA_START completions are
++ * immediately recycled, so the TPA completions are not bound by
++ * the RX ring size.
++ */
++ if (bp->flags & BNXT_FLAG_TPA)
++ max_rx_cmpl += bp->max_tpa;
++ /* RX and TPA completions are 32-byte, all others are 16-byte */
++ ring_size = max_rx_cmpl * 2 + agg_ring_size + bp->tx_ring_size;
+ bp->cp_ring_size = ring_size;
+
+ bp->cp_nr_pages = bnxt_calc_nr_ring_pages(ring_size, CP_DESC_CNT);
+--
+2.25.1
+
--- /dev/null
+From 8e358e0ad3b8d511710c1ad33c6bca90cc8802d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 20:48:23 -0400
+Subject: bnxt_en: Fix race when modifying pause settings.
+
+From: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+
+[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ]
+
+The driver was modified to not rely on rtnl lock to protect link
+settings about 2 years ago. The pause setting was missed when
+making that change. Fix it by acquiring link_lock mutex before
+calling bnxt_hwrm_set_pause().
+
+Fixes: e2dc9b6e38fa ("bnxt_en: Don't use rtnl lock to protect link change logic in workqueue.")
+Signed-off-by: Vasundhara Volam <vasundhara-v.volam@broadcom.com>
+Reviewed-by: Edwin Peer <edwin.peer@broadcom.com>
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index fb1ab58da9fa5..1f512e7c3d434 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1688,8 +1688,11 @@ static int bnxt_set_pauseparam(struct net_device *dev,
+ if (epause->tx_pause)
+ link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX;
+
+- if (netif_running(dev))
++ if (netif_running(dev)) {
++ mutex_lock(&bp->link_lock);
+ rc = bnxt_hwrm_set_pause(bp);
++ mutex_unlock(&bp->link_lock);
++ }
+ return rc;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 77c330f38fa6e7f369722bd2113d93198e56926f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jul 2020 12:11:24 +0000
+Subject: bonding: check error value of register_netdevice() immediately
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 544f287b84959203367cd29e16e772717612fab4 ]
+
+If register_netdevice() is failed, net_device should not be used
+because variables are uninitialized or freed.
+So, the routine should be stopped immediately.
+But, bond_create() doesn't check return value of register_netdevice()
+immediately. That will result in a panic because of using uninitialized
+or freed memory.
+
+Test commands:
+ modprobe netdev-notifier-error-inject
+ echo -22 > /sys/kernel/debug/notifier-error-inject/netdev/\
+actions/NETDEV_REGISTER/error
+ modprobe bonding max_bonds=3
+
+Splat looks like:
+[ 375.028492][ T193] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6b6b: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
+[ 375.033207][ T193] CPU: 2 PID: 193 Comm: kworker/2:2 Not tainted 5.8.0-rc4+ #645
+[ 375.036068][ T193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+[ 375.039673][ T193] Workqueue: events linkwatch_event
+[ 375.041557][ T193] RIP: 0010:dev_activate+0x4a/0x340
+[ 375.043381][ T193] Code: 40 a8 04 0f 85 db 00 00 00 8b 83 08 04 00 00 85 c0 0f 84 0d 01 00 00 31 d2 89 d0 48 8d 04 40 48 c1 e0 07 48 03 83 00 04 00 00 <48> 8b 48 10 f6 41 10 01 75 08 f0 80 a1 a0 01 00 00 fd 48 89 48 08
+[ 375.050267][ T193] RSP: 0018:ffff9f8facfcfdd8 EFLAGS: 00010202
+[ 375.052410][ T193] RAX: 6b6b6b6b6b6b6b6b RBX: ffff9f8fae6ea000 RCX: 0000000000000006
+[ 375.055178][ T193] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f8fae6ea000
+[ 375.057762][ T193] RBP: ffff9f8fae6ea000 R08: 0000000000000000 R09: 0000000000000000
+[ 375.059810][ T193] R10: 0000000000000001 R11: 0000000000000000 R12: ffff9f8facfcfe08
+[ 375.061892][ T193] R13: ffffffff883587e0 R14: 0000000000000000 R15: ffff9f8fae6ea580
+[ 375.063931][ T193] FS: 0000000000000000(0000) GS:ffff9f8fbae00000(0000) knlGS:0000000000000000
+[ 375.066239][ T193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 375.067841][ T193] CR2: 00007f2f542167a0 CR3: 000000012cee6002 CR4: 00000000003606e0
+[ 375.069657][ T193] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 375.071471][ T193] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 375.073269][ T193] Call Trace:
+[ 375.074005][ T193] linkwatch_do_dev+0x4d/0x50
+[ 375.075052][ T193] __linkwatch_run_queue+0x10b/0x200
+[ 375.076244][ T193] linkwatch_event+0x21/0x30
+[ 375.077274][ T193] process_one_work+0x252/0x600
+[ 375.078379][ T193] ? process_one_work+0x600/0x600
+[ 375.079518][ T193] worker_thread+0x3c/0x380
+[ 375.080534][ T193] ? process_one_work+0x600/0x600
+[ 375.081668][ T193] kthread+0x139/0x150
+[ 375.082567][ T193] ? kthread_park+0x90/0x90
+[ 375.083567][ T193] ret_from_fork+0x22/0x30
+
+Fixes: e826eafa65c6 ("bonding: Call netif_carrier_off after register_netdevice")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 703c5c2c80e51..499845c32b1bc 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4864,15 +4864,19 @@ int bond_create(struct net *net, const char *name)
+ bond_dev->rtnl_link_ops = &bond_link_ops;
+
+ res = register_netdevice(bond_dev);
++ if (res < 0) {
++ free_netdev(bond_dev);
++ rtnl_unlock();
++
++ return res;
++ }
+
+ netif_carrier_off(bond_dev);
+
+ bond_work_init_all(bond);
+
+ rtnl_unlock();
+- if (res < 0)
+- free_netdev(bond_dev);
+- return res;
++ return 0;
+ }
+
+ static int __net_init bond_net_init(struct net *net)
+--
+2.25.1
+
--- /dev/null
+From 353855ddc837038323fbf85e3afd42ee7fd3f98c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 16:31:54 -0700
+Subject: bonding: check return value of register_netdevice() in bond_newlink()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit c75d1d5248c0c97996051809ad0e9f154ba5d76e ]
+
+Very similar to commit 544f287b8495
+("bonding: check error value of register_netdevice() immediately"),
+we should immediately check the return value of register_netdevice()
+before doing anything else.
+
+Fixes: 005db31d5f5f ("bonding: set carrier off for devices created through netlink")
+Reported-and-tested-by: syzbot+bbc3a11c4da63c1b74d6@syzkaller.appspotmail.com
+Cc: Beniamino Galvani <bgalvani@redhat.com>
+Cc: Taehee Yoo <ap420073@gmail.com>
+Cc: Jay Vosburgh <j.vosburgh@gmail.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_netlink.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
+index b43b51646b11a..f0f9138e967f3 100644
+--- a/drivers/net/bonding/bond_netlink.c
++++ b/drivers/net/bonding/bond_netlink.c
+@@ -456,11 +456,10 @@ static int bond_newlink(struct net *src_net, struct net_device *bond_dev,
+ return err;
+
+ err = register_netdevice(bond_dev);
+-
+- netif_carrier_off(bond_dev);
+ if (!err) {
+ struct bonding *bond = netdev_priv(bond_dev);
+
++ netif_carrier_off(bond_dev);
+ bond_work_init_all(bond);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 41f5eccdf28762545590092b9e9168d655b9992a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 Jul 2020 00:52:05 +0200
+Subject: dmaengine: fsl-edma: fix wrong tcd endianness for big-endian cpu
+
+From: Angelo Dureghello <angelo.dureghello@timesys.com>
+
+[ Upstream commit 8678c71c17721e0f771f135967ef0cce8f69ce9a ]
+
+Due to recent fixes in m68k arch-specific I/O accessor macros, this
+driver is not working anymore for ColdFire. Fix wrong tcd endianness
+removing additional swaps, since edma_writex() functions should already
+take care of any eventual swap if needed.
+
+Note, i could only test the change in ColdFire mcf54415 and Vybrid
+vf50 / Colibri where i don't see any issue. So, every feedback and
+test for all other SoCs involved is really appreciated.
+
+Signed-off-by: Angelo Dureghello <angelo.dureghello@timesys.com>
+Reported-by: kbuild test robot <lkp@intel.com>
+Link: https://lore.kernel.org/r/20200701225205.1674463-1-angelo.dureghello@timesys.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/fsl-edma-common.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/dma/fsl-edma-common.c b/drivers/dma/fsl-edma-common.c
+index b1a7ca91701a8..d6010486ee502 100644
+--- a/drivers/dma/fsl-edma-common.c
++++ b/drivers/dma/fsl-edma-common.c
+@@ -347,26 +347,28 @@ static void fsl_edma_set_tcd_regs(struct fsl_edma_chan *fsl_chan,
+ /*
+ * TCD parameters are stored in struct fsl_edma_hw_tcd in little
+ * endian format. However, we need to load the TCD registers in
+- * big- or little-endian obeying the eDMA engine model endian.
++ * big- or little-endian obeying the eDMA engine model endian,
++ * and this is performed from specific edma_write functions
+ */
+ edma_writew(edma, 0, ®s->tcd[ch].csr);
+- edma_writel(edma, le32_to_cpu(tcd->saddr), ®s->tcd[ch].saddr);
+- edma_writel(edma, le32_to_cpu(tcd->daddr), ®s->tcd[ch].daddr);
+
+- edma_writew(edma, le16_to_cpu(tcd->attr), ®s->tcd[ch].attr);
+- edma_writew(edma, le16_to_cpu(tcd->soff), ®s->tcd[ch].soff);
++ edma_writel(edma, (s32)tcd->saddr, ®s->tcd[ch].saddr);
++ edma_writel(edma, (s32)tcd->daddr, ®s->tcd[ch].daddr);
+
+- edma_writel(edma, le32_to_cpu(tcd->nbytes), ®s->tcd[ch].nbytes);
+- edma_writel(edma, le32_to_cpu(tcd->slast), ®s->tcd[ch].slast);
++ edma_writew(edma, (s16)tcd->attr, ®s->tcd[ch].attr);
++ edma_writew(edma, tcd->soff, ®s->tcd[ch].soff);
+
+- edma_writew(edma, le16_to_cpu(tcd->citer), ®s->tcd[ch].citer);
+- edma_writew(edma, le16_to_cpu(tcd->biter), ®s->tcd[ch].biter);
+- edma_writew(edma, le16_to_cpu(tcd->doff), ®s->tcd[ch].doff);
++ edma_writel(edma, (s32)tcd->nbytes, ®s->tcd[ch].nbytes);
++ edma_writel(edma, (s32)tcd->slast, ®s->tcd[ch].slast);
+
+- edma_writel(edma, le32_to_cpu(tcd->dlast_sga),
++ edma_writew(edma, (s16)tcd->citer, ®s->tcd[ch].citer);
++ edma_writew(edma, (s16)tcd->biter, ®s->tcd[ch].biter);
++ edma_writew(edma, (s16)tcd->doff, ®s->tcd[ch].doff);
++
++ edma_writel(edma, (s32)tcd->dlast_sga,
+ ®s->tcd[ch].dlast_sga);
+
+- edma_writew(edma, le16_to_cpu(tcd->csr), ®s->tcd[ch].csr);
++ edma_writew(edma, (s16)tcd->csr, ®s->tcd[ch].csr);
+ }
+
+ static inline
+--
+2.25.1
+
--- /dev/null
+From 0ba89faf345ecdf595aa0f478e9ce42f2886f4ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 21:48:12 +0300
+Subject: dmaengine: ioat setting ioat timeout as module parameter
+
+From: Leonid Ravich <Leonid.Ravich@emc.com>
+
+[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ]
+
+DMA transaction time to completion is a function of PCI bandwidth,
+transaction size and a queue depth. So hard coded value for timeouts
+might be wrong for some scenarios.
+
+Signed-off-by: Leonid Ravich <Leonid.Ravich@emc.com>
+Reviewed-by: Dave Jiang <dave.jiang@intel.com>
+Link: https://lore.kernel.org/r/20200701184816.29138-1-leonid.ravich@dell.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/ioat/dma.c | 12 ++++++++++++
+ drivers/dma/ioat/dma.h | 2 --
+ 2 files changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
+index 18c011e57592e..8e2a4d1f0be53 100644
+--- a/drivers/dma/ioat/dma.c
++++ b/drivers/dma/ioat/dma.c
+@@ -26,6 +26,18 @@
+
+ #include "../dmaengine.h"
+
++int completion_timeout = 200;
++module_param(completion_timeout, int, 0644);
++MODULE_PARM_DESC(completion_timeout,
++ "set ioat completion timeout [msec] (default 200 [msec])");
++int idle_timeout = 2000;
++module_param(idle_timeout, int, 0644);
++MODULE_PARM_DESC(idle_timeout,
++ "set ioat idel timeout [msec] (default 2000 [msec])");
++
++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout)
++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout)
++
+ static char *chanerr_str[] = {
+ "DMA Transfer Source Address Error",
+ "DMA Transfer Destination Address Error",
+diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h
+index b8e8e0b9693c7..4ac9134962f3b 100644
+--- a/drivers/dma/ioat/dma.h
++++ b/drivers/dma/ioat/dma.h
+@@ -99,8 +99,6 @@ struct ioatdma_chan {
+ #define IOAT_RUN 5
+ #define IOAT_CHAN_ACTIVE 6
+ struct timer_list timer;
+- #define COMPLETION_TIMEOUT msecs_to_jiffies(100)
+- #define IDLE_TIMEOUT msecs_to_jiffies(2000)
+ #define RESET_DELAY msecs_to_jiffies(100)
+ struct ioatdma_device *ioat_dma;
+ dma_addr_t completion_dma;
+--
+2.25.1
+
--- /dev/null
+From 47339e589b435023ed288548caeb39023fe0a97d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 14:46:26 +0800
+Subject: dmaengine: tegra210-adma: Fix runtime PM imbalance on error
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ]
+
+pm_runtime_get_sync() increments the runtime PM usage counter even
+when it returns an error code. Thus a pairing decrement is needed on
+the error handling path to keep the counter balanced.
+
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Link: https://lore.kernel.org/r/20200624064626.19855-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index 914901a680c8a..9068591bd684b 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -658,6 +658,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc)
+
+ ret = pm_runtime_get_sync(tdc2dev(tdc));
+ if (ret < 0) {
++ pm_runtime_put_noidle(tdc2dev(tdc));
+ free_irq(tdc->irq, tdc);
+ return ret;
+ }
+@@ -869,8 +870,10 @@ static int tegra_adma_probe(struct platform_device *pdev)
+ pm_runtime_enable(&pdev->dev);
+
+ ret = pm_runtime_get_sync(&pdev->dev);
+- if (ret < 0)
++ if (ret < 0) {
++ pm_runtime_put_noidle(&pdev->dev);
+ goto rpm_disable;
++ }
+
+ ret = tegra_adma_init(tdma);
+ if (ret)
+--
+2.25.1
+
--- /dev/null
+From a882a40f9e13b3cc82f7a36610e19b6f534bd5a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 17:19:25 +0800
+Subject: drivers/perf: Fix kernel panic when rmmod PMU modules during perf
+ sampling
+
+From: Qi Liu <liuqi115@huawei.com>
+
+[ Upstream commit bdc5c744c7b6457d18a95c26769dad0e7f480a08 ]
+
+When users try to remove PMU modules during perf sampling, kernel panic
+will happen because the pmu->read() is a NULL pointer here.
+
+INFO on HiSilicon hip08 platform as follow:
+pc : hisi_uncore_pmu_event_update+0x30/0xa4 [hisi_uncore_pmu]
+lr : hisi_uncore_pmu_read+0x20/0x2c [hisi_uncore_pmu]
+sp : ffff800010103e90
+x29: ffff800010103e90 x28: ffff0027db0c0e40
+x27: ffffa29a76f129d8 x26: ffffa29a77ceb000
+x25: ffffa29a773a5000 x24: ffffa29a77392000
+x23: ffffddffe5943f08 x22: ffff002784285960
+x21: ffff002784285800 x20: ffff0027d2e76c80
+x19: ffff0027842859e0 x18: ffff80003498bcc8
+x17: ffffa29a76afe910 x16: ffffa29a7583f530
+x15: 16151a1512061a1e x14: 0000000000000000
+x13: ffffa29a76f1e238 x12: 0000000000000001
+x11: 0000000000000400 x10: 00000000000009f0
+x9 : ffff8000107b3e70 x8 : ffff0027db0c1890
+x7 : ffffa29a773a7000 x6 : 00000007f5131013
+x5 : 00000007f5131013 x4 : 09f257d417c00000
+x3 : 00000002187bd7ce x2 : ffffa29a38f0f0d8
+x1 : ffffa29a38eae268 x0 : ffff0027d2e76c80
+Call trace:
+hisi_uncore_pmu_event_update+0x30/0xa4 [hisi_uncore_pmu]
+hisi_uncore_pmu_read+0x20/0x2c [hisi_uncore_pmu]
+__perf_event_read+0x1a0/0x1f8
+flush_smp_call_function_queue+0xa0/0x160
+generic_smp_call_function_single_interrupt+0x18/0x20
+handle_IPI+0x31c/0x4dc
+gic_handle_irq+0x2c8/0x310
+el1_irq+0xcc/0x180
+arch_cpu_idle+0x4c/0x20c
+default_idle_call+0x20/0x30
+do_idle+0x1b4/0x270
+cpu_startup_entry+0x28/0x30
+secondary_start_kernel+0x1a4/0x1fc
+
+To solve the above issue, current module should be registered to kernel,
+so that try_module_get() can be invoked when perf sampling starts. This
+adds the reference counting of module and could prevent users from removing
+modules during sampling.
+
+Reported-by: Haifeng Wang <wang.wanghaifeng@huawei.com>
+Signed-off-by: Qi Liu <liuqi115@huawei.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1594891165-8228-1-git-send-email-liuqi115@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm_smmuv3_pmu.c | 1 +
+ drivers/perf/fsl_imx8_ddr_perf.c | 1 +
+ drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 1 +
+ drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 1 +
+ drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 1 +
+ 5 files changed, 5 insertions(+)
+
+diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c
+index 3269232ff5708..f8fc1b612119c 100644
+--- a/drivers/perf/arm_smmuv3_pmu.c
++++ b/drivers/perf/arm_smmuv3_pmu.c
+@@ -742,6 +742,7 @@ static int smmu_pmu_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, smmu_pmu);
+
+ smmu_pmu->pmu = (struct pmu) {
++ .module = THIS_MODULE,
+ .task_ctx_nr = perf_invalid_context,
+ .pmu_enable = smmu_pmu_enable,
+ .pmu_disable = smmu_pmu_disable,
+diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
+index 6eef47de8fccc..b241db6929c08 100644
+--- a/drivers/perf/fsl_imx8_ddr_perf.c
++++ b/drivers/perf/fsl_imx8_ddr_perf.c
+@@ -451,6 +451,7 @@ static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base,
+ {
+ *pmu = (struct ddr_pmu) {
+ .pmu = (struct pmu) {
++ .module = THIS_MODULE,
+ .capabilities = PERF_PMU_CAP_NO_EXCLUDE,
+ .task_ctx_nr = perf_invalid_context,
+ .attr_groups = attr_groups,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+index e42d4464c2cf7..64712cf2f99ad 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+@@ -381,6 +381,7 @@ static int hisi_ddrc_pmu_probe(struct platform_device *pdev)
+ ddrc_pmu->sccl_id, ddrc_pmu->index_id);
+ ddrc_pmu->pmu = (struct pmu) {
+ .name = name,
++ .module = THIS_MODULE,
+ .task_ctx_nr = perf_invalid_context,
+ .event_init = hisi_uncore_pmu_event_init,
+ .pmu_enable = hisi_uncore_pmu_enable,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+index 0d6325d6a4ec3..a4004dad6bf1c 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+@@ -392,6 +392,7 @@ static int hisi_hha_pmu_probe(struct platform_device *pdev)
+ hha_pmu->sccl_id, hha_pmu->index_id);
+ hha_pmu->pmu = (struct pmu) {
+ .name = name,
++ .module = THIS_MODULE,
+ .task_ctx_nr = perf_invalid_context,
+ .event_init = hisi_uncore_pmu_event_init,
+ .pmu_enable = hisi_uncore_pmu_enable,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+index c5b0950c2a7a9..2f3f291b0c2ed 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+@@ -382,6 +382,7 @@ static int hisi_l3c_pmu_probe(struct platform_device *pdev)
+ l3c_pmu->sccl_id, l3c_pmu->index_id);
+ l3c_pmu->pmu = (struct pmu) {
+ .name = name,
++ .module = THIS_MODULE,
+ .task_ctx_nr = perf_invalid_context,
+ .event_init = hisi_uncore_pmu_event_init,
+ .pmu_enable = hisi_uncore_pmu_enable,
+--
+2.25.1
+
--- /dev/null
+From 97dc1c96b3c696cb1d58d6dfd86d132aaa607c62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 16:49:23 +0800
+Subject: drivers/perf: Prevent forced unbinding of PMU drivers
+
+From: Qi Liu <liuqi115@huawei.com>
+
+[ Upstream commit f32ed8eb0e3f0d0ef4ddb854554d60ca5863a9f9 ]
+
+Forcefully unbinding PMU drivers during perf sampling will lead to
+a kernel panic, because the perf upper-layer framework call a NULL
+pointer in this situation.
+
+To solve this issue, "suppress_bind_attrs" should be set to true, so
+that bind/unbind can be disabled via sysfs and prevent unbinding PMU
+drivers during perf sampling.
+
+Signed-off-by: Qi Liu <liuqi115@huawei.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Link: https://lore.kernel.org/r/1594975763-32966-1-git-send-email-liuqi115@huawei.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/perf/arm-cci.c | 1 +
+ drivers/perf/arm-ccn.c | 1 +
+ drivers/perf/arm_dsu_pmu.c | 1 +
+ drivers/perf/arm_smmuv3_pmu.c | 1 +
+ drivers/perf/arm_spe_pmu.c | 1 +
+ drivers/perf/fsl_imx8_ddr_perf.c | 1 +
+ drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c | 1 +
+ drivers/perf/hisilicon/hisi_uncore_hha_pmu.c | 1 +
+ drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 1 +
+ drivers/perf/qcom_l2_pmu.c | 1 +
+ drivers/perf/qcom_l3_pmu.c | 1 +
+ drivers/perf/thunderx2_pmu.c | 1 +
+ drivers/perf/xgene_pmu.c | 1 +
+ 13 files changed, 13 insertions(+)
+
+diff --git a/drivers/perf/arm-cci.c b/drivers/perf/arm-cci.c
+index 8f8606b9bc9ee..aca4570f78a86 100644
+--- a/drivers/perf/arm-cci.c
++++ b/drivers/perf/arm-cci.c
+@@ -1720,6 +1720,7 @@ static struct platform_driver cci_pmu_driver = {
+ .driver = {
+ .name = DRIVER_NAME,
+ .of_match_table = arm_cci_pmu_matches,
++ .suppress_bind_attrs = true,
+ },
+ .probe = cci_pmu_probe,
+ .remove = cci_pmu_remove,
+diff --git a/drivers/perf/arm-ccn.c b/drivers/perf/arm-ccn.c
+index 6fc0273b6129d..336948b41bd16 100644
+--- a/drivers/perf/arm-ccn.c
++++ b/drivers/perf/arm-ccn.c
+@@ -1545,6 +1545,7 @@ static struct platform_driver arm_ccn_driver = {
+ .driver = {
+ .name = "arm-ccn",
+ .of_match_table = arm_ccn_match,
++ .suppress_bind_attrs = true,
+ },
+ .probe = arm_ccn_probe,
+ .remove = arm_ccn_remove,
+diff --git a/drivers/perf/arm_dsu_pmu.c b/drivers/perf/arm_dsu_pmu.c
+index 70968c8c09d7f..4594e2ed13d59 100644
+--- a/drivers/perf/arm_dsu_pmu.c
++++ b/drivers/perf/arm_dsu_pmu.c
+@@ -759,6 +759,7 @@ static struct platform_driver dsu_pmu_driver = {
+ .driver = {
+ .name = DRVNAME,
+ .of_match_table = of_match_ptr(dsu_pmu_of_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = dsu_pmu_device_probe,
+ .remove = dsu_pmu_device_remove,
+diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c
+index f8fc1b612119c..9cdd89b29334e 100644
+--- a/drivers/perf/arm_smmuv3_pmu.c
++++ b/drivers/perf/arm_smmuv3_pmu.c
+@@ -861,6 +861,7 @@ static void smmu_pmu_shutdown(struct platform_device *pdev)
+ static struct platform_driver smmu_pmu_driver = {
+ .driver = {
+ .name = "arm-smmu-v3-pmcg",
++ .suppress_bind_attrs = true,
+ },
+ .probe = smmu_pmu_probe,
+ .remove = smmu_pmu_remove,
+diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c
+index 4e4984a55cd1b..079701e8de186 100644
+--- a/drivers/perf/arm_spe_pmu.c
++++ b/drivers/perf/arm_spe_pmu.c
+@@ -1228,6 +1228,7 @@ static struct platform_driver arm_spe_pmu_driver = {
+ .driver = {
+ .name = DRVNAME,
+ .of_match_table = of_match_ptr(arm_spe_pmu_of_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = arm_spe_pmu_device_probe,
+ .remove = arm_spe_pmu_device_remove,
+diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
+index b241db6929c08..09f44c6e2eaf6 100644
+--- a/drivers/perf/fsl_imx8_ddr_perf.c
++++ b/drivers/perf/fsl_imx8_ddr_perf.c
+@@ -646,6 +646,7 @@ static struct platform_driver imx_ddr_pmu_driver = {
+ .driver = {
+ .name = "imx-ddr-pmu",
+ .of_match_table = imx_ddr_pmu_dt_ids,
++ .suppress_bind_attrs = true,
+ },
+ .probe = ddr_perf_probe,
+ .remove = ddr_perf_remove,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+index 64712cf2f99ad..b79c96b14328b 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_ddrc_pmu.c
+@@ -420,6 +420,7 @@ static struct platform_driver hisi_ddrc_pmu_driver = {
+ .driver = {
+ .name = "hisi_ddrc_pmu",
+ .acpi_match_table = ACPI_PTR(hisi_ddrc_pmu_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = hisi_ddrc_pmu_probe,
+ .remove = hisi_ddrc_pmu_remove,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+index a4004dad6bf1c..78865b4ac4a6f 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_hha_pmu.c
+@@ -431,6 +431,7 @@ static struct platform_driver hisi_hha_pmu_driver = {
+ .driver = {
+ .name = "hisi_hha_pmu",
+ .acpi_match_table = ACPI_PTR(hisi_hha_pmu_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = hisi_hha_pmu_probe,
+ .remove = hisi_hha_pmu_remove,
+diff --git a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+index 2f3f291b0c2ed..9dd50c3bc74ec 100644
+--- a/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
++++ b/drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c
+@@ -421,6 +421,7 @@ static struct platform_driver hisi_l3c_pmu_driver = {
+ .driver = {
+ .name = "hisi_l3c_pmu",
+ .acpi_match_table = ACPI_PTR(hisi_l3c_pmu_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = hisi_l3c_pmu_probe,
+ .remove = hisi_l3c_pmu_remove,
+diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c
+index 21d6991dbe0ba..4da37f650f983 100644
+--- a/drivers/perf/qcom_l2_pmu.c
++++ b/drivers/perf/qcom_l2_pmu.c
+@@ -1028,6 +1028,7 @@ static struct platform_driver l2_cache_pmu_driver = {
+ .driver = {
+ .name = "qcom-l2cache-pmu",
+ .acpi_match_table = ACPI_PTR(l2_cache_pmu_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = l2_cache_pmu_probe,
+ .remove = l2_cache_pmu_remove,
+diff --git a/drivers/perf/qcom_l3_pmu.c b/drivers/perf/qcom_l3_pmu.c
+index 656e830798d9e..9ddb577c542b5 100644
+--- a/drivers/perf/qcom_l3_pmu.c
++++ b/drivers/perf/qcom_l3_pmu.c
+@@ -814,6 +814,7 @@ static struct platform_driver qcom_l3_cache_pmu_driver = {
+ .driver = {
+ .name = "qcom-l3cache-pmu",
+ .acpi_match_table = ACPI_PTR(qcom_l3_cache_pmu_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = qcom_l3_cache_pmu_probe,
+ };
+diff --git a/drivers/perf/thunderx2_pmu.c b/drivers/perf/thunderx2_pmu.c
+index 43d76c85da56b..9e1c3c7eeba9b 100644
+--- a/drivers/perf/thunderx2_pmu.c
++++ b/drivers/perf/thunderx2_pmu.c
+@@ -816,6 +816,7 @@ static struct platform_driver tx2_uncore_driver = {
+ .driver = {
+ .name = "tx2-uncore-pmu",
+ .acpi_match_table = ACPI_PTR(tx2_uncore_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ .probe = tx2_uncore_probe,
+ .remove = tx2_uncore_remove,
+diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
+index 7e328d6385c37..328aea9f6be32 100644
+--- a/drivers/perf/xgene_pmu.c
++++ b/drivers/perf/xgene_pmu.c
+@@ -1981,6 +1981,7 @@ static struct platform_driver xgene_pmu_driver = {
+ .name = "xgene-pmu",
+ .of_match_table = xgene_pmu_of_match,
+ .acpi_match_table = ACPI_PTR(xgene_pmu_acpi_match),
++ .suppress_bind_attrs = true,
+ },
+ };
+
+--
+2.25.1
+
--- /dev/null
+From 7bc936f7e23196e6aa2d2d2430789c2c02c0bcf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 12:34:52 +0800
+Subject: drm/amdgpu: fix preemption unit test
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit d845a2051b6b673fab4229b920ea04c7c4352b51 ]
+
+Remove signaled jobs from job list and ensure the
+job was indeed preempted.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+index 1e25ca34d876c..700e26b69abca 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+@@ -990,27 +990,37 @@ static void amdgpu_ib_preempt_job_recovery(struct drm_gpu_scheduler *sched)
+ static void amdgpu_ib_preempt_mark_partial_job(struct amdgpu_ring *ring)
+ {
+ struct amdgpu_job *job;
+- struct drm_sched_job *s_job;
++ struct drm_sched_job *s_job, *tmp;
+ uint32_t preempt_seq;
+ struct dma_fence *fence, **ptr;
+ struct amdgpu_fence_driver *drv = &ring->fence_drv;
+ struct drm_gpu_scheduler *sched = &ring->sched;
++ bool preempted = true;
+
+ if (ring->funcs->type != AMDGPU_RING_TYPE_GFX)
+ return;
+
+ preempt_seq = le32_to_cpu(*(drv->cpu_addr + 2));
+- if (preempt_seq <= atomic_read(&drv->last_seq))
+- return;
++ if (preempt_seq <= atomic_read(&drv->last_seq)) {
++ preempted = false;
++ goto no_preempt;
++ }
+
+ preempt_seq &= drv->num_fences_mask;
+ ptr = &drv->fences[preempt_seq];
+ fence = rcu_dereference_protected(*ptr, 1);
+
++no_preempt:
+ spin_lock(&sched->job_list_lock);
+- list_for_each_entry(s_job, &sched->ring_mirror_list, node) {
++ list_for_each_entry_safe(s_job, tmp, &sched->ring_mirror_list, node) {
++ if (dma_fence_is_signaled(&s_job->s_fence->finished)) {
++ /* remove job from ring_mirror_list */
++ list_del_init(&s_job->node);
++ sched->ops->free_job(s_job);
++ continue;
++ }
+ job = to_amdgpu_job(s_job);
+- if (job->fence == fence)
++ if (preempted && job->fence == fence)
+ /* mark the job as preempted */
+ job->preemption_status |= AMDGPU_IB_PREEMPTED;
+ }
+--
+2.25.1
+
--- /dev/null
+From b1fe34fafc6029c02828ea9892e01dc548bf64d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 12:18:22 +0800
+Subject: drm/amdgpu/gfx10: fix race condition for kiq
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jack Xiao <Jack.Xiao@amd.com>
+
+[ Upstream commit 7d65a577bb58d4f27a3398a4c0cb0b00ab7d0511 ]
+
+During preemption test for gfx10, it uses kiq to trigger
+gfx preemption, which would result in race condition
+with flushing TLB for kiq.
+
+Signed-off-by: Jack Xiao <Jack.Xiao@amd.com>
+Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+index 6f118292e40fb..64d96eb0a2337 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c
+@@ -4683,12 +4683,17 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring)
+ struct amdgpu_device *adev = ring->adev;
+ struct amdgpu_kiq *kiq = &adev->gfx.kiq;
+ struct amdgpu_ring *kiq_ring = &kiq->ring;
++ unsigned long flags;
+
+ if (!kiq->pmf || !kiq->pmf->kiq_unmap_queues)
+ return -EINVAL;
+
+- if (amdgpu_ring_alloc(kiq_ring, kiq->pmf->unmap_queues_size))
++ spin_lock_irqsave(&kiq->ring_lock, flags);
++
++ if (amdgpu_ring_alloc(kiq_ring, kiq->pmf->unmap_queues_size)) {
++ spin_unlock_irqrestore(&kiq->ring_lock, flags);
+ return -ENOMEM;
++ }
+
+ /* assert preemption condition */
+ amdgpu_ring_set_preempt_cond_exec(ring, false);
+@@ -4699,6 +4704,8 @@ static int gfx_v10_0_ring_preempt_ib(struct amdgpu_ring *ring)
+ ++ring->trail_seq);
+ amdgpu_ring_commit(kiq_ring);
+
++ spin_unlock_irqrestore(&kiq->ring_lock, flags);
++
+ /* poll the trailing fence */
+ for (i = 0; i < adev->usec_timeout; i++) {
+ if (ring->trail_seq ==
+--
+2.25.1
+
--- /dev/null
+From 78db1b42ab826dfd56335e85f285936fc3d3e85d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 11 Jul 2020 09:10:30 +0800
+Subject: drm: sun4i: hdmi: Fix inverted HPD result
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+[ Upstream commit baa1841eb797eadce6c907bdaed7cd6f01815404 ]
+
+When the extra HPD polling in sun4i_hdmi was removed, the result of
+HPD was accidentally inverted.
+
+Fix this by inverting the check.
+
+Fixes: bda8eaa6dee7 ("drm: sun4i: hdmi: Remove extra HPD polling")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Tested-by: Mans Rullgard <mans@mansr.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Link: https://patchwork.freedesktop.org/patch/msgid/20200711011030.21997-1-wens@kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+index 63b4de81686ac..4acdfa6087751 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c
+@@ -263,7 +263,7 @@ sun4i_hdmi_connector_detect(struct drm_connector *connector, bool force)
+ unsigned long reg;
+
+ reg = readl(hdmi->base + SUN4I_HDMI_HPD_REG);
+- if (reg & SUN4I_HDMI_HPD_HIGH) {
++ if (!(reg & SUN4I_HDMI_HPD_HIGH)) {
+ cec_phys_addr_invalidate(hdmi->cec_adap);
+ return connector_status_disconnected;
+ }
+--
+2.25.1
+
--- /dev/null
+From b872251d8bf7d00127d7d71511b33a9b61ef1972 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 17:40:12 +0300
+Subject: enetc: Remove the mdio bus on PF probe bailout
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit 26cb7085c8984e5b71d65c374a135134ed8cabb3 ]
+
+For ENETC ports that register an external MDIO bus,
+the bus doesn't get removed on the error bailout path
+of enetc_pf_probe().
+
+This issue became much more visible after recent:
+commit 07095c025ac2 ("net: enetc: Use DT protocol information to set up the ports")
+Before this commit, one could make probing fail on the error
+path only by having register_netdev() fail, which is unlikely.
+But after this commit, because it moved the enetc_of_phy_get()
+call up in the probing sequence, now we can trigger an mdiobus_free()
+bug just by forcing enetc_alloc_msix() to return error, i.e. with the
+'pci=nomsi' kernel bootarg (since ENETC relies on MSI support to work),
+as the calltrace below shows:
+
+kernel BUG at /home/eiz/work/enetc/net/drivers/net/phy/mdio_bus.c:648!
+Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
+[...]
+Hardware name: LS1028A RDB Board (DT)
+pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--)
+pc : mdiobus_free+0x50/0x58
+lr : devm_mdiobus_free+0x14/0x20
+[...]
+Call trace:
+ mdiobus_free+0x50/0x58
+ devm_mdiobus_free+0x14/0x20
+ release_nodes+0x138/0x228
+ devres_release_all+0x38/0x60
+ really_probe+0x1c8/0x368
+ driver_probe_device+0x5c/0xc0
+ device_driver_attach+0x74/0x80
+ __driver_attach+0x8c/0xd8
+ bus_for_each_dev+0x7c/0xd8
+ driver_attach+0x24/0x30
+ bus_add_driver+0x154/0x200
+ driver_register+0x64/0x120
+ __pci_register_driver+0x44/0x50
+ enetc_pf_driver_init+0x24/0x30
+ do_one_initcall+0x60/0x1c0
+ kernel_init_freeable+0x1fc/0x274
+ kernel_init+0x14/0x110
+ ret_from_fork+0x10/0x34
+
+Fixes: ebfcb23d62ab ("enetc: Add ENETC PF level external MDIO support")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/enetc_pf.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+index b73421c3e25b1..74847aa644f12 100644
+--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c
++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c
+@@ -885,6 +885,7 @@ static int enetc_pf_probe(struct pci_dev *pdev,
+ return 0;
+
+ err_reg_netdev:
++ enetc_mdio_remove(pf);
+ enetc_of_put_phy(priv);
+ enetc_free_msix(priv);
+ err_alloc_msix:
+--
+2.25.1
+
--- /dev/null
+From b65b9de931b3df65699792a0b0acc2b02c51c26b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 14:10:03 +0800
+Subject: fpga: dfl: fix bug in port reset handshake
+
+From: Matthew Gerlach <matthew.gerlach@linux.intel.com>
+
+[ Upstream commit 8614afd689df59d9ce019439389be20bd788a897 ]
+
+When putting the port in reset, driver must wait for the soft reset
+acknowledgment bit instead of the soft reset bit.
+
+Fixes: 47c1b19c160f (fpga: dfl: afu: add port ops support)
+Signed-off-by: Matthew Gerlach <matthew.gerlach@linux.intel.com>
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Acked-by: Wu Hao <hao.wu@intel.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/dfl-afu-main.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/dfl-afu-main.c b/drivers/fpga/dfl-afu-main.c
+index e4a34dc7947f9..041d23469238d 100644
+--- a/drivers/fpga/dfl-afu-main.c
++++ b/drivers/fpga/dfl-afu-main.c
+@@ -83,7 +83,8 @@ int __afu_port_disable(struct platform_device *pdev)
+ * on this port and minimum soft reset pulse width has elapsed.
+ * Driver polls port_soft_reset_ack to determine if reset done by HW.
+ */
+- if (readq_poll_timeout(base + PORT_HDR_CTRL, v, v & PORT_CTRL_SFTRST,
++ if (readq_poll_timeout(base + PORT_HDR_CTRL, v,
++ v & PORT_CTRL_SFTRST_ACK,
+ RST_POLL_INVL, RST_POLL_TIMEOUT)) {
+ dev_err(&pdev->dev, "timeout, fail to reset device\n");
+ return -ETIMEDOUT;
+--
+2.25.1
+
--- /dev/null
+From 10e9a029c2c7474eaadb6dd2e9e56bbe2ab36a00 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jul 2020 14:10:02 +0800
+Subject: fpga: dfl: pci: reduce the scope of variable 'ret'
+
+From: Xu Yilun <yilun.xu@intel.com>
+
+[ Upstream commit e19485dc7a0d210b428a249c0595769bd495fb71 ]
+
+This is to fix lkp cppcheck warnings:
+
+ drivers/fpga/dfl-pci.c:230:6: warning: The scope of the variable 'ret' can be reduced. [variableScope]
+ int ret = 0;
+ ^
+
+ drivers/fpga/dfl-pci.c:230:10: warning: Variable 'ret' is assigned a value that is never used. [unreadVariable]
+ int ret = 0;
+ ^
+
+Fixes: 3c2760b78f90 ("fpga: dfl: pci: fix return value of cci_pci_sriov_configure")
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Xu Yilun <yilun.xu@intel.com>
+Acked-by: Wu Hao <hao.wu@intel.com>
+Reviewed-by: Tom Rix <trix@redhat.com>
+Signed-off-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/fpga/dfl-pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/dfl-pci.c b/drivers/fpga/dfl-pci.c
+index 538755062ab7c..a78c409bf2c44 100644
+--- a/drivers/fpga/dfl-pci.c
++++ b/drivers/fpga/dfl-pci.c
+@@ -227,7 +227,6 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs)
+ {
+ struct cci_drvdata *drvdata = pci_get_drvdata(pcidev);
+ struct dfl_fpga_cdev *cdev = drvdata->cdev;
+- int ret = 0;
+
+ if (!num_vfs) {
+ /*
+@@ -239,6 +238,8 @@ static int cci_pci_sriov_configure(struct pci_dev *pcidev, int num_vfs)
+ dfl_fpga_cdev_config_ports_pf(cdev);
+
+ } else {
++ int ret;
++
+ /*
+ * before enable SRIOV, put released ports into VF access mode
+ * first of all.
+--
+2.25.1
+
--- /dev/null
+From 1c516a9abefcba0b11b0272d34d9608bd1674aac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 18:56:25 -0700
+Subject: geneve: fix an uninitialized value in geneve_changelink()
+
+From: Cong Wang <xiyou.wangcong@gmail.com>
+
+[ Upstream commit 32818c075c54bb0cae44dd6f7ab00b01c52b8372 ]
+
+geneve_nl2info() sets 'df' conditionally, so we have to
+initialize it by copying the value from existing geneve
+device in geneve_changelink().
+
+Fixes: 56c09de347e4 ("geneve: allow changing DF behavior after creation")
+Reported-by: syzbot+7ebc2e088af5e4c0c9fa@syzkaller.appspotmail.com
+Cc: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/geneve.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
+index 19d9d78a6df2c..adfdf6260b269 100644
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -1615,11 +1615,11 @@ static int geneve_changelink(struct net_device *dev, struct nlattr *tb[],
+ struct netlink_ext_ack *extack)
+ {
+ struct geneve_dev *geneve = netdev_priv(dev);
++ enum ifla_geneve_df df = geneve->df;
+ struct geneve_sock *gs4, *gs6;
+ struct ip_tunnel_info info;
+ bool metadata;
+ bool use_udp6_rx_checksums;
+- enum ifla_geneve_df df;
+ bool ttl_inherit;
+ int err;
+
+--
+2.25.1
+
--- /dev/null
+From 244f070cdbb2bd61ab37bbd5c38bc78cfed87d8d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 22 May 2020 05:06:10 -0400
+Subject: HID: alps: support devices with report id 2
+
+From: Caiyuan Xie <caiyuan.xie@cn.alps.com>
+
+[ Upstream commit aa3c439c144f0a465ed1f28f11c772886fb02b35 ]
+
+Add support for devices which that have reports with id == 2
+
+Signed-off-by: Caiyuan Xie <caiyuan.xie@cn.alps.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-alps.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c
+index b2ad319a74b9a..d33f5abc8f64d 100644
+--- a/drivers/hid/hid-alps.c
++++ b/drivers/hid/hid-alps.c
+@@ -25,6 +25,7 @@
+
+ #define U1_MOUSE_REPORT_ID 0x01 /* Mouse data ReportID */
+ #define U1_ABSOLUTE_REPORT_ID 0x03 /* Absolute data ReportID */
++#define U1_ABSOLUTE_REPORT_ID_SECD 0x02 /* FW-PTP Absolute data ReportID */
+ #define U1_FEATURE_REPORT_ID 0x05 /* Feature ReportID */
+ #define U1_SP_ABSOLUTE_REPORT_ID 0x06 /* Feature ReportID */
+
+@@ -368,6 +369,7 @@ static int u1_raw_event(struct alps_dev *hdata, u8 *data, int size)
+ case U1_FEATURE_REPORT_ID:
+ break;
+ case U1_ABSOLUTE_REPORT_ID:
++ case U1_ABSOLUTE_REPORT_ID_SECD:
+ for (i = 0; i < hdata->max_fingers; i++) {
+ u8 *contact = &data[i * 5];
+
+--
+2.25.1
+
--- /dev/null
+From daa61fb79657f88d406f406c7e03746362a9b7be Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 20 Jun 2020 14:32:29 +0200
+Subject: HID: apple: Disable Fn-key key-re-mapping on clone keyboards
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ]
+
+The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the
+Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239)
+of the Apple Wireless Keyboard (2009 ANSI version) <sigh>.
+
+But its F1 - F10 keys are marked as sending F1 - F10, not the special
+functions hid-apple.c maps them too; and since its descriptors do not
+contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the
+Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped
+to key-codes which have not been set in the keybit array causing them
+to not send any events at all.
+
+The lack of a usage code matching the Fn key in the clone is actually
+useful as this allows solving this problem in a generic way.
+
+This commits adds a fn_found flag and it adds a input_configured
+callback which checks if this flag is set once all usages have been
+mapped. If it is not set, then assume this is a clone and clear the
+quirks bitmap so that the hid-apple code does not add any special
+handling to this keyboard.
+
+This fixes F1 - F6 not sending anything at all and F7 - F12 sending
+the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on
+similar clones.
+
+Cc: Joao Moreno <mail@joaomoreno.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-apple.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
+index d732d1d10cafb..6909c045fece1 100644
+--- a/drivers/hid/hid-apple.c
++++ b/drivers/hid/hid-apple.c
+@@ -54,6 +54,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\")
+ struct apple_sc {
+ unsigned long quirks;
+ unsigned int fn_on;
++ unsigned int fn_found;
+ DECLARE_BITMAP(pressed_numlock, KEY_CNT);
+ };
+
+@@ -339,12 +340,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+ {
++ struct apple_sc *asc = hid_get_drvdata(hdev);
++
+ if (usage->hid == (HID_UP_CUSTOM | 0x0003) ||
+ usage->hid == (HID_UP_MSVENDOR | 0x0003) ||
+ usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) {
+ /* The fn key on Apple USB keyboards */
+ set_bit(EV_REP, hi->input->evbit);
+ hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN);
++ asc->fn_found = true;
+ apple_setup_input(hi->input);
+ return 1;
+ }
+@@ -371,6 +375,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ return 0;
+ }
+
++static int apple_input_configured(struct hid_device *hdev,
++ struct hid_input *hidinput)
++{
++ struct apple_sc *asc = hid_get_drvdata(hdev);
++
++ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) {
++ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n");
++ asc->quirks = 0;
++ }
++
++ return 0;
++}
++
+ static int apple_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+ {
+@@ -585,6 +602,7 @@ static struct hid_driver apple_driver = {
+ .event = apple_event,
+ .input_mapping = apple_input_mapping,
+ .input_mapped = apple_input_mapped,
++ .input_configured = apple_input_configured,
+ };
+ module_hid_driver(apple_driver);
+
+--
+2.25.1
+
--- /dev/null
+From 3a5300baff2a8364bf759c9cfc65328dd1c9305b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jun 2020 22:49:11 +0200
+Subject: HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override
+
+From: Federico Ricchiuto <fed.ricchiuto@gmail.com>
+
+[ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ]
+
+The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not
+supply descriptors, so it has to be added to the override list.
+
+Signed-off-by: Federico Ricchiuto <fed.ricchiuto@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index ec142bc8c1daf..35f3bfc3e6f59 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ },
+ .driver_data = (void *)&sipodev_desc
+ },
++ {
++ .ident = "Mediacom FlexBook edge 13",
++ .matches = {
++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"),
++ },
++ .driver_data = (void *)&sipodev_desc
++ },
+ {
+ .ident = "Odys Winbook 13",
+ .matches = {
+--
+2.25.1
+
--- /dev/null
+From 027411d74ee955102300383c811b033e3b36c0c6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 18:44:18 +0200
+Subject: HID: steam: fixes race in handling device list.
+
+From: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
+
+[ Upstream commit 2d3f53a80e4eed078669853a178ed96d88f74143 ]
+
+Using uhid and KASAN this driver crashed because it was getting
+several connection events where it only expected one. Then the
+device was added several times to the static device list and it got
+corrupted.
+
+This patch checks if the device is already in the list before adding
+it.
+
+Signed-off-by: Rodrigo Rivas Costa <rodrigorivascosta@gmail.com>
+Tested-by: Siarhei Vishniakou <svv@google.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-steam.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
+index 6286204d4c560..a3b151b29bd71 100644
+--- a/drivers/hid/hid-steam.c
++++ b/drivers/hid/hid-steam.c
+@@ -526,7 +526,8 @@ static int steam_register(struct steam_device *steam)
+ steam_battery_register(steam);
+
+ mutex_lock(&steam_devices_lock);
+- list_add(&steam->list, &steam_devices);
++ if (list_empty(&steam->list))
++ list_add(&steam->list, &steam_devices);
+ mutex_unlock(&steam_devices_lock);
+ }
+
+@@ -552,7 +553,7 @@ static void steam_unregister(struct steam_device *steam)
+ hid_info(steam->hdev, "Steam Controller '%s' disconnected",
+ steam->serial_no);
+ mutex_lock(&steam_devices_lock);
+- list_del(&steam->list);
++ list_del_init(&steam->list);
+ mutex_unlock(&steam_devices_lock);
+ steam->serial_no[0] = 0;
+ }
+@@ -738,6 +739,7 @@ static int steam_probe(struct hid_device *hdev,
+ mutex_init(&steam->mutex);
+ steam->quirks = id->driver_data;
+ INIT_WORK(&steam->work_connect, steam_work_connect_cb);
++ INIT_LIST_HEAD(&steam->list);
+
+ steam->client_hdev = steam_create_client_hid(hdev);
+ if (IS_ERR(steam->client_hdev)) {
+--
+2.25.1
+
--- /dev/null
+From 3fec4408f5fd85588d1ea856ad3395fec6fa4593 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 13:00:27 +0200
+Subject: hippi: Fix a size used in a 'pci_free_consistent()' in an error
+ handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ]
+
+The size used when calling 'pci_alloc_consistent()' and
+'pci_free_consistent()' should match.
+
+Fix it and have it consistent with the corresponding call in 'rr_close()'.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/hippi/rrunner.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
+index 2a6ec53949666..a4b3fce69ecd9 100644
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1242,7 +1242,7 @@ static int rr_open(struct net_device *dev)
+ rrpriv->info = NULL;
+ }
+ if (rrpriv->rx_ctrl) {
+- pci_free_consistent(pdev, sizeof(struct ring_ctrl),
++ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl),
+ rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma);
+ rrpriv->rx_ctrl = NULL;
+ }
+--
+2.25.1
+
--- /dev/null
+From 72bb64ffd10c729090ffd52f1b32e21928f3f39e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 9 Jul 2020 04:06:12 +0000
+Subject: hwmon: (adm1275) Make sure we are reading enough data for different
+ chips
+
+From: Chu Lin <linchuyuan@google.com>
+
+[ Upstream commit 6d1d41c075a1a54ba03370e268171fec20e06563 ]
+
+Issue:
+When PEC is enabled, binding adm1272 to the adm1275 would
+fail due to PEC error. See below:
+adm1275: probe of xxxx failed with error -74
+
+Diagnosis:
+Per the datasheet of adm1272, adm1278, adm1293 and amd1294,
+PMON_CONFIG (0xd4) is 16bits wide. On the other hand,
+PMON_CONFIG (0xd4) for adm1275 is 8bits wide. The driver should not
+assume everything is 8bits wide and read only 8bits from it.
+
+Solution:
+If it is adm1272, adm1278, adm1293 and adm1294, use i2c_read_word.
+Else, use i2c_read_byte
+
+Testing:
+Binding adm1272 to the driver.
+The change is only tested on adm1272.
+
+Signed-off-by: Chu Lin <linchuyuan@google.com>
+Link: https://lore.kernel.org/r/20200709040612.3977094-1-linchuyuan@google.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/pmbus/adm1275.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
+index 5caa37fbfc187..66b12e5ccbc65 100644
+--- a/drivers/hwmon/pmbus/adm1275.c
++++ b/drivers/hwmon/pmbus/adm1275.c
+@@ -454,6 +454,7 @@ MODULE_DEVICE_TABLE(i2c, adm1275_id);
+ static int adm1275_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
++ s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
+ u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1];
+ int config, device_config;
+ int ret;
+@@ -499,11 +500,16 @@ static int adm1275_probe(struct i2c_client *client,
+ "Device mismatch: Configured %s, detected %s\n",
+ id->name, mid->name);
+
+- config = i2c_smbus_read_byte_data(client, ADM1275_PMON_CONFIG);
++ if (mid->driver_data == adm1272 || mid->driver_data == adm1278 ||
++ mid->driver_data == adm1293 || mid->driver_data == adm1294)
++ config_read_fn = i2c_smbus_read_word_data;
++ else
++ config_read_fn = i2c_smbus_read_byte_data;
++ config = config_read_fn(client, ADM1275_PMON_CONFIG);
+ if (config < 0)
+ return config;
+
+- device_config = i2c_smbus_read_byte_data(client, ADM1275_DEVICE_CONFIG);
++ device_config = config_read_fn(client, ADM1275_DEVICE_CONFIG);
+ if (device_config < 0)
+ return device_config;
+
+--
+2.25.1
+
--- /dev/null
+From cd1a27ec6bdb13eb5b8a935ca63c4b2113bd7a25 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 14:15:18 +0300
+Subject: hwmon: (aspeed-pwm-tacho) Avoid possible buffer overflow
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit bc4071aafcf4d0535ee423b69167696d6c03207d ]
+
+aspeed_create_fan() reads a pwm_port value using of_property_read_u32().
+If pwm_port will be more than ARRAY_SIZE(pwm_port_params), there will be
+a buffer overflow in
+aspeed_create_pwm_port()->aspeed_set_pwm_port_enable(). The patch fixes
+the potential buffer overflow.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Link: https://lore.kernel.org/r/20200703111518.9644-1-novikov@ispras.ru
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/aspeed-pwm-tacho.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/hwmon/aspeed-pwm-tacho.c b/drivers/hwmon/aspeed-pwm-tacho.c
+index 40c489be62eaa..40f3139f1e028 100644
+--- a/drivers/hwmon/aspeed-pwm-tacho.c
++++ b/drivers/hwmon/aspeed-pwm-tacho.c
+@@ -851,6 +851,8 @@ static int aspeed_create_fan(struct device *dev,
+ ret = of_property_read_u32(child, "reg", &pwm_port);
+ if (ret)
+ return ret;
++ if (pwm_port >= ARRAY_SIZE(pwm_port_params))
++ return -EINVAL;
+ aspeed_create_pwm_port(priv, (u8)pwm_port);
+
+ ret = of_property_count_u8_elems(child, "cooling-levels");
+--
+2.25.1
+
--- /dev/null
+From 35a4eb41d14686a12e5166c6ff01cb9f8e6e99d8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Jul 2020 14:31:11 -0700
+Subject: hwmon: (nct6775) Accept PECI Calibration as temperature source for
+ NCT6798D
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+[ Upstream commit 8a03746c8baf82e1616f05a1a716d34378dcf780 ]
+
+Stefan Dietrich reports invalid temperature source messages on Asus Formula
+XII Z490.
+
+nct6775 nct6775.656: Invalid temperature source 28 at index 0,
+ source register 0x100, temp register 0x73
+
+Debugging suggests that temperature source 28 reports the CPU temperature.
+Let's assume that temperature sources 28 and 29 reflect "PECI Agent {0,1}
+Calibration", similar to other chips of the series.
+
+Reported-by: Stefan Dietrich <roots@gmx.de>
+Cc: Stefan Dietrich <roots@gmx.de>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/nct6775.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
+index 7efa6bfef0609..ba9b96973e808 100644
+--- a/drivers/hwmon/nct6775.c
++++ b/drivers/hwmon/nct6775.c
+@@ -786,13 +786,13 @@ static const char *const nct6798_temp_label[] = {
+ "Agent1 Dimm1",
+ "BYTE_TEMP0",
+ "BYTE_TEMP1",
+- "",
+- "",
++ "PECI Agent 0 Calibration", /* undocumented */
++ "PECI Agent 1 Calibration", /* undocumented */
+ "",
+ "Virtual_TEMP"
+ };
+
+-#define NCT6798_TEMP_MASK 0x8fff0ffe
++#define NCT6798_TEMP_MASK 0xbfff0ffe
+ #define NCT6798_VIRT_TEMP_MASK 0x80000c00
+
+ /* NCT6102D/NCT6106D specific data */
+--
+2.25.1
+
--- /dev/null
+From ba956d8e2d4e0c1de4df40d0a9fd584586c16fc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 13:13:38 +0100
+Subject: hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
+
+From: Cristian Marussi <cristian.marussi@arm.com>
+
+[ Upstream commit 3ce17cd2b94907f6d91b81b32848044b84c97606 ]
+
+SMATCH detected a potential buffer overflow in the manipulation of
+hwmon_attributes array inside the scmi_hwmon_probe function:
+
+drivers/hwmon/scmi-hwmon.c:226
+ scmi_hwmon_probe() error: buffer overflow 'hwmon_attributes' 6 <= 9
+
+Fix it by statically declaring the size of the array as the maximum
+possible as defined by hwmon_max define.
+
+Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Link: https://lore.kernel.org/r/20200715121338.GA18761@e119603-lin.cambridge.arm.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/scmi-hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/scmi-hwmon.c b/drivers/hwmon/scmi-hwmon.c
+index 8a7732c0bef3e..7cd13a217c615 100644
+--- a/drivers/hwmon/scmi-hwmon.c
++++ b/drivers/hwmon/scmi-hwmon.c
+@@ -147,7 +147,7 @@ static enum hwmon_sensor_types scmi_types[] = {
+ [ENERGY] = hwmon_energy,
+ };
+
+-static u32 hwmon_attributes[] = {
++static u32 hwmon_attributes[hwmon_max] = {
+ [hwmon_chip] = HWMON_C_REGISTER_TZ,
+ [hwmon_temp] = HWMON_T_INPUT | HWMON_T_LABEL,
+ [hwmon_in] = HWMON_I_INPUT | HWMON_I_LABEL,
+--
+2.25.1
+
--- /dev/null
+From 1e3848cac8efb91a49c2ecda502d5fa9ed0c1081 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 15:00:21 -0700
+Subject: i2c: i2c-qcom-geni: Fix DMA transfer race
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 02b9aec59243c6240fc42884acc958602146ddf6 ]
+
+When I have KASAN enabled on my kernel and I start stressing the
+touchscreen my system tends to hang. The touchscreen is one of the
+only things that does a lot of big i2c transfers and ends up hitting
+the DMA paths in the geni i2c driver. It appears that KASAN adds
+enough delay in my system to tickle a race condition in the DMA setup
+code.
+
+When the system hangs, I found that it was running the geni_i2c_irq()
+over and over again. It had these:
+
+m_stat = 0x04000080
+rx_st = 0x30000011
+dm_tx_st = 0x00000000
+dm_rx_st = 0x00000000
+dma = 0x00000001
+
+Notably we're in DMA mode but are getting M_RX_IRQ_EN and
+M_RX_FIFO_WATERMARK_EN over and over again.
+
+Putting some traces in geni_i2c_rx_one_msg() showed that when we
+failed we were getting to the start of geni_i2c_rx_one_msg() but were
+never executing geni_se_rx_dma_prep().
+
+I believe that the problem here is that we are starting the geni
+command before we run geni_se_rx_dma_prep(). If a transfer makes it
+far enough before we do that then we get into the state I have
+observed. Let's change the order, which seems to work fine.
+
+Although problems were seen on the RX path, code inspection suggests
+that the TX should be changed too. Change it as well.
+
+Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Reviewed-by: Akash Asthana <akashast@codeaurora.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Reviewed-by: Mukesh Kumar Savaliya <msavaliy@codeaurora.org>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-qcom-geni.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
+index 17abf60c94aeb..aafc76ee93e02 100644
+--- a/drivers/i2c/busses/i2c-qcom-geni.c
++++ b/drivers/i2c/busses/i2c-qcom-geni.c
+@@ -368,7 +368,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ geni_se_select_mode(se, GENI_SE_FIFO);
+
+ writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN);
+- geni_se_setup_m_cmd(se, I2C_READ, m_param);
+
+ if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) {
+ geni_se_select_mode(se, GENI_SE_FIFO);
+@@ -376,6 +375,8 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ dma_buf = NULL;
+ }
+
++ geni_se_setup_m_cmd(se, I2C_READ, m_param);
++
+ time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT);
+ if (!time_left)
+ geni_i2c_abort_xfer(gi2c);
+@@ -409,7 +410,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ geni_se_select_mode(se, GENI_SE_FIFO);
+
+ writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN);
+- geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
+
+ if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) {
+ geni_se_select_mode(se, GENI_SE_FIFO);
+@@ -417,6 +417,8 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg,
+ dma_buf = NULL;
+ }
+
++ geni_se_setup_m_cmd(se, I2C_WRITE, m_param);
++
+ if (!dma_buf) /* Get FIFO IRQ */
+ writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG);
+
+--
+2.25.1
+
--- /dev/null
+From 9cb6adac94ebe82388d0fd9a3feb6906c89aba75 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 4 Jul 2020 15:38:29 +0200
+Subject: i2c: rcar: always clear ICSAR to avoid side effects
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+[ Upstream commit eb01597158ffb1853a7a7fc2c57d4c844640f75e ]
+
+On R-Car Gen2, we get a timeout when reading from the address set in
+ICSAR, even though the slave interface is disabled. Clearing it fixes
+this situation. Note that Gen3 is not affected.
+
+To reproduce: bind and undbind an I2C slave on some bus, run
+'i2cdetect' on that bus.
+
+Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-rcar.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
+index 531c01100b560..36af8fdb66586 100644
+--- a/drivers/i2c/busses/i2c-rcar.c
++++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -865,6 +865,7 @@ static int rcar_unreg_slave(struct i2c_client *slave)
+ /* disable irqs and ensure none is running before clearing ptr */
+ rcar_i2c_write(priv, ICSIER, 0);
+ rcar_i2c_write(priv, ICSCR, 0);
++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
+
+ synchronize_irq(priv->irq);
+ priv->slave = NULL;
+@@ -971,6 +972,8 @@ static int rcar_i2c_probe(struct platform_device *pdev)
+ if (ret < 0)
+ goto out_pm_put;
+
++ rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
++
+ if (priv->devtype == I2C_RCAR_GEN3) {
+ priv->rstc = devm_reset_control_get_exclusive(&pdev->dev, NULL);
+ if (!IS_ERR(priv->rstc)) {
+--
+2.25.1
+
--- /dev/null
+From f9100f33bc51cd78bcc975c38481b68e51593e19 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 17:01:21 +0800
+Subject: ieee802154: fix one possible memleak in adf7242_probe
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 66673f96f0f968b991dc38be06102246919c663c ]
+
+When probe fail, we should destroy the workqueue.
+
+Fixes: 2795e8c25161 ("net: ieee802154: fix a potential NULL pointer dereference")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Acked-by: Michael Hennerich <michael.hennerich@analog.com>
+Link: https://lore.kernel.org/r/20200717090121.2143-1-liujian56@huawei.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/adf7242.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c
+index 5a37514e42347..8dbccec6ac866 100644
+--- a/drivers/net/ieee802154/adf7242.c
++++ b/drivers/net/ieee802154/adf7242.c
+@@ -1262,7 +1262,7 @@ static int adf7242_probe(struct spi_device *spi)
+ WQ_MEM_RECLAIM);
+ if (unlikely(!lp->wqueue)) {
+ ret = -ENOMEM;
+- goto err_hw_init;
++ goto err_alloc_wq;
+ }
+
+ ret = adf7242_hw_init(lp);
+@@ -1294,6 +1294,8 @@ static int adf7242_probe(struct spi_device *spi)
+ return ret;
+
+ err_hw_init:
++ destroy_workqueue(lp->wqueue);
++err_alloc_wq:
+ mutex_destroy(&lp->bmux);
+ ieee802154_free_hw(lp->hw);
+
+--
+2.25.1
+
--- /dev/null
+From 8f22b461db5d087689d4ed70d42dac55314457ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 11:47:04 -0700
+Subject: Input: add `SW_MACHINE_COVER`
+
+From: Merlijn Wajer <merlijn@wizzup.org>
+
+[ Upstream commit c463bb2a8f8d7d97aa414bf7714fc77e9d3b10df ]
+
+This event code represents the state of a removable cover of a device.
+Value 0 means that the cover is open or removed, value 1 means that the
+cover is closed.
+
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Merlijn Wajer <merlijn@wizzup.org>
+Link: https://lore.kernel.org/r/20200612125402.18393-2-merlijn@wizzup.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mod_devicetable.h | 2 +-
+ include/uapi/linux/input-event-codes.h | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 953d7ca01eb60..4c56404e53a76 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -318,7 +318,7 @@ struct pcmcia_device_id {
+ #define INPUT_DEVICE_ID_LED_MAX 0x0f
+ #define INPUT_DEVICE_ID_SND_MAX 0x07
+ #define INPUT_DEVICE_ID_FF_MAX 0x7f
+-#define INPUT_DEVICE_ID_SW_MAX 0x0f
++#define INPUT_DEVICE_ID_SW_MAX 0x10
+ #define INPUT_DEVICE_ID_PROP_MAX 0x1f
+
+ #define INPUT_DEVICE_ID_MATCH_BUS 1
+diff --git a/include/uapi/linux/input-event-codes.h b/include/uapi/linux/input-event-codes.h
+index 85387c76c24f3..472cd5bc55676 100644
+--- a/include/uapi/linux/input-event-codes.h
++++ b/include/uapi/linux/input-event-codes.h
+@@ -808,7 +808,8 @@
+ #define SW_LINEIN_INSERT 0x0d /* set = inserted */
+ #define SW_MUTE_DEVICE 0x0e /* set = device disabled */
+ #define SW_PEN_INSERTED 0x0f /* set = pen inserted */
+-#define SW_MAX 0x0f
++#define SW_MACHINE_COVER 0x10 /* set = cover closed */
++#define SW_MAX 0x10
+ #define SW_CNT (SW_MAX+1)
+
+ /*
+--
+2.25.1
+
--- /dev/null
+From 4e8e71c9e991106d79fe6063a4daf5b2b4ec2526 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 17:39:41 -0700
+Subject: Input: elan_i2c - only increment wakeup count on touch
+
+From: Derek Basehore <dbasehore@chromium.org>
+
+[ Upstream commit 966334dfc472bdfa67bed864842943b19755d192 ]
+
+This moves the wakeup increment for elan devices to the touch report.
+This prevents the drivers from incorrectly reporting a wakeup when the
+resume callback resets then device, which causes an interrupt to
+occur.
+
+Signed-off-by: Derek Basehore <dbasehore@chromium.org>
+Link: https://lore.kernel.org/r/20200706235046.1984283-1-dbasehore@chromium.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/elan_i2c_core.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 8719da5403834..196e8505dd8d7 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -951,6 +951,8 @@ static void elan_report_absolute(struct elan_tp_data *data, u8 *packet)
+ u8 hover_info = packet[ETP_HOVER_INFO_OFFSET];
+ bool contact_valid, hover_event;
+
++ pm_wakeup_event(&data->client->dev, 0);
++
+ hover_event = hover_info & 0x40;
+ for (i = 0; i < ETP_MAX_FINGERS; i++) {
+ contact_valid = tp_info & (1U << (3 + i));
+@@ -974,6 +976,8 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)
+ u8 *packet = &report[ETP_REPORT_ID_OFFSET + 1];
+ int x, y;
+
++ pm_wakeup_event(&data->client->dev, 0);
++
+ if (!data->tp_input) {
+ dev_warn_once(&data->client->dev,
+ "received a trackpoint report while no trackpoint device has been created. Please report upstream.\n");
+@@ -998,7 +1002,6 @@ static void elan_report_trackpoint(struct elan_tp_data *data, u8 *report)
+ static irqreturn_t elan_isr(int irq, void *dev_id)
+ {
+ struct elan_tp_data *data = dev_id;
+- struct device *dev = &data->client->dev;
+ int error;
+ u8 report[ETP_MAX_REPORT_LEN];
+
+@@ -1016,8 +1019,6 @@ static irqreturn_t elan_isr(int irq, void *dev_id)
+ if (error)
+ goto out;
+
+- pm_wakeup_event(dev, 0);
+-
+ switch (report[ETP_REPORT_ID_OFFSET]) {
+ case ETP_REPORT_ID:
+ elan_report_absolute(data, report);
+@@ -1026,7 +1027,7 @@ static irqreturn_t elan_isr(int irq, void *dev_id)
+ elan_report_trackpoint(data, report);
+ break;
+ default:
+- dev_err(dev, "invalid report id data (%x)\n",
++ dev_err(&data->client->dev, "invalid report id data (%x)\n",
+ report[ETP_REPORT_ID_OFFSET]);
+ }
+
+--
+2.25.1
+
--- /dev/null
+From b8edd6a3a053ff205688c62582b54814cf7b67b7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jul 2020 15:27:43 -0700
+Subject: Input: synaptics - enable InterTouch for ThinkPad X1E 1st gen
+
+From: Ilya Katsnelson <me@0upti.me>
+
+[ Upstream commit dcb00fc799dc03fd320e123e4c81b3278c763ea5 ]
+
+Tested on my own laptop, touchpad feels slightly more responsive with
+this on, though it might just be placebo.
+
+Signed-off-by: Ilya Katsnelson <me@0upti.me>
+Reviewed-by: Lyude Paul <lyude@redhat.com>
+Link: https://lore.kernel.org/r/20200703143457.132373-1-me@0upti.me
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 758dae8d65006..4b81b2d0fe067 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0093", /* T480 */
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
++ "LEN0099", /* X1 Extreme 1st */
+ "LEN009b", /* T580 */
+ "LEN200f", /* T450s */
+ "LEN2044", /* L470 */
+--
+2.25.1
+
--- /dev/null
+From 4f85a4aa5c5d706bebdb69aa33839368e34be071 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 16:00:14 -0700
+Subject: ionic: fix up filter locks and debug msgs
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit cbec2153a9a68d011454960ba84887e46e40b37d ]
+
+Add in a couple of forgotten spinlocks and fix up some of
+the debug messages around filter management.
+
+Fixes: c1e329ebec8d ("ionic: Add management of rx filters")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 17 +++++++----------
+ .../ethernet/pensando/ionic/ionic_rx_filter.c | 5 +++++
+ 2 files changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+index d5b0bf54f9610..c00ec9a020973 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -809,8 +809,7 @@ static int ionic_lif_addr_add(struct ionic_lif *lif, const u8 *addr)
+ if (f)
+ return 0;
+
+- netdev_dbg(lif->netdev, "rx_filter add ADDR %pM (id %d)\n", addr,
+- ctx.comp.rx_filter_add.filter_id);
++ netdev_dbg(lif->netdev, "rx_filter add ADDR %pM\n", addr);
+
+ memcpy(ctx.cmd.rx_filter_add.mac.addr, addr, ETH_ALEN);
+ err = ionic_adminq_post_wait(lif, &ctx);
+@@ -839,6 +838,9 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr)
+ return -ENOENT;
+ }
+
++ netdev_dbg(lif->netdev, "rx_filter del ADDR %pM (id %d)\n",
++ addr, f->filter_id);
++
+ ctx.cmd.rx_filter_del.filter_id = cpu_to_le32(f->filter_id);
+ ionic_rx_filter_free(lif, f);
+ spin_unlock_bh(&lif->rx_filters.lock);
+@@ -847,9 +849,6 @@ static int ionic_lif_addr_del(struct ionic_lif *lif, const u8 *addr)
+ if (err)
+ return err;
+
+- netdev_dbg(lif->netdev, "rx_filter del ADDR %pM (id %d)\n", addr,
+- ctx.cmd.rx_filter_del.filter_id);
+-
+ return 0;
+ }
+
+@@ -1291,13 +1290,11 @@ static int ionic_vlan_rx_add_vid(struct net_device *netdev, __be16 proto,
+ };
+ int err;
+
++ netdev_dbg(netdev, "rx_filter add VLAN %d\n", vid);
+ err = ionic_adminq_post_wait(lif, &ctx);
+ if (err)
+ return err;
+
+- netdev_dbg(netdev, "rx_filter add VLAN %d (id %d)\n", vid,
+- ctx.comp.rx_filter_add.filter_id);
+-
+ return ionic_rx_filter_save(lif, 0, IONIC_RXQ_INDEX_ANY, 0, &ctx);
+ }
+
+@@ -1322,8 +1319,8 @@ static int ionic_vlan_rx_kill_vid(struct net_device *netdev, __be16 proto,
+ return -ENOENT;
+ }
+
+- netdev_dbg(netdev, "rx_filter del VLAN %d (id %d)\n", vid,
+- le32_to_cpu(ctx.cmd.rx_filter_del.filter_id));
++ netdev_dbg(netdev, "rx_filter del VLAN %d (id %d)\n",
++ vid, f->filter_id);
+
+ ctx.cmd.rx_filter_del.filter_id = cpu_to_le32(f->filter_id);
+ ionic_rx_filter_free(lif, f);
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c
+index 7a093f148ee58..60cb77e2bab4c 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_rx_filter.c
+@@ -36,10 +36,12 @@ int ionic_rx_filters_init(struct ionic_lif *lif)
+
+ spin_lock_init(&lif->rx_filters.lock);
+
++ spin_lock_bh(&lif->rx_filters.lock);
+ for (i = 0; i < IONIC_RX_FILTER_HLISTS; i++) {
+ INIT_HLIST_HEAD(&lif->rx_filters.by_hash[i]);
+ INIT_HLIST_HEAD(&lif->rx_filters.by_id[i]);
+ }
++ spin_unlock_bh(&lif->rx_filters.lock);
+
+ return 0;
+ }
+@@ -51,11 +53,13 @@ void ionic_rx_filters_deinit(struct ionic_lif *lif)
+ struct hlist_node *tmp;
+ unsigned int i;
+
++ spin_lock_bh(&lif->rx_filters.lock);
+ for (i = 0; i < IONIC_RX_FILTER_HLISTS; i++) {
+ head = &lif->rx_filters.by_id[i];
+ hlist_for_each_entry_safe(f, tmp, head, by_id)
+ ionic_rx_filter_free(lif, f);
+ }
++ spin_unlock_bh(&lif->rx_filters.lock);
+ }
+
+ int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index,
+@@ -91,6 +95,7 @@ int ionic_rx_filter_save(struct ionic_lif *lif, u32 flow_id, u16 rxq_index,
+ f->filter_id = le32_to_cpu(ctx->comp.rx_filter_add.filter_id);
+ f->rxq_index = rxq_index;
+ memcpy(&f->cmd, ac, sizeof(f->cmd));
++ netdev_dbg(lif->netdev, "rx_filter add filter_id %d\n", f->filter_id);
+
+ INIT_HLIST_NODE(&f->by_hash);
+ INIT_HLIST_NODE(&f->by_id);
+--
+2.25.1
+
--- /dev/null
+From d1261fc62bd0b001eb338addeafef535a3ed8bd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 16:00:13 -0700
+Subject: ionic: use offset for ethtool regs data
+
+From: Shannon Nelson <snelson@pensando.io>
+
+[ Upstream commit f85ae16f924f92a370b81b4e77862c1c59882fce ]
+
+Use an offset to write the second half of the regs data into the
+second half of the buffer instead of overwriting the first half.
+
+Fixes: 4d03e00a2140 ("ionic: Add initial ethtool support")
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/pensando/ionic/ionic_ethtool.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+index 7d10265f782a6..5aacc00962df7 100644
+--- a/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_ethtool.c
+@@ -102,15 +102,18 @@ static void ionic_get_regs(struct net_device *netdev, struct ethtool_regs *regs,
+ void *p)
+ {
+ struct ionic_lif *lif = netdev_priv(netdev);
++ unsigned int offset;
+ unsigned int size;
+
+ regs->version = IONIC_DEV_CMD_REG_VERSION;
+
++ offset = 0;
+ size = IONIC_DEV_INFO_REG_COUNT * sizeof(u32);
+- memcpy_fromio(p, lif->ionic->idev.dev_info_regs->words, size);
++ memcpy_fromio(p + offset, lif->ionic->idev.dev_info_regs->words, size);
+
++ offset += size;
+ size = IONIC_DEV_CMD_REG_COUNT * sizeof(u32);
+- memcpy_fromio(p, lif->ionic->idev.dev_cmd_regs->words, size);
++ memcpy_fromio(p + offset, lif->ionic->idev.dev_cmd_regs->words, size);
+ }
+
+ static int ionic_get_link_ksettings(struct net_device *netdev,
+--
+2.25.1
+
--- /dev/null
+From 59f586c30b6f1a3cad5a2235a762e091477aa0e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 16:12:08 +0800
+Subject: ipvs: fix the connection sync failed in some cases
+
+From: guodeqing <geffrey.guo@huawei.com>
+
+[ Upstream commit 8210e344ccb798c672ab237b1a4f241bda08909b ]
+
+The sync_thread_backup only checks sk_receive_queue is empty or not,
+there is a situation which cannot sync the connection entries when
+sk_receive_queue is empty and sk_rmem_alloc is larger than sk_rcvbuf,
+the sync packets are dropped in __udp_enqueue_schedule_skb, this is
+because the packets in reader_queue is not read, so the rmem is
+not reclaimed.
+
+Here I add the check of whether the reader_queue of the udp sock is
+empty or not to solve this problem.
+
+Fixes: 2276f58ac589 ("udp: use a separate rx queue for packet reception")
+Reported-by: zhouxudong <zhouxudong8@huawei.com>
+Signed-off-by: guodeqing <geffrey.guo@huawei.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipvs/ip_vs_sync.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index 8dc892a9dc91a..0c1bc654245c0 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -1717,6 +1717,8 @@ static int sync_thread_backup(void *data)
+ {
+ struct ip_vs_sync_thread_data *tinfo = data;
+ struct netns_ipvs *ipvs = tinfo->ipvs;
++ struct sock *sk = tinfo->sock->sk;
++ struct udp_sock *up = udp_sk(sk);
+ int len;
+
+ pr_info("sync thread started: state = BACKUP, mcast_ifn = %s, "
+@@ -1724,12 +1726,14 @@ static int sync_thread_backup(void *data)
+ ipvs->bcfg.mcast_ifn, ipvs->bcfg.syncid, tinfo->id);
+
+ while (!kthread_should_stop()) {
+- wait_event_interruptible(*sk_sleep(tinfo->sock->sk),
+- !skb_queue_empty(&tinfo->sock->sk->sk_receive_queue)
+- || kthread_should_stop());
++ wait_event_interruptible(*sk_sleep(sk),
++ !skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++ !skb_queue_empty_lockless(&up->reader_queue) ||
++ kthread_should_stop());
+
+ /* do we have data now? */
+- while (!skb_queue_empty(&(tinfo->sock->sk->sk_receive_queue))) {
++ while (!skb_queue_empty_lockless(&sk->sk_receive_queue) ||
++ !skb_queue_empty_lockless(&up->reader_queue)) {
+ len = ip_vs_receive(tinfo->sock, tinfo->buf,
+ ipvs->bcfg.sync_maxlen);
+ if (len <= 0) {
+--
+2.25.1
+
--- /dev/null
+From 1b715afe91be58c5c7e9abcaab7a04f3497cd407 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jul 2020 22:31:49 +0800
+Subject: mlxsw: destroy workqueue when trap_register in mlxsw_emad_init
+
+From: Liu Jian <liujian56@huawei.com>
+
+[ Upstream commit 5dbaeb87f2b309936be0aeae00cbc9e7f20ab296 ]
+
+When mlxsw_core_trap_register fails in mlxsw_emad_init,
+destroy_workqueue() shouled be called to destroy mlxsw_core->emad_wq.
+
+Fixes: d965465b60ba ("mlxsw: core: Fix possible deadlock")
+Signed-off-by: Liu Jian <liujian56@huawei.com>
+Reviewed-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index 0a0884d86d44d..1b204ce30ee42 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -592,7 +592,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ err = mlxsw_core_trap_register(mlxsw_core, &mlxsw_emad_rx_listener,
+ mlxsw_core);
+ if (err)
+- return err;
++ goto err_trap_register;
+
+ err = mlxsw_core->driver->basic_trap_groups_set(mlxsw_core);
+ if (err)
+@@ -604,6 +604,7 @@ static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
+ err_emad_trap_set:
+ mlxsw_core_trap_unregister(mlxsw_core, &mlxsw_emad_rx_listener,
+ mlxsw_core);
++err_trap_register:
+ destroy_workqueue(mlxsw_core->emad_wq);
+ return err;
+ }
+--
+2.25.1
+
--- /dev/null
+From d8e859e99bb2a41e91df8cca29c08d692995a585 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jul 2020 21:46:14 -0400
+Subject: net: ag71xx: add missed clk_disable_unprepare in error path of probe
+
+From: Huang Guobin <huangguobin4@huawei.com>
+
+[ Upstream commit befc113c56a76ae7be3986034a0e476d3385e265 ]
+
+The ag71xx_mdio_probe() forgets to call clk_disable_unprepare() when
+of_reset_control_get_exclusive() failed. Add the missed call to fix it.
+
+Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/ag71xx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
+index 1b1a09095c0dc..78e20f53677d5 100644
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -553,7 +553,8 @@ static int ag71xx_mdio_probe(struct ag71xx *ag)
+ ag->mdio_reset = of_reset_control_get_exclusive(np, "mdio");
+ if (IS_ERR(ag->mdio_reset)) {
+ netif_err(ag, probe, ndev, "Failed to get reset mdio.\n");
+- return PTR_ERR(ag->mdio_reset);
++ err = PTR_ERR(ag->mdio_reset);
++ goto mdio_err_put_clk;
+ }
+
+ mii_bus->name = "ag71xx_mdio";
+--
+2.25.1
+
--- /dev/null
+From d90a8e4567f81418687e1940391fdaf3ed2b9db8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 19:10:00 +0300
+Subject: net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual
+ configuration
+
+From: Sergey Organov <sorganov@gmail.com>
+
+[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ]
+
+From Documentation/networking/timestamping.txt:
+
+ A driver which supports hardware time stamping shall update the
+ struct with the actual, possibly more permissive configuration.
+
+Do update the struct passed when we upscale the requested time
+stamping mode.
+
+Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.")
+Signed-off-by: Sergey Organov <sorganov@gmail.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/dp83640.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 1c75b2627ca87..7d845117abb02 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -1348,6 +1348,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4;
+ dp83640->version = PTP_CLASS_V1;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_L4_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L4_SYNC:
+@@ -1355,6 +1356,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_L2_SYNC:
+@@ -1362,6 +1364,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L2;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT;
+ break;
+ case HWTSTAMP_FILTER_PTP_V2_EVENT:
+ case HWTSTAMP_FILTER_PTP_V2_SYNC:
+@@ -1369,6 +1372,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr)
+ dp83640->hwts_rx_en = 1;
+ dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2;
+ dp83640->version = PTP_CLASS_V2;
++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ break;
+ default:
+ return -ERANGE;
+--
+2.25.1
+
--- /dev/null
+From 72fd6854e52cf8fbe9c3c6f60586a2d181873bd5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 13:07:39 +0200
+Subject: net: dsa: microchip: call phy_remove_link_mode during probe
+
+From: Helmut Grohne <helmut.grohne@intenta.de>
+
+[ Upstream commit 3506b2f42dff66ea6814c3dfa1988bafb79e6f88 ]
+
+When doing "ip link set dev ... up" for a ksz9477 backed link,
+ksz9477_phy_setup is called and it calls phy_remove_link_mode to remove
+1000baseT HDX. During phy_remove_link_mode, phy_advertise_supported is
+called. Doing so reverts any previous change to advertised link modes
+e.g. using a udevd .link file.
+
+phy_remove_link_mode is not meant to be used while opening a link and
+should be called during phy probe when the link is not yet available to
+userspace.
+
+Therefore move the phy_remove_link_mode calls into
+ksz9477_switch_register. It indirectly calls dsa_register_switch, which
+creates the relevant struct phy_devices and we update the link modes
+right after that. At that time dev->features is already initialized by
+ksz9477_switch_detect.
+
+Remove phy_setup from ksz_dev_ops as no users remain.
+
+Link: https://lore.kernel.org/netdev/20200715192722.GD1256692@lunn.ch/
+Fixes: 42fc6a4c613019 ("net: dsa: microchip: prepare PHY for proper advertisement")
+Signed-off-by: Helmut Grohne <helmut.grohne@intenta.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/microchip/ksz9477.c | 42 ++++++++++++++------------
+ drivers/net/dsa/microchip/ksz_common.c | 2 --
+ drivers/net/dsa/microchip/ksz_common.h | 2 --
+ 3 files changed, 23 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c
+index f600874e24763..b15da9a8e3bb9 100644
+--- a/drivers/net/dsa/microchip/ksz9477.c
++++ b/drivers/net/dsa/microchip/ksz9477.c
+@@ -976,23 +976,6 @@ static void ksz9477_port_mirror_del(struct dsa_switch *ds, int port,
+ PORT_MIRROR_SNIFFER, false);
+ }
+
+-static void ksz9477_phy_setup(struct ksz_device *dev, int port,
+- struct phy_device *phy)
+-{
+- /* Only apply to port with PHY. */
+- if (port >= dev->phy_port_cnt)
+- return;
+-
+- /* The MAC actually cannot run in 1000 half-duplex mode. */
+- phy_remove_link_mode(phy,
+- ETHTOOL_LINK_MODE_1000baseT_Half_BIT);
+-
+- /* PHY does not support gigabit. */
+- if (!(dev->features & GBIT_SUPPORT))
+- phy_remove_link_mode(phy,
+- ETHTOOL_LINK_MODE_1000baseT_Full_BIT);
+-}
+-
+ static bool ksz9477_get_gbit(struct ksz_device *dev, u8 data)
+ {
+ bool gbit;
+@@ -1605,7 +1588,6 @@ static const struct ksz_dev_ops ksz9477_dev_ops = {
+ .get_port_addr = ksz9477_get_port_addr,
+ .cfg_port_member = ksz9477_cfg_port_member,
+ .flush_dyn_mac_table = ksz9477_flush_dyn_mac_table,
+- .phy_setup = ksz9477_phy_setup,
+ .port_setup = ksz9477_port_setup,
+ .r_mib_cnt = ksz9477_r_mib_cnt,
+ .r_mib_pkt = ksz9477_r_mib_pkt,
+@@ -1619,7 +1601,29 @@ static const struct ksz_dev_ops ksz9477_dev_ops = {
+
+ int ksz9477_switch_register(struct ksz_device *dev)
+ {
+- return ksz_switch_register(dev, &ksz9477_dev_ops);
++ int ret, i;
++ struct phy_device *phydev;
++
++ ret = ksz_switch_register(dev, &ksz9477_dev_ops);
++ if (ret)
++ return ret;
++
++ for (i = 0; i < dev->phy_port_cnt; ++i) {
++ if (!dsa_is_user_port(dev->ds, i))
++ continue;
++
++ phydev = dsa_to_port(dev->ds, i)->slave->phydev;
++
++ /* The MAC actually cannot run in 1000 half-duplex mode. */
++ phy_remove_link_mode(phydev,
++ ETHTOOL_LINK_MODE_1000baseT_Half_BIT);
++
++ /* PHY does not support gigabit. */
++ if (!(dev->features & GBIT_SUPPORT))
++ phy_remove_link_mode(phydev,
++ ETHTOOL_LINK_MODE_1000baseT_Full_BIT);
++ }
++ return ret;
+ }
+ EXPORT_SYMBOL(ksz9477_switch_register);
+
+diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
+index fe47180c908b9..7fabc0e3d807a 100644
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -366,8 +366,6 @@ int ksz_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy)
+
+ /* setup slave port */
+ dev->dev_ops->port_setup(dev, port, false);
+- if (dev->dev_ops->phy_setup)
+- dev->dev_ops->phy_setup(dev, port, phy);
+
+ /* port_stp_state_set() will be called after to enable the port so
+ * there is no need to do anything.
+diff --git a/drivers/net/dsa/microchip/ksz_common.h b/drivers/net/dsa/microchip/ksz_common.h
+index a20ebb749377c..061142b183cb9 100644
+--- a/drivers/net/dsa/microchip/ksz_common.h
++++ b/drivers/net/dsa/microchip/ksz_common.h
+@@ -120,8 +120,6 @@ struct ksz_dev_ops {
+ u32 (*get_port_addr)(int port, int offset);
+ void (*cfg_port_member)(struct ksz_device *dev, int port, u8 member);
+ void (*flush_dyn_mac_table)(struct ksz_device *dev, int port);
+- void (*phy_setup)(struct ksz_device *dev, int port,
+- struct phy_device *phy);
+ void (*port_cleanup)(struct ksz_device *dev, int port);
+ void (*port_setup)(struct ksz_device *dev, int port, bool cpu_port);
+ void (*r_phy)(struct ksz_device *dev, u16 phy, u16 reg, u16 *val);
+--
+2.25.1
+
--- /dev/null
+From 0fffadf1d9c8bbc0e6618962a4a0f6ece2f8a370 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 10:50:49 +0800
+Subject: net: ethernet: ave: Fix error returns in ave_init
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit 1264d7fa3a64d8bea7aebb77253f917947ffda25 ]
+
+When regmap_update_bits failed in ave_init(), calls of the functions
+reset_control_assert() and clk_disable_unprepare() were missed.
+Add goto out_reset_assert to do this.
+
+Fixes: 57878f2f4697 ("net: ethernet: ave: add support for phy-mode setting of system controller")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Reviewed-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/socionext/sni_ave.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c
+index 38d39c4b5ac83..603d54f83399c 100644
+--- a/drivers/net/ethernet/socionext/sni_ave.c
++++ b/drivers/net/ethernet/socionext/sni_ave.c
+@@ -1191,7 +1191,7 @@ static int ave_init(struct net_device *ndev)
+ ret = regmap_update_bits(priv->regmap, SG_ETPINMODE,
+ priv->pinmode_mask, priv->pinmode_val);
+ if (ret)
+- return ret;
++ goto out_reset_assert;
+
+ ave_global_reset(ndev);
+
+--
+2.25.1
+
--- /dev/null
+From a368e09780e01765687933c93c2cddaf0408e982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 19:03:53 +0800
+Subject: net: hns3: fix error handling for desc filling
+
+From: Yunsheng Lin <linyunsheng@huawei.com>
+
+[ Upstream commit 8ceca59fb3ed48a693171bd571c4fcbd555b7f1f ]
+
+The content of the TX desc is automatically cleared by the HW
+when the HW has sent out the packet to the wire. When desc filling
+fails in hns3_nic_net_xmit(), it will call hns3_clear_desc() to do
+the error handling, which miss zeroing of the TX desc and the
+checking if a unmapping is needed.
+
+So add the zeroing and checking in hns3_clear_desc() to avoid the
+above problem. Also add DESC_TYPE_UNKNOWN to indicate the info in
+desc_cb is not valid, because hns3_nic_reclaim_desc() may treat
+the desc_cb->type of zero as packet and add to the sent pkt
+statistics accordingly.
+
+Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 +
+ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 8 ++++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+index a0998937727d8..0db835d87d09d 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h
++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h
+@@ -77,6 +77,7 @@
+ ((ring)->p = ((ring)->p - 1 + (ring)->desc_num) % (ring)->desc_num)
+
+ enum hns_desc_type {
++ DESC_TYPE_UNKNOWN,
+ DESC_TYPE_SKB,
+ DESC_TYPE_PAGE,
+ };
+diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+index 37537c3020806..506381224559f 100644
+--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c
+@@ -1292,6 +1292,10 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)
+ unsigned int i;
+
+ for (i = 0; i < ring->desc_num; i++) {
++ struct hns3_desc *desc = &ring->desc[ring->next_to_use];
++
++ memset(desc, 0, sizeof(*desc));
++
+ /* check if this is where we started */
+ if (ring->next_to_use == next_to_use_orig)
+ break;
+@@ -1299,6 +1303,9 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)
+ /* rollback one */
+ ring_ptr_move_bw(ring, next_to_use);
+
++ if (!ring->desc_cb[ring->next_to_use].dma)
++ continue;
++
+ /* unmap the descriptor dma address */
+ if (ring->desc_cb[ring->next_to_use].type == DESC_TYPE_SKB)
+ dma_unmap_single(dev,
+@@ -1313,6 +1320,7 @@ static void hns3_clear_desc(struct hns3_enet_ring *ring, int next_to_use_orig)
+
+ ring->desc_cb[ring->next_to_use].length = 0;
+ ring->desc_cb[ring->next_to_use].dma = 0;
++ ring->desc_cb[ring->next_to_use].type = DESC_TYPE_UNKNOWN;
+ }
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 933cf238c17df836081f4b12006eebf79a49b318 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:50:38 +0800
+Subject: net: smc91x: Fix possible memory leak in smc_drv_probe()
+
+From: Wang Hai <wanghai38@huawei.com>
+
+[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ]
+
+If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev)
+should be called to free the ndev created earlier. Otherwise, a memleak
+will occur.
+
+Fixes: 7d2911c43815 ("net: smc91x: Fix gpios for device tree based booting")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai38@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/smsc/smc91x.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
+index 3a6761131f4c2..2248d26746124 100644
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -2274,7 +2274,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+ "power", 0, 0, 100);
+ if (ret)
+- return ret;
++ goto out_free_netdev;
+
+ /*
+ * Optional reset GPIO configured? Minimum 100 ns reset needed
+@@ -2283,7 +2283,7 @@ static int smc_drv_probe(struct platform_device *pdev)
+ ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+ "reset", 0, 0, 100);
+ if (ret)
+- return ret;
++ goto out_free_netdev;
+
+ /*
+ * Need to wait for optional EEPROM to load, max 750 us according
+--
+2.25.1
+
--- /dev/null
+From aecf16fb833384e89965bcecab46945526ae19e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 14:51:50 +0000
+Subject: netdevsim: fix unbalaced locking in nsim_create()
+
+From: Taehee Yoo <ap420073@gmail.com>
+
+[ Upstream commit 2c9d8e01f0c6017317eee7638496173d4a64e6bc ]
+
+In the nsim_create(), rtnl_lock() is called before nsim_bpf_init().
+If nsim_bpf_init() is failed, rtnl_unlock() should be called,
+but it isn't called.
+So, unbalanced locking would occur.
+
+Fixes: e05b2d141fef ("netdevsim: move netdev creation/destruction to dev probe")
+Signed-off-by: Taehee Yoo <ap420073@gmail.com>
+Reviewed-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/netdevsim/netdev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/netdevsim/netdev.c b/drivers/net/netdevsim/netdev.c
+index 55f57f76d01bb..a6bbe93f29ef6 100644
+--- a/drivers/net/netdevsim/netdev.c
++++ b/drivers/net/netdevsim/netdev.c
+@@ -301,7 +301,7 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port)
+ rtnl_lock();
+ err = nsim_bpf_init(ns);
+ if (err)
+- goto err_free_netdev;
++ goto err_rtnl_unlock;
+
+ nsim_ipsec_init(ns);
+
+@@ -315,8 +315,8 @@ nsim_create(struct nsim_dev *nsim_dev, struct nsim_dev_port *nsim_dev_port)
+ err_ipsec_teardown:
+ nsim_ipsec_teardown(ns);
+ nsim_bpf_uninit(ns);
++err_rtnl_unlock:
+ rtnl_unlock();
+-err_free_netdev:
+ free_netdev(dev);
+ return ERR_PTR(err);
+ }
+--
+2.25.1
+
--- /dev/null
+From e3c51b98b722ff25764c5f2851bd8f063fb8ddbb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jul 2020 13:31:36 -0400
+Subject: nfsd4: fix NULL dereference in nfsd/clients display code
+
+From: J. Bruce Fields <bfields@redhat.com>
+
+[ Upstream commit 9affa435817711861d774f5626c393c80f16d044 ]
+
+We hold the cl_lock here, and that's enough to keep stateid's from going
+away, but it's not enough to prevent the files they point to from going
+away. Take fi_lock and a reference and check for NULL, as we do in
+other code.
+
+Reported-by: NeilBrown <neilb@suse.de>
+Fixes: 78599c42ae3c ("nfsd4: add file to display list of client's opens")
+Reviewed-by: NeilBrown <neilb@suse.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfsd/nfs4state.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 9af9b673f2923..68cf116607645 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -506,6 +506,17 @@ find_any_file(struct nfs4_file *f)
+ return ret;
+ }
+
++static struct nfsd_file *find_deleg_file(struct nfs4_file *f)
++{
++ struct nfsd_file *ret = NULL;
++
++ spin_lock(&f->fi_lock);
++ if (f->fi_deleg_file)
++ ret = nfsd_file_get(f->fi_deleg_file);
++ spin_unlock(&f->fi_lock);
++ return ret;
++}
++
+ static atomic_long_t num_delegations;
+ unsigned long max_delegations;
+
+@@ -2378,6 +2389,8 @@ static int nfs4_show_open(struct seq_file *s, struct nfs4_stid *st)
+ oo = ols->st_stateowner;
+ nf = st->sc_file;
+ file = find_any_file(nf);
++ if (!file)
++ return 0;
+
+ seq_printf(s, "- 0x%16phN: { type: open, ", &st->sc_stateid);
+
+@@ -2411,6 +2424,8 @@ static int nfs4_show_lock(struct seq_file *s, struct nfs4_stid *st)
+ oo = ols->st_stateowner;
+ nf = st->sc_file;
+ file = find_any_file(nf);
++ if (!file)
++ return 0;
+
+ seq_printf(s, "- 0x%16phN: { type: lock, ", &st->sc_stateid);
+
+@@ -2439,7 +2454,9 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
+
+ ds = delegstateid(st);
+ nf = st->sc_file;
+- file = nf->fi_deleg_file;
++ file = find_deleg_file(nf);
++ if (!file)
++ return 0;
+
+ seq_printf(s, "- 0x%16phN: { type: deleg, ", &st->sc_stateid);
+
+@@ -2451,6 +2468,7 @@ static int nfs4_show_deleg(struct seq_file *s, struct nfs4_stid *st)
+
+ nfs4_show_superblock(s, file);
+ seq_printf(s, " }\n");
++ nfsd_file_put(file);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From 3d9c2be06126968d8fe2874ee8d29eef59d0b055 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 20:56:01 +0300
+Subject: platform/x86: asus-wmi: allow BAT1 battery name
+
+From: Vasiliy Kupriakov <rublag-ns@yandex.ru>
+
+[ Upstream commit 9a33e375d98ece5ea40c576eabd3257acb90c509 ]
+
+The battery on my laptop ASUS TUF Gaming FX706II is named BAT1.
+This patch allows battery extension to load.
+
+Signed-off-by: Vasiliy Kupriakov <rublag-ns@yandex.ru>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/asus-wmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index b1f4a31ba1ee5..ed83fb135bab3 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -424,6 +424,7 @@ static int asus_wmi_battery_add(struct power_supply *battery)
+ * battery is named BATT.
+ */
+ if (strcmp(battery->desc->name, "BAT0") != 0 &&
++ strcmp(battery->desc->name, "BAT1") != 0 &&
+ strcmp(battery->desc->name, "BATT") != 0)
+ return -ENODEV;
+
+--
+2.25.1
+
--- /dev/null
+From e0491ae4986caa31a297e0d2359ff56ccbfc4b32 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Jun 2020 10:51:38 -0700
+Subject: platform/x86: ISST: Add new PCI device ids
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit e1eea3f839f41368d7cb4eb2d872d5b288677e94 ]
+
+Added new PCI device ids for supporting mailbox and MMIO interface for
+Sapphire Rapids.
+
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_speed_select_if/isst_if_common.h | 3 +++
+ drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c | 1 +
+ drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c | 1 +
+ 3 files changed, 5 insertions(+)
+
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_common.h b/drivers/platform/x86/intel_speed_select_if/isst_if_common.h
+index 1409a5bb55820..4f6f7f0761fc1 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_common.h
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_common.h
+@@ -13,6 +13,9 @@
+ #define INTEL_RAPL_PRIO_DEVID_0 0x3451
+ #define INTEL_CFG_MBOX_DEVID_0 0x3459
+
++#define INTEL_RAPL_PRIO_DEVID_1 0x3251
++#define INTEL_CFG_MBOX_DEVID_1 0x3259
++
+ /*
+ * Validate maximum commands in a single request.
+ * This is enough to handle command to every core in one ioctl, or all
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c
+index de4169d0796bd..9a055fd54053f 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_mbox_pci.c
+@@ -148,6 +148,7 @@ static long isst_if_mbox_proc_cmd(u8 *cmd_ptr, int *write_only, int resume)
+
+ static const struct pci_device_id isst_if_mbox_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_CFG_MBOX_DEVID_0)},
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_CFG_MBOX_DEVID_1)},
+ { 0 },
+ };
+ MODULE_DEVICE_TABLE(pci, isst_if_mbox_ids);
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c b/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c
+index ad8c7c0df4d9a..e3778204b7a60 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_mmio.c
+@@ -72,6 +72,7 @@ static long isst_if_mmio_rd_wr(u8 *cmd_ptr, int *write_only, int resume)
+
+ static const struct pci_device_id isst_if_ids[] = {
+ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_RAPL_PRIO_DEVID_0)},
++ { PCI_DEVICE(PCI_VENDOR_ID_INTEL, INTEL_RAPL_PRIO_DEVID_1)},
+ { 0 },
+ };
+ MODULE_DEVICE_TABLE(pci, isst_if_ids);
+--
+2.25.1
+
--- /dev/null
+From d3ccbabd5006203d4e68e045d6d03a62c3e2552a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 17:41:42 +0300
+Subject: qed: suppress "don't support RoCE & iWARP" flooding on HW init
+
+From: Alexander Lobakin <alobakin@marvell.com>
+
+[ Upstream commit 1ea999039fe7c7953da2fbb7ca7c3ef00064d328 ]
+
+Change the verbosity of the "don't support RoCE & iWARP simultaneously"
+warning to debug level to stop flooding on driver/hardware initialization:
+
+[ 4.783230] qede 01:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0
+[MBI 15.10.6] [eth0]
+[ 4.810020] [qed_rdma_set_pf_params:2076()]Current day drivers don't
+support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only
+[ 4.861186] qede 01:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0
+[MBI 15.10.6] [eth1]
+[ 4.893311] [qed_rdma_set_pf_params:2076()]Current day drivers don't
+support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only
+[ 5.181713] qede a1:00.00: Storm FW 8.37.7.0, Management FW 8.52.9.0
+[MBI 15.10.6] [eth2]
+[ 5.224740] [qed_rdma_set_pf_params:2076()]Current day drivers don't
+support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only
+[ 5.276449] qede a1:00.01: Storm FW 8.37.7.0, Management FW 8.52.9.0
+[MBI 15.10.6] [eth3]
+[ 5.318671] [qed_rdma_set_pf_params:2076()]Current day drivers don't
+support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only
+[ 5.369548] qede a1:00.02: Storm FW 8.37.7.0, Management FW 8.52.9.0
+[MBI 15.10.6] [eth4]
+[ 5.411645] [qed_rdma_set_pf_params:2076()]Current day drivers don't
+support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only
+
+Fixes: e0a8f9de16fc ("qed: Add iWARP enablement support")
+Signed-off-by: Alexander Lobakin <alobakin@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_cxt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+index 1d6dfba0c034d..8ea46b81b7395 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
+@@ -2073,8 +2073,8 @@ static void qed_rdma_set_pf_params(struct qed_hwfn *p_hwfn,
+ num_srqs = min_t(u32, QED_RDMA_MAX_SRQS, p_params->num_srqs);
+
+ if (p_hwfn->mcp_info->func_info.protocol == QED_PCI_ETH_RDMA) {
+- DP_NOTICE(p_hwfn,
+- "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n");
++ DP_VERBOSE(p_hwfn, QED_MSG_SP,
++ "Current day drivers don't support RoCE & iWARP simultaneously on the same PF. Default to RoCE-only\n");
+ p_hwfn->hw_info.personality = QED_PCI_ETH_ROCE;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From 4daae93ea6100a5d859a6d9b413551d090b07682 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Jul 2020 17:41:43 +0300
+Subject: qed: suppress false-positives interrupt error messages on HW init
+
+From: Alexander Lobakin <alobakin@marvell.com>
+
+[ Upstream commit eb61c2d69903e977ffa2b80b1da9d1f758cf228d ]
+
+It was found that qed_pglueb_rbc_attn_handler() can produce a lot of
+false-positive error detections on driver load/reload (especially after
+crashes/recoveries) and spam the kernel log:
+
+[ 4.958275] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d00ff0
+[ 2079.146764] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0
+[ 2116.374631] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0
+[ 2135.250564] [qed_pglueb_rbc_attn_handler:324()]ICPL error - 00d80ff0
+[...]
+
+Reduce the logging level of two false-positive prone error messages from
+notice to verbose on initialization (only) to not mix it with real error
+attentions while debugging.
+
+Fixes: 666db4862f2d ("qed: Revise load sequence to avoid PCI errors")
+Signed-off-by: Alexander Lobakin <alobakin@marvell.com>
+Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +-
+ drivers/net/ethernet/qlogic/qed/qed_int.c | 50 +++++++++++++----------
+ drivers/net/ethernet/qlogic/qed/qed_int.h | 4 +-
+ 3 files changed, 32 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+index 638047b937c65..4456ce5325a74 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -3092,7 +3092,7 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params)
+ }
+
+ /* Log and clear previous pglue_b errors if such exist */
+- qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_main_ptt);
++ qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_main_ptt, true);
+
+ /* Enable the PF's internal FID_enable in the PXP */
+ rc = qed_pglueb_set_pfid_enable(p_hwfn, p_hwfn->p_main_ptt,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index 9f5113639eaf0..8d106063e9275 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -256,9 +256,10 @@ out:
+ #define PGLUE_ATTENTION_ZLR_VALID (1 << 25)
+ #define PGLUE_ATTENTION_ILT_VALID (1 << 23)
+
+-int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt)
++int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ bool hw_init)
+ {
++ char msg[256];
+ u32 tmp;
+
+ tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_WR_DETAILS2);
+@@ -272,22 +273,23 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+ details = qed_rd(p_hwfn, p_ptt,
+ PGLUE_B_REG_TX_ERR_WR_DETAILS);
+
+- DP_NOTICE(p_hwfn,
+- "Illegal write by chip to [%08x:%08x] blocked.\n"
+- "Details: %08x [PFID %02x, VFID %02x, VF_VALID %02x]\n"
+- "Details2 %08x [Was_error %02x BME deassert %02x FID_enable deassert %02x]\n",
+- addr_hi, addr_lo, details,
+- (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_PFID),
+- (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VFID),
+- GET_FIELD(details,
+- PGLUE_ATTENTION_DETAILS_VF_VALID) ? 1 : 0,
+- tmp,
+- GET_FIELD(tmp,
+- PGLUE_ATTENTION_DETAILS2_WAS_ERR) ? 1 : 0,
+- GET_FIELD(tmp,
+- PGLUE_ATTENTION_DETAILS2_BME) ? 1 : 0,
+- GET_FIELD(tmp,
+- PGLUE_ATTENTION_DETAILS2_FID_EN) ? 1 : 0);
++ snprintf(msg, sizeof(msg),
++ "Illegal write by chip to [%08x:%08x] blocked.\n"
++ "Details: %08x [PFID %02x, VFID %02x, VF_VALID %02x]\n"
++ "Details2 %08x [Was_error %02x BME deassert %02x FID_enable deassert %02x]",
++ addr_hi, addr_lo, details,
++ (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_PFID),
++ (u8)GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VFID),
++ !!GET_FIELD(details, PGLUE_ATTENTION_DETAILS_VF_VALID),
++ tmp,
++ !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_WAS_ERR),
++ !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_BME),
++ !!GET_FIELD(tmp, PGLUE_ATTENTION_DETAILS2_FID_EN));
++
++ if (hw_init)
++ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, "%s\n", msg);
++ else
++ DP_NOTICE(p_hwfn, "%s\n", msg);
+ }
+
+ tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_RD_DETAILS2);
+@@ -320,8 +322,14 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+ }
+
+ tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_TX_ERR_WR_DETAILS_ICPL);
+- if (tmp & PGLUE_ATTENTION_ICPL_VALID)
+- DP_NOTICE(p_hwfn, "ICPL error - %08x\n", tmp);
++ if (tmp & PGLUE_ATTENTION_ICPL_VALID) {
++ snprintf(msg, sizeof(msg), "ICPL error - %08x", tmp);
++
++ if (hw_init)
++ DP_VERBOSE(p_hwfn, NETIF_MSG_INTR, "%s\n", msg);
++ else
++ DP_NOTICE(p_hwfn, "%s\n", msg);
++ }
+
+ tmp = qed_rd(p_hwfn, p_ptt, PGLUE_B_REG_MASTER_ZLR_ERR_DETAILS);
+ if (tmp & PGLUE_ATTENTION_ZLR_VALID) {
+@@ -360,7 +368,7 @@ int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+
+ static int qed_pglueb_rbc_attn_cb(struct qed_hwfn *p_hwfn)
+ {
+- return qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_dpc_ptt);
++ return qed_pglueb_rbc_attn_handler(p_hwfn, p_hwfn->p_dpc_ptt, false);
+ }
+
+ #define QED_DORQ_ATTENTION_REASON_MASK (0xfffff)
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.h b/drivers/net/ethernet/qlogic/qed/qed_int.h
+index d473b522afc51..ba5cfebf2d0d0 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.h
+@@ -431,7 +431,7 @@ int qed_int_set_timer_res(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
+
+ #define QED_MAPPING_MEMORY_SIZE(dev) (NUM_OF_SBS(dev))
+
+-int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn,
+- struct qed_ptt *p_ptt);
++int qed_pglueb_rbc_attn_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt,
++ bool hw_init);
+
+ #endif
+--
+2.25.1
+
--- /dev/null
+From 3d0c27193d6a3bb8b3c88395b68d04396e3960d9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 12 Jul 2020 13:26:41 +0300
+Subject: RDMA/mlx5: Use xa_lock_irq when access to SRQ table
+
+From: Maor Gottlieb <maorg@mellanox.com>
+
+[ Upstream commit c3d6057e07a5d15be7c69ea545b3f91877808c96 ]
+
+SRQ table is accessed both from interrupt and process context,
+therefore we must use xa_lock_irq.
+
+ inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.
+ kworker/u17:9/8573 takes:
+ ffff8883e3503d30 (&xa->xa_lock#13){?...}-{2:2}, at: mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib]
+ {IN-HARDIRQ-W} state was registered at:
+ lock_acquire+0xb9/0x3a0
+ _raw_spin_lock+0x25/0x30
+ srq_event_notifier+0x2b/0xc0 [mlx5_ib]
+ notifier_call_chain+0x45/0x70
+ __atomic_notifier_call_chain+0x69/0x100
+ forward_event+0x36/0xc0 [mlx5_core]
+ notifier_call_chain+0x45/0x70
+ __atomic_notifier_call_chain+0x69/0x100
+ mlx5_eq_async_int+0xc5/0x160 [mlx5_core]
+ notifier_call_chain+0x45/0x70
+ __atomic_notifier_call_chain+0x69/0x100
+ mlx5_irq_int_handler+0x19/0x30 [mlx5_core]
+ __handle_irq_event_percpu+0x43/0x2a0
+ handle_irq_event_percpu+0x30/0x70
+ handle_irq_event+0x34/0x60
+ handle_edge_irq+0x7c/0x1b0
+ do_IRQ+0x60/0x110
+ ret_from_intr+0x0/0x2a
+ default_idle+0x34/0x160
+ do_idle+0x1ec/0x220
+ cpu_startup_entry+0x19/0x20
+ start_secondary+0x153/0x1a0
+ secondary_startup_64+0xa4/0xb0
+ irq event stamp: 20907
+ hardirqs last enabled at (20907): _raw_spin_unlock_irq+0x24/0x30
+ hardirqs last disabled at (20906): _raw_spin_lock_irq+0xf/0x40
+ softirqs last enabled at (20746): __do_softirq+0x2c9/0x436
+ softirqs last disabled at (20681): irq_exit+0xb3/0xc0
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&xa->xa_lock#13);
+ <Interrupt>
+ lock(&xa->xa_lock#13);
+
+ *** DEADLOCK ***
+
+ 2 locks held by kworker/u17:9/8573:
+ #0: ffff888295218d38 ((wq_completion)mlx5_ib_page_fault){+.+.}-{0:0}, at: process_one_work+0x1f1/0x5f0
+ #1: ffff888401647e78 ((work_completion)(&pfault->work)){+.+.}-{0:0}, at: process_one_work+0x1f1/0x5f0
+
+ stack backtrace:
+ CPU: 0 PID: 8573 Comm: kworker/u17:9 Tainted: GO 5.7.0_for_upstream_min_debug_2020_06_14_11_31_46_41 #1
+ Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
+ Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]
+ Call Trace:
+ dump_stack+0x71/0x9b
+ mark_lock+0x4f2/0x590
+ ? print_shortest_lock_dependencies+0x200/0x200
+ __lock_acquire+0xa00/0x1eb0
+ lock_acquire+0xb9/0x3a0
+ ? mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib]
+ _raw_spin_lock+0x25/0x30
+ ? mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib]
+ mlx5_cmd_get_srq+0x18/0x70 [mlx5_ib]
+ mlx5_ib_eqe_pf_action+0x257/0xa30 [mlx5_ib]
+ ? process_one_work+0x209/0x5f0
+ process_one_work+0x27b/0x5f0
+ ? __schedule+0x280/0x7e0
+ worker_thread+0x2d/0x3c0
+ ? process_one_work+0x5f0/0x5f0
+ kthread+0x111/0x130
+ ? kthread_park+0x90/0x90
+ ret_from_fork+0x24/0x30
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Link: https://lore.kernel.org/r/20200712102641.15210-1-leon@kernel.org
+Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/mlx5/srq_cmd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/srq_cmd.c b/drivers/infiniband/hw/mlx5/srq_cmd.c
+index 8fc3630a9d4c3..0224231a2e6f8 100644
+--- a/drivers/infiniband/hw/mlx5/srq_cmd.c
++++ b/drivers/infiniband/hw/mlx5/srq_cmd.c
+@@ -83,11 +83,11 @@ struct mlx5_core_srq *mlx5_cmd_get_srq(struct mlx5_ib_dev *dev, u32 srqn)
+ struct mlx5_srq_table *table = &dev->srq_table;
+ struct mlx5_core_srq *srq;
+
+- xa_lock(&table->array);
++ xa_lock_irq(&table->array);
+ srq = xa_load(&table->array, srqn);
+ if (srq)
+ refcount_inc(&srq->common.refcount);
+- xa_unlock(&table->array);
++ xa_unlock_irq(&table->array);
+
+ return srq;
+ }
+--
+2.25.1
+
--- /dev/null
+From 8d178d5dc81b7d0642fca36d81f3f7cb5578234c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jul 2020 12:33:15 +0200
+Subject: regmap: dev_get_regmap_match(): fix string comparison
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ]
+
+This function is used by dev_get_regmap() to retrieve a regmap for the
+specified device. If the device has more than one regmap, the name parameter
+can be used to specify one.
+
+The code here uses a pointer comparison to check for equal strings. This
+however will probably always fail, as the regmap->name is allocated via
+kstrdup_const() from the regmap's config->name.
+
+Fix this by using strcmp() instead.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Link: https://lore.kernel.org/r/20200703103315.267996-1-mkl@pengutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/base/regmap/regmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 320d23de02c29..927ebde1607be 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1363,7 +1363,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data)
+
+ /* If the user didn't specify a name match any */
+ if (data)
+- return (*r)->name == data;
++ return !strcmp((*r)->name, data);
+ else
+ return 1;
+ }
+--
+2.25.1
+
--- /dev/null
+From 71a084646f01f38d53a4f011b9d8d7c357203263 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jul 2020 17:21:28 -0500
+Subject: Revert "PCI/PM: Assume ports without DLL Link Active train links in
+ 100 ms"
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit d08c30d7a0d1826f771f16cde32bd86e48401791 ]
+
+This reverts commit ec411e02b7a2e785a4ed9ed283207cd14f48699d.
+
+Patrick reported that this commit broke hybrid graphics on a ThinkPad X1
+Extreme 2nd with Intel UHD Graphics 630 and NVIDIA GeForce GTX 1650 Mobile:
+
+ nouveau 0000:01:00.0: fifo: PBDMA0: 01000000 [] ch 0 [00ff992000 DRM] subc 0 mthd 0008 data 00000000
+
+Karol reported that this commit broke Nouveau firmware loading on a Lenovo
+P1G2 with Intel UHD Graphics 630 and NVIDIA TU117GLM [Quadro T1000 Mobile]:
+
+ nouveau 0000:01:00.0: acr: AHESASC binary failed
+
+In both cases, reverting ec411e02b7a2 solved the problem. Unfortunately,
+this revert will reintroduce the "Thunderbolt bridges take long time to
+resume from D3cold" problem:
+https://bugzilla.kernel.org/show_bug.cgi?id=206837
+
+Link: https://lore.kernel.org/r/CAErSpo5sTeK_my1dEhWp7aHD0xOp87+oHYWkTjbL7ALgDbXo-Q@mail.gmail.com
+Link: https://lore.kernel.org/r/CACO55tsAEa5GXw5oeJPG=mcn+qxNvspXreJYWDJGZBy5v82JDA@mail.gmail.com
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=208597
+Reported-by: Patrick Volkerding <volkerdi@gmail.com>
+Reported-by: Karol Herbst <kherbst@redhat.com>
+Fixes: ec411e02b7a2 ("PCI/PM: Assume ports without DLL Link Active train links in 100 ms")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pci/pci.c | 30 +++++++++---------------------
+ 1 file changed, 9 insertions(+), 21 deletions(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 08f7b1ed8c62e..b1b2c8ddbc927 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4610,8 +4610,7 @@ static int pci_pm_reset(struct pci_dev *dev, int probe)
+ * pcie_wait_for_link_delay - Wait until link is active or inactive
+ * @pdev: Bridge device
+ * @active: waiting for active or inactive?
+- * @delay: Delay to wait after link has become active (in ms). Specify %0
+- * for no delay.
++ * @delay: Delay to wait after link has become active (in ms)
+ *
+ * Use this to wait till link becomes active or inactive.
+ */
+@@ -4652,7 +4651,7 @@ static bool pcie_wait_for_link_delay(struct pci_dev *pdev, bool active,
+ msleep(10);
+ timeout -= 10;
+ }
+- if (active && ret && delay)
++ if (active && ret)
+ msleep(delay);
+ else if (ret != active)
+ pci_info(pdev, "Data Link Layer Link Active not %s in 1000 msec\n",
+@@ -4773,28 +4772,17 @@ void pci_bridge_wait_for_secondary_bus(struct pci_dev *dev)
+ if (!pcie_downstream_port(dev))
+ return;
+
+- /*
+- * Per PCIe r5.0, sec 6.6.1, for downstream ports that support
+- * speeds > 5 GT/s, we must wait for link training to complete
+- * before the mandatory delay.
+- *
+- * We can only tell when link training completes via DLL Link
+- * Active, which is required for downstream ports that support
+- * speeds > 5 GT/s (sec 7.5.3.6). Unfortunately some common
+- * devices do not implement Link Active reporting even when it's
+- * required, so we'll check for that directly instead of checking
+- * the supported link speed. We assume devices without Link Active
+- * reporting can train in 100 ms regardless of speed.
+- */
+- if (dev->link_active_reporting) {
+- pci_dbg(dev, "waiting for link to train\n");
+- if (!pcie_wait_for_link_delay(dev, true, 0)) {
++ if (pcie_get_speed_cap(dev) <= PCIE_SPEED_5_0GT) {
++ pci_dbg(dev, "waiting %d ms for downstream link\n", delay);
++ msleep(delay);
++ } else {
++ pci_dbg(dev, "waiting %d ms for downstream link, after activation\n",
++ delay);
++ if (!pcie_wait_for_link_delay(dev, true, delay)) {
+ /* Did not train, no need to wait any further */
+ return;
+ }
+ }
+- pci_dbg(child, "waiting %d ms to become accessible\n", delay);
+- msleep(delay);
+
+ if (!pci_device_is_present(child)) {
+ pci_dbg(child, "waiting additional %d ms to become accessible\n", delay);
+--
+2.25.1
+
--- /dev/null
+From 44a7befc50c576c0b61f95bb3964eb449cc21df3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jul 2020 11:57:26 -0700
+Subject: RISC-V: Upgrade smp_mb__after_spinlock() to iorw,iorw
+
+From: Palmer Dabbelt <palmerdabbelt@google.com>
+
+[ Upstream commit 38b7c2a3ffb1fce8358ddc6006cfe5c038ff9963 ]
+
+While digging through the recent mmiowb preemption issue it came up that
+we aren't actually preventing IO from crossing a scheduling boundary.
+While it's a bit ugly to overload smp_mb__after_spinlock() with this
+behavior, it's what PowerPC is doing so there's some precedent.
+
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/barrier.h | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/include/asm/barrier.h b/arch/riscv/include/asm/barrier.h
+index 3f1737f301ccb..d0e24aaa2aa06 100644
+--- a/arch/riscv/include/asm/barrier.h
++++ b/arch/riscv/include/asm/barrier.h
+@@ -58,8 +58,16 @@ do { \
+ * The AQ/RL pair provides a RCpc critical section, but there's not really any
+ * way we can take advantage of that here because the ordering is only enforced
+ * on that one lock. Thus, we're just doing a full fence.
++ *
++ * Since we allow writeX to be called from preemptive regions we need at least
++ * an "o" in the predecessor set to ensure device writes are visible before the
++ * task is marked as available for scheduling on a new hart. While I don't see
++ * any concrete reason we need a full IO fence, it seems safer to just upgrade
++ * this in order to avoid any IO crossing a scheduling boundary. In both
++ * instances the scheduler pairs this with an mb(), so nothing is necessary on
++ * the new hart.
+ */
+-#define smp_mb__after_spinlock() RISCV_FENCE(rw,rw)
++#define smp_mb__after_spinlock() RISCV_FENCE(iorw,iorw)
+
+ #include <asm-generic/barrier.h>
+
+--
+2.25.1
+
--- /dev/null
+From 3b65125d2229d621d6fa42e35e7f5a54d81224e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 21:15:43 -0700
+Subject: scripts/decode_stacktrace: strip basepath from all paths
+
+From: Pi-Hsun Shih <pihsun@chromium.org>
+
+[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ]
+
+Currently the basepath is removed only from the beginning of the string.
+When the symbol is inlined and there's multiple line outputs of
+addr2line, only the first line would have basepath removed.
+
+Change to remove the basepath prefix from all lines.
+
+Fixes: 31013836a71e ("scripts/decode_stacktrace: match basepath using shell prefix operator, not regex")
+Co-developed-by: Shik Chen <shik@chromium.org>
+Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org>
+Signed-off-by: Shik Chen <shik@chromium.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Cc: Sasha Levin <sashal@kernel.org>
+Cc: Nicolas Boichat <drinkcat@chromium.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Link: http://lkml.kernel.org/r/20200720082709.252805-1-pihsun@chromium.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/decode_stacktrace.sh | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh
+index 13e5fbafdf2f7..fe7076fdac8a3 100755
+--- a/scripts/decode_stacktrace.sh
++++ b/scripts/decode_stacktrace.sh
+@@ -84,8 +84,8 @@ parse_symbol() {
+ return
+ fi
+
+- # Strip out the base of the path
+- code=${code#$basepath/}
++ # Strip out the base of the path on each line
++ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code")
+
+ # In the case of inlines, move everything to same line
+ code=${code//$'\n'/' '}
+--
+2.25.1
+
--- /dev/null
+From 59b7afe3c06208862839f256e782211e1ad48837 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jul 2020 21:15:52 -0700
+Subject: scripts/gdb: fix lx-symbols 'gdb.error' while loading modules
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit 7359608a271ce81803de148befefd309baf88c76 ]
+
+Commit ed66f991bb19 ("module: Refactor section attr into bin attribute")
+removed the 'name' field from 'struct module_sect_attr' triggering the
+following error when invoking lx-symbols:
+
+ (gdb) lx-symbols
+ loading vmlinux
+ scanning for modules in linux/build
+ loading @0xffffffffc014f000: linux/build/drivers/net/tun.ko
+ Python Exception <class 'gdb.error'> There is no member named name.:
+ Error occurred in Python: There is no member named name.
+
+This patch fixes the issue taking the module name from the 'struct
+attribute'.
+
+Fixes: ed66f991bb19 ("module: Refactor section attr into bin attribute")
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Reviewed-by: Kieran Bingham <kbingham@kernel.org>
+Link: http://lkml.kernel.org/r/20200722102239.313231-1-sgarzare@redhat.com
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/symbols.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index be984aa29b759..1be9763cf8bb2 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -96,7 +96,7 @@ lx-symbols command."""
+ return ""
+ attrs = sect_attrs['attrs']
+ section_name_to_address = {
+- attrs[n]['name'].string(): attrs[n]['address']
++ attrs[n]['battr']['attr']['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
+--
+2.25.1
+
--- /dev/null
+From 05e6620fd6565abba16720496217d7e222cbfed3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jul 2020 16:11:24 -0400
+Subject: serial: exar: Fix GPIO configuration for Sealevel cards based on
+ XR17V35X
+
+From: Matthew Howell <matthew.howell@sealevel.com>
+
+[ Upstream commit 5fdbe136ae19ab751daaa4d08d9a42f3e30d17f9 ]
+
+Sealevel XR17V35X based devices are inoperable on kernel versions
+4.11 and above due to a change in the GPIO preconfiguration introduced in
+commit
+7dea8165f1d. This patch fixes this by preconfiguring the GPIO on Sealevel
+cards to the value (0x00) used prior to commit 7dea8165f1d
+
+With GPIOs preconfigured as per commit 7dea8165f1d all ports on
+Sealevel XR17V35X based devices become stuck in high impedance
+mode, regardless of dip-switch or software configuration. This
+causes the device to become effectively unusable. This patch (in
+various forms) has been distributed to our customers and no issues
+related to it have been reported.
+
+Fixes: 7dea8165f1d6 ("serial: exar: Preconfigure xr17v35x MPIOs as output")
+Signed-off-by: Matthew Howell <matthew.howell@sealevel.com>
+Link: https://lore.kernel.org/r/alpine.DEB.2.21.2007221605270.13247@tstest-VirtualBox
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tty/serial/8250/8250_exar.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c
+index e1268646ee562..9e2dbe43667ae 100644
+--- a/drivers/tty/serial/8250/8250_exar.c
++++ b/drivers/tty/serial/8250/8250_exar.c
+@@ -307,7 +307,17 @@ static void setup_gpio(struct pci_dev *pcidev, u8 __iomem *p)
+ * devices will export them as GPIOs, so we pre-configure them safely
+ * as inputs.
+ */
+- u8 dir = pcidev->vendor == PCI_VENDOR_ID_EXAR ? 0xff : 0x00;
++
++ u8 dir = 0x00;
++
++ if ((pcidev->vendor == PCI_VENDOR_ID_EXAR) &&
++ (pcidev->subsystem_vendor != PCI_VENDOR_ID_SEALEVEL)) {
++ // Configure GPIO as inputs for Commtech adapters
++ dir = 0xff;
++ } else {
++ // Configure GPIO as outputs for SeaLevel adapters
++ dir = 0x00;
++ }
+
+ writeb(0x00, p + UART_EXAR_MPIOINT_7_0);
+ writeb(0x00, p + UART_EXAR_MPIOLVL_7_0);
+--
+2.25.1
+
btrfs-fix-double-free-on-ulist-after-backref-resolution-failure.patch
btrfs-fix-mount-failure-caused-by-race-with-umount.patch
btrfs-fix-page-leaks-after-failure-to-lock-page-for-delalloc.patch
+bnxt_en-fix-race-when-modifying-pause-settings.patch
+bnxt_en-fix-completion-ring-sizing-with-tpa-enabled.patch
+fpga-dfl-pci-reduce-the-scope-of-variable-ret.patch
+fpga-dfl-fix-bug-in-port-reset-handshake.patch
+hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch
+vsock-virtio-annotate-the_virtio_vsock-rcu-pointer.patch
+ax88172a-fix-ax88172a_unbind-failures.patch
+rdma-mlx5-use-xa_lock_irq-when-access-to-srq-table.patch
+asoc-intel-bytcht_es8316-add-missed-put_device.patch
+net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch
+ieee802154-fix-one-possible-memleak-in-adf7242_probe.patch
+drm-sun4i-hdmi-fix-inverted-hpd-result.patch
+net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch
+bonding-check-error-value-of-register_netdevice-imme.patch
+mlxsw-destroy-workqueue-when-trap_register-in-mlxsw_.patch
+ionic-use-offset-for-ethtool-regs-data.patch
+ionic-fix-up-filter-locks-and-debug-msgs.patch
+net-ag71xx-add-missed-clk_disable_unprepare-in-error.patch
+net-hns3-fix-error-handling-for-desc-filling.patch
+net-dsa-microchip-call-phy_remove_link_mode-during-p.patch
+netdevsim-fix-unbalaced-locking-in-nsim_create.patch
+qed-suppress-don-t-support-roce-iwarp-flooding-on-hw.patch
+qed-suppress-false-positives-interrupt-error-message.patch
+ipvs-fix-the-connection-sync-failed-in-some-cases.patch
+net-ethernet-ave-fix-error-returns-in-ave_init.patch
+revert-pci-pm-assume-ports-without-dll-link-active-t.patch
+nfsd4-fix-null-dereference-in-nfsd-clients-display-c.patch
+enetc-remove-the-mdio-bus-on-pf-probe-bailout.patch
+i2c-rcar-always-clear-icsar-to-avoid-side-effects.patch
+i2c-i2c-qcom-geni-fix-dma-transfer-race.patch
+bonding-check-return-value-of-register_netdevice-in-.patch
+geneve-fix-an-uninitialized-value-in-geneve_changeli.patch
+serial-exar-fix-gpio-configuration-for-sealevel-card.patch
+scripts-decode_stacktrace-strip-basepath-from-all-pa.patch
+scripts-gdb-fix-lx-symbols-gdb.error-while-loading-m.patch
+hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch
+hid-alps-support-devices-with-report-id-2.patch
+hid-steam-fixes-race-in-handling-device-list.patch
+hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch
+dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch
+input-add-sw_machine_cover.patch
+arm-dts-n900-remove-mmc1-card-detect-gpio.patch
+spi-mediatek-use-correct-spi_cfg2_reg-macro.patch
+regmap-dev_get_regmap_match-fix-string-comparison.patch
+hwmon-aspeed-pwm-tacho-avoid-possible-buffer-overflo.patch
+dmaengine-fsl-edma-fix-wrong-tcd-endianness-for-big-.patch
+dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch
+input-synaptics-enable-intertouch-for-thinkpad-x1e-1.patch
+input-elan_i2c-only-increment-wakeup-count-on-touch.patch
+usb-dwc3-pci-add-support-for-the-intel-tiger-lake-pc.patch
+usb-dwc3-pci-add-support-for-the-intel-jasper-lake.patch
+usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch
+usb-cdns3-ep0-fix-some-endian-issues.patch
+usb-cdns3-trace-fix-some-endian-issues.patch
+hwmon-adm1275-make-sure-we-are-reading-enough-data-f.patch
+drm-amdgpu-gfx10-fix-race-condition-for-kiq.patch
+drm-amdgpu-fix-preemption-unit-test.patch
+hwmon-nct6775-accept-peci-calibration-as-temperature.patch
+platform-x86-isst-add-new-pci-device-ids.patch
+platform-x86-asus-wmi-allow-bat1-battery-name.patch
+hwmon-scmi-fix-potential-buffer-overflow-in-scmi_hwm.patch
+alsa-hda-realtek-fixup-for-yet-another-intel-referen.patch
+drivers-perf-fix-kernel-panic-when-rmmod-pmu-modules.patch
+arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch
+x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch
+asm-generic-mmiowb-allow-mmiowb_set_pending-when-pre.patch
+drivers-perf-prevent-forced-unbinding-of-pmu-drivers.patch
+risc-v-upgrade-smp_mb__after_spinlock-to-iorw-iorw.patch
--- /dev/null
+From d44ffeb954ddd0d5b56f0f497c02fb0da727ac17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 1 Jul 2020 17:00:20 +0800
+Subject: spi: mediatek: use correct SPI_CFG2_REG MACRO
+
+From: leilk.liu <leilk.liu@mediatek.com>
+
+[ Upstream commit 44b37eb79e16a56cb30ba55b2da452396b941e7a ]
+
+this patch use correct SPI_CFG2_REG offset.
+
+Signed-off-by: leilk.liu <leilk.liu@mediatek.com>
+Link: https://lore.kernel.org/r/20200701090020.7935-1-leilk.liu@mediatek.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-mt65xx.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/spi/spi-mt65xx.c b/drivers/spi/spi-mt65xx.c
+index 6888a4dcff6de..8acf24f7c5d40 100644
+--- a/drivers/spi/spi-mt65xx.c
++++ b/drivers/spi/spi-mt65xx.c
+@@ -36,7 +36,6 @@
+ #define SPI_CFG0_SCK_LOW_OFFSET 8
+ #define SPI_CFG0_CS_HOLD_OFFSET 16
+ #define SPI_CFG0_CS_SETUP_OFFSET 24
+-#define SPI_ADJUST_CFG0_SCK_LOW_OFFSET 16
+ #define SPI_ADJUST_CFG0_CS_HOLD_OFFSET 0
+ #define SPI_ADJUST_CFG0_CS_SETUP_OFFSET 16
+
+@@ -48,6 +47,8 @@
+ #define SPI_CFG1_CS_IDLE_MASK 0xff
+ #define SPI_CFG1_PACKET_LOOP_MASK 0xff00
+ #define SPI_CFG1_PACKET_LENGTH_MASK 0x3ff0000
++#define SPI_CFG2_SCK_HIGH_OFFSET 0
++#define SPI_CFG2_SCK_LOW_OFFSET 16
+
+ #define SPI_CMD_ACT BIT(0)
+ #define SPI_CMD_RESUME BIT(1)
+@@ -279,7 +280,7 @@ static void mtk_spi_set_cs(struct spi_device *spi, bool enable)
+ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ struct spi_transfer *xfer)
+ {
+- u32 spi_clk_hz, div, sck_time, cs_time, reg_val = 0;
++ u32 spi_clk_hz, div, sck_time, cs_time, reg_val;
+ struct mtk_spi *mdata = spi_master_get_devdata(master);
+
+ spi_clk_hz = clk_get_rate(mdata->spi_clk);
+@@ -292,18 +293,18 @@ static void mtk_spi_prepare_transfer(struct spi_master *master,
+ cs_time = sck_time * 2;
+
+ if (mdata->dev_comp->enhance_timing) {
++ reg_val = (((sck_time - 1) & 0xffff)
++ << SPI_CFG2_SCK_HIGH_OFFSET);
+ reg_val |= (((sck_time - 1) & 0xffff)
+- << SPI_CFG0_SCK_HIGH_OFFSET);
+- reg_val |= (((sck_time - 1) & 0xffff)
+- << SPI_ADJUST_CFG0_SCK_LOW_OFFSET);
++ << SPI_CFG2_SCK_LOW_OFFSET);
+ writel(reg_val, mdata->base + SPI_CFG2_REG);
+- reg_val |= (((cs_time - 1) & 0xffff)
++ reg_val = (((cs_time - 1) & 0xffff)
+ << SPI_ADJUST_CFG0_CS_HOLD_OFFSET);
+ reg_val |= (((cs_time - 1) & 0xffff)
+ << SPI_ADJUST_CFG0_CS_SETUP_OFFSET);
+ writel(reg_val, mdata->base + SPI_CFG0_REG);
+ } else {
+- reg_val |= (((sck_time - 1) & 0xff)
++ reg_val = (((sck_time - 1) & 0xff)
+ << SPI_CFG0_SCK_HIGH_OFFSET);
+ reg_val |= (((sck_time - 1) & 0xff) << SPI_CFG0_SCK_LOW_OFFSET);
+ reg_val |= (((cs_time - 1) & 0xff) << SPI_CFG0_CS_HOLD_OFFSET);
+--
+2.25.1
+
--- /dev/null
+From e2f60573e3b41fec4d4650b639e65f33285d6191 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 14:53:54 +0800
+Subject: usb: cdns3: ep0: fix some endian issues
+
+From: Peter Chen <peter.chen@nxp.com>
+
+[ Upstream commit 9f81d45c79271def8a9b90447b04b9c6323291f9 ]
+
+It is found by sparse.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/ep0.c | 30 +++++++++++++++---------------
+ 1 file changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/usb/cdns3/ep0.c b/drivers/usb/cdns3/ep0.c
+index da4c5eb03d7ee..666cebd9c5f29 100644
+--- a/drivers/usb/cdns3/ep0.c
++++ b/drivers/usb/cdns3/ep0.c
+@@ -37,18 +37,18 @@ static void cdns3_ep0_run_transfer(struct cdns3_device *priv_dev,
+ struct cdns3_usb_regs __iomem *regs = priv_dev->regs;
+ struct cdns3_endpoint *priv_ep = priv_dev->eps[0];
+
+- priv_ep->trb_pool[0].buffer = TRB_BUFFER(dma_addr);
+- priv_ep->trb_pool[0].length = TRB_LEN(length);
++ priv_ep->trb_pool[0].buffer = cpu_to_le32(TRB_BUFFER(dma_addr));
++ priv_ep->trb_pool[0].length = cpu_to_le32(TRB_LEN(length));
+
+ if (zlp) {
+- priv_ep->trb_pool[0].control = TRB_CYCLE | TRB_TYPE(TRB_NORMAL);
+- priv_ep->trb_pool[1].buffer = TRB_BUFFER(dma_addr);
+- priv_ep->trb_pool[1].length = TRB_LEN(0);
+- priv_ep->trb_pool[1].control = TRB_CYCLE | TRB_IOC |
+- TRB_TYPE(TRB_NORMAL);
++ priv_ep->trb_pool[0].control = cpu_to_le32(TRB_CYCLE | TRB_TYPE(TRB_NORMAL));
++ priv_ep->trb_pool[1].buffer = cpu_to_le32(TRB_BUFFER(dma_addr));
++ priv_ep->trb_pool[1].length = cpu_to_le32(TRB_LEN(0));
++ priv_ep->trb_pool[1].control = cpu_to_le32(TRB_CYCLE | TRB_IOC |
++ TRB_TYPE(TRB_NORMAL));
+ } else {
+- priv_ep->trb_pool[0].control = TRB_CYCLE | TRB_IOC |
+- TRB_TYPE(TRB_NORMAL);
++ priv_ep->trb_pool[0].control = cpu_to_le32(TRB_CYCLE | TRB_IOC |
++ TRB_TYPE(TRB_NORMAL));
+ priv_ep->trb_pool[1].control = 0;
+ }
+
+@@ -264,11 +264,11 @@ static int cdns3_req_ep0_get_status(struct cdns3_device *priv_dev,
+ case USB_RECIP_INTERFACE:
+ return cdns3_ep0_delegate_req(priv_dev, ctrl);
+ case USB_RECIP_ENDPOINT:
+- index = cdns3_ep_addr_to_index(ctrl->wIndex);
++ index = cdns3_ep_addr_to_index(le16_to_cpu(ctrl->wIndex));
+ priv_ep = priv_dev->eps[index];
+
+ /* check if endpoint is stalled or stall is pending */
+- cdns3_select_ep(priv_dev, ctrl->wIndex);
++ cdns3_select_ep(priv_dev, le16_to_cpu(ctrl->wIndex));
+ if (EP_STS_STALL(readl(&priv_dev->regs->ep_sts)) ||
+ (priv_ep->flags & EP_STALL_PENDING))
+ usb_status = BIT(USB_ENDPOINT_HALT);
+@@ -388,10 +388,10 @@ static int cdns3_ep0_feature_handle_endpoint(struct cdns3_device *priv_dev,
+ if (!(ctrl->wIndex & ~USB_DIR_IN))
+ return 0;
+
+- index = cdns3_ep_addr_to_index(ctrl->wIndex);
++ index = cdns3_ep_addr_to_index(le16_to_cpu(ctrl->wIndex));
+ priv_ep = priv_dev->eps[index];
+
+- cdns3_select_ep(priv_dev, ctrl->wIndex);
++ cdns3_select_ep(priv_dev, le16_to_cpu(ctrl->wIndex));
+
+ if (set)
+ __cdns3_gadget_ep_set_halt(priv_ep);
+@@ -452,7 +452,7 @@ static int cdns3_req_ep0_set_sel(struct cdns3_device *priv_dev,
+ if (priv_dev->gadget.state < USB_STATE_ADDRESS)
+ return -EINVAL;
+
+- if (ctrl_req->wLength != 6) {
++ if (le16_to_cpu(ctrl_req->wLength) != 6) {
+ dev_err(priv_dev->dev, "Set SEL should be 6 bytes, got %d\n",
+ ctrl_req->wLength);
+ return -EINVAL;
+@@ -476,7 +476,7 @@ static int cdns3_req_ep0_set_isoch_delay(struct cdns3_device *priv_dev,
+ if (ctrl_req->wIndex || ctrl_req->wLength)
+ return -EINVAL;
+
+- priv_dev->isoch_delay = ctrl_req->wValue;
++ priv_dev->isoch_delay = le16_to_cpu(ctrl_req->wValue);
+
+ return 0;
+ }
+--
+2.25.1
+
--- /dev/null
+From f4ede199b78b1f1c7eda68771b3cb79dbb68c76d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 3 Jun 2020 14:53:55 +0800
+Subject: usb: cdns3: trace: fix some endian issues
+
+From: Peter Chen <peter.chen@nxp.com>
+
+[ Upstream commit 65b7cf48c211ece5e2560a334eb9608e48775a8f ]
+
+It is found by sparse.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/cdns3/trace.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/cdns3/trace.h b/drivers/usb/cdns3/trace.h
+index 7cc8bebaa07da..f8482456116e8 100644
+--- a/drivers/usb/cdns3/trace.h
++++ b/drivers/usb/cdns3/trace.h
+@@ -333,9 +333,9 @@ DECLARE_EVENT_CLASS(cdns3_log_trb,
+ TP_fast_assign(
+ __assign_str(name, priv_ep->name);
+ __entry->trb = trb;
+- __entry->buffer = trb->buffer;
+- __entry->length = trb->length;
+- __entry->control = trb->control;
++ __entry->buffer = le32_to_cpu(trb->buffer);
++ __entry->length = le32_to_cpu(trb->length);
++ __entry->control = le32_to_cpu(trb->control);
+ __entry->type = usb_endpoint_type(priv_ep->endpoint.desc);
+ ),
+ TP_printk("%s: trb %p, dma buf: 0x%08x, size: %ld, burst: %d ctrl: 0x%08x (%s%s%s%s%s%s%s)",
+--
+2.25.1
+
--- /dev/null
+From bc3b6239b111fd874e336914ee626f25e8b7a405 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 30 Jun 2020 15:24:59 +0300
+Subject: usb: dwc3: pci: add support for the Intel Jasper Lake
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit e25d1e8532c3d84f075deca1580a7d61e0f43ce6 ]
+
+This patch adds the necessary PCI ID for Intel Jasper Lake
+devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 47b7e83d90626..139474c3e77b1 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -39,6 +39,7 @@
+ #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e
+ #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee
+ #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee
++#define PCI_DEVICE_ID_INTEL_JSP 0x4dee
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR 4
+@@ -362,6 +363,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB),
+ (kernel_ulong_t) &dwc3_pci_amd_properties, },
+ { } /* Terminating Entry */
+--
+2.25.1
+
--- /dev/null
+From 5617cc0c09e44bc3d4afa76924923bf323178f08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 10:34:32 +0300
+Subject: usb: dwc3: pci: add support for the Intel Tiger Lake PCH -H variant
+
+From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+
+[ Upstream commit c3f595a8119207cc0f82b3dc6ec5bbf6f3e6b135 ]
+
+This patch adds the necessary PCI ID for TGP-H devices.
+
+Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
+index 96c05b121fac8..47b7e83d90626 100644
+--- a/drivers/usb/dwc3/dwc3-pci.c
++++ b/drivers/usb/dwc3/dwc3-pci.c
+@@ -38,6 +38,7 @@
+ #define PCI_DEVICE_ID_INTEL_ICLLP 0x34ee
+ #define PCI_DEVICE_ID_INTEL_EHLLP 0x4b7e
+ #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee
++#define PCI_DEVICE_ID_INTEL_TGPH 0x43ee
+
+ #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511"
+ #define PCI_INTEL_BXT_FUNC_PMU_PWR 4
+@@ -358,6 +359,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPLP),
+ (kernel_ulong_t) &dwc3_pci_intel_properties, },
+
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_TGPH),
++ (kernel_ulong_t) &dwc3_pci_intel_properties, },
++
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB),
+ (kernel_ulong_t) &dwc3_pci_amd_properties, },
+ { } /* Terminating Entry */
+--
+2.25.1
+
--- /dev/null
+From 7f8cd29b53e19742b53b17f2f36f7e77711d9182 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jun 2020 16:17:47 +0300
+Subject: usb: gadget: udc: gr_udc: fix memleak on error handling path in
+ gr_ep_init()
+
+From: Evgeny Novikov <novikov@ispras.ru>
+
+[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ]
+
+gr_ep_init() does not assign the allocated request anywhere if allocation
+of memory for the buffer fails. This is a memory leak fixed by the given
+patch.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/gadget/udc/gr_udc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
+index 116d386472efe..da73a06c20a39 100644
+--- a/drivers/usb/gadget/udc/gr_udc.c
++++ b/drivers/usb/gadget/udc/gr_udc.c
+@@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)
+
+ if (num == 0) {
+ _req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
++ if (!_req)
++ return -ENOMEM;
++
+ buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
+- if (!_req || !buf) {
+- /* possible _req freed by gr_probe via gr_remove */
++ if (!buf) {
++ gr_free_request(&ep->ep, _req);
+ return -ENOMEM;
+ }
+
+--
+2.25.1
+
--- /dev/null
+From cd231f9fde8ee9d997db77b69683199e8e870e9b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jul 2020 14:12:43 +0200
+Subject: vsock/virtio: annotate 'the_virtio_vsock' RCU pointer
+
+From: Stefano Garzarella <sgarzare@redhat.com>
+
+[ Upstream commit f961134a612c793d5901a93d85a29337c74af978 ]
+
+Commit 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free
+on the_virtio_vsock") starts to use RCU to protect 'the_virtio_vsock'
+pointer, but we forgot to annotate it.
+
+This patch adds the annotation to fix the following sparse errors:
+
+ net/vmw_vsock/virtio_transport.c:73:17: error: incompatible types in comparison expression (different address spaces):
+ net/vmw_vsock/virtio_transport.c:73:17: struct virtio_vsock [noderef] __rcu *
+ net/vmw_vsock/virtio_transport.c:73:17: struct virtio_vsock *
+ net/vmw_vsock/virtio_transport.c:171:17: error: incompatible types in comparison expression (different address spaces):
+ net/vmw_vsock/virtio_transport.c:171:17: struct virtio_vsock [noderef] __rcu *
+ net/vmw_vsock/virtio_transport.c:171:17: struct virtio_vsock *
+ net/vmw_vsock/virtio_transport.c:207:17: error: incompatible types in comparison expression (different address spaces):
+ net/vmw_vsock/virtio_transport.c:207:17: struct virtio_vsock [noderef] __rcu *
+ net/vmw_vsock/virtio_transport.c:207:17: struct virtio_vsock *
+ net/vmw_vsock/virtio_transport.c:561:13: error: incompatible types in comparison expression (different address spaces):
+ net/vmw_vsock/virtio_transport.c:561:13: struct virtio_vsock [noderef] __rcu *
+ net/vmw_vsock/virtio_transport.c:561:13: struct virtio_vsock *
+ net/vmw_vsock/virtio_transport.c:612:9: error: incompatible types in comparison expression (different address spaces):
+ net/vmw_vsock/virtio_transport.c:612:9: struct virtio_vsock [noderef] __rcu *
+ net/vmw_vsock/virtio_transport.c:612:9: struct virtio_vsock *
+ net/vmw_vsock/virtio_transport.c:631:9: error: incompatible types in comparison expression (different address spaces):
+ net/vmw_vsock/virtio_transport.c:631:9: struct virtio_vsock [noderef] __rcu *
+ net/vmw_vsock/virtio_transport.c:631:9: struct virtio_vsock *
+
+Fixes: 0deab087b16a ("vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock")
+Reported-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/virtio_transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 082a309366905..861ec9a671f9d 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -22,7 +22,7 @@
+ #include <net/af_vsock.h>
+
+ static struct workqueue_struct *virtio_vsock_workqueue;
+-static struct virtio_vsock *the_virtio_vsock;
++static struct virtio_vsock __rcu *the_virtio_vsock;
+ static DEFINE_MUTEX(the_virtio_vsock_mutex); /* protects the_virtio_vsock */
+
+ struct virtio_vsock {
+--
+2.25.1
+
--- /dev/null
+From 4c8c0d023722624eb8101abdfe835d1132caf982 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 May 2020 15:53:46 +0200
+Subject: x86: math-emu: Fix up 'cmp' insn for clang ias
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ]
+
+The clang integrated assembler requires the 'cmp' instruction to
+have a length prefix here:
+
+arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl')
+ cmp $0xffffffff,-24(%ebp)
+ ^
+
+Make this a 32-bit comparison, which it was clearly meant to be.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lkml.kernel.org/r/20200527135352.1198078-1-arnd@arndb.de
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/math-emu/wm_sqrt.S | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S
+index f031c0e193565..515cdee90df72 100644
+--- a/arch/x86/math-emu/wm_sqrt.S
++++ b/arch/x86/math-emu/wm_sqrt.S
+@@ -209,7 +209,7 @@ sqrt_stage_2_finish:
+
+ #ifdef PARANOID
+ /* It should be possible to get here only if the arg is ffff....ffff */
+- cmp $0xffffffff,FPU_fsqrt_arg_1
++ cmpl $0xffffffff,FPU_fsqrt_arg_1
+ jnz sqrt_stage_2_error
+ #endif /* PARANOID */
+
+--
+2.25.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
