--- /dev/null
+From 80fb18c08e45512818d7d0fabad6ecbe4f448454 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 20:22:56 +0200
+Subject: Added QUIRKs for ADATA XPG SX8200 Pro 512GB
+
+From: Gabriel Craciunescu <nix.or.die@gmail.com>
+
+[ Upstream commit f03e42c6af60f778a6d1ccfb857db9b2ec835279 ]
+
+Booting with default_ps_max_latency_us >6000 makes the device fail.
+Also SUBNQN is NULL and gives a warning on each boot/resume.
+ $ nvme id-ctrl /dev/nvme0 | grep ^subnqn
+ subnqn : (null)
+
+I use this device with an Acer Nitro 5 (AN515-43-R8BF) Laptop.
+To be sure is not a Laptop issue only, I tested the device on
+my server board with the same results.
+( with 2x,4x link on the board and 4x link on a PCI-E card ).
+
+Signed-off-by: Gabriel Craciunescu <nix.or.die@gmail.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 19458e85dab34..86763969e7cb0 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3041,6 +3041,9 @@ static const struct pci_device_id nvme_id_table[] = {
+ .driver_data = NVME_QUIRK_LIGHTNVM, },
+ { PCI_DEVICE(0x10ec, 0x5762), /* ADATA SX6000LNP */
+ .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++ { PCI_DEVICE(0x1cc1, 0x8201), /* ADATA SX8200PNP 512GB */
++ .driver_data = NVME_QUIRK_NO_DEEPEST_PS |
++ NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
+ { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
+--
+2.20.1
+
--- /dev/null
+From d429af4978e3b6ebc4eaa1d281a093954a217d2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 11:54:50 +0300
+Subject: ARM: dts: am4372: Set memory bandwidth limit for DISPC
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit f90ec6cdf674248dcad85bf9af6e064bf472b841 ]
+
+Set memory bandwidth limit to filter out resolutions above 720p@60Hz to
+avoid underflow errors due to the bandwidth needs of higher resolutions.
+
+am43xx can not provide enough bandwidth to DISPC to correctly handle
+'high' resolutions.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am4372.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
+index 848e2a8884e2c..14bbc438055fd 100644
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -337,6 +337,8 @@
+ ti,hwmods = "dss_dispc";
+ clocks = <&disp_clk>;
+ clock-names = "fck";
++
++ max-memory-bandwidth = <230000000>;
+ };
+
+ rfbi: rfbi@4832a800 {
+--
+2.20.1
+
--- /dev/null
+From 19ee4c5d542c993607e795a63d6fc8e44db3cba7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 09:24:28 -0700
+Subject: ARM: dts: Fix gpio0 flags for am335x-icev2
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 4ef5d76b453908f21341e661a9b6f96862f6f589 ]
+
+The ti,no-idle-on-init and ti,no-reset-on-init flags need to be at
+the interconnect target module level for the modules that have it
+defined. Otherwise we get the following warnings:
+
+dts flag should be at module level for ti,no-idle-on-init
+dts flag should be at module level for ti,no-reset-on-init
+
+Fixes: 87fc89ced3a7 ("ARM: dts: am335x: Move l4 child devices to probe them with ti-sysc")
+Cc: Lokesh Vutla <lokeshvutla@ti.com>
+Reported-by: Suman Anna <s-anna@ti.com>
+Reviewed-by: Lokesh Vutla <lokeshvutla@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-icev2.dts | 2 +-
+ arch/arm/boot/dts/am33xx-l4.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am335x-icev2.dts b/arch/arm/boot/dts/am335x-icev2.dts
+index 18f70b35da4c7..204bccfcc110a 100644
+--- a/arch/arm/boot/dts/am335x-icev2.dts
++++ b/arch/arm/boot/dts/am335x-icev2.dts
+@@ -432,7 +432,7 @@
+ pinctrl-0 = <&mmc0_pins_default>;
+ };
+
+-&gpio0 {
++&gpio0_target {
+ /* Do not idle the GPIO used for holding the VTT regulator */
+ ti,no-reset-on-init;
+ ti,no-idle-on-init;
+diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi
+index 46849d6ecb3e2..1515f4f914999 100644
+--- a/arch/arm/boot/dts/am33xx-l4.dtsi
++++ b/arch/arm/boot/dts/am33xx-l4.dtsi
+@@ -127,7 +127,7 @@
+ ranges = <0x0 0x5000 0x1000>;
+ };
+
+- target-module@7000 { /* 0x44e07000, ap 14 20.0 */
++ gpio0_target: target-module@7000 { /* 0x44e07000, ap 14 20.0 */
+ compatible = "ti,sysc-omap2", "ti,sysc";
+ ti,hwmods = "gpio1";
+ reg = <0x7000 0x4>,
+--
+2.20.1
+
--- /dev/null
+From ebf28cdf81d47740dd45efed5c5f00c8328ffa0a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 10:32:38 -0700
+Subject: ARM: dts: Fix wrong clocks for dra7 mcasp
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 2d3c8ba3cffa00f76bedb713c8c2126c82d8cd13 ]
+
+The ahclkr clkctrl clock bit 28 only exists for mcasp 1 and 2 on dra7.
+This causes the following warning on beagle-x15:
+
+ti-sysc 48468000.target-module: could not add child clock ahclkr: -19
+
+Also the mcasp clkctrl clock bits are wrong:
+
+For mcasp1 and 2 we have four clocks at bits 28, 24, 22 and 0:
+
+bit 28 is ahclkr
+bit 24 is ahclkx
+bit 22 is auxclk
+bit 0 is fck
+
+For mcasp3 to 8 we have three clocks at bits 24, 22 and 0.
+
+bit 24 is ahclkx
+bit 22 is auxclk
+bit 0 is fck
+
+We do not have currently mapped auxclk at bit 22 for the drivers, that can
+be added if needed.
+
+Fixes: 5241ccbf2819 ("ARM: dts: Add missing ranges for dra7 mcasp l3 ports")
+Cc: Suman Anna <s-anna@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/dra7-l4.dtsi | 48 +++++++++++++++-------------------
+ 1 file changed, 21 insertions(+), 27 deletions(-)
+
+diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi
+index 21e5914fdd620..099d6fe2a57ad 100644
+--- a/arch/arm/boot/dts/dra7-l4.dtsi
++++ b/arch/arm/boot/dts/dra7-l4.dtsi
+@@ -2762,7 +2762,7 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 129 1>, <&edma_xbar 128 1>;
+ dma-names = "tx", "rx";
+- clocks = <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 22>,
++ clocks = <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 0>,
+ <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 24>,
+ <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 28>;
+ clock-names = "fck", "ahclkx", "ahclkr";
+@@ -2799,8 +2799,8 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 131 1>, <&edma_xbar 130 1>;
+ dma-names = "tx", "rx";
+- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 22>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 24>,
++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 0>,
++ <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 24>,
+ <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 28>;
+ clock-names = "fck", "ahclkx", "ahclkr";
+ status = "disabled";
+@@ -2818,9 +2818,8 @@
+ <SYSC_IDLE_SMART>;
+ /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 0>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 28>;
+- clock-names = "fck", "ahclkx", "ahclkr";
++ <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>;
++ clock-names = "fck", "ahclkx";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x68000 0x2000>,
+@@ -2836,7 +2835,7 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 133 1>, <&edma_xbar 132 1>;
+ dma-names = "tx", "rx";
+- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 22>,
++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 0>,
+ <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>;
+ clock-names = "fck", "ahclkx";
+ status = "disabled";
+@@ -2854,9 +2853,8 @@
+ <SYSC_IDLE_SMART>;
+ /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 0>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 28>;
+- clock-names = "fck", "ahclkx", "ahclkr";
++ <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>;
++ clock-names = "fck", "ahclkx";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x6c000 0x2000>,
+@@ -2872,7 +2870,7 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 135 1>, <&edma_xbar 134 1>;
+ dma-names = "tx", "rx";
+- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 22>,
++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 0>,
+ <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>;
+ clock-names = "fck", "ahclkx";
+ status = "disabled";
+@@ -2890,9 +2888,8 @@
+ <SYSC_IDLE_SMART>;
+ /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 0>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 28>;
+- clock-names = "fck", "ahclkx", "ahclkr";
++ <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>;
++ clock-names = "fck", "ahclkx";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x70000 0x2000>,
+@@ -2908,7 +2905,7 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 137 1>, <&edma_xbar 136 1>;
+ dma-names = "tx", "rx";
+- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 22>,
++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 0>,
+ <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>;
+ clock-names = "fck", "ahclkx";
+ status = "disabled";
+@@ -2926,9 +2923,8 @@
+ <SYSC_IDLE_SMART>;
+ /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 0>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 28>;
+- clock-names = "fck", "ahclkx", "ahclkr";
++ <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>;
++ clock-names = "fck", "ahclkx";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x74000 0x2000>,
+@@ -2944,7 +2940,7 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 139 1>, <&edma_xbar 138 1>;
+ dma-names = "tx", "rx";
+- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 22>,
++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 0>,
+ <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>;
+ clock-names = "fck", "ahclkx";
+ status = "disabled";
+@@ -2962,9 +2958,8 @@
+ <SYSC_IDLE_SMART>;
+ /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 0>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 28>;
+- clock-names = "fck", "ahclkx", "ahclkr";
++ <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>;
++ clock-names = "fck", "ahclkx";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x78000 0x2000>,
+@@ -2980,7 +2975,7 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 141 1>, <&edma_xbar 140 1>;
+ dma-names = "tx", "rx";
+- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 22>,
++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 0>,
+ <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>;
+ clock-names = "fck", "ahclkx";
+ status = "disabled";
+@@ -2998,9 +2993,8 @@
+ <SYSC_IDLE_SMART>;
+ /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */
+ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 0>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>,
+- <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 28>;
+- clock-names = "fck", "ahclkx", "ahclkr";
++ <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>;
++ clock-names = "fck", "ahclkx";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ ranges = <0x0 0x7c000 0x2000>,
+@@ -3016,7 +3010,7 @@
+ interrupt-names = "tx", "rx";
+ dmas = <&edma_xbar 143 1>, <&edma_xbar 142 1>;
+ dma-names = "tx", "rx";
+- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 22>,
++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 0>,
+ <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>;
+ clock-names = "fck", "ahclkx";
+ status = "disabled";
+--
+2.20.1
+
--- /dev/null
+From 53a8efe3a426c5c879fedb60a6c9b80172f82674 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 09:25:51 -0700
+Subject: ARM: OMAP2+: Add missing LCDC midlemode for am335x
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 17529d43b21c72466e9109d602c6f5c360a1a9e8 ]
+
+TRM "Table 13-34. SYSCONFIG Register Field Descriptions" lists both
+standbymode and idlemode that should be just the sidle and midle
+registers where midle is currently unconfigured for lcdc_sysc. As
+the dts data has been generated based on lcdc_sysc, we now have an
+empty "ti,sysc-midle" property.
+
+And so we currently get a warning for lcdc because of a difference
+with dts provided configuration compared to the legacy platform
+data. This is because lcdc has SYSC_HAS_MIDLEMODE configured in
+the platform data without configuring the modes.
+
+Let's fix the issue by adding the missing midlemode to lcdc_sysc,
+and configuring the "ti,sysc-midle" property based on the TRM
+values.
+
+Fixes: f711c575cfec ("ARM: dts: am335x: Add l4 interconnect hierarchy and ti-sysc data")
+Cc: Jyri Sarha <jsarha@ti.com>
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Robert Nelson <robertcnelson@gmail.com>
+Cc: Suman Anna <s-anna@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am33xx-l4.dtsi | 4 +++-
+ arch/arm/mach-omap2/omap_hwmod_33xx_data.c | 5 +++--
+ 2 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi
+index 1515f4f914999..3287cf695b5a4 100644
+--- a/arch/arm/boot/dts/am33xx-l4.dtsi
++++ b/arch/arm/boot/dts/am33xx-l4.dtsi
+@@ -2038,7 +2038,9 @@
+ reg = <0xe000 0x4>,
+ <0xe054 0x4>;
+ reg-names = "rev", "sysc";
+- ti,sysc-midle ;
++ ti,sysc-midle = <SYSC_IDLE_FORCE>,
++ <SYSC_IDLE_NO>,
++ <SYSC_IDLE_SMART>;
+ ti,sysc-sidle = <SYSC_IDLE_FORCE>,
+ <SYSC_IDLE_NO>,
+ <SYSC_IDLE_SMART>;
+diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
+index c965af275e341..81d9912f17c85 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c
+@@ -231,8 +231,9 @@ static struct omap_hwmod am33xx_control_hwmod = {
+ static struct omap_hwmod_class_sysconfig lcdc_sysc = {
+ .rev_offs = 0x0,
+ .sysc_offs = 0x54,
+- .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_MIDLEMODE),
+- .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
++ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_MIDLEMODE,
++ .idlemodes = SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
++ MSTANDBY_FORCE | MSTANDBY_NO | MSTANDBY_SMART,
+ .sysc_fields = &omap_hwmod_sysc_type2,
+ };
+
+--
+2.20.1
+
--- /dev/null
+From be4b7e0198902d95c58948006237a8d100a52652 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 09:25:52 -0700
+Subject: ARM: OMAP2+: Fix missing reset done flag for am3 and am43
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 8ad8041b98c665b6147e607b749586d6e20ba73a ]
+
+For ti,sysc-omap4 compatible devices with no sysstatus register, we do have
+reset done status available in the SOFTRESET bit that clears when the reset
+is done. This is documented for example in am437x TRM for DMTIMER_TIOCP_CFG
+register. The am335x TRM just says that SOFTRESET bit value 1 means reset is
+ongoing, but it behaves the same way clearing after reset is done.
+
+With the ti-sysc driver handling this automatically based on no sysstatus
+register defined, we see warnings if SYSC_HAS_RESET_STATUS is missing in the
+legacy platform data:
+
+ti-sysc 48042000.target-module: sysc_flags 00000222 != 00000022
+ti-sysc 48044000.target-module: sysc_flags 00000222 != 00000022
+ti-sysc 48046000.target-module: sysc_flags 00000222 != 00000022
+...
+
+Let's fix these warnings by adding SYSC_HAS_RESET_STATUS. Let's also
+remove the useless parentheses while at it.
+
+If it turns out we do have ti,sysc-omap4 compatible devices without a
+working SOFTRESET bit we can set up additional quirk handling for it.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+index adb6271f819be..7773876d165f1 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
+@@ -811,7 +811,8 @@ static struct omap_hwmod_class_sysconfig am33xx_timer_sysc = {
+ .rev_offs = 0x0000,
+ .sysc_offs = 0x0010,
+ .syss_offs = 0x0014,
+- .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET),
++ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
++ SYSC_HAS_RESET_STATUS,
+ .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
+ SIDLE_SMART_WKUP),
+ .sysc_fields = &omap_hwmod_sysc_type2,
+--
+2.20.1
+
--- /dev/null
+From bfe0f6387c0a3cd6aa146d5c7a4d3363a8418dd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 16:19:00 -0700
+Subject: ARM: OMAP2+: Fix warnings with broken omap2_set_init_voltage()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit cf395f7ddb9ebc6b2d28d83b53d18aa4e7c19701 ]
+
+This code is currently unable to find the dts opp tables as ti-cpufreq
+needs to set them up first based on speed binning.
+
+We stopped initializing the opp tables with platform code years ago for
+device tree based booting with commit 92d51856d740 ("ARM: OMAP3+: do not
+register non-dt OPP tables for device tree boot"), and all of mach-omap2
+is now booting using device tree.
+
+We currently get the following errors on init:
+
+omap2_set_init_voltage: unable to find boot up OPP for vdd_mpu
+omap2_set_init_voltage: unable to set vdd_mpu
+omap2_set_init_voltage: unable to find boot up OPP for vdd_core
+omap2_set_init_voltage: unable to set vdd_core
+omap2_set_init_voltage: unable to find boot up OPP for vdd_iva
+omap2_set_init_voltage: unable to set vdd_iva
+
+Let's just drop the unused code. Nowadays ti-cpufreq should be used to
+to initialize things properly.
+
+Cc: Adam Ford <aford173@gmail.com>
+Cc: André Roth <neolynx@gmail.com>
+Cc: "H. Nikolaus Schaller" <hns@goldelico.com>
+Cc: Nishanth Menon <nm@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Tested-by: Adam Ford <aford173@gmail.com> #logicpd-torpedo-37xx-devkit
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/pm.c | 100 ---------------------------------------
+ 1 file changed, 100 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
+index 1fde1bf53fb65..7ac9af56762df 100644
+--- a/arch/arm/mach-omap2/pm.c
++++ b/arch/arm/mach-omap2/pm.c
+@@ -74,83 +74,6 @@ int omap_pm_clkdms_setup(struct clockdomain *clkdm, void *unused)
+ return 0;
+ }
+
+-/*
+- * This API is to be called during init to set the various voltage
+- * domains to the voltage as per the opp table. Typically we boot up
+- * at the nominal voltage. So this function finds out the rate of
+- * the clock associated with the voltage domain, finds out the correct
+- * opp entry and sets the voltage domain to the voltage specified
+- * in the opp entry
+- */
+-static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
+- const char *oh_name)
+-{
+- struct voltagedomain *voltdm;
+- struct clk *clk;
+- struct dev_pm_opp *opp;
+- unsigned long freq, bootup_volt;
+- struct device *dev;
+-
+- if (!vdd_name || !clk_name || !oh_name) {
+- pr_err("%s: invalid parameters\n", __func__);
+- goto exit;
+- }
+-
+- if (!strncmp(oh_name, "mpu", 3))
+- /*
+- * All current OMAPs share voltage rail and clock
+- * source, so CPU0 is used to represent the MPU-SS.
+- */
+- dev = get_cpu_device(0);
+- else
+- dev = omap_device_get_by_hwmod_name(oh_name);
+-
+- if (IS_ERR(dev)) {
+- pr_err("%s: Unable to get dev pointer for hwmod %s\n",
+- __func__, oh_name);
+- goto exit;
+- }
+-
+- voltdm = voltdm_lookup(vdd_name);
+- if (!voltdm) {
+- pr_err("%s: unable to get vdd pointer for vdd_%s\n",
+- __func__, vdd_name);
+- goto exit;
+- }
+-
+- clk = clk_get(NULL, clk_name);
+- if (IS_ERR(clk)) {
+- pr_err("%s: unable to get clk %s\n", __func__, clk_name);
+- goto exit;
+- }
+-
+- freq = clk_get_rate(clk);
+- clk_put(clk);
+-
+- opp = dev_pm_opp_find_freq_ceil(dev, &freq);
+- if (IS_ERR(opp)) {
+- pr_err("%s: unable to find boot up OPP for vdd_%s\n",
+- __func__, vdd_name);
+- goto exit;
+- }
+-
+- bootup_volt = dev_pm_opp_get_voltage(opp);
+- dev_pm_opp_put(opp);
+-
+- if (!bootup_volt) {
+- pr_err("%s: unable to find voltage corresponding to the bootup OPP for vdd_%s\n",
+- __func__, vdd_name);
+- goto exit;
+- }
+-
+- voltdm_scale(voltdm, bootup_volt);
+- return 0;
+-
+-exit:
+- pr_err("%s: unable to set vdd_%s\n", __func__, vdd_name);
+- return -EINVAL;
+-}
+-
+ #ifdef CONFIG_SUSPEND
+ static int omap_pm_enter(suspend_state_t suspend_state)
+ {
+@@ -208,25 +131,6 @@ void omap_common_suspend_init(void *pm_suspend)
+ }
+ #endif /* CONFIG_SUSPEND */
+
+-static void __init omap3_init_voltages(void)
+-{
+- if (!soc_is_omap34xx())
+- return;
+-
+- omap2_set_init_voltage("mpu_iva", "dpll1_ck", "mpu");
+- omap2_set_init_voltage("core", "l3_ick", "l3_main");
+-}
+-
+-static void __init omap4_init_voltages(void)
+-{
+- if (!soc_is_omap44xx())
+- return;
+-
+- omap2_set_init_voltage("mpu", "dpll_mpu_ck", "mpu");
+- omap2_set_init_voltage("core", "l3_div_ck", "l3_main_1");
+- omap2_set_init_voltage("iva", "dpll_iva_m5x2_ck", "iva");
+-}
+-
+ int __maybe_unused omap_pm_nop_init(void)
+ {
+ return 0;
+@@ -246,10 +150,6 @@ int __init omap2_common_pm_late_init(void)
+ omap4_twl_init();
+ omap_voltage_late_init();
+
+- /* Initialize the voltages */
+- omap3_init_voltages();
+- omap4_init_voltages();
+-
+ /* Smartreflex device init */
+ omap_devinit_smartreflex();
+
+--
+2.20.1
+
--- /dev/null
+From 3bb8a6691771a2166df9a095360822a8578affb5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 15:24:30 +0800
+Subject: blk-mq: honor IO scheduler for multiqueue devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ming Lei <ming.lei@redhat.com>
+
+[ Upstream commit a12de1d42d74ef3c80e9fb9a2da94daaef747869 ]
+
+If a device is using multiple queues, the IO scheduler may be bypassed.
+This may hurt performance for some slow MQ devices, and it also breaks
+zoned devices which depend on mq-deadline for respecting the write order
+in one zone.
+
+Don't bypass io scheduler if we have one setup.
+
+This patch can double sequential write performance basically on MQ
+scsi_debug when mq-deadline is applied.
+
+Cc: Bart Van Assche <bvanassche@acm.org>
+Cc: Hannes Reinecke <hare@suse.com>
+Cc: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Javier González <javier@javigon.com>
+Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index a79b9ad1aba18..ed41cde93641c 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1998,6 +1998,8 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
+ }
+
+ blk_add_rq_to_plug(plug, rq);
++ } else if (q->elevator) {
++ blk_mq_sched_insert_request(rq, false, true, true);
+ } else if (plug && !blk_queue_nomerges(q)) {
+ /*
+ * We do limited plugging. If the bio can be merged, do that.
+@@ -2021,8 +2023,8 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio)
+ blk_mq_try_issue_directly(data.hctx, same_queue_rq,
+ &cookie);
+ }
+- } else if ((q->nr_hw_queues > 1 && is_sync) || (!q->elevator &&
+- !data.hctx->dispatch_busy)) {
++ } else if ((q->nr_hw_queues > 1 && is_sync) ||
++ !data.hctx->dispatch_busy) {
+ blk_mq_try_issue_directly(data.hctx, rq, &cookie);
+ } else {
+ blk_mq_sched_insert_request(rq, false, true, true);
+--
+2.20.1
+
--- /dev/null
+From 49b172a770499fc9392d93e5bd95a20ba6f0b69e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 10:32:37 -0700
+Subject: clk: ti: dra7: Fix mcasp8 clock bits
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit dd8882a255388ba66175098b1560d4f81c100d30 ]
+
+There's a typo for dra7 mcasp clkctrl bit, it should be 22 like the other
+macasp instances, and not 24. And in dra7xx_clks[] we have the bits wrong
+way around.
+
+Fixes: dffa9051d546 ("clk: ti: dra7: add new clkctrl data")
+Cc: linux-clk@vger.kernel.org
+Cc: Michael Turquette <mturquette@baylibre.com>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Suman Anna <s-anna@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-7xx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c
+index b57fe09b428be..9dd6185a4b4e2 100644
+--- a/drivers/clk/ti/clk-7xx.c
++++ b/drivers/clk/ti/clk-7xx.c
+@@ -683,7 +683,7 @@ static const struct omap_clkctrl_reg_data dra7_l4per2_clkctrl_regs[] __initconst
+ { DRA7_L4PER2_MCASP2_CLKCTRL, dra7_mcasp2_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0154:22" },
+ { DRA7_L4PER2_MCASP3_CLKCTRL, dra7_mcasp3_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:015c:22" },
+ { DRA7_L4PER2_MCASP5_CLKCTRL, dra7_mcasp5_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:016c:22" },
+- { DRA7_L4PER2_MCASP8_CLKCTRL, dra7_mcasp8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0184:24" },
++ { DRA7_L4PER2_MCASP8_CLKCTRL, dra7_mcasp8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0184:22" },
+ { DRA7_L4PER2_MCASP4_CLKCTRL, dra7_mcasp4_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:018c:22" },
+ { DRA7_L4PER2_UART7_CLKCTRL, dra7_uart7_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:01c4:24" },
+ { DRA7_L4PER2_UART8_CLKCTRL, dra7_uart8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:01d4:24" },
+@@ -828,8 +828,8 @@ static struct ti_dt_clk dra7xx_clks[] = {
+ DT_CLK(NULL, "mcasp6_aux_gfclk_mux", "l4per2-clkctrl:01f8:22"),
+ DT_CLK(NULL, "mcasp7_ahclkx_mux", "l4per2-clkctrl:01fc:24"),
+ DT_CLK(NULL, "mcasp7_aux_gfclk_mux", "l4per2-clkctrl:01fc:22"),
+- DT_CLK(NULL, "mcasp8_ahclkx_mux", "l4per2-clkctrl:0184:22"),
+- DT_CLK(NULL, "mcasp8_aux_gfclk_mux", "l4per2-clkctrl:0184:24"),
++ DT_CLK(NULL, "mcasp8_ahclkx_mux", "l4per2-clkctrl:0184:24"),
++ DT_CLK(NULL, "mcasp8_aux_gfclk_mux", "l4per2-clkctrl:0184:22"),
+ DT_CLK(NULL, "mmc1_clk32k", "l3init-clkctrl:0008:8"),
+ DT_CLK(NULL, "mmc1_fclk_div", "l3init-clkctrl:0008:25"),
+ DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"),
+--
+2.20.1
+
--- /dev/null
+From 29d7cc8d183c55049640424456473c240a81fea2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 May 2016 21:59:07 -0700
+Subject: Convert filldir[64]() from __put_user() to unsafe_put_user()
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 9f79b78ef74436c7507bac6bfb7b8b989263bccb ]
+
+We really should avoid the "__{get,put}_user()" functions entirely,
+because they can easily be mis-used and the original intent of being
+used for simple direct user accesses no longer holds in a post-SMAP/PAN
+world.
+
+Manually optimizing away the user access range check makes no sense any
+more, when the range check is generally much cheaper than the "enable
+user accesses" code that the __{get,put}_user() functions still need.
+
+So instead of __put_user(), use the unsafe_put_user() interface with
+user_access_{begin,end}() that really does generate better code these
+days, and which is generally a nicer interface. Under some loads, the
+multiple user writes that filldir() does are actually quite noticeable.
+
+This also makes the dirent name copy use unsafe_put_user() with a couple
+of macros. We do not want to make function calls with SMAP/PAN
+disabled, and the code this generates is quite good when the
+architecture uses "asm goto" for unsafe_put_user() like x86 does.
+
+Note that this doesn't bother with the legacy cases. Nobody should use
+them anyway, so performance doesn't really matter there.
+
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/readdir.c | 128 +++++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 93 insertions(+), 35 deletions(-)
+
+diff --git a/fs/readdir.c b/fs/readdir.c
+index 2f6a4534e0dfe..579c8ea894ae3 100644
+--- a/fs/readdir.c
++++ b/fs/readdir.c
+@@ -20,9 +20,63 @@
+ #include <linux/syscalls.h>
+ #include <linux/unistd.h>
+ #include <linux/compat.h>
+-
+ #include <linux/uaccess.h>
+
++#include <asm/unaligned.h>
++
++/*
++ * Note the "unsafe_put_user() semantics: we goto a
++ * label for errors.
++ *
++ * Also note how we use a "while()" loop here, even though
++ * only the biggest size needs to loop. The compiler (well,
++ * at least gcc) is smart enough to turn the smaller sizes
++ * into just if-statements, and this way we don't need to
++ * care whether 'u64' or 'u32' is the biggest size.
++ */
++#define unsafe_copy_loop(dst, src, len, type, label) \
++ while (len >= sizeof(type)) { \
++ unsafe_put_user(get_unaligned((type *)src), \
++ (type __user *)dst, label); \
++ dst += sizeof(type); \
++ src += sizeof(type); \
++ len -= sizeof(type); \
++ }
++
++/*
++ * We avoid doing 64-bit copies on 32-bit architectures. They
++ * might be better, but the component names are mostly small,
++ * and the 64-bit cases can end up being much more complex and
++ * put much more register pressure on the code, so it's likely
++ * not worth the pain of unaligned accesses etc.
++ *
++ * So limit the copies to "unsigned long" size. I did verify
++ * that at least the x86-32 case is ok without this limiting,
++ * but I worry about random other legacy 32-bit cases that
++ * might not do as well.
++ */
++#define unsafe_copy_type(dst, src, len, type, label) do { \
++ if (sizeof(type) <= sizeof(unsigned long)) \
++ unsafe_copy_loop(dst, src, len, type, label); \
++} while (0)
++
++/*
++ * Copy the dirent name to user space, and NUL-terminate
++ * it. This should not be a function call, since we're doing
++ * the copy inside a "user_access_begin/end()" section.
++ */
++#define unsafe_copy_dirent_name(_dst, _src, _len, label) do { \
++ char __user *dst = (_dst); \
++ const char *src = (_src); \
++ size_t len = (_len); \
++ unsafe_copy_type(dst, src, len, u64, label); \
++ unsafe_copy_type(dst, src, len, u32, label); \
++ unsafe_copy_type(dst, src, len, u16, label); \
++ unsafe_copy_type(dst, src, len, u8, label); \
++ unsafe_put_user(0, dst, label); \
++} while (0)
++
++
+ int iterate_dir(struct file *file, struct dir_context *ctx)
+ {
+ struct inode *inode = file_inode(file);
+@@ -182,28 +236,31 @@ static int filldir(struct dir_context *ctx, const char *name, int namlen,
+ return -EOVERFLOW;
+ }
+ dirent = buf->previous;
+- if (dirent) {
+- if (signal_pending(current))
+- return -EINTR;
+- if (__put_user(offset, &dirent->d_off))
+- goto efault;
+- }
+- dirent = buf->current_dir;
+- if (__put_user(d_ino, &dirent->d_ino))
+- goto efault;
+- if (__put_user(reclen, &dirent->d_reclen))
+- goto efault;
+- if (copy_to_user(dirent->d_name, name, namlen))
+- goto efault;
+- if (__put_user(0, dirent->d_name + namlen))
+- goto efault;
+- if (__put_user(d_type, (char __user *) dirent + reclen - 1))
++ if (dirent && signal_pending(current))
++ return -EINTR;
++
++ /*
++ * Note! This range-checks 'previous' (which may be NULL).
++ * The real range was checked in getdents
++ */
++ if (!user_access_begin(dirent, sizeof(*dirent)))
+ goto efault;
++ if (dirent)
++ unsafe_put_user(offset, &dirent->d_off, efault_end);
++ dirent = buf->current_dir;
++ unsafe_put_user(d_ino, &dirent->d_ino, efault_end);
++ unsafe_put_user(reclen, &dirent->d_reclen, efault_end);
++ unsafe_put_user(d_type, (char __user *) dirent + reclen - 1, efault_end);
++ unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end);
++ user_access_end();
++
+ buf->previous = dirent;
+ dirent = (void __user *)dirent + reclen;
+ buf->current_dir = dirent;
+ buf->count -= reclen;
+ return 0;
++efault_end:
++ user_access_end();
+ efault:
+ buf->error = -EFAULT;
+ return -EFAULT;
+@@ -263,30 +320,31 @@ static int filldir64(struct dir_context *ctx, const char *name, int namlen,
+ if (reclen > buf->count)
+ return -EINVAL;
+ dirent = buf->previous;
+- if (dirent) {
+- if (signal_pending(current))
+- return -EINTR;
+- if (__put_user(offset, &dirent->d_off))
+- goto efault;
+- }
+- dirent = buf->current_dir;
+- if (__put_user(ino, &dirent->d_ino))
+- goto efault;
+- if (__put_user(0, &dirent->d_off))
+- goto efault;
+- if (__put_user(reclen, &dirent->d_reclen))
+- goto efault;
+- if (__put_user(d_type, &dirent->d_type))
+- goto efault;
+- if (copy_to_user(dirent->d_name, name, namlen))
+- goto efault;
+- if (__put_user(0, dirent->d_name + namlen))
++ if (dirent && signal_pending(current))
++ return -EINTR;
++
++ /*
++ * Note! This range-checks 'previous' (which may be NULL).
++ * The real range was checked in getdents
++ */
++ if (!user_access_begin(dirent, sizeof(*dirent)))
+ goto efault;
++ if (dirent)
++ unsafe_put_user(offset, &dirent->d_off, efault_end);
++ dirent = buf->current_dir;
++ unsafe_put_user(ino, &dirent->d_ino, efault_end);
++ unsafe_put_user(reclen, &dirent->d_reclen, efault_end);
++ unsafe_put_user(d_type, &dirent->d_type, efault_end);
++ unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end);
++ user_access_end();
++
+ buf->previous = dirent;
+ dirent = (void __user *)dirent + reclen;
+ buf->current_dir = dirent;
+ buf->count -= reclen;
+ return 0;
++efault_end:
++ user_access_end();
+ efault:
+ buf->error = -EFAULT;
+ return -EFAULT;
+--
+2.20.1
+
--- /dev/null
+From 799b6e85606d872eaa3cb00bf81dea4c2a33e420 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 22:20:44 -0500
+Subject: drm/amd/display: memory leak
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 055e547478a11a6360c7ce05e2afc3e366968a12 ]
+
+In dcn*_clock_source_create when dcn20_clk_src_construct fails allocated
+clk_src needs release.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 1 +
+ drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 1 +
+ 7 files changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+index 6248c84553140..45f74219e79ed 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c
+@@ -668,6 +668,7 @@ struct clock_source *dce100_clock_source_create(
+ return &clk_src->base;
+ }
+
++ kfree(clk_src);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+index 764329264c3b4..0cb83b0e0e1ee 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c
+@@ -714,6 +714,7 @@ struct clock_source *dce110_clock_source_create(
+ return &clk_src->base;
+ }
+
++ kfree(clk_src);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+index 7a04be74c9cf9..918455caa9a61 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c
+@@ -687,6 +687,7 @@ struct clock_source *dce112_clock_source_create(
+ return &clk_src->base;
+ }
+
++ kfree(clk_src);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+index ae38c9c7277cf..49f3f0fad7633 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c
+@@ -500,6 +500,7 @@ static struct clock_source *dce120_clock_source_create(
+ return &clk_src->base;
+ }
+
++ kfree(clk_src);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+index 860a524ebcfab..952440893fbb3 100644
+--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c
+@@ -701,6 +701,7 @@ struct clock_source *dce80_clock_source_create(
+ return &clk_src->base;
+ }
+
++ kfree(clk_src);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+index a12530a3ab9ca..3f25e8da5396a 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c
+@@ -786,6 +786,7 @@ struct clock_source *dcn10_clock_source_create(
+ return &clk_src->base;
+ }
+
++ kfree(clk_src);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+index b949e202d6cb7..5b7ff6c549f18 100644
+--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c
+@@ -955,6 +955,7 @@ struct clock_source *dcn20_clock_source_create(
+ return &clk_src->base;
+ }
+
++ kfree(clk_src);
+ BREAK_TO_DEBUGGER();
+ return NULL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 61df336468074da0784bd5aade25476fd977e2d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 22:46:07 -0500
+Subject: drm/amdgpu: fix multiple memory leaks in acp_hw_init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 57be09c6e8747bf48704136d9e3f92bfb93f5725 ]
+
+In acp_hw_init there are some allocations that needs to be released in
+case of failure:
+
+1- adev->acp.acp_genpd should be released if any allocation attemp for
+adev->acp.acp_cell, adev->acp.acp_res or i2s_pdata fails.
+2- all of those allocations should be released if
+mfd_add_hotplug_devices or pm_genpd_add_device fail.
+3- Release is needed in case of time out values expire.
+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 34 ++++++++++++++++---------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+index eba42c752bca3..82155ac3288a0 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+@@ -189,7 +189,7 @@ static int acp_hw_init(void *handle)
+ u32 val = 0;
+ u32 count = 0;
+ struct device *dev;
+- struct i2s_platform_data *i2s_pdata;
++ struct i2s_platform_data *i2s_pdata = NULL;
+
+ struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+@@ -231,20 +231,21 @@ static int acp_hw_init(void *handle)
+ adev->acp.acp_cell = kcalloc(ACP_DEVS, sizeof(struct mfd_cell),
+ GFP_KERNEL);
+
+- if (adev->acp.acp_cell == NULL)
+- return -ENOMEM;
++ if (adev->acp.acp_cell == NULL) {
++ r = -ENOMEM;
++ goto failure;
++ }
+
+ adev->acp.acp_res = kcalloc(5, sizeof(struct resource), GFP_KERNEL);
+ if (adev->acp.acp_res == NULL) {
+- kfree(adev->acp.acp_cell);
+- return -ENOMEM;
++ r = -ENOMEM;
++ goto failure;
+ }
+
+ i2s_pdata = kcalloc(3, sizeof(struct i2s_platform_data), GFP_KERNEL);
+ if (i2s_pdata == NULL) {
+- kfree(adev->acp.acp_res);
+- kfree(adev->acp.acp_cell);
+- return -ENOMEM;
++ r = -ENOMEM;
++ goto failure;
+ }
+
+ switch (adev->asic_type) {
+@@ -341,14 +342,14 @@ static int acp_hw_init(void *handle)
+ r = mfd_add_hotplug_devices(adev->acp.parent, adev->acp.acp_cell,
+ ACP_DEVS);
+ if (r)
+- return r;
++ goto failure;
+
+ for (i = 0; i < ACP_DEVS ; i++) {
+ dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
+ r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev);
+ if (r) {
+ dev_err(dev, "Failed to add dev to genpd\n");
+- return r;
++ goto failure;
+ }
+ }
+
+@@ -367,7 +368,8 @@ static int acp_hw_init(void *handle)
+ break;
+ if (--count == 0) {
+ dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+- return -ETIMEDOUT;
++ r = -ETIMEDOUT;
++ goto failure;
+ }
+ udelay(100);
+ }
+@@ -384,7 +386,8 @@ static int acp_hw_init(void *handle)
+ break;
+ if (--count == 0) {
+ dev_err(&adev->pdev->dev, "Failed to reset ACP\n");
+- return -ETIMEDOUT;
++ r = -ETIMEDOUT;
++ goto failure;
+ }
+ udelay(100);
+ }
+@@ -393,6 +396,13 @@ static int acp_hw_init(void *handle)
+ val &= ~ACP_SOFT_RESET__SoftResetAud_MASK;
+ cgs_write_register(adev->acp.cgs_device, mmACP_SOFT_RESET, val);
+ return 0;
++
++failure:
++ kfree(i2s_pdata);
++ kfree(adev->acp.acp_res);
++ kfree(adev->acp.acp_cell);
++ kfree(adev->acp.acp_genpd);
++ return r;
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 5680a63777add46b6ff725c6ef800b926facab35 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 11:04:45 +0000
+Subject: drm: Clear the fence pointer when writeback job signaled
+
+From: Lowry Li (Arm Technology China) <Lowry.Li@arm.com>
+
+[ Upstream commit b1066a123538044117f0a78ba8c6a50cf5a04c86 ]
+
+During it signals the completion of a writeback job, after releasing
+the out_fence, we'd clear the pointer.
+
+Check if fence left over in drm_writeback_cleanup_job(), release it.
+
+Signed-off-by: Lowry Li (Arm Technology China) <lowry.li@arm.com>
+Reviewed-by: Brian Starkey <brian.starkey@arm.com>
+Reviewed-by: James Qian Wang (Arm Technology China) <james.qian.wang@arm.com>
+Signed-off-by: james qian wang (Arm Technology China) <james.qian.wang@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1564571048-15029-3-git-send-email-lowry.li@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_writeback.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_writeback.c b/drivers/gpu/drm/drm_writeback.c
+index ff138b6ec48ba..43d9e3bb3a943 100644
+--- a/drivers/gpu/drm/drm_writeback.c
++++ b/drivers/gpu/drm/drm_writeback.c
+@@ -324,6 +324,9 @@ void drm_writeback_cleanup_job(struct drm_writeback_job *job)
+ if (job->fb)
+ drm_framebuffer_put(job->fb);
+
++ if (job->out_fence)
++ dma_fence_put(job->out_fence);
++
+ kfree(job);
+ }
+ EXPORT_SYMBOL(drm_writeback_cleanup_job);
+@@ -366,25 +369,29 @@ drm_writeback_signal_completion(struct drm_writeback_connector *wb_connector,
+ {
+ unsigned long flags;
+ struct drm_writeback_job *job;
++ struct dma_fence *out_fence;
+
+ spin_lock_irqsave(&wb_connector->job_lock, flags);
+ job = list_first_entry_or_null(&wb_connector->job_queue,
+ struct drm_writeback_job,
+ list_entry);
+- if (job) {
++ if (job)
+ list_del(&job->list_entry);
+- if (job->out_fence) {
+- if (status)
+- dma_fence_set_error(job->out_fence, status);
+- dma_fence_signal(job->out_fence);
+- dma_fence_put(job->out_fence);
+- }
+- }
++
+ spin_unlock_irqrestore(&wb_connector->job_lock, flags);
+
+ if (WARN_ON(!job))
+ return;
+
++ out_fence = job->out_fence;
++ if (out_fence) {
++ if (status)
++ dma_fence_set_error(out_fence, status);
++ dma_fence_signal(out_fence);
++ dma_fence_put(out_fence);
++ job->out_fence = NULL;
++ }
++
+ INIT_WORK(&job->cleanup_work, cleanup_work);
+ queue_work(system_long_wq, &job->cleanup_work);
+ }
+--
+2.20.1
+
--- /dev/null
+From c315cd08ccfccc653687508ea6f59b94975f4085 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Jul 2019 11:04:38 +0000
+Subject: drm: Free the writeback_job when it with an empty fb
+
+From: Lowry Li (Arm Technology China) <Lowry.Li@arm.com>
+
+[ Upstream commit 8581d51055a08cc6eb061c8856062290e8582ce4 ]
+
+Adds the check if the writeback_job with an empty fb, then it should
+be freed in atomic_check phase.
+
+With this change, the driver users will not check empty fb case any more.
+So refined accordingly.
+
+Signed-off-by: Lowry Li (Arm Technology China) <lowry.li@arm.com>
+Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
+Reviewed-by: James Qian Wang (Arm Technology China) <james.qian.wang@arm.com>
+Signed-off-by: james qian wang (Arm Technology China) <james.qian.wang@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1564571048-15029-2-git-send-email-lowry.li@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../drm/arm/display/komeda/komeda_wb_connector.c | 3 +--
+ drivers/gpu/drm/arm/malidp_mw.c | 4 ++--
+ drivers/gpu/drm/drm_atomic.c | 13 +++++++++----
+ drivers/gpu/drm/rcar-du/rcar_du_writeback.c | 4 ++--
+ drivers/gpu/drm/vc4/vc4_txp.c | 5 ++---
+ 5 files changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+index 2851cac94d869..23fbee268119f 100644
+--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
++++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+@@ -43,9 +43,8 @@ komeda_wb_encoder_atomic_check(struct drm_encoder *encoder,
+ struct komeda_data_flow_cfg dflow;
+ int err;
+
+- if (!writeback_job || !writeback_job->fb) {
++ if (!writeback_job)
+ return 0;
+- }
+
+ if (!crtc_st->active) {
+ DRM_DEBUG_ATOMIC("Cannot write the composition result out on a inactive CRTC.\n");
+diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c
+index 2e812525025dd..a59227b2cdb55 100644
+--- a/drivers/gpu/drm/arm/malidp_mw.c
++++ b/drivers/gpu/drm/arm/malidp_mw.c
+@@ -130,7 +130,7 @@ malidp_mw_encoder_atomic_check(struct drm_encoder *encoder,
+ struct drm_framebuffer *fb;
+ int i, n_planes;
+
+- if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
++ if (!conn_state->writeback_job)
+ return 0;
+
+ fb = conn_state->writeback_job->fb;
+@@ -247,7 +247,7 @@ void malidp_mw_atomic_commit(struct drm_device *drm,
+
+ mw_state = to_mw_state(conn_state);
+
+- if (conn_state->writeback_job && conn_state->writeback_job->fb) {
++ if (conn_state->writeback_job) {
+ struct drm_framebuffer *fb = conn_state->writeback_job->fb;
+
+ DRM_DEV_DEBUG_DRIVER(drm->dev,
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 419381abbdd16..14aeaf7363210 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -430,10 +430,15 @@ static int drm_atomic_connector_check(struct drm_connector *connector,
+ return -EINVAL;
+ }
+
+- if (writeback_job->out_fence && !writeback_job->fb) {
+- DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] requesting out-fence without framebuffer\n",
+- connector->base.id, connector->name);
+- return -EINVAL;
++ if (!writeback_job->fb) {
++ if (writeback_job->out_fence) {
++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] requesting out-fence without framebuffer\n",
++ connector->base.id, connector->name);
++ return -EINVAL;
++ }
++
++ drm_writeback_cleanup_job(writeback_job);
++ state->writeback_job = NULL;
+ }
+
+ return 0;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_writeback.c b/drivers/gpu/drm/rcar-du/rcar_du_writeback.c
+index ae07290bba6a4..04efa78d70b6e 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_writeback.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_writeback.c
+@@ -147,7 +147,7 @@ static int rcar_du_wb_enc_atomic_check(struct drm_encoder *encoder,
+ struct drm_device *dev = encoder->dev;
+ struct drm_framebuffer *fb;
+
+- if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
++ if (!conn_state->writeback_job)
+ return 0;
+
+ fb = conn_state->writeback_job->fb;
+@@ -221,7 +221,7 @@ void rcar_du_writeback_setup(struct rcar_du_crtc *rcrtc,
+ unsigned int i;
+
+ state = rcrtc->writeback.base.state;
+- if (!state || !state->writeback_job || !state->writeback_job->fb)
++ if (!state || !state->writeback_job)
+ return;
+
+ fb = state->writeback_job->fb;
+diff --git a/drivers/gpu/drm/vc4/vc4_txp.c b/drivers/gpu/drm/vc4/vc4_txp.c
+index 96f91c1b4b6e6..e92fa12750343 100644
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -229,7 +229,7 @@ static int vc4_txp_connector_atomic_check(struct drm_connector *conn,
+ int i;
+
+ conn_state = drm_atomic_get_new_connector_state(state, conn);
+- if (!conn_state->writeback_job || !conn_state->writeback_job->fb)
++ if (!conn_state->writeback_job)
+ return 0;
+
+ crtc_state = drm_atomic_get_new_crtc_state(state, conn_state->crtc);
+@@ -269,8 +269,7 @@ static void vc4_txp_connector_atomic_commit(struct drm_connector *conn,
+ u32 ctrl;
+ int i;
+
+- if (WARN_ON(!conn_state->writeback_job ||
+- !conn_state->writeback_job->fb))
++ if (WARN_ON(!conn_state->writeback_job))
+ return;
+
+ mode = &conn_state->crtc->state->adjusted_mode;
+--
+2.20.1
+
--- /dev/null
+From cedd7f21589a279c680be909d5408054544c7c6f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 23:30:30 -0500
+Subject: drm/komeda: prevent memory leak in komeda_wb_connector_add
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit a0ecd6fdbf5d648123a7315c695fb6850d702835 ]
+
+In komeda_wb_connector_add if drm_writeback_connector_init fails the
+allocated memory for kwb_conn should be released.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: James Qian Wang (Arm Technology China) <james.qian.wang@arm.com>
+Signed-off-by: james qian wang (Arm Technology China) <james.qian.wang@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190925043031.32308-1-navid.emamdoost@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+index 23fbee268119f..b72840c06ab76 100644
+--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
++++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c
+@@ -165,8 +165,10 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms,
+ &komeda_wb_encoder_helper_funcs,
+ formats, n_formats);
+ komeda_put_fourcc_list(formats);
+- if (err)
++ if (err) {
++ kfree(kwb_conn);
+ return err;
++ }
+
+ drm_connector_helper_add(&wb_conn->base, &komeda_wb_conn_helper_funcs);
+
+--
+2.20.1
+
--- /dev/null
+From bf90247e7e05abd26e9cece3b348e140c385e4f3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 6 Oct 2019 13:53:27 -0700
+Subject: elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit b212921b13bda088a004328457c5c21458262fe2 ]
+
+In commit 4ed28639519c ("fs, elf: drop MAP_FIXED usage from elf_map") we
+changed elf to use MAP_FIXED_NOREPLACE instead of MAP_FIXED for the
+executable mappings.
+
+Then, people reported that it broke some binaries that had overlapping
+segments from the same file, and commit ad55eac74f20 ("elf: enforce
+MAP_FIXED on overlaying elf segments") re-instated MAP_FIXED for some
+overlaying elf segment cases. But only some - despite the summary line
+of that commit, it only did it when it also does a temporary brk vma for
+one obvious overlapping case.
+
+Now Russell King reports another overlapping case with old 32-bit x86
+binaries, which doesn't trigger that limited case. End result: we had
+better just drop MAP_FIXED_NOREPLACE entirely, and go back to MAP_FIXED.
+
+Yes, it's a sign of old binaries generated with old tool-chains, but we
+do pride ourselves on not breaking existing setups.
+
+This still leaves MAP_FIXED_NOREPLACE in place for the load_elf_interp()
+and the old load_elf_library() use-cases, because nobody has reported
+breakage for those. Yet.
+
+Note that in all the cases seen so far, the overlapping elf sections
+seem to be just re-mapping of the same executable with different section
+attributes. We could possibly introduce a new MAP_FIXED_NOFILECHANGE
+flag or similar, which acts like NOREPLACE, but allows just remapping
+the same executable file using different protection flags.
+
+It's not clear that would make a huge difference to anything, but if
+people really hate that "elf remaps over previous maps" behavior, maybe
+at least a more limited form of remapping would alleviate some concerns.
+
+Alternatively, we should take a look at our elf_map() logic to see if we
+end up not mapping things properly the first time.
+
+In the meantime, this is the minimal "don't do that then" patch while
+people hopefully think about it more.
+
+Reported-by: Russell King <linux@armlinux.org.uk>
+Fixes: 4ed28639519c ("fs, elf: drop MAP_FIXED usage from elf_map")
+Fixes: ad55eac74f20 ("elf: enforce MAP_FIXED on overlaying elf segments")
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Kees Cook <keescook@chromium.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/binfmt_elf.c | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index f131651502b8a..c62903290f3a5 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -899,7 +899,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ the correct location in memory. */
+ for(i = 0, elf_ppnt = elf_phdata;
+ i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+- int elf_prot, elf_flags, elf_fixed = MAP_FIXED_NOREPLACE;
++ int elf_prot, elf_flags;
+ unsigned long k, vaddr;
+ unsigned long total_size = 0;
+
+@@ -931,13 +931,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ */
+ }
+ }
+-
+- /*
+- * Some binaries have overlapping elf segments and then
+- * we have to forcefully map over an existing mapping
+- * e.g. over this newly established brk mapping.
+- */
+- elf_fixed = MAP_FIXED;
+ }
+
+ elf_prot = make_prot(elf_ppnt->p_flags);
+@@ -950,7 +943,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ * the ET_DYN load_addr calculations, proceed normally.
+ */
+ if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
+- elf_flags |= elf_fixed;
++ elf_flags |= MAP_FIXED;
+ } else if (loc->elf_ex.e_type == ET_DYN) {
+ /*
+ * This logic is run once for the first LOAD Program
+@@ -986,7 +979,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
+ load_bias = ELF_ET_DYN_BASE;
+ if (current->flags & PF_RANDOMIZE)
+ load_bias += arch_mmap_rnd();
+- elf_flags |= elf_fixed;
++ elf_flags |= MAP_FIXED;
+ } else
+ load_bias = 0;
+
+--
+2.20.1
+
--- /dev/null
+From 04a7655844ebedd0d7db62e6e73007bc4a86707a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Sep 2019 17:47:12 -0500
+Subject: ieee802154: ca8210: prevent memory leak
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 6402939ec86eaf226c8b8ae00ed983936b164908 ]
+
+In ca8210_probe the allocated pdata needs to be assigned to
+spi_device->dev.platform_data before calling ca8210_get_platform_data.
+Othrwise when ca8210_get_platform_data fails pdata cannot be released.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Link: https://lore.kernel.org/r/20190917224713.26371-1-navid.emamdoost@gmail.com
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ieee802154/ca8210.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index b188fce3f6410..658b399ac9eac 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -3152,12 +3152,12 @@ static int ca8210_probe(struct spi_device *spi_device)
+ goto error;
+ }
+
++ priv->spi->dev.platform_data = pdata;
+ ret = ca8210_get_platform_data(priv->spi, pdata);
+ if (ret) {
+ dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n");
+ goto error;
+ }
+- priv->spi->dev.platform_data = pdata;
+
+ ret = ca8210_dev_com_init(priv);
+ if (ret) {
+--
+2.20.1
+
--- /dev/null
+From 8d9b32b6e148f0245115669117619b0bf78067f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 17:08:18 -0700
+Subject: lib: textsearch: fix escapes in example code
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit 2105b52e30debe7f19f3218598d8ae777dcc6776 ]
+
+This textsearch code example does not need the '\' escapes and they can
+be misleading to someone reading the example. Also, gcc and sparse warn
+that the "\%d" is an unknown escape sequence.
+
+Fixes: 5968a70d7af5 ("textsearch: fix kernel-doc warnings and add kernel-api section")
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: netdev@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/textsearch.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/textsearch.c b/lib/textsearch.c
+index 4f16eec5d5544..f68dea8806be2 100644
+--- a/lib/textsearch.c
++++ b/lib/textsearch.c
+@@ -89,9 +89,9 @@
+ * goto errout;
+ * }
+ *
+- * pos = textsearch_find_continuous(conf, \&state, example, strlen(example));
++ * pos = textsearch_find_continuous(conf, &state, example, strlen(example));
+ * if (pos != UINT_MAX)
+- * panic("Oh my god, dancing chickens at \%d\n", pos);
++ * panic("Oh my god, dancing chickens at %d\n", pos);
+ *
+ * textsearch_destroy(conf);
+ */
+--
+2.20.1
+
--- /dev/null
+From dd5d887fe9b34571edc3a0d2dfc646e37a861acd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Sep 2019 21:49:01 +0200
+Subject: loop: change queue block size to match when using DIO
+
+From: Martijn Coenen <maco@android.com>
+
+[ Upstream commit 85560117d00f5d528e928918b8f61cadcefff98b ]
+
+The loop driver assumes that if the passed in fd is opened with
+O_DIRECT, the caller wants to use direct I/O on the loop device.
+However, if the underlying block device has a different block size than
+the loop block queue, direct I/O can't be enabled. Instead of requiring
+userspace to manually change the blocksize and re-enable direct I/O,
+just change the queue block sizes to match, as well as the io_min size.
+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martijn Coenen <maco@android.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/loop.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 1410fa8936538..f6f77eaa7217e 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -994,6 +994,16 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync)
+ blk_queue_write_cache(lo->lo_queue, true, false);
+
++ if (io_is_direct(lo->lo_backing_file) && inode->i_sb->s_bdev) {
++ /* In case of direct I/O, match underlying block size */
++ unsigned short bsize = bdev_logical_block_size(
++ inode->i_sb->s_bdev);
++
++ blk_queue_logical_block_size(lo->lo_queue, bsize);
++ blk_queue_physical_block_size(lo->lo_queue, bsize);
++ blk_queue_io_min(lo->lo_queue, bsize);
++ }
++
+ loop_update_rotational(lo);
+ loop_update_dio(lo);
+ set_capacity(lo->lo_disk, size);
+--
+2.20.1
+
--- /dev/null
+From cb094061b4bdc5269c76fc379a850e395507a916 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 10:03:16 +0800
+Subject: mac80211: fix txq null pointer dereference
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Miaoqing Pan <miaoqing@codeaurora.org>
+
+[ Upstream commit 8ed31a264065ae92058ce54aa3cc8da8d81dc6d7 ]
+
+If the interface type is P2P_DEVICE or NAN, read the file of
+'/sys/kernel/debug/ieee80211/phyx/netdev:wlanx/aqm' will get a
+NULL pointer dereference. As for those interface type, the
+pointer sdata->vif.txq is NULL.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000011
+CPU: 1 PID: 30936 Comm: cat Not tainted 4.14.104 #1
+task: ffffffc0337e4880 task.stack: ffffff800cd20000
+PC is at ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211]
+LR is at ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211]
+[...]
+Process cat (pid: 30936, stack limit = 0xffffff800cd20000)
+[...]
+[<ffffff8000b7cd00>] ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211]
+[<ffffff8000b7c414>] ieee80211_if_read+0x60/0xbc [mac80211]
+[<ffffff8000b7ccc4>] ieee80211_if_read_aqm+0x28/0x30 [mac80211]
+[<ffffff80082eff94>] full_proxy_read+0x2c/0x48
+[<ffffff80081eef00>] __vfs_read+0x2c/0xd4
+[<ffffff80081ef084>] vfs_read+0x8c/0x108
+[<ffffff80081ef494>] SyS_read+0x40/0x7c
+
+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/1569549796-8223-1-git-send-email-miaoqing@codeaurora.org
+[trim useless data from commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/debugfs_netdev.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index b1438fd4d8760..64b544ae9966b 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -487,9 +487,14 @@ static ssize_t ieee80211_if_fmt_aqm(
+ const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
+ {
+ struct ieee80211_local *local = sdata->local;
+- struct txq_info *txqi = to_txq_info(sdata->vif.txq);
++ struct txq_info *txqi;
+ int len;
+
++ if (!sdata->vif.txq)
++ return 0;
++
++ txqi = to_txq_info(sdata->vif.txq);
++
+ spin_lock_bh(&local->fq.lock);
+ rcu_read_lock();
+
+@@ -658,7 +663,9 @@ static void add_common_files(struct ieee80211_sub_if_data *sdata)
+ DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
+ DEBUGFS_ADD(hw_queues);
+
+- if (sdata->local->ops->wake_tx_queue)
++ if (sdata->local->ops->wake_tx_queue &&
++ sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
++ sdata->vif.type != NL80211_IFTYPE_NAN)
+ DEBUGFS_ADD(aqm);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From bd1c4c5e76ea9133404b9ec3a3c2f597d0072122 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 11:39:52 +0200
+Subject: MIPS: dts: ar9331: fix interrupt-controller size
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 0889d07f3e4b171c453b2aaf2b257f9074cdf624 ]
+
+It is two registers each of 4 byte.
+
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Pengutronix Kernel Team <kernel@pengutronix.de>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: devicetree@vger.kernel.org
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/boot/dts/qca/ar9331.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/boot/dts/qca/ar9331.dtsi b/arch/mips/boot/dts/qca/ar9331.dtsi
+index 63a9f33aa43e8..5cfc9d347826a 100644
+--- a/arch/mips/boot/dts/qca/ar9331.dtsi
++++ b/arch/mips/boot/dts/qca/ar9331.dtsi
+@@ -99,7 +99,7 @@
+
+ miscintc: interrupt-controller@18060010 {
+ compatible = "qca,ar7240-misc-intc";
+- reg = <0x18060010 0x4>;
++ reg = <0x18060010 0x8>;
+
+ interrupt-parent = <&cpuintc>;
+ interrupts = <6>;
+--
+2.20.1
+
--- /dev/null
+From 62b23946aee9ce3113cc092c6362b1071d795899 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Sep 2019 05:59:07 +0200
+Subject: mips: Loongson: Fix the link time qualifier of 'serial_exit()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 25b69a889b638b0b7e51e2c4fe717a66bec0e566 ]
+
+'exit' functions should be marked as __exit, not __init.
+
+Fixes: 85cc028817ef ("mips: make loongsoon serial driver explicitly modular")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: chenhc@lemote.com
+Cc: ralf@linux-mips.org
+Cc: jhogan@kernel.org
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: kernel-janitors@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/loongson64/common/serial.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/mips/loongson64/common/serial.c b/arch/mips/loongson64/common/serial.c
+index ffefc1cb26121..98c3a7feb10f8 100644
+--- a/arch/mips/loongson64/common/serial.c
++++ b/arch/mips/loongson64/common/serial.c
+@@ -110,7 +110,7 @@ static int __init serial_init(void)
+ }
+ module_init(serial_init);
+
+-static void __init serial_exit(void)
++static void __exit serial_exit(void)
+ {
+ platform_device_unregister(&uart8250_device);
+ }
+--
+2.20.1
+
--- /dev/null
+From 85b3dc399b5a90c500b754346914daa2af0a6262 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 16:30:27 -0700
+Subject: namespace: fix namespace.pl script to support relative paths
+
+From: Jacob Keller <jacob.e.keller@intel.com>
+
+[ Upstream commit 82fdd12b95727640c9a8233c09d602e4518e71f7 ]
+
+The namespace.pl script does not work properly if objtree is not set to
+an absolute path. The do_nm function is run from within the find
+function, which changes directories.
+
+Because of this, appending objtree, $File::Find::dir, and $source, will
+return a path which is not valid from the current directory.
+
+This used to work when objtree was set to an absolute path when using
+"make namespacecheck". It appears to have not worked when calling
+./scripts/namespace.pl directly.
+
+This behavior was changed in 7e1c04779efd ("kbuild: Use relative path
+for $(objtree)", 2014-05-14)
+
+Rather than fixing the Makefile to set objtree to an absolute path, just
+fix namespace.pl to work when srctree and objtree are relative. Also fix
+the script to use an absolute path for these by default.
+
+Use the File::Spec module for this purpose. It's been part of perl
+5 since 5.005.
+
+The curdir() function is used to get the current directory when the
+objtree and srctree aren't set in the environment.
+
+rel2abs() is used to convert possibly relative objtree and srctree
+environment variables to absolute paths.
+
+Finally, the catfile() function is used instead of string appending
+paths together, since this is more robust when joining paths together.
+
+Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Acked-by: Randy Dunlap <rdunlap@infradead.org>
+Tested-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/namespace.pl | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/scripts/namespace.pl b/scripts/namespace.pl
+index 6135574a6f394..1da7bca201a42 100755
+--- a/scripts/namespace.pl
++++ b/scripts/namespace.pl
+@@ -65,13 +65,14 @@
+ use warnings;
+ use strict;
+ use File::Find;
++use File::Spec;
+
+ my $nm = ($ENV{'NM'} || "nm") . " -p";
+ my $objdump = ($ENV{'OBJDUMP'} || "objdump") . " -s -j .comment";
+-my $srctree = "";
+-my $objtree = "";
+-$srctree = "$ENV{'srctree'}/" if (exists($ENV{'srctree'}));
+-$objtree = "$ENV{'objtree'}/" if (exists($ENV{'objtree'}));
++my $srctree = File::Spec->curdir();
++my $objtree = File::Spec->curdir();
++$srctree = File::Spec->rel2abs($ENV{'srctree'}) if (exists($ENV{'srctree'}));
++$objtree = File::Spec->rel2abs($ENV{'objtree'}) if (exists($ENV{'objtree'}));
+
+ if ($#ARGV != -1) {
+ print STDERR "usage: $0 takes no parameters\n";
+@@ -231,9 +232,9 @@ sub do_nm
+ }
+ ($source = $basename) =~ s/\.o$//;
+ if (-e "$source.c" || -e "$source.S") {
+- $source = "$objtree$File::Find::dir/$source";
++ $source = File::Spec->catfile($objtree, $File::Find::dir, $source)
+ } else {
+- $source = "$srctree$File::Find::dir/$source";
++ $source = File::Spec->catfile($srctree, $File::Find::dir, $source)
+ }
+ if (! -e "$source.c" && ! -e "$source.S") {
+ # No obvious source, exclude the object if it is conglomerate
+--
+2.20.1
+
--- /dev/null
+From 3aa1f52c5cec2fb17f6cd57eb28dff03949045e7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 08:41:47 +0200
+Subject: net: ag71xx: fix mdio subnode support
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+[ Upstream commit 569aad4fcd82cba64eb10ede235d330a00f0aa09 ]
+
+This patch is syncing driver with actual devicetree documentation:
+Documentation/devicetree/bindings/net/qca,ar71xx.txt
+|Optional subnodes:
+|- mdio : specifies the mdio bus, used as a container for phy nodes
+| according to phy.txt in the same directory
+
+The driver was working with fixed phy without any noticeable issues. This bug
+was uncovered by introducing dsa ar9331-switch driver.
+Since no one reported this bug until now, I assume no body is using it
+and this patch should not brake existing system.
+
+Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver")
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/atheros/ag71xx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
+index 6703960c7cf50..d1101eea15c2a 100644
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -526,7 +526,7 @@ static int ag71xx_mdio_probe(struct ag71xx *ag)
+ struct device *dev = &ag->pdev->dev;
+ struct net_device *ndev = ag->ndev;
+ static struct mii_bus *mii_bus;
+- struct device_node *np;
++ struct device_node *np, *mnp;
+ int err;
+
+ np = dev->of_node;
+@@ -571,7 +571,9 @@ static int ag71xx_mdio_probe(struct ag71xx *ag)
+ msleep(200);
+ }
+
+- err = of_mdiobus_register(mii_bus, np);
++ mnp = of_get_child_by_name(np, "mdio");
++ err = of_mdiobus_register(mii_bus, mnp);
++ of_node_put(mnp);
+ if (err)
+ goto mdio_err_put_clk;
+
+--
+2.20.1
+
--- /dev/null
+From 9356246509ec1808578fec03b06faae3c26c6917 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 10:59:17 +0200
+Subject: net: dsa: qca8k: Use up to 7 ports for all operations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michal Vokáč <michal.vokac@ysoft.com>
+
+[ Upstream commit 7ae6d93c8f052b7a77ba56ed0f654e22a2876739 ]
+
+The QCA8K family supports up to 7 ports. So use the existing
+QCA8K_NUM_PORTS define to allocate the switch structure and limit all
+operations with the switch ports.
+
+This was not an issue until commit 0394a63acfe2 ("net: dsa: enable and
+disable all ports") disabled all unused ports. Since the unused ports 7-11
+are outside of the correct register range on this switch some registers
+were rewritten with invalid content.
+
+Fixes: 6b93fb46480a ("net-next: dsa: add new driver for qca8xxx family")
+Fixes: a0c02161ecfc ("net: dsa: variable number of ports")
+Fixes: 0394a63acfe2 ("net: dsa: enable and disable all ports")
+Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/qca8k.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c
+index 16f15c93a102c..bbeeb8618c80c 100644
+--- a/drivers/net/dsa/qca8k.c
++++ b/drivers/net/dsa/qca8k.c
+@@ -705,7 +705,7 @@ qca8k_setup(struct dsa_switch *ds)
+ BIT(0) << QCA8K_GLOBAL_FW_CTRL1_UC_DP_S);
+
+ /* Setup connection between CPU port & user ports */
+- for (i = 0; i < DSA_MAX_PORTS; i++) {
++ for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+ /* CPU port gets connected to all user ports of the switch */
+ if (dsa_is_cpu_port(ds, i)) {
+ qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(QCA8K_CPU_PORT),
+@@ -1074,7 +1074,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev)
+ if (id != QCA8K_ID_QCA8337)
+ return -ENODEV;
+
+- priv->ds = dsa_switch_alloc(&mdiodev->dev, DSA_MAX_PORTS);
++ priv->ds = dsa_switch_alloc(&mdiodev->dev, QCA8K_NUM_PORTS);
+ if (!priv->ds)
+ return -ENOMEM;
+
+--
+2.20.1
+
--- /dev/null
+From 6351558fc53b99fe005cba967f0f79e6c3ab3607 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 15:00:47 +0800
+Subject: net: dsa: rtl8366rb: add missing of_node_put after calling
+ of_get_child_by_name
+
+From: Wen Yang <wenyang@linux.alibaba.com>
+
+[ Upstream commit f32eb9d80470dab05df26b6efd02d653c72e6a11 ]
+
+of_node_put needs to be called when the device node which is got
+from of_get_child_by_name finished using.
+irq_domain_add_linear() also calls of_node_get() to increase refcount,
+so irq_domain will not be affected when it is released.
+
+Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver")
+Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Vivien Didelot <vivien.didelot@gmail.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/rtl8366rb.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c
+index a268085ffad28..f5cc8b0a7c74c 100644
+--- a/drivers/net/dsa/rtl8366rb.c
++++ b/drivers/net/dsa/rtl8366rb.c
+@@ -507,7 +507,8 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ irq = of_irq_get(intc, 0);
+ if (irq <= 0) {
+ dev_err(smi->dev, "failed to get parent IRQ\n");
+- return irq ? irq : -EINVAL;
++ ret = irq ? irq : -EINVAL;
++ goto out_put_node;
+ }
+
+ /* This clears the IRQ status register */
+@@ -515,7 +516,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ &val);
+ if (ret) {
+ dev_err(smi->dev, "can't read interrupt status\n");
+- return ret;
++ goto out_put_node;
+ }
+
+ /* Fetch IRQ edge information from the descriptor */
+@@ -537,7 +538,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ val);
+ if (ret) {
+ dev_err(smi->dev, "could not configure IRQ polarity\n");
+- return ret;
++ goto out_put_node;
+ }
+
+ ret = devm_request_threaded_irq(smi->dev, irq, NULL,
+@@ -545,7 +546,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ "RTL8366RB", smi);
+ if (ret) {
+ dev_err(smi->dev, "unable to request irq: %d\n", ret);
+- return ret;
++ goto out_put_node;
+ }
+ smi->irqdomain = irq_domain_add_linear(intc,
+ RTL8366RB_NUM_INTERRUPT,
+@@ -553,12 +554,15 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi)
+ smi);
+ if (!smi->irqdomain) {
+ dev_err(smi->dev, "failed to create IRQ domain\n");
+- return -EINVAL;
++ ret = -EINVAL;
++ goto out_put_node;
+ }
+ for (i = 0; i < smi->num_ports; i++)
+ irq_set_parent(irq_create_mapping(smi->irqdomain, i), irq);
+
+- return 0;
++out_put_node:
++ of_node_put(intc);
++ return ret;
+ }
+
+ static int rtl8366rb_set_addr(struct realtek_smi *smi)
+--
+2.20.1
+
--- /dev/null
+From 2561f83437bf2b6868ff7395e58bb8e437a58570 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 13:24:39 -0700
+Subject: net: hisilicon: Fix usage of uninitialized variable in function
+ mdio_sc_cfg_reg_write()
+
+From: Yizhuo <yzhai003@ucr.edu>
+
+[ Upstream commit 53de429f4e88f538f7a8ec2b18be8c0cd9b2c8e1 ]
+
+In function mdio_sc_cfg_reg_write(), variable "reg_value" could be
+uninitialized if regmap_read() fails. However, "reg_value" is used
+to decide the control flow later in the if statement, which is
+potentially unsafe.
+
+Signed-off-by: Yizhuo <yzhai003@ucr.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hns_mdio.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
+index 3e863a71c5136..7df5d7d211d47 100644
+--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
++++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
+@@ -148,11 +148,15 @@ static int mdio_sc_cfg_reg_write(struct hns_mdio_device *mdio_dev,
+ {
+ u32 time_cnt;
+ u32 reg_value;
++ int ret;
+
+ regmap_write(mdio_dev->subctrl_vbase, cfg_reg, set_val);
+
+ for (time_cnt = MDIO_TIMEOUT; time_cnt; time_cnt--) {
+- regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value);
++ ret = regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value);
++ if (ret)
++ return ret;
++
+ reg_value &= st_msk;
+ if ((!!check_st) == (!!reg_value))
+ break;
+--
+2.20.1
+
--- /dev/null
+From 385fc6104c6b6b2304c093b1c1d249570b8dbbdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 14:54:24 +0800
+Subject: net: mscc: ocelot: add missing of_node_put after calling
+ of_get_child_by_name
+
+From: Wen Yang <wenyang@linux.alibaba.com>
+
+[ Upstream commit d2c50b1cd94528aea8c8e9abb4cce81590f32cc4 ]
+
+of_node_put needs to be called when the device node which is got
+from of_get_child_by_name finished using.
+In both cases of success and failure, we need to release 'ports',
+so clean up the code using goto.
+
+fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support")
+Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: netdev@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot_board.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c
+index 2451d4a96490b..041fb9f38ecaa 100644
+--- a/drivers/net/ethernet/mscc/ocelot_board.c
++++ b/drivers/net/ethernet/mscc/ocelot_board.c
+@@ -287,13 +287,14 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ continue;
+
+ phy = of_phy_find_device(phy_node);
++ of_node_put(phy_node);
+ if (!phy)
+ continue;
+
+ err = ocelot_probe_port(ocelot, port, regs, phy);
+ if (err) {
+ of_node_put(portnp);
+- return err;
++ goto out_put_ports;
+ }
+
+ phy_mode = of_get_phy_mode(portnp);
+@@ -321,7 +322,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ "invalid phy mode for port%d, (Q)SGMII only\n",
+ port);
+ of_node_put(portnp);
+- return -EINVAL;
++ err = -EINVAL;
++ goto out_put_ports;
+ }
+
+ serdes = devm_of_phy_get(ocelot->dev, portnp, NULL);
+@@ -334,7 +336,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+ "missing SerDes phys for port%d\n",
+ port);
+
+- goto err_probe_ports;
++ of_node_put(portnp);
++ goto out_put_ports;
+ }
+
+ ocelot->ports[port]->serdes = serdes;
+@@ -346,9 +349,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev)
+
+ dev_info(&pdev->dev, "Ocelot switch probed\n");
+
+- return 0;
+-
+-err_probe_ports:
++out_put_ports:
++ of_node_put(ports);
+ return err;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 7eb510a600eaf1a571642e70d22a43b671454c48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 15:53:32 +0200
+Subject: net: phy: allow for reset line to be tied to a sleepy GPIO controller
+
+From: Andrea Merello <andrea.merello@gmail.com>
+
+[ Upstream commit ea977d19d918324ad5b66953f051a6ed07d0a3c5 ]
+
+mdio_device_reset() makes use of the atomic-pretending API flavor for
+handling the PHY reset GPIO line.
+
+I found no hint that mdio_device_reset() is called from atomic context
+and indeed it uses usleep_range() since long time, so I would assume that
+it is OK to sleep there.
+
+This patch switch to gpiod_set_value_cansleep() in mdio_device_reset().
+This is relevant if e.g. the PHY reset line is tied to a I2C GPIO
+controller.
+
+This has been tested on a ZynqMP board running an upstream 4.19 kernel and
+then hand-ported on current kernel tree.
+
+Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/mdio_device.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c
+index e282600bd83e2..c1d345c3cab35 100644
+--- a/drivers/net/phy/mdio_device.c
++++ b/drivers/net/phy/mdio_device.c
+@@ -121,7 +121,7 @@ void mdio_device_reset(struct mdio_device *mdiodev, int value)
+ return;
+
+ if (mdiodev->reset_gpio)
+- gpiod_set_value(mdiodev->reset_gpio, value);
++ gpiod_set_value_cansleep(mdiodev->reset_gpio, value);
+
+ if (mdiodev->reset_ctrl) {
+ if (value)
+--
+2.20.1
+
--- /dev/null
+From aebb06e1b2b1c77870f6d6d1eac045dd6fef170e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 17:05:58 +0100
+Subject: net: phy: fix write to mii-ctrl1000 register
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4cf6c57e61fee954f7b7685de31b80ec26843d27 ]
+
+When userspace writes to the MII_ADVERTISE register, we update phylib's
+advertising mask and trigger a renegotiation. However, writing to the
+MII_CTRL1000 register, which contains the gigabit advertisement, does
+neither. This can lead to phylib's copy of the advertisement becoming
+de-synced with the values in the PHY register set, which can result in
+incorrect negotiation resolution.
+
+Fixes: 5502b218e001 ("net: phy: use phy_resolve_aneg_linkmode in genphy_read_status")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy.c | 5 +++++
+ include/linux/mii.h | 9 +++++++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
+index 6b0f89369b460..0a314cf454080 100644
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -457,6 +457,11 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
+ val);
+ change_autoneg = true;
+ break;
++ case MII_CTRL1000:
++ mii_ctrl1000_mod_linkmode_adv_t(phydev->advertising,
++ val);
++ change_autoneg = true;
++ break;
+ default:
+ /* do nothing */
+ break;
+diff --git a/include/linux/mii.h b/include/linux/mii.h
+index 5cd824c1c0caa..4ce8901a1af65 100644
+--- a/include/linux/mii.h
++++ b/include/linux/mii.h
+@@ -455,6 +455,15 @@ static inline void mii_lpa_mod_linkmode_lpa_t(unsigned long *lp_advertising,
+ lp_advertising, lpa & LPA_LPACK);
+ }
+
++static inline void mii_ctrl1000_mod_linkmode_adv_t(unsigned long *advertising,
++ u32 ctrl1000)
++{
++ linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT, advertising,
++ ctrl1000 & ADVERTISE_1000HALF);
++ linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, advertising,
++ ctrl1000 & ADVERTISE_1000FULL);
++}
++
+ /**
+ * linkmode_adv_to_lcl_adv_t
+ * @advertising:pointer to linkmode advertising
+--
+2.20.1
+
--- /dev/null
+From 036834184933337f5269912e37dd42455498f947 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 16:49:46 +0200
+Subject: net: stmmac: Avoid deadlock on suspend/resume
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 134cc4cefad34d8d24670d8a911b59c3b89c6731 ]
+
+The stmmac driver will try to acquire its private mutex during suspend
+via phylink_resolve() -> stmmac_mac_link_down() -> stmmac_eee_init().
+However, the phylink configuration is updated with the private mutex
+held already, which causes a deadlock during suspend.
+
+Fix this by moving the phylink configuration updates out of the region
+of code protected by the private mutex.
+
+Fixes: 19e13cb27b99 ("net: stmmac: Hold rtnl lock in suspend/resume callbacks")
+Suggested-by: Bitan Biswas <bbiswas@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 69cc9133336fc..8d5ec73e02d34 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4454,10 +4454,10 @@ int stmmac_suspend(struct device *dev)
+ if (!ndev || !netif_running(ndev))
+ return 0;
+
+- mutex_lock(&priv->lock);
+-
+ phylink_mac_change(priv->phylink, false);
+
++ mutex_lock(&priv->lock);
++
+ netif_device_detach(ndev);
+ stmmac_stop_all_queues(priv);
+
+@@ -4471,9 +4471,11 @@ int stmmac_suspend(struct device *dev)
+ stmmac_pmt(priv, priv->hw, priv->wolopts);
+ priv->irq_wake = 1;
+ } else {
++ mutex_unlock(&priv->lock);
+ rtnl_lock();
+ phylink_stop(priv->phylink);
+ rtnl_unlock();
++ mutex_lock(&priv->lock);
+
+ stmmac_mac_set(priv, priv->ioaddr, false);
+ pinctrl_pm_select_sleep_state(priv->device);
+@@ -4565,6 +4567,8 @@ int stmmac_resume(struct device *dev)
+
+ stmmac_start_all_queues(priv);
+
++ mutex_unlock(&priv->lock);
++
+ if (!device_may_wakeup(priv->device)) {
+ rtnl_lock();
+ phylink_start(priv->phylink);
+@@ -4573,8 +4577,6 @@ int stmmac_resume(struct device *dev)
+
+ phylink_mac_change(priv->phylink, true);
+
+- mutex_unlock(&priv->lock);
+-
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(stmmac_resume);
+--
+2.20.1
+
--- /dev/null
+From 16f82b82556ea7faa9d412a7c7510d754d99ee26 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 10:19:09 +0200
+Subject: net: stmmac: Correctly take timestamp for PTPv2
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 14f347334bf232074616e29e29103dd0c7c54dec ]
+
+The case for PTPV2_EVENT requires event packets to be captured so add
+this setting to the list of enabled captures.
+
+Fixes: 891434b18ec0 ("stmmac: add IEEE PTPv1 and PTPv2 support.")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 5c4408bdc843a..ade85ca9d8c7f 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -626,6 +626,7 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr)
+ config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
+ ptp_v2 = PTP_TCR_TSVER2ENA;
+ snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
++ ts_event_en = PTP_TCR_TSEVNTENA;
+ ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
+ ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
+ ptp_over_ethernet = PTP_TCR_TSIPENA;
+--
+2.20.1
+
--- /dev/null
+From 7a749d0659267dd1333013864984fa37c3ad6b9a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 10:19:10 +0200
+Subject: net: stmmac: Do not stop PHY if WoL is enabled
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 3e2bf04fb0447aa4b967b8000125178f55ae7800 ]
+
+If WoL is enabled we can't really stop the PHY, otherwise we will not
+receive the WoL packet. Fix this by telling phylink that only the MAC is
+down and only stop the PHY if WoL is not enabled.
+
+Fixes: 74371272f97f ("net: stmmac: Convert to phylink and remove phylib logic")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/stmicro/stmmac/stmmac_main.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index ade85ca9d8c7f..69cc9133336fc 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -4456,9 +4456,7 @@ int stmmac_suspend(struct device *dev)
+
+ mutex_lock(&priv->lock);
+
+- rtnl_lock();
+- phylink_stop(priv->phylink);
+- rtnl_unlock();
++ phylink_mac_change(priv->phylink, false);
+
+ netif_device_detach(ndev);
+ stmmac_stop_all_queues(priv);
+@@ -4473,6 +4471,10 @@ int stmmac_suspend(struct device *dev)
+ stmmac_pmt(priv, priv->hw, priv->wolopts);
+ priv->irq_wake = 1;
+ } else {
++ rtnl_lock();
++ phylink_stop(priv->phylink);
++ rtnl_unlock();
++
+ stmmac_mac_set(priv, priv->ioaddr, false);
+ pinctrl_pm_select_sleep_state(priv->device);
+ /* Disable clock in case of PWM is off */
+@@ -4563,9 +4565,13 @@ int stmmac_resume(struct device *dev)
+
+ stmmac_start_all_queues(priv);
+
+- rtnl_lock();
+- phylink_start(priv->phylink);
+- rtnl_unlock();
++ if (!device_may_wakeup(priv->device)) {
++ rtnl_lock();
++ phylink_start(priv->phylink);
++ rtnl_unlock();
++ }
++
++ phylink_mac_change(priv->phylink, true);
+
+ mutex_unlock(&priv->lock);
+
+--
+2.20.1
+
--- /dev/null
+From a1846370d2ffe2135c79831addc868b5c0ff9661 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 10:19:08 +0200
+Subject: net: stmmac: dwmac4: Always update the MAC Hash Filter
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit f79bfda3756c50a86c0ee65091935c42c5bbe0cb ]
+
+We need to always update the MAC Hash Filter so that previous entries
+are invalidated.
+
+Found out while running stmmac selftests.
+
+Fixes: b8ef7020d6e5 ("net: stmmac: add support for hash table size 128/256 in dwmac4")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index fc9954e4a7729..9c73fb759b575 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -407,8 +407,11 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ int numhashregs = (hw->multicast_filter_bins >> 5);
+ int mcbitslog2 = hw->mcast_bits_log2;
+ unsigned int value;
++ u32 mc_filter[8];
+ int i;
+
++ memset(mc_filter, 0, sizeof(mc_filter));
++
+ value = readl(ioaddr + GMAC_PACKET_FILTER);
+ value &= ~GMAC_PACKET_FILTER_HMC;
+ value &= ~GMAC_PACKET_FILTER_HPF;
+@@ -422,16 +425,13 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ /* Pass all multi */
+ value |= GMAC_PACKET_FILTER_PM;
+ /* Set all the bits of the HASH tab */
+- for (i = 0; i < numhashregs; i++)
+- writel(0xffffffff, ioaddr + GMAC_HASH_TAB(i));
++ memset(mc_filter, 0xff, sizeof(mc_filter));
+ } else if (!netdev_mc_empty(dev)) {
+ struct netdev_hw_addr *ha;
+- u32 mc_filter[8];
+
+ /* Hash filter for multicast */
+ value |= GMAC_PACKET_FILTER_HMC;
+
+- memset(mc_filter, 0, sizeof(mc_filter));
+ netdev_for_each_mc_addr(ha, dev) {
+ /* The upper n bits of the calculated CRC are used to
+ * index the contents of the hash table. The number of
+@@ -446,10 +446,11 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ */
+ mc_filter[bit_nr >> 5] |= (1 << (bit_nr & 0x1f));
+ }
+- for (i = 0; i < numhashregs; i++)
+- writel(mc_filter[i], ioaddr + GMAC_HASH_TAB(i));
+ }
+
++ for (i = 0; i < numhashregs; i++)
++ writel(mc_filter[i], ioaddr + GMAC_HASH_TAB(i));
++
+ value |= GMAC_PACKET_FILTER_HPF;
+
+ /* Handle multiple unicast addresses */
+--
+2.20.1
+
--- /dev/null
+From 0c620fa5cb55dac35e04969efd40616f47383f22 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 10:19:05 +0200
+Subject: net: stmmac: xgmac: Not all Unicast addresses may be available
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 9a2ae7b3960eb2426a8560cbc3251e3453230d21 ]
+
+Some setups may not have all Unicast addresses filters available. Let's
+check this before trying to setup filters.
+
+Fixes: 0efedbf11f07 ("net: stmmac: xgmac: Fix XGMAC selftests")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+index 85c68b7ee8c6a..46d74f407aab6 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -370,7 +370,7 @@ static void dwxgmac2_set_filter(struct mac_device_info *hw,
+ dwxgmac2_set_mchash(ioaddr, mc_filter, mcbitslog2);
+
+ /* Handle multiple unicast addresses */
+- if (netdev_uc_count(dev) > XGMAC_ADDR_MAX) {
++ if (netdev_uc_count(dev) > hw->unicast_filter_entries) {
+ value |= XGMAC_FILTER_PR;
+ } else {
+ struct netdev_hw_addr *ha;
+--
+2.20.1
+
--- /dev/null
+From b80086f375ecd0debfcf8e61aae184c666d6f7ac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 11:05:49 +0200
+Subject: netfilter: nft_connlimit: disable bh on garbage collection
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 34a4c95abd25ab41fb390b985a08a651b1fa0b0f ]
+
+BH must be disabled when invoking nf_conncount_gc_list() to perform
+garbage collection, otherwise deadlock might happen.
+
+ nf_conncount_add+0x1f/0x50 [nf_conncount]
+ nft_connlimit_eval+0x4c/0xe0 [nft_connlimit]
+ nft_dynset_eval+0xb5/0x100 [nf_tables]
+ nft_do_chain+0xea/0x420 [nf_tables]
+ ? sch_direct_xmit+0x111/0x360
+ ? noqueue_init+0x10/0x10
+ ? __qdisc_run+0x84/0x510
+ ? tcp_packet+0x655/0x1610 [nf_conntrack]
+ ? ip_finish_output2+0x1a7/0x430
+ ? tcp_error+0x130/0x150 [nf_conntrack]
+ ? nf_conntrack_in+0x1fc/0x4c0 [nf_conntrack]
+ nft_do_chain_ipv4+0x66/0x80 [nf_tables]
+ nf_hook_slow+0x44/0xc0
+ ip_rcv+0xb5/0xd0
+ ? ip_rcv_finish_core.isra.19+0x360/0x360
+ __netif_receive_skb_one_core+0x52/0x70
+ netif_receive_skb_internal+0x34/0xe0
+ napi_gro_receive+0xba/0xe0
+ e1000_clean_rx_irq+0x1e9/0x420 [e1000e]
+ e1000e_poll+0xbe/0x290 [e1000e]
+ net_rx_action+0x149/0x3b0
+ __do_softirq+0xde/0x2d8
+ irq_exit+0xba/0xc0
+ do_IRQ+0x85/0xd0
+ common_interrupt+0xf/0xf
+ </IRQ>
+ RIP: 0010:nf_conncount_gc_list+0x3b/0x130 [nf_conncount]
+
+Fixes: 2f971a8f4255 ("netfilter: nf_conncount: move all list iterations under spinlock")
+Reported-by: Laura Garcia Liebana <nevola@gmail.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_connlimit.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
+index af1497ab94642..69d6173f91e2b 100644
+--- a/net/netfilter/nft_connlimit.c
++++ b/net/netfilter/nft_connlimit.c
+@@ -218,8 +218,13 @@ static void nft_connlimit_destroy_clone(const struct nft_ctx *ctx,
+ static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)
+ {
+ struct nft_connlimit *priv = nft_expr_priv(expr);
++ bool ret;
+
+- return nf_conncount_gc_list(net, &priv->list);
++ local_bh_disable();
++ ret = nf_conncount_gc_list(net, &priv->list);
++ local_bh_enable();
++
++ return ret;
+ }
+
+ static struct nft_expr_type nft_connlimit_type;
+--
+2.20.1
+
--- /dev/null
+From 6c3081cdc9a5312be7a407b749724ca384a83046 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 26 Sep 2019 16:16:50 +0800
+Subject: nl80211: fix null pointer dereference
+
+From: Miaoqing Pan <miaoqing@codeaurora.org>
+
+[ Upstream commit b501426cf86e70649c983c52f4c823b3c40d72a3 ]
+
+If the interface is not in MESH mode, the command 'iw wlanx mpath del'
+will cause kernel panic.
+
+The root cause is null pointer access in mpp_flush_by_proxy(), as the
+pointer 'sdata->u.mesh.mpp_paths' is NULL for non MESH interface.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000068
+[...]
+PC is at _raw_spin_lock_bh+0x20/0x5c
+LR is at mesh_path_del+0x1c/0x17c [mac80211]
+[...]
+Process iw (pid: 4537, stack limit = 0xd83e0238)
+[...]
+[<c021211c>] (_raw_spin_lock_bh) from [<bf8c7648>] (mesh_path_del+0x1c/0x17c [mac80211])
+[<bf8c7648>] (mesh_path_del [mac80211]) from [<bf6cdb7c>] (extack_doit+0x20/0x68 [compat])
+[<bf6cdb7c>] (extack_doit [compat]) from [<c05c309c>] (genl_rcv_msg+0x274/0x30c)
+[<c05c309c>] (genl_rcv_msg) from [<c05c25d8>] (netlink_rcv_skb+0x58/0xac)
+[<c05c25d8>] (netlink_rcv_skb) from [<c05c2e14>] (genl_rcv+0x20/0x34)
+[<c05c2e14>] (genl_rcv) from [<c05c1f90>] (netlink_unicast+0x11c/0x204)
+[<c05c1f90>] (netlink_unicast) from [<c05c2420>] (netlink_sendmsg+0x30c/0x370)
+[<c05c2420>] (netlink_sendmsg) from [<c05886d0>] (sock_sendmsg+0x70/0x84)
+[<c05886d0>] (sock_sendmsg) from [<c0589f4c>] (___sys_sendmsg.part.3+0x188/0x228)
+[<c0589f4c>] (___sys_sendmsg.part.3) from [<c058add4>] (__sys_sendmsg+0x4c/0x70)
+[<c058add4>] (__sys_sendmsg) from [<c0208c80>] (ret_fast_syscall+0x0/0x44)
+Code: e2822c02 e2822001 e5832004 f590f000 (e1902f9f)
+---[ end trace bbd717600f8f884d ]---
+
+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
+Link: https://lore.kernel.org/r/1569485810-761-1-git-send-email-miaoqing@codeaurora.org
+[trim useless data from commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index f03459ddc840a..c2ce582ea1437 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6184,6 +6184,9 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
+ if (!rdev->ops->del_mpath)
+ return -EOPNOTSUPP;
+
++ if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
++ return -EOPNOTSUPP;
++
+ return rdev_del_mpath(rdev, dev, dst);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 97b83b613b88355cdcc1f74b8f592dfcc7a1c152 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 17:42:41 +0800
+Subject: nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T
+
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+
+[ Upstream commit 19ea025e1d28c629b369c3532a85b3df478cc5c6 ]
+
+Kingston NVME SSD with firmware version E8FK11.T has no interrupt after
+resume with actions related to suspend to idle. This patch applied
+NVME_QUIRK_SIMPLE_SUSPEND quirk to fix this issue.
+
+Fixes: d916b1be94b6 ("nvme-pci: use host managed power state for suspend")
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=204887
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index ac2ac06d870b5..3304e2c8a448a 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2270,6 +2270,16 @@ static const struct nvme_core_quirk_entry core_quirks[] = {
+ .vid = 0x14a4,
+ .fr = "22301111",
+ .quirks = NVME_QUIRK_SIMPLE_SUSPEND,
++ },
++ {
++ /*
++ * This Kingston E8FK11.T firmware version has no interrupt
++ * after resume with actions related to suspend to idle
++ * https://bugzilla.kernel.org/show_bug.cgi?id=204887
++ */
++ .vid = 0x2646,
++ .fr = "E8FK11.T",
++ .quirks = NVME_QUIRK_SIMPLE_SUSPEND,
+ }
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 6441e6445adbb8d01d095a79f362c3faf5b51728 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 15:14:52 +0200
+Subject: nvme: allow 64-bit results in passthru commands
+
+From: Marta Rybczynska <mrybczyn@kalray.eu>
+
+[ Upstream commit 65e68edce0db433aa0c2b26d7dc14fbbbeb89fbb ]
+
+It is not possible to get 64-bit results from the passthru commands,
+what prevents from getting for the Capabilities (CAP) property value.
+
+As a result, it is not possible to implement IOL's NVMe Conformance
+test 4.3 Case 1 for Fabrics targets [1] (page 123).
+
+This issue has been already discussed [2], but without a solution.
+
+This patch solves the problem by adding new ioctls with a new
+passthru structure, including 64-bit results. The older ioctls stay
+unchanged.
+
+[1] https://www.iol.unh.edu/sites/default/files/testsuites/nvme/UNH-IOL_NVMe_Conformance_Test_Suite_v11.0.pdf
+[2] http://lists.infradead.org/pipermail/linux-nvme/2018-June/018791.html
+
+Signed-off-by: Marta Rybczynska <marta.rybczynska@kalray.eu>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 108 +++++++++++++++++++++++++++-----
+ include/uapi/linux/nvme_ioctl.h | 23 +++++++
+ 2 files changed, 115 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 3304e2c8a448a..36a5ed1eacbea 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -852,7 +852,7 @@ static void *nvme_add_user_metadata(struct bio *bio, void __user *ubuf,
+ static int nvme_submit_user_cmd(struct request_queue *q,
+ struct nvme_command *cmd, void __user *ubuffer,
+ unsigned bufflen, void __user *meta_buffer, unsigned meta_len,
+- u32 meta_seed, u32 *result, unsigned timeout)
++ u32 meta_seed, u64 *result, unsigned timeout)
+ {
+ bool write = nvme_is_write(cmd);
+ struct nvme_ns *ns = q->queuedata;
+@@ -893,7 +893,7 @@ static int nvme_submit_user_cmd(struct request_queue *q,
+ else
+ ret = nvme_req(req)->status;
+ if (result)
+- *result = le32_to_cpu(nvme_req(req)->result.u32);
++ *result = le64_to_cpu(nvme_req(req)->result.u64);
+ if (meta && !ret && !write) {
+ if (copy_to_user(meta_buffer, meta, meta_len))
+ ret = -EFAULT;
+@@ -1339,6 +1339,54 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ struct nvme_command c;
+ unsigned timeout = 0;
+ u32 effects;
++ u64 result;
++ int status;
++
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
++ if (copy_from_user(&cmd, ucmd, sizeof(cmd)))
++ return -EFAULT;
++ if (cmd.flags)
++ return -EINVAL;
++
++ memset(&c, 0, sizeof(c));
++ c.common.opcode = cmd.opcode;
++ c.common.flags = cmd.flags;
++ c.common.nsid = cpu_to_le32(cmd.nsid);
++ c.common.cdw2[0] = cpu_to_le32(cmd.cdw2);
++ c.common.cdw2[1] = cpu_to_le32(cmd.cdw3);
++ c.common.cdw10 = cpu_to_le32(cmd.cdw10);
++ c.common.cdw11 = cpu_to_le32(cmd.cdw11);
++ c.common.cdw12 = cpu_to_le32(cmd.cdw12);
++ c.common.cdw13 = cpu_to_le32(cmd.cdw13);
++ c.common.cdw14 = cpu_to_le32(cmd.cdw14);
++ c.common.cdw15 = cpu_to_le32(cmd.cdw15);
++
++ if (cmd.timeout_ms)
++ timeout = msecs_to_jiffies(cmd.timeout_ms);
++
++ effects = nvme_passthru_start(ctrl, ns, cmd.opcode);
++ status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c,
++ (void __user *)(uintptr_t)cmd.addr, cmd.data_len,
++ (void __user *)(uintptr_t)cmd.metadata,
++ cmd.metadata_len, 0, &result, timeout);
++ nvme_passthru_end(ctrl, effects);
++
++ if (status >= 0) {
++ if (put_user(result, &ucmd->result))
++ return -EFAULT;
++ }
++
++ return status;
++}
++
++static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
++ struct nvme_passthru_cmd64 __user *ucmd)
++{
++ struct nvme_passthru_cmd64 cmd;
++ struct nvme_command c;
++ unsigned timeout = 0;
++ u32 effects;
+ int status;
+
+ if (!capable(CAP_SYS_ADMIN))
+@@ -1409,6 +1457,41 @@ static void nvme_put_ns_from_disk(struct nvme_ns_head *head, int idx)
+ srcu_read_unlock(&head->srcu, idx);
+ }
+
++static bool is_ctrl_ioctl(unsigned int cmd)
++{
++ if (cmd == NVME_IOCTL_ADMIN_CMD || cmd == NVME_IOCTL_ADMIN64_CMD)
++ return true;
++ if (is_sed_ioctl(cmd))
++ return true;
++ return false;
++}
++
++static int nvme_handle_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd,
++ void __user *argp,
++ struct nvme_ns_head *head,
++ int srcu_idx)
++{
++ struct nvme_ctrl *ctrl = ns->ctrl;
++ int ret;
++
++ nvme_get_ctrl(ns->ctrl);
++ nvme_put_ns_from_disk(head, srcu_idx);
++
++ switch (cmd) {
++ case NVME_IOCTL_ADMIN_CMD:
++ ret = nvme_user_cmd(ctrl, NULL, argp);
++ break;
++ case NVME_IOCTL_ADMIN64_CMD:
++ ret = nvme_user_cmd64(ctrl, NULL, argp);
++ break;
++ default:
++ ret = sed_ioctl(ctrl->opal_dev, cmd, argp);
++ break;
++ }
++ nvme_put_ctrl(ctrl);
++ return ret;
++}
++
+ static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+@@ -1426,20 +1509,8 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
+ * seperately and drop the ns SRCU reference early. This avoids a
+ * deadlock when deleting namespaces using the passthrough interface.
+ */
+- if (cmd == NVME_IOCTL_ADMIN_CMD || is_sed_ioctl(cmd)) {
+- struct nvme_ctrl *ctrl = ns->ctrl;
+-
+- nvme_get_ctrl(ns->ctrl);
+- nvme_put_ns_from_disk(head, srcu_idx);
+-
+- if (cmd == NVME_IOCTL_ADMIN_CMD)
+- ret = nvme_user_cmd(ctrl, NULL, argp);
+- else
+- ret = sed_ioctl(ctrl->opal_dev, cmd, argp);
+-
+- nvme_put_ctrl(ctrl);
+- return ret;
+- }
++ if (is_ctrl_ioctl(cmd))
++ return nvme_handle_ctrl_ioctl(ns, cmd, argp, head, srcu_idx);
+
+ switch (cmd) {
+ case NVME_IOCTL_ID:
+@@ -1452,6 +1523,9 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode,
+ case NVME_IOCTL_SUBMIT_IO:
+ ret = nvme_submit_io(ns, argp);
+ break;
++ case NVME_IOCTL_IO64_CMD:
++ ret = nvme_user_cmd64(ns->ctrl, ns, argp);
++ break;
+ default:
+ if (ns->ndev)
+ ret = nvme_nvm_ioctl(ns, cmd, arg);
+@@ -2826,6 +2900,8 @@ static long nvme_dev_ioctl(struct file *file, unsigned int cmd,
+ switch (cmd) {
+ case NVME_IOCTL_ADMIN_CMD:
+ return nvme_user_cmd(ctrl, NULL, argp);
++ case NVME_IOCTL_ADMIN64_CMD:
++ return nvme_user_cmd64(ctrl, NULL, argp);
+ case NVME_IOCTL_IO_CMD:
+ return nvme_dev_user_cmd(ctrl, argp);
+ case NVME_IOCTL_RESET:
+diff --git a/include/uapi/linux/nvme_ioctl.h b/include/uapi/linux/nvme_ioctl.h
+index 1c215ea1798e6..e168dc59e9a0d 100644
+--- a/include/uapi/linux/nvme_ioctl.h
++++ b/include/uapi/linux/nvme_ioctl.h
+@@ -45,6 +45,27 @@ struct nvme_passthru_cmd {
+ __u32 result;
+ };
+
++struct nvme_passthru_cmd64 {
++ __u8 opcode;
++ __u8 flags;
++ __u16 rsvd1;
++ __u32 nsid;
++ __u32 cdw2;
++ __u32 cdw3;
++ __u64 metadata;
++ __u64 addr;
++ __u32 metadata_len;
++ __u32 data_len;
++ __u32 cdw10;
++ __u32 cdw11;
++ __u32 cdw12;
++ __u32 cdw13;
++ __u32 cdw14;
++ __u32 cdw15;
++ __u32 timeout_ms;
++ __u64 result;
++};
++
+ #define nvme_admin_cmd nvme_passthru_cmd
+
+ #define NVME_IOCTL_ID _IO('N', 0x40)
+@@ -54,5 +75,7 @@ struct nvme_passthru_cmd {
+ #define NVME_IOCTL_RESET _IO('N', 0x44)
+ #define NVME_IOCTL_SUBSYS_RESET _IO('N', 0x45)
+ #define NVME_IOCTL_RESCAN _IO('N', 0x46)
++#define NVME_IOCTL_ADMIN64_CMD _IOWR('N', 0x47, struct nvme_passthru_cmd64)
++#define NVME_IOCTL_IO64_CMD _IOWR('N', 0x48, struct nvme_passthru_cmd64)
+
+ #endif /* _UAPI_LINUX_NVME_IOCTL_H */
+--
+2.20.1
+
--- /dev/null
+From 54a9131f733faf0940e84bd49d24e807688328b4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 23 Sep 2019 17:18:36 +0300
+Subject: nvme: fix an error code in nvme_init_subsystem()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit bc4f6e06a90ea016855fc67212b4d500145f0b8a ]
+
+"ret" should be a negative error code here, but it's either success or
+possibly uninitialized.
+
+Fixes: 32fd90c40768 ("nvme: change locking for the per-subsystem controller list")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 28217cee5e762..ac2ac06d870b5 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2513,8 +2513,9 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id)
+ list_add_tail(&subsys->entry, &nvme_subsystems);
+ }
+
+- if (sysfs_create_link(&subsys->dev.kobj, &ctrl->device->kobj,
+- dev_name(ctrl->device))) {
++ ret = sysfs_create_link(&subsys->dev.kobj, &ctrl->device->kobj,
++ dev_name(ctrl->device));
++ if (ret) {
+ dev_err(ctrl->device,
+ "failed to create sysfs link from subsystem.\n");
+ goto out_put_subsystem;
+--
+2.20.1
+
--- /dev/null
+From 066f74f2d2cdf63214a08695f6ef5ca324607bf1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 00:27:20 +0000
+Subject: nvme-pci: Fix a race in controller removal
+
+From: Balbir Singh <sblbir@amzn.com>
+
+[ Upstream commit b224726de5e496dbf78147a66755c3d81e28bdd2 ]
+
+User space programs like udevd may try to read to partitions at the
+same time the driver detects a namespace is unusable, and may deadlock
+if revalidate_disk() is called while such a process is waiting to
+enter the frozen queue. On detecting a dead namespace, move the disk
+revalidate after unblocking dispatchers that may be holding bd_butex.
+
+changelog Suggested-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Balbir Singh <sblbir@amzn.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/core.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index d3d6b7bd69033..28217cee5e762 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -103,10 +103,13 @@ static void nvme_set_queue_dying(struct nvme_ns *ns)
+ */
+ if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags))
+ return;
+- revalidate_disk(ns->disk);
+ blk_set_queue_dying(ns->queue);
+ /* Forcibly unquiesce queues to avoid blocking dispatch */
+ blk_mq_unquiesce_queue(ns->queue);
++ /*
++ * Revalidate after unblocking dispatchers that may be holding bd_butex
++ */
++ revalidate_disk(ns->disk);
+ }
+
+ static void nvme_queue_scan(struct nvme_ctrl *ctrl)
+--
+2.20.1
+
--- /dev/null
+From 5608332f2ae5b422b93819980155cef92b02fe42 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 13:15:55 -0500
+Subject: nvme-pci: Save PCI state before putting drive into deepest state
+
+From: Mario Limonciello <mario.limonciello@dell.com>
+
+[ Upstream commit 7cbb5c6f9aa7cfda7175d82a9cf77a92965b0c5e ]
+
+The action of saving the PCI state will cause numerous PCI configuration
+space reads which depending upon the vendor implementation may cause
+the drive to exit the deepest NVMe state.
+
+In these cases ASPM will typically resolve the PCIe link state and APST
+may resolve the NVMe power state. However it has also been observed
+that this register access after quiesced will cause PC10 failure
+on some device combinations.
+
+To resolve this, move the PCI state saving to before SetFeatures has been
+called. This has been proven to resolve the issue across a 5000 sample
+test on previously failing disk/system combinations.
+
+Signed-off-by: Mario Limonciello <mario.limonciello@dell.com>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/pci.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 732d5b63ec054..19458e85dab34 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -2894,11 +2894,21 @@ static int nvme_suspend(struct device *dev)
+ if (ret < 0)
+ goto unfreeze;
+
++ /*
++ * A saved state prevents pci pm from generically controlling the
++ * device's power. If we're using protocol specific settings, we don't
++ * want pci interfering.
++ */
++ pci_save_state(pdev);
++
+ ret = nvme_set_power_state(ctrl, ctrl->npss);
+ if (ret < 0)
+ goto unfreeze;
+
+ if (ret) {
++ /* discard the saved state */
++ pci_load_saved_state(pdev, NULL);
++
+ /*
+ * Clearing npss forces a controller reset on resume. The
+ * correct value will be resdicovered then.
+@@ -2906,14 +2916,7 @@ static int nvme_suspend(struct device *dev)
+ nvme_dev_disable(ndev, true);
+ ctrl->npss = 0;
+ ret = 0;
+- goto unfreeze;
+ }
+- /*
+- * A saved state prevents pci pm from generically controlling the
+- * device's power. If we're using protocol specific settings, we don't
+- * want pci interfering.
+- */
+- pci_save_state(pdev);
+ unfreeze:
+ nvme_unfreeze(ctrl);
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From f7665ad184a62da83248004b09adb3181c753c73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Sep 2019 23:58:19 +0300
+Subject: nvme-rdma: Fix max_hw_sectors calculation
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit ff13c1b87c97275b82b2af99044b4abf6861b28f ]
+
+By default, the NVMe/RDMA driver should support max io_size of 1MiB (or
+upto the maximum supported size by the HCA). Currently, one will see that
+/sys/class/block/<bdev>/queue/max_hw_sectors_kb is 1020 instead of 1024.
+
+A non power of 2 value can cause performance degradation due to
+unnecessary splitting of IO requests and unoptimized allocation units.
+
+The number of pages per MR has been fixed here, so there is no longer any
+need to reduce max_sectors by 1.
+
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 1a6449bc547b9..cc1956349a2af 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -427,7 +427,7 @@ static void nvme_rdma_destroy_queue_ib(struct nvme_rdma_queue *queue)
+ static int nvme_rdma_get_max_fr_pages(struct ib_device *ibdev)
+ {
+ return min_t(u32, NVME_RDMA_MAX_SEGMENTS,
+- ibdev->attrs.max_fast_reg_page_list_len);
++ ibdev->attrs.max_fast_reg_page_list_len - 1);
+ }
+
+ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+@@ -437,7 +437,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+ const int cq_factor = send_wr_factor + 1; /* + RECV */
+ int comp_vector, idx = nvme_rdma_queue_idx(queue);
+ enum ib_poll_context poll_ctx;
+- int ret;
++ int ret, pages_per_mr;
+
+ queue->device = nvme_rdma_find_get_device(queue->cm_id);
+ if (!queue->device) {
+@@ -479,10 +479,16 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue)
+ goto out_destroy_qp;
+ }
+
++ /*
++ * Currently we don't use SG_GAPS MR's so if the first entry is
++ * misaligned we'll end up using two entries for a single data page,
++ * so one additional entry is required.
++ */
++ pages_per_mr = nvme_rdma_get_max_fr_pages(ibdev) + 1;
+ ret = ib_mr_pool_init(queue->qp, &queue->qp->rdma_mrs,
+ queue->queue_size,
+ IB_MR_TYPE_MEM_REG,
+- nvme_rdma_get_max_fr_pages(ibdev), 0);
++ pages_per_mr, 0);
+ if (ret) {
+ dev_err(queue->ctrl->ctrl.device,
+ "failed to initialize MR pool sized %d for QID %d\n",
+@@ -824,8 +830,8 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
+ if (error)
+ goto out_stop_queue;
+
+- ctrl->ctrl.max_hw_sectors =
+- (ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9);
++ ctrl->ctrl.max_segments = ctrl->max_fr_pages;
++ ctrl->ctrl.max_hw_sectors = ctrl->max_fr_pages << (ilog2(SZ_4K) - 9);
+
+ error = nvme_init_identify(&ctrl->ctrl);
+ if (error)
+--
+2.20.1
+
--- /dev/null
+From 307f46ab6cf0325e33ebdaf7d965316809eb8bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 11:27:05 -0700
+Subject: nvme-rdma: fix possible use-after-free in connect timeout
+
+From: Sagi Grimberg <sagi@grimberg.me>
+
+[ Upstream commit 67b483dd03c4cd9e90e4c3943132dce514ea4e88 ]
+
+If the connect times out, we may have already destroyed the
+queue in the timeout handler, so test if the queue is still
+allocated in the connect error handler.
+
+Reported-by: Yi Zhang <yi.zhang@redhat.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index cc1956349a2af..842ef876724f7 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -620,7 +620,8 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx)
+ if (!ret) {
+ set_bit(NVME_RDMA_Q_LIVE, &queue->flags);
+ } else {
+- __nvme_rdma_stop_queue(queue);
++ if (test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
++ __nvme_rdma_stop_queue(queue);
+ dev_info(ctrl->ctrl.device,
+ "failed to connect queue: %d ret=%d\n", idx, ret);
+ }
+--
+2.20.1
+
--- /dev/null
+From 34ee4025663117bc5b71ba53787b5d16e445edf8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 23:36:37 +0000
+Subject: nvme-tcp: fix wrong stop condition in io_work
+
+From: Wunderlich, Mark <mark.wunderlich@intel.com>
+
+[ Upstream commit ddef29578a81a1d4d8f2b26a7adbfe21407ee3ea ]
+
+Allow the do/while statement to continue if current time
+is not after the proposed time 'deadline'. Intent is to
+allow loop to proceed for a specific time period. Currently
+the loop, as coded, will exit after first pass.
+
+Signed-off-by: Mark Wunderlich <mark.wunderlich@intel.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/tcp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index 606b13d35d16f..bdadb27b28bbb 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1039,7 +1039,7 @@ static void nvme_tcp_io_work(struct work_struct *w)
+ {
+ struct nvme_tcp_queue *queue =
+ container_of(w, struct nvme_tcp_queue, io_work);
+- unsigned long start = jiffies + msecs_to_jiffies(1);
++ unsigned long deadline = jiffies + msecs_to_jiffies(1);
+
+ do {
+ bool pending = false;
+@@ -1064,7 +1064,7 @@ static void nvme_tcp_io_work(struct work_struct *w)
+ if (!pending)
+ return;
+
+- } while (time_after(jiffies, start)); /* quota is exhausted */
++ } while (!time_after(jiffies, deadline)); /* quota is exhausted */
+
+ queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work);
+ }
+--
+2.20.1
+
--- /dev/null
+From 5c8d425a1399fc033cd146d7c2341b9e4017eb8c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 4 Oct 2019 20:51:04 +0800
+Subject: r8152: Set macpassthru in reset_resume callback
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+[ Upstream commit a54cdeeb04fc719e4c7f19d6e28dba7ea86cee5b ]
+
+r8152 may fail to establish network connection after resume from system
+suspend.
+
+If the USB port connects to r8152 lost its power during system suspend,
+the MAC address was written before is lost. The reason is that The MAC
+address doesn't get written again in its reset_resume callback.
+
+So let's set MAC address again in reset_resume callback. Also remove
+unnecessary lock as no other locking attempt will happen during
+reset_resume.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 04137ac373b07..9eedc0714422c 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4533,10 +4533,9 @@ static int rtl8152_reset_resume(struct usb_interface *intf)
+ struct r8152 *tp = usb_get_intfdata(intf);
+
+ clear_bit(SELECTIVE_SUSPEND, &tp->flags);
+- mutex_lock(&tp->control);
+ tp->rtl_ops.init(tp);
+ queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+- mutex_unlock(&tp->control);
++ set_ethernet_addr(tp);
+ return rtl8152_resume(intf);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 70d4560ea70a565ce7b72ace6c1a0a259dd5accb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 17:15:56 -0700
+Subject: RISC-V: Clear load reservations while restoring hart contexts
+
+From: Palmer Dabbelt <palmer@sifive.com>
+
+[ Upstream commit 18856604b3e7090ce42d533995173ee70c24b1c9 ]
+
+This is almost entirely a comment. The bug is unlikely to manifest on
+existing hardware because there is a timeout on load reservations, but
+manifests on QEMU because there is no timeout.
+
+Signed-off-by: Palmer Dabbelt <palmer@sifive.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/include/asm/asm.h | 1 +
+ arch/riscv/kernel/entry.S | 21 ++++++++++++++++++++-
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/include/asm/asm.h b/arch/riscv/include/asm/asm.h
+index 5a02b7d509408..9c992a88d858f 100644
+--- a/arch/riscv/include/asm/asm.h
++++ b/arch/riscv/include/asm/asm.h
+@@ -22,6 +22,7 @@
+
+ #define REG_L __REG_SEL(ld, lw)
+ #define REG_S __REG_SEL(sd, sw)
++#define REG_SC __REG_SEL(sc.d, sc.w)
+ #define SZREG __REG_SEL(8, 4)
+ #define LGREG __REG_SEL(3, 2)
+
+diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
+index 9b60878a4469c..2a82e0a5af46e 100644
+--- a/arch/riscv/kernel/entry.S
++++ b/arch/riscv/kernel/entry.S
+@@ -98,7 +98,26 @@ _save_context:
+ */
+ .macro RESTORE_ALL
+ REG_L a0, PT_SSTATUS(sp)
+- REG_L a2, PT_SEPC(sp)
++ /*
++ * The current load reservation is effectively part of the processor's
++ * state, in the sense that load reservations cannot be shared between
++ * different hart contexts. We can't actually save and restore a load
++ * reservation, so instead here we clear any existing reservation --
++ * it's always legal for implementations to clear load reservations at
++ * any point (as long as the forward progress guarantee is kept, but
++ * we'll ignore that here).
++ *
++ * Dangling load reservations can be the result of taking a trap in the
++ * middle of an LR/SC sequence, but can also be the result of a taken
++ * forward branch around an SC -- which is how we implement CAS. As a
++ * result we need to clear reservations between the last CAS and the
++ * jump back to the new context. While it is unlikely the store
++ * completes, implementations are allowed to expand reservations to be
++ * arbitrarily large.
++ */
++ REG_L a2, PT_SEPC(sp)
++ REG_SC x0, a2, PT_SEPC(sp)
++
+ csrw CSR_SSTATUS, a0
+ csrw CSR_SEPC, a2
+
+--
+2.20.1
+
--- /dev/null
+From e92518801b2ad53aeb3d91762ef17d820be24735 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 16:14:18 -0700
+Subject: riscv: Fix memblock reservation for device tree blob
+
+From: Albert Ou <aou@eecs.berkeley.edu>
+
+[ Upstream commit 922b0375fc93fb1a20c5617e37c389c26bbccb70 ]
+
+This fixes an error with how the FDT blob is reserved in memblock.
+An incorrect physical address calculation exposed the FDT header to
+unintended corruption, which typically manifested with of_fdt_raw_init()
+faulting during late boot after fdt_totalsize() returned a wrong value.
+Systems with smaller physical memory sizes more frequently trigger this
+issue, as the kernel is more likely to allocate from the DMA32 zone
+where bbl places the DTB after the kernel image.
+
+Commit 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages")
+changed the mapping of the DTB to reside in the fixmap area.
+Consequently, early_init_fdt_reserve_self() cannot be used anymore in
+setup_bootmem() since it relies on __pa() to derive a physical address,
+which does not work with dtb_early_va that is no longer a valid kernel
+logical address.
+
+The reserved[0x1] region shows the effect of the pointer underflow
+resulting from the __pa(initial_boot_params) offset subtraction:
+
+[ 0.000000] MEMBLOCK configuration:
+[ 0.000000] memory size = 0x000000001fe00000 reserved size = 0x0000000000a2e514
+[ 0.000000] memory.cnt = 0x1
+[ 0.000000] memory[0x0] [0x0000000080200000-0x000000009fffffff], 0x000000001fe00000 bytes flags: 0x0
+[ 0.000000] reserved.cnt = 0x2
+[ 0.000000] reserved[0x0] [0x0000000080200000-0x0000000080c2dfeb], 0x0000000000a2dfec bytes flags: 0x0
+[ 0.000000] reserved[0x1] [0xfffffff080100000-0xfffffff080100527], 0x0000000000000528 bytes flags: 0x0
+
+With the fix applied:
+
+[ 0.000000] MEMBLOCK configuration:
+[ 0.000000] memory size = 0x000000001fe00000 reserved size = 0x0000000000a2e514
+[ 0.000000] memory.cnt = 0x1
+[ 0.000000] memory[0x0] [0x0000000080200000-0x000000009fffffff], 0x000000001fe00000 bytes flags: 0x0
+[ 0.000000] reserved.cnt = 0x2
+[ 0.000000] reserved[0x0] [0x0000000080200000-0x0000000080c2dfeb], 0x0000000000a2dfec bytes flags: 0x0
+[ 0.000000] reserved[0x1] [0x0000000080e00000-0x0000000080e00527], 0x0000000000000528 bytes flags: 0x0
+
+Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages")
+Signed-off-by: Albert Ou <aou@eecs.berkeley.edu>
+Tested-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Anup Patel <anup@brainfault.org>
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/mm/init.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
+index 42bf939693d34..ed9cd9944d4f9 100644
+--- a/arch/riscv/mm/init.c
++++ b/arch/riscv/mm/init.c
+@@ -11,6 +11,7 @@
+ #include <linux/swap.h>
+ #include <linux/sizes.h>
+ #include <linux/of_fdt.h>
++#include <linux/libfdt.h>
+
+ #include <asm/fixmap.h>
+ #include <asm/tlbflush.h>
+@@ -82,6 +83,8 @@ static void __init setup_initrd(void)
+ }
+ #endif /* CONFIG_BLK_DEV_INITRD */
+
++static phys_addr_t dtb_early_pa __initdata;
++
+ void __init setup_bootmem(void)
+ {
+ struct memblock_region *reg;
+@@ -117,7 +120,12 @@ void __init setup_bootmem(void)
+ setup_initrd();
+ #endif /* CONFIG_BLK_DEV_INITRD */
+
+- early_init_fdt_reserve_self();
++ /*
++ * Avoid using early_init_fdt_reserve_self() since __pa() does
++ * not work for DTB pointers that are fixmap addresses
++ */
++ memblock_reserve(dtb_early_pa, fdt_totalsize(dtb_early_va));
++
+ early_init_fdt_scan_reserved_mem();
+ memblock_allow_resize();
+ memblock_dump_all();
+@@ -393,6 +401,8 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa)
+
+ /* Save pointer to DTB for early FDT parsing */
+ dtb_early_va = (void *)fix_to_virt(FIX_FDT) + (dtb_pa & ~PAGE_MASK);
++ /* Save physical address for memblock reservation */
++ dtb_early_pa = dtb_pa;
+ }
+
+ static void __init setup_vm_final(void)
+--
+2.20.1
+
--- /dev/null
+From ae41386d9c73f3b2beff999e90641740e0e33db0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 3 Oct 2019 17:36:36 -0400
+Subject: s390/mm: fix -Wunused-but-set-variable warnings
+
+From: Qian Cai <cai@lca.pw>
+
+[ Upstream commit 51ce02216d4ad4e8f6a58de81d6e803cf04c418e ]
+
+Convert two functions to static inline to get ride of W=1 GCC warnings
+like,
+
+mm/gup.c: In function 'gup_pte_range':
+mm/gup.c:1816:16: warning: variable 'ptem' set but not used
+[-Wunused-but-set-variable]
+ pte_t *ptep, *ptem;
+ ^~~~
+
+mm/mmap.c: In function 'acct_stack_growth':
+mm/mmap.c:2322:16: warning: variable 'new_start' set but not used
+[-Wunused-but-set-variable]
+ unsigned long new_start;
+ ^~~~~~~~~
+
+Signed-off-by: Qian Cai <cai@lca.pw>
+Link: https://lore.kernel.org/lkml/1570138596-11913-1-git-send-email-cai@lca.pw/
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/include/asm/hugetlb.h | 9 +++++++--
+ arch/s390/include/asm/pgtable.h | 3 ++-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
+index bb59dd9645909..de8f0bf5f238c 100644
+--- a/arch/s390/include/asm/hugetlb.h
++++ b/arch/s390/include/asm/hugetlb.h
+@@ -12,8 +12,6 @@
+ #include <asm/page.h>
+ #include <asm/pgtable.h>
+
+-
+-#define is_hugepage_only_range(mm, addr, len) 0
+ #define hugetlb_free_pgd_range free_pgd_range
+ #define hugepages_supported() (MACHINE_HAS_EDAT1)
+
+@@ -23,6 +21,13 @@ pte_t huge_ptep_get(pte_t *ptep);
+ pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ unsigned long addr, pte_t *ptep);
+
++static inline bool is_hugepage_only_range(struct mm_struct *mm,
++ unsigned long addr,
++ unsigned long len)
++{
++ return false;
++}
++
+ /*
+ * If the arch doesn't supply something else, assume that hugepage
+ * size aligned regions are ok without further preparation.
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 9b274fcaacb68..70ac23e50cae9 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -1268,7 +1268,8 @@ static inline pte_t *pte_offset(pmd_t *pmd, unsigned long address)
+
+ #define pte_offset_kernel(pmd, address) pte_offset(pmd, address)
+ #define pte_offset_map(pmd, address) pte_offset_kernel(pmd, address)
+-#define pte_unmap(pte) do { } while (0)
++
++static inline void pte_unmap(pte_t *pte) { }
+
+ static inline bool gup_fast_permitted(unsigned long start, unsigned long end)
+ {
+--
+2.20.1
+
--- /dev/null
+From e70f18b55c4537760cbf76dde3bf52c8efe3de3a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 7 Sep 2019 09:07:30 +0800
+Subject: scsi: megaraid: disable device when probe failed after enabled device
+
+From: Xiang Chen <chenxiang66@hisilicon.com>
+
+[ Upstream commit 70054aa39a013fa52eff432f2223b8bd5c0048f8 ]
+
+For pci device, need to disable device when probe failed after enabled
+device.
+
+Link: https://lore.kernel.org/r/1567818450-173315-1-git-send-email-chenxiang66@hisilicon.com
+Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
+Reviewed-by: John Garry <john.garry@huawei.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/megaraid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 45a66048801be..ff6d4aa924213 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -4183,11 +4183,11 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ */
+ if (pdev->subsystem_vendor == PCI_VENDOR_ID_COMPAQ &&
+ pdev->subsystem_device == 0xC000)
+- return -ENODEV;
++ goto out_disable_device;
+ /* Now check the magic signature byte */
+ pci_read_config_word(pdev, PCI_CONF_AMISIG, &magic);
+ if (magic != HBA_SIGNATURE_471 && magic != HBA_SIGNATURE)
+- return -ENODEV;
++ goto out_disable_device;
+ /* Ok it is probably a megaraid */
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 17ad619002e4953a0d345314180e97a7b61bfe3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 11:09:09 -0700
+Subject: scsi: qla2xxx: Fix N2N link reset
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit 7f2a398d59d658818f3d219645164676fbbc88e8 ]
+
+Fix stalled link recovery for N2N with FC-NVMe connection.
+
+Link: https://lore.kernel.org/r/20190912180918.6436-6-hmadhani@marvell.com
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_def.h | 3 +-
+ drivers/scsi/qla2xxx/qla_init.c | 107 +++++++++++++++++++++++---------
+ drivers/scsi/qla2xxx/qla_mbx.c | 23 ++++++-
+ drivers/scsi/qla2xxx/qla_os.c | 4 ++
+ 4 files changed, 103 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
+index bad2b12604f1b..a2922b17b55b0 100644
+--- a/drivers/scsi/qla2xxx/qla_def.h
++++ b/drivers/scsi/qla2xxx/qla_def.h
+@@ -2338,6 +2338,7 @@ typedef struct fc_port {
+ unsigned int query:1;
+ unsigned int id_changed:1;
+ unsigned int scan_needed:1;
++ unsigned int n2n_flag:1;
+
+ struct completion nvme_del_done;
+ uint32_t nvme_prli_service_param;
+@@ -2388,7 +2389,6 @@ typedef struct fc_port {
+ uint8_t fc4_type;
+ uint8_t fc4f_nvme;
+ uint8_t scan_state;
+- uint8_t n2n_flag;
+
+ unsigned long last_queue_full;
+ unsigned long last_ramp_up;
+@@ -2979,6 +2979,7 @@ enum scan_flags_t {
+ enum fc4type_t {
+ FS_FC4TYPE_FCP = BIT_0,
+ FS_FC4TYPE_NVME = BIT_1,
++ FS_FCP_IS_N2N = BIT_7,
+ };
+
+ struct fab_scan_rp {
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 3fbe909744a8f..cd74cc9651dea 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -746,12 +746,15 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
+ break;
+ default:
+ if ((id.b24 != fcport->d_id.b24 &&
+- fcport->d_id.b24) ||
++ fcport->d_id.b24 &&
++ fcport->loop_id != FC_NO_LOOP_ID) ||
+ (fcport->loop_id != FC_NO_LOOP_ID &&
+ fcport->loop_id != loop_id)) {
+ ql_dbg(ql_dbg_disc, vha, 0x20e3,
+ "%s %d %8phC post del sess\n",
+ __func__, __LINE__, fcport->port_name);
++ if (fcport->n2n_flag)
++ fcport->d_id.b24 = 0;
+ qlt_schedule_sess_for_deletion(fcport);
+ return;
+ }
+@@ -759,6 +762,8 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha,
+ }
+
+ fcport->loop_id = loop_id;
++ if (fcport->n2n_flag)
++ fcport->d_id.b24 = id.b24;
+
+ wwn = wwn_to_u64(fcport->port_name);
+ qlt_find_sess_invalidate_other(vha, wwn,
+@@ -966,7 +971,7 @@ qla24xx_async_gnl_sp_done(void *s, int res)
+ wwn = wwn_to_u64(e->port_name);
+
+ ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x20e8,
+- "%s %8phC %02x:%02x:%02x state %d/%d lid %x \n",
++ "%s %8phC %02x:%02x:%02x CLS %x/%x lid %x \n",
+ __func__, (void *)&wwn, e->port_id[2], e->port_id[1],
+ e->port_id[0], e->current_login_state, e->last_login_state,
+ (loop_id & 0x7fff));
+@@ -1498,7 +1503,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ (fcport->fw_login_state == DSC_LS_PRLI_PEND)))
+ return 0;
+
+- if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) {
++ if (fcport->fw_login_state == DSC_LS_PLOGI_COMP &&
++ !N2N_TOPO(vha->hw)) {
+ if (time_before_eq(jiffies, fcport->plogi_nack_done_deadline)) {
+ set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+ return 0;
+@@ -1569,8 +1575,9 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport)
+ qla24xx_post_gpdb_work(vha, fcport, 0);
+ } else {
+ ql_dbg(ql_dbg_disc, vha, 0x2118,
+- "%s %d %8phC post NVMe PRLI\n",
+- __func__, __LINE__, fcport->port_name);
++ "%s %d %8phC post %s PRLI\n",
++ __func__, __LINE__, fcport->port_name,
++ fcport->fc4f_nvme ? "NVME" : "FC");
+ qla24xx_post_prli_work(vha, fcport);
+ }
+ break;
+@@ -1924,17 +1931,38 @@ qla24xx_handle_prli_done_event(struct scsi_qla_host *vha, struct event_arg *ea)
+ break;
+ }
+
+- if (ea->fcport->n2n_flag) {
++ if (ea->fcport->fc4f_nvme) {
+ ql_dbg(ql_dbg_disc, vha, 0x2118,
+ "%s %d %8phC post fc4 prli\n",
+ __func__, __LINE__, ea->fcport->port_name);
+ ea->fcport->fc4f_nvme = 0;
+- ea->fcport->n2n_flag = 0;
+ qla24xx_post_prli_work(vha, ea->fcport);
++ return;
++ }
++
++ /* at this point both PRLI NVME & PRLI FCP failed */
++ if (N2N_TOPO(vha->hw)) {
++ if (ea->fcport->n2n_link_reset_cnt < 3) {
++ ea->fcport->n2n_link_reset_cnt++;
++ /*
++ * remote port is not sending Plogi. Reset
++ * link to kick start his state machine
++ */
++ set_bit(N2N_LINK_RESET, &vha->dpc_flags);
++ } else {
++ ql_log(ql_log_warn, vha, 0x2119,
++ "%s %d %8phC Unable to reconnect\n",
++ __func__, __LINE__, ea->fcport->port_name);
++ }
++ } else {
++ /*
++ * switch connect. login failed. Take connection
++ * down and allow relogin to retrigger
++ */
++ ea->fcport->flags &= ~FCF_ASYNC_SENT;
++ ea->fcport->keep_nport_handle = 0;
++ qlt_schedule_sess_for_deletion(ea->fcport);
+ }
+- ql_dbg(ql_dbg_disc, vha, 0x2119,
+- "%s %d %8phC unhandle event of %x\n",
+- __func__, __LINE__, ea->fcport->port_name, ea->data[0]);
+ break;
+ }
+ }
+@@ -5078,28 +5106,47 @@ qla2x00_configure_local_loop(scsi_qla_host_t *vha)
+ unsigned long flags;
+
+ /* Inititae N2N login. */
+- if (test_and_clear_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags)) {
+- /* borrowing */
+- u32 *bp, i, sz;
+-
+- memset(ha->init_cb, 0, ha->init_cb_size);
+- sz = min_t(int, sizeof(struct els_plogi_payload),
+- ha->init_cb_size);
+- rval = qla24xx_get_port_login_templ(vha, ha->init_cb_dma,
+- (void *)ha->init_cb, sz);
+- if (rval == QLA_SUCCESS) {
+- bp = (uint32_t *)ha->init_cb;
+- for (i = 0; i < sz/4 ; i++, bp++)
+- *bp = cpu_to_be32(*bp);
++ if (N2N_TOPO(ha)) {
++ if (test_and_clear_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags)) {
++ /* borrowing */
++ u32 *bp, i, sz;
++
++ memset(ha->init_cb, 0, ha->init_cb_size);
++ sz = min_t(int, sizeof(struct els_plogi_payload),
++ ha->init_cb_size);
++ rval = qla24xx_get_port_login_templ(vha,
++ ha->init_cb_dma, (void *)ha->init_cb, sz);
++ if (rval == QLA_SUCCESS) {
++ bp = (uint32_t *)ha->init_cb;
++ for (i = 0; i < sz/4 ; i++, bp++)
++ *bp = cpu_to_be32(*bp);
+
+- memcpy(&ha->plogi_els_payld.data, (void *)ha->init_cb,
+- sizeof(ha->plogi_els_payld.data));
+- set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
+- } else {
+- ql_dbg(ql_dbg_init, vha, 0x00d1,
+- "PLOGI ELS param read fail.\n");
++ memcpy(&ha->plogi_els_payld.data,
++ (void *)ha->init_cb,
++ sizeof(ha->plogi_els_payld.data));
++ set_bit(RELOGIN_NEEDED, &vha->dpc_flags);
++ } else {
++ ql_dbg(ql_dbg_init, vha, 0x00d1,
++ "PLOGI ELS param read fail.\n");
++ goto skip_login;
++ }
++ }
++
++ list_for_each_entry(fcport, &vha->vp_fcports, list) {
++ if (fcport->n2n_flag) {
++ qla24xx_fcport_handle_login(vha, fcport);
++ return QLA_SUCCESS;
++ }
++ }
++skip_login:
++ spin_lock_irqsave(&vha->work_lock, flags);
++ vha->scan.scan_retry++;
++ spin_unlock_irqrestore(&vha->work_lock, flags);
++
++ if (vha->scan.scan_retry < MAX_SCAN_RETRIES) {
++ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags);
++ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags);
+ }
+- return QLA_SUCCESS;
+ }
+
+ found_devs = 0;
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index 133f5f6270ffa..aadff0124f39f 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -2257,7 +2257,7 @@ qla2x00_lip_reset(scsi_qla_host_t *vha)
+ mbx_cmd_t mc;
+ mbx_cmd_t *mcp = &mc;
+
+- ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x105a,
++ ql_dbg(ql_dbg_disc, vha, 0x105a,
+ "Entered %s.\n", __func__);
+
+ if (IS_CNA_CAPABLE(vha->hw)) {
+@@ -3891,14 +3891,23 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ case TOPO_N2N:
+ ha->current_topology = ISP_CFG_N;
+ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
++ list_for_each_entry(fcport, &vha->vp_fcports, list) {
++ fcport->scan_state = QLA_FCPORT_SCAN;
++ fcport->n2n_flag = 0;
++ }
++
+ fcport = qla2x00_find_fcport_by_wwpn(vha,
+ rptid_entry->u.f1.port_name, 1);
+ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags);
+
+ if (fcport) {
+ fcport->plogi_nack_done_deadline = jiffies + HZ;
+- fcport->dm_login_expire = jiffies + 3*HZ;
++ fcport->dm_login_expire = jiffies + 2*HZ;
+ fcport->scan_state = QLA_FCPORT_FOUND;
++ fcport->n2n_flag = 1;
++ if (vha->flags.nvme_enabled)
++ fcport->fc4f_nvme = 1;
++
+ switch (fcport->disc_state) {
+ case DSC_DELETED:
+ set_bit(RELOGIN_NEEDED,
+@@ -3932,7 +3941,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ rptid_entry->u.f1.port_name,
+ rptid_entry->u.f1.node_name,
+ NULL,
+- FC4_TYPE_UNKNOWN);
++ FS_FCP_IS_N2N);
+ }
+
+ /* if our portname is higher then initiate N2N login */
+@@ -4031,6 +4040,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+
+ list_for_each_entry(fcport, &vha->vp_fcports, list) {
+ fcport->scan_state = QLA_FCPORT_SCAN;
++ fcport->n2n_flag = 0;
+ }
+
+ fcport = qla2x00_find_fcport_by_wwpn(vha,
+@@ -4040,6 +4050,13 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ fcport->login_retry = vha->hw->login_retry_count;
+ fcport->plogi_nack_done_deadline = jiffies + HZ;
+ fcport->scan_state = QLA_FCPORT_FOUND;
++ fcport->n2n_flag = 1;
++ fcport->d_id.b.domain =
++ rptid_entry->u.f2.remote_nport_id[2];
++ fcport->d_id.b.area =
++ rptid_entry->u.f2.remote_nport_id[1];
++ fcport->d_id.b.al_pa =
++ rptid_entry->u.f2.remote_nport_id[0];
+ }
+ }
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 084e39e415ff5..12d5f50646fba 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -5050,6 +5050,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+
+ memcpy(fcport->port_name, e->u.new_sess.port_name,
+ WWN_SIZE);
++
++ if (e->u.new_sess.fc4_type & FS_FCP_IS_N2N)
++ fcport->n2n_flag = 1;
++
+ } else {
+ ql_dbg(ql_dbg_disc, vha, 0xffff,
+ "%s %8phC mem alloc fail.\n",
+--
+2.20.1
+
--- /dev/null
+From 2f26fedbb20554c1cc555ee9218aeba39d03aee2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 11:09:10 -0700
+Subject: scsi: qla2xxx: Fix N2N link up fail
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit f3f1938bb673b1b5ad182c4608f5f8a24921eea3 ]
+
+During link up/bounce, qla driver would do command flush as part of
+cleanup. In this case, the flush can intefere with FW state. This patch
+allows FW to be in control of link up.
+
+Link: https://lore.kernel.org/r/20190912180918.6436-7-hmadhani@marvell.com
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_mbx.c | 2 ++
+ drivers/scsi/qla2xxx/qla_os.c | 6 ++----
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
+index aadff0124f39f..abfb9c800ce28 100644
+--- a/drivers/scsi/qla2xxx/qla_mbx.c
++++ b/drivers/scsi/qla2xxx/qla_mbx.c
+@@ -3905,6 +3905,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ fcport->dm_login_expire = jiffies + 2*HZ;
+ fcport->scan_state = QLA_FCPORT_FOUND;
+ fcport->n2n_flag = 1;
++ fcport->keep_nport_handle = 1;
+ if (vha->flags.nvme_enabled)
+ fcport->fc4f_nvme = 1;
+
+@@ -4050,6 +4051,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha,
+ fcport->login_retry = vha->hw->login_retry_count;
+ fcport->plogi_nack_done_deadline = jiffies + HZ;
+ fcport->scan_state = QLA_FCPORT_FOUND;
++ fcport->keep_nport_handle = 1;
+ fcport->n2n_flag = 1;
+ fcport->d_id.b.domain =
+ rptid_entry->u.f2.remote_nport_id[2];
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 12d5f50646fba..2835afbd2edc7 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -5150,11 +5150,9 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e)
+ if (dfcp)
+ qlt_schedule_sess_for_deletion(tfcp);
+
+-
+- if (N2N_TOPO(vha->hw))
+- fcport->flags &= ~FCF_FABRIC_DEVICE;
+-
+ if (N2N_TOPO(vha->hw)) {
++ fcport->flags &= ~FCF_FABRIC_DEVICE;
++ fcport->keep_nport_handle = 1;
+ if (vha->flags.nvme_enabled) {
+ fcport->fc4f_nvme = 1;
+ fcport->n2n_flag = 1;
+--
+2.20.1
+
--- /dev/null
+From 62d4b720faf0eceef1a7a6768967f60d63cc3f84 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 11:09:07 -0700
+Subject: scsi: qla2xxx: Fix stale mem access on driver unload
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit fd5564ba54e0d8a9e3e823d311b764232e09eb5f ]
+
+On driver unload, 'remove_one' thread was allowed to advance, while session
+cleanup still lag behind. This patch ensures session deletion will finish
+before remove_one can advance.
+
+Link: https://lore.kernel.org/r/20190912180918.6436-4-hmadhani@marvell.com
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_os.c | 1 +
+ drivers/scsi/qla2xxx/qla_target.c | 21 ++++++++-------------
+ 2 files changed, 9 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
+index 4fda308c3ef5c..084e39e415ff5 100644
+--- a/drivers/scsi/qla2xxx/qla_os.c
++++ b/drivers/scsi/qla2xxx/qla_os.c
+@@ -1153,6 +1153,7 @@ qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha)
+ qla2x00_mark_all_devices_lost(vha, 0);
+
+ wait_event_timeout(vha->fcport_waitQ, test_fcport_count(vha), 10*HZ);
++ flush_workqueue(vha->hw->wq);
+ }
+
+ /*
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index f77baf107024f..1bb0fc9324ead 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -954,7 +954,7 @@ void qlt_free_session_done(struct work_struct *work)
+ struct qla_hw_data *ha = vha->hw;
+ unsigned long flags;
+ bool logout_started = false;
+- scsi_qla_host_t *base_vha;
++ scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev);
+ struct qlt_plogi_ack_t *own =
+ sess->plogi_link[QLT_PLOGI_LINK_SAME_WWN];
+
+@@ -1106,6 +1106,7 @@ void qlt_free_session_done(struct work_struct *work)
+ }
+
+ spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
++ sess->free_pending = 0;
+
+ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf001,
+ "Unregistration of sess %p %8phC finished fcp_cnt %d\n",
+@@ -1114,17 +1115,8 @@ void qlt_free_session_done(struct work_struct *work)
+ if (tgt && (tgt->sess_count == 0))
+ wake_up_all(&tgt->waitQ);
+
+- if (vha->fcport_count == 0)
+- wake_up_all(&vha->fcport_waitQ);
+-
+- base_vha = pci_get_drvdata(ha->pdev);
+-
+- sess->free_pending = 0;
+-
+- if (test_bit(PFLG_DRIVER_REMOVING, &base_vha->pci_flags))
+- return;
+-
+- if ((!tgt || !tgt->tgt_stop) && !LOOP_TRANSITION(vha)) {
++ if (!test_bit(PFLG_DRIVER_REMOVING, &base_vha->pci_flags) &&
++ (!tgt || !tgt->tgt_stop) && !LOOP_TRANSITION(vha)) {
+ switch (vha->host->active_mode) {
+ case MODE_INITIATOR:
+ case MODE_DUAL:
+@@ -1137,6 +1129,9 @@ void qlt_free_session_done(struct work_struct *work)
+ break;
+ }
+ }
++
++ if (vha->fcport_count == 0)
++ wake_up_all(&vha->fcport_waitQ);
+ }
+
+ /* ha->tgt.sess_lock supposed to be held on entry */
+@@ -1166,7 +1161,7 @@ void qlt_unreg_sess(struct fc_port *sess)
+ sess->last_login_gen = sess->login_gen;
+
+ INIT_WORK(&sess->free_work, qlt_free_session_done);
+- schedule_work(&sess->free_work);
++ queue_work(sess->vha->hw->wq, &sess->free_work);
+ }
+ EXPORT_SYMBOL(qlt_unreg_sess);
+
+--
+2.20.1
+
--- /dev/null
+From a1a82fa237686b3b7cf78cff20ce7286f59dbe1e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 11:09:06 -0700
+Subject: scsi: qla2xxx: Fix unbound sleep in fcport delete path.
+
+From: Quinn Tran <qutran@marvell.com>
+
+[ Upstream commit c3b6a1d397420a0fdd97af2f06abfb78adc370df ]
+
+There are instances, though rare, where a LOGO request cannot be sent out
+and the thread in free session done can wait indefinitely. Fix this by
+putting an upper bound to sleep.
+
+Link: https://lore.kernel.org/r/20190912180918.6436-3-hmadhani@marvell.com
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 459c28aa3b94a..f77baf107024f 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -1021,6 +1021,7 @@ void qlt_free_session_done(struct work_struct *work)
+
+ if (logout_started) {
+ bool traced = false;
++ u16 cnt = 0;
+
+ while (!READ_ONCE(sess->logout_completed)) {
+ if (!traced) {
+@@ -1030,6 +1031,9 @@ void qlt_free_session_done(struct work_struct *work)
+ traced = true;
+ }
+ msleep(100);
++ cnt++;
++ if (cnt > 200)
++ break;
+ }
+
+ ql_dbg(ql_dbg_disc, vha, 0xf087,
+--
+2.20.1
+
--- /dev/null
+From 5f834edb67c1a9eda5c8b24761b7e102d3902dc8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 12 Sep 2019 11:09:05 -0700
+Subject: scsi: qla2xxx: Silence fwdump template message
+
+From: Himanshu Madhani <hmadhani@marvell.com>
+
+[ Upstream commit 248a445adfc8c33ffd67cf1f2e336578e34f9e21 ]
+
+Print if fwdt template is present or not, only when
+ql2xextended_error_logging is enabled.
+
+Link: https://lore.kernel.org/r/20190912180918.6436-2-hmadhani@marvell.com
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index afcd9a8858845..3fbe909744a8f 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -3268,7 +3268,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha)
+
+ for (j = 0; j < 2; j++, fwdt++) {
+ if (!fwdt->template) {
+- ql_log(ql_log_warn, vha, 0x00ba,
++ ql_dbg(ql_dbg_init, vha, 0x00ba,
+ "-> fwdt%u no template\n", j);
+ continue;
+ }
+--
+2.20.1
+
--- /dev/null
+From 134ff85d99f1f6b0268b06c54c884d816216713a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Sep 2019 12:20:38 +0800
+Subject: scsi: ufs: skip shutdown if hba is not powered
+
+From: Stanley Chu <stanley.chu@mediatek.com>
+
+[ Upstream commit f51913eef23f74c3bd07899dc7f1ed6df9e521d8 ]
+
+In some cases, hba may go through shutdown flow without successful
+initialization and then make system hang.
+
+For example, if ufshcd_change_power_mode() gets error and leads to
+ufshcd_hba_exit() to release resources of the host, future shutdown flow
+may hang the system since the host register will be accessed in unpowered
+state.
+
+To solve this issue, simply add checking to skip shutdown for above kind of
+situation.
+
+Link: https://lore.kernel.org/r/1568780438-28753-1-git-send-email-stanley.chu@mediatek.com
+Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
+Acked-by: Bean Huo <beanhuo@micron.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/ufs/ufshcd.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 029da74bb2f5c..e674f6148f698 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -8095,6 +8095,9 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ {
+ int ret = 0;
+
++ if (!hba->is_powered)
++ goto out;
++
+ if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ goto out;
+
+--
+2.20.1
+
--- /dev/null
+From 31b782f9c3d539cc92304da4e144e9ad81af7bdc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 17:14:30 -0600
+Subject: selftests: kvm: Fix libkvm build error
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+[ Upstream commit 6e06983dde969c15eb4fdab77f0eda8b18ea28e6 ]
+
+Fix the following build error from "make TARGETS=kvm kselftest":
+
+libkvm.a(assert.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a PIE object; recompile with -fPIC
+
+This error is seen when build is done from the main Makefile using
+kselftest target. In this case KBUILD_CPPFLAGS and CC_OPTION_CFLAGS
+are defined.
+
+When build is invoked using:
+
+"make -C tools/testing/selftests/kvm" KBUILD_CPPFLAGS and CC_OPTION_CFLAGS
+aren't defined.
+
+There is no need to pass in KBUILD_CPPFLAGS and CC_OPTION_CFLAGS for the
+check to determine if --no-pie is necessary, which is the case when these
+two aren't defined when "make -C tools/testing/selftests/kvm" runs.
+
+Fix it by simplifying the no-pie-option logic. With this change, both
+build variations work.
+
+"make TARGETS=kvm kselftest"
+"make -C tools/testing/selftests/kvm"
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile
+index ba78497519894..fc8aeb224c032 100644
+--- a/tools/testing/selftests/kvm/Makefile
++++ b/tools/testing/selftests/kvm/Makefile
+@@ -46,7 +46,7 @@ CFLAGS += -Wall -Wstrict-prototypes -Wuninitialized -O2 -g -std=gnu99 \
+ -I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(UNAME_M) -I..
+
+ no-pie-option := $(call try-run, echo 'int main() { return 0; }' | \
+- $(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -no-pie -x c - -o "$$TMP", -no-pie)
++ $(CC) -Werror -no-pie -x c - -o "$$TMP", -no-pie)
+
+ # On s390, build the testcases KVM-enabled
+ pgste-option = $(call try-run, echo 'int main() { return 0; }' | \
+--
+2.20.1
+
--- /dev/null
+drm-free-the-writeback_job-when-it-with-an-empty-fb.patch
+drm-clear-the-fence-pointer-when-writeback-job-signa.patch
+clk-ti-dra7-fix-mcasp8-clock-bits.patch
+arm-dts-fix-wrong-clocks-for-dra7-mcasp.patch
+nvme-pci-fix-a-race-in-controller-removal.patch
+scsi-ufs-skip-shutdown-if-hba-is-not-powered.patch
+scsi-megaraid-disable-device-when-probe-failed-after.patch
+scsi-qla2xxx-silence-fwdump-template-message.patch
+scsi-qla2xxx-fix-unbound-sleep-in-fcport-delete-path.patch
+scsi-qla2xxx-fix-stale-mem-access-on-driver-unload.patch
+scsi-qla2xxx-fix-n2n-link-reset.patch
+scsi-qla2xxx-fix-n2n-link-up-fail.patch
+arm-dts-fix-gpio0-flags-for-am335x-icev2.patch
+arm-omap2-fix-missing-reset-done-flag-for-am3-and-am.patch
+arm-omap2-add-missing-lcdc-midlemode-for-am335x.patch
+arm-omap2-fix-warnings-with-broken-omap2_set_init_vo.patch
+nvme-tcp-fix-wrong-stop-condition-in-io_work.patch
+nvme-pci-save-pci-state-before-putting-drive-into-de.patch
+nvme-fix-an-error-code-in-nvme_init_subsystem.patch
+nvme-rdma-fix-max_hw_sectors-calculation.patch
+added-quirks-for-adata-xpg-sx8200-pro-512gb.patch
+nvme-add-quirk-for-kingston-nvme-ssd-running-fw-e8fk.patch
+nvme-allow-64-bit-results-in-passthru-commands.patch
+drm-komeda-prevent-memory-leak-in-komeda_wb_connecto.patch
+nvme-rdma-fix-possible-use-after-free-in-connect-tim.patch
+blk-mq-honor-io-scheduler-for-multiqueue-devices.patch
+ieee802154-ca8210-prevent-memory-leak.patch
+arm-dts-am4372-set-memory-bandwidth-limit-for-dispc.patch
+net-dsa-qca8k-use-up-to-7-ports-for-all-operations.patch
+mips-dts-ar9331-fix-interrupt-controller-size.patch
+xen-efi-set-nonblocking-callbacks.patch
+loop-change-queue-block-size-to-match-when-using-dio.patch
+nl80211-fix-null-pointer-dereference.patch
+mac80211-fix-txq-null-pointer-dereference.patch
+netfilter-nft_connlimit-disable-bh-on-garbage-collec.patch
+net-mscc-ocelot-add-missing-of_node_put-after-callin.patch
+net-dsa-rtl8366rb-add-missing-of_node_put-after-call.patch
+net-stmmac-xgmac-not-all-unicast-addresses-may-be-av.patch
+net-stmmac-dwmac4-always-update-the-mac-hash-filter.patch
+net-stmmac-correctly-take-timestamp-for-ptpv2.patch
+net-stmmac-do-not-stop-phy-if-wol-is-enabled.patch
+net-ag71xx-fix-mdio-subnode-support.patch
+risc-v-clear-load-reservations-while-restoring-hart-.patch
+riscv-fix-memblock-reservation-for-device-tree-blob.patch
+drm-amdgpu-fix-multiple-memory-leaks-in-acp_hw_init.patch
+drm-amd-display-memory-leak.patch
+mips-loongson-fix-the-link-time-qualifier-of-serial_.patch
+net-hisilicon-fix-usage-of-uninitialized-variable-in.patch
+net-stmmac-avoid-deadlock-on-suspend-resume.patch
+selftests-kvm-fix-libkvm-build-error.patch
+lib-textsearch-fix-escapes-in-example-code.patch
+s390-mm-fix-wunused-but-set-variable-warnings.patch
+r8152-set-macpassthru-in-reset_resume-callback.patch
+net-phy-allow-for-reset-line-to-be-tied-to-a-sleepy-.patch
+net-phy-fix-write-to-mii-ctrl1000-register.patch
+namespace-fix-namespace.pl-script-to-support-relativ.patch
+convert-filldir-64-from-__put_user-to-unsafe_put_use.patch
+elf-don-t-use-map_fixed_noreplace-for-elf-executable.patch
--- /dev/null
+From a85ef09b01b0f6838c22f9dd44f21f6b07ec97ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 16:49:20 +0100
+Subject: xen/efi: Set nonblocking callbacks
+
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+
+[ Upstream commit df359f0d09dc029829b66322707a2f558cb720f7 ]
+
+Other parts of the kernel expect these nonblocking EFI callbacks to
+exist and crash when running under Xen. Since the implementations of
+xen_efi_set_variable() and xen_efi_query_variable_info() do not take any
+locks, use them for the nonblocking callbacks too.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/xen/efi.c | 2 ++
+ arch/x86/xen/efi.c | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/arch/arm/xen/efi.c b/arch/arm/xen/efi.c
+index d687a73044bfa..cb2aaf98e243d 100644
+--- a/arch/arm/xen/efi.c
++++ b/arch/arm/xen/efi.c
+@@ -19,7 +19,9 @@ void __init xen_efi_runtime_setup(void)
+ efi.get_variable = xen_efi_get_variable;
+ efi.get_next_variable = xen_efi_get_next_variable;
+ efi.set_variable = xen_efi_set_variable;
++ efi.set_variable_nonblocking = xen_efi_set_variable;
+ efi.query_variable_info = xen_efi_query_variable_info;
++ efi.query_variable_info_nonblocking = xen_efi_query_variable_info;
+ efi.update_capsule = xen_efi_update_capsule;
+ efi.query_capsule_caps = xen_efi_query_capsule_caps;
+ efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count;
+diff --git a/arch/x86/xen/efi.c b/arch/x86/xen/efi.c
+index 0d3365cb64de0..7e3eb70f411ab 100644
+--- a/arch/x86/xen/efi.c
++++ b/arch/x86/xen/efi.c
+@@ -65,7 +65,9 @@ static efi_system_table_t __init *xen_efi_probe(void)
+ efi.get_variable = xen_efi_get_variable;
+ efi.get_next_variable = xen_efi_get_next_variable;
+ efi.set_variable = xen_efi_set_variable;
++ efi.set_variable_nonblocking = xen_efi_set_variable;
+ efi.query_variable_info = xen_efi_query_variable_info;
++ efi.query_variable_info_nonblocking = xen_efi_query_variable_info;
+ efi.update_capsule = xen_efi_update_capsule;
+ efi.query_capsule_caps = xen_efi_query_capsule_caps;
+ efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count;
+--
+2.20.1
+