--- /dev/null
+From 5f6beb9e0f633f3cc845cdd67973c506372931b4 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 3 Jun 2019 22:03:44 +0200
+Subject: af_unix: add compat_ioctl support
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 5f6beb9e0f633f3cc845cdd67973c506372931b4 upstream.
+
+The af_unix protocol family has a custom ioctl command (inexplicibly
+based on SIOCPROTOPRIVATE), but never had a compat_ioctl handler for
+32-bit applications.
+
+Since all commands are compatible here, add a trivial wrapper that
+performs the compat_ptr() conversion for SIOCOUTQ/SIOCINQ. SIOCUNIXFILE
+does not use the argument, but it doesn't hurt to also use compat_ptr()
+here.
+
+Fixes: ba94f3088b79 ("unix: add ioctl to open a unix socket file with O_PATH")
+Cc: netdev@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/unix/af_unix.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -646,6 +646,9 @@ static __poll_t unix_poll(struct file *,
+ static __poll_t unix_dgram_poll(struct file *, struct socket *,
+ poll_table *);
+ static int unix_ioctl(struct socket *, unsigned int, unsigned long);
++#ifdef CONFIG_COMPAT
++static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
++#endif
+ static int unix_shutdown(struct socket *, int);
+ static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t);
+ static int unix_stream_recvmsg(struct socket *, struct msghdr *, size_t, int);
+@@ -687,6 +690,9 @@ static const struct proto_ops unix_strea
+ .getname = unix_getname,
+ .poll = unix_poll,
+ .ioctl = unix_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = unix_compat_ioctl,
++#endif
+ .listen = unix_listen,
+ .shutdown = unix_shutdown,
+ .setsockopt = sock_no_setsockopt,
+@@ -710,6 +716,9 @@ static const struct proto_ops unix_dgram
+ .getname = unix_getname,
+ .poll = unix_dgram_poll,
+ .ioctl = unix_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = unix_compat_ioctl,
++#endif
+ .listen = sock_no_listen,
+ .shutdown = unix_shutdown,
+ .setsockopt = sock_no_setsockopt,
+@@ -732,6 +741,9 @@ static const struct proto_ops unix_seqpa
+ .getname = unix_getname,
+ .poll = unix_dgram_poll,
+ .ioctl = unix_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = unix_compat_ioctl,
++#endif
+ .listen = unix_listen,
+ .shutdown = unix_shutdown,
+ .setsockopt = sock_no_setsockopt,
+@@ -2582,6 +2594,13 @@ static int unix_ioctl(struct socket *soc
+ return err;
+ }
+
++#ifdef CONFIG_COMPAT
++static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
++{
++ return unix_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
++}
++#endif
++
+ static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait)
+ {
+ struct sock *sk = sock->sk;
--- /dev/null
+From ff98a5f624d2910de050f1fc7f2a32769da86b51 Mon Sep 17 00:00:00 2001
+From: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Date: Fri, 29 Nov 2019 16:23:02 +0100
+Subject: ARM: 8943/1: Fix topology setup in case of CPU hotplug for CONFIG_SCHED_MC
+
+From: Dietmar Eggemann <dietmar.eggemann@arm.com>
+
+commit ff98a5f624d2910de050f1fc7f2a32769da86b51 upstream.
+
+Commit ca74b316df96 ("arm: Use common cpu_topology structure and
+functions.") changed cpu_coregroup_mask() from the ARM32 specific
+implementation in arch/arm/include/asm/topology.h to the one shared
+with ARM64 and RISCV in drivers/base/arch_topology.c.
+
+Currently on ARM32 (TC2 w/ CONFIG_SCHED_MC) the task scheduler setup
+code (w/ CONFIG_SCHED_DEBUG) shows this during CPU hotplug:
+
+ ERROR: groups don't span domain->span
+
+It happens to CPUs of the cluster of the CPU which gets hot-plugged
+out on scheduler domain MC.
+
+Turns out that the shared cpu_coregroup_mask() requires that the
+hot-plugged CPU is removed from the core_sibling mask via
+remove_cpu_topology(). Otherwise the 'is core_sibling subset of
+cpumask_of_node()' doesn't work. In this case the task scheduler has to
+deal with cpumask_of_node instead of core_sibling which is wrong on
+scheduler domain MC.
+
+e.g. CPU3 hot-plugged out on TC2 [cluster0: 0,3-4 cluster1: 1-2]:
+
+ cpu_coregroup_mask(): CPU3 cpumask_of_node=0-2,4 core_sibling=0,3-4
+ ^
+should be:
+
+ cpu_coregroup_mask(): CPU3 cpumask_of_node=0-2,4 core_sibling=0,4
+
+Add remove_cpu_topology() to __cpu_disable() to remove the CPU from the
+topology masks in case of a CPU hotplug out operation.
+
+At the same time tweak store_cpu_topology() slightly so it will call
+update_siblings_masks() in case of CPU hotplug in operation via
+secondary_start_kernel()->smp_store_cpu_info().
+
+This aligns the ARM32 implementation with the ARM64 one.
+
+Guarding remove_cpu_topology() with CONFIG_GENERIC_ARCH_TOPOLOGY is
+necessary since some Arm32 defconfigs (aspeed_g5_defconfig,
+milbeaut_m10v_defconfig, spear13xx_defconfig) specify an explicit
+
+ # CONFIG_ARM_CPU_TOPOLOGY is not set
+
+w/ ./arch/arm/Kconfig: select GENERIC_ARCH_TOPOLOGY if ARM_CPU_TOPOLOGY
+
+Fixes: ca74b316df96 ("arm: Use common cpu_topology structure and functions")
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Reviewed-by: Lukasz Luba <lukasz.luba@arm.com>
+Tested-by: Lukasz Luba <lukasz.luba@arm.com>
+Tested-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/kernel/smp.c | 4 ++++
+ arch/arm/kernel/topology.c | 10 +++++-----
+ 2 files changed, 9 insertions(+), 5 deletions(-)
+
+--- a/arch/arm/kernel/smp.c
++++ b/arch/arm/kernel/smp.c
+@@ -240,6 +240,10 @@ int __cpu_disable(void)
+ if (ret)
+ return ret;
+
++#ifdef CONFIG_GENERIC_ARCH_TOPOLOGY
++ remove_cpu_topology(cpu);
++#endif
++
+ /*
+ * Take this CPU offline. Once we clear this, we can't return,
+ * and we must not schedule until we're ready to give up the cpu.
+--- a/arch/arm/kernel/topology.c
++++ b/arch/arm/kernel/topology.c
+@@ -196,9 +196,8 @@ void store_cpu_topology(unsigned int cpu
+ struct cpu_topology *cpuid_topo = &cpu_topology[cpuid];
+ unsigned int mpidr;
+
+- /* If the cpu topology has been already set, just return */
+- if (cpuid_topo->core_id != -1)
+- return;
++ if (cpuid_topo->package_id != -1)
++ goto topology_populated;
+
+ mpidr = read_cpuid_mpidr();
+
+@@ -231,14 +230,15 @@ void store_cpu_topology(unsigned int cpu
+ cpuid_topo->package_id = -1;
+ }
+
+- update_siblings_masks(cpuid);
+-
+ update_cpu_capacity(cpuid);
+
+ pr_info("CPU%u: thread %d, cpu %d, socket %d, mpidr %x\n",
+ cpuid, cpu_topology[cpuid].thread_id,
+ cpu_topology[cpuid].core_id,
+ cpu_topology[cpuid].package_id, mpidr);
++
++topology_populated:
++ update_siblings_masks(cpuid);
+ }
+
+ static inline int cpu_corepower_flags(void)
--- /dev/null
+From e38161bd325ea541ef2f258d8e28281077dde524 Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Wed, 12 Dec 2018 18:13:26 +0100
+Subject: arm64: dts: apq8096-db820c: Increase load on l21 for SDCARD
+
+From: Loic Poulain <loic.poulain@linaro.org>
+
+commit e38161bd325ea541ef2f258d8e28281077dde524 upstream.
+
+In the same way as for msm8974-hammerhead, l21 load, used for SDCARD
+VMMC, needs to be increased in order to prevent any voltage drop issues
+(due to limited current) happening with some SDCARDS or during specific
+operations (e.g. write).
+
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Fixes: 660a9763c6a9 (arm64: dts: qcom: db820c: Add pm8994 regulator node)
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+@@ -623,6 +623,8 @@
+ l21 {
+ regulator-min-microvolt = <2950000>;
+ regulator-max-microvolt = <2950000>;
++ regulator-allow-set-load;
++ regulator-system-load = <200000>;
+ };
+ l22 {
+ regulator-min-microvolt = <3300000>;
--- /dev/null
+From 9d7bf41fafa5b5ddd4c13eb39446b0045f0a8167 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 3 Jun 2019 23:06:00 +0200
+Subject: compat_ioctl: handle SIOCOUTQNSD
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 9d7bf41fafa5b5ddd4c13eb39446b0045f0a8167 upstream.
+
+Unlike the normal SIOCOUTQ, SIOCOUTQNSD was never handled in compat
+mode. Add it to the common socket compat handler along with similar
+ones.
+
+Fixes: 2f4e1b397097 ("tcp: ioctl type SIOCOUTQNSD returns amount of data not sent")
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: netdev@vger.kernel.org
+Cc: "David S. Miller" <davem@davemloft.net>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/socket.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -3532,6 +3532,7 @@ static int compat_sock_ioctl_trans(struc
+ case SIOCSARP:
+ case SIOCGARP:
+ case SIOCDARP:
++ case SIOCOUTQNSD:
+ case SIOCATMARK:
+ return sock_do_ioctl(net, sock, cmd, arg);
+ }
--- /dev/null
+From 1f0d5c911b64165c9754139a26c8c2fad352c132 Mon Sep 17 00:00:00 2001
+From: Chao Yu <chao@kernel.org>
+Date: Thu, 7 Nov 2019 17:29:00 +0800
+Subject: f2fs: fix potential overflow
+
+From: Chao Yu <yuchao0@huawei.com>
+
+commit 1f0d5c911b64165c9754139a26c8c2fad352c132 upstream.
+
+We expect 64-bit calculation result from below statement, however
+in 32-bit machine, looped left shift operation on pgoff_t type
+variable may cause overflow issue, fix it by forcing type cast.
+
+page->index << PAGE_SHIFT;
+
+Fixes: 26de9b117130 ("f2fs: avoid unnecessary updating inode during fsync")
+Fixes: 0a2aa8fbb969 ("f2fs: refactor __exchange_data_block for speed up")
+Signed-off-by: Chao Yu <yuchao0@huawei.com>
+Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/f2fs/data.c | 2 +-
+ fs/f2fs/file.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -2098,7 +2098,7 @@ static int __write_data_page(struct page
+ loff_t i_size = i_size_read(inode);
+ const pgoff_t end_index = ((unsigned long long) i_size)
+ >> PAGE_SHIFT;
+- loff_t psize = (page->index + 1) << PAGE_SHIFT;
++ loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT;
+ unsigned offset = 0;
+ bool need_balance_fs = false;
+ int err = 0;
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -1139,7 +1139,7 @@ static int __clone_blkaddrs(struct inode
+ }
+ dn.ofs_in_node++;
+ i++;
+- new_size = (dst + i) << PAGE_SHIFT;
++ new_size = (loff_t)(dst + i) << PAGE_SHIFT;
+ if (dst_inode->i_size < new_size)
+ f2fs_i_size_write(dst_inode, new_size);
+ } while (--ilen && (do_replace[i] || blkaddr[i] == NULL_ADDR));
--- /dev/null
+From 8d0980704842e8a68df2c3164c1c165e5c7ebc08 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 3 Jun 2019 13:40:01 +0200
+Subject: gfs2: add compat_ioctl support
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 8d0980704842e8a68df2c3164c1c165e5c7ebc08 upstream.
+
+Out of the four ioctl commands supported on gfs2, only FITRIM
+works in compat mode.
+
+Add a proper handler based on the ext4 implementation.
+
+Fixes: 6ddc5c3ddf25 ("gfs2: getlabel support")
+Reviewed-by: Bob Peterson <rpeterso@redhat.com>
+Cc: Andreas Gruenbacher <agruenba@redhat.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/file.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/fs/gfs2/file.c
++++ b/fs/gfs2/file.c
+@@ -6,6 +6,7 @@
+
+ #include <linux/slab.h>
+ #include <linux/spinlock.h>
++#include <linux/compat.h>
+ #include <linux/completion.h>
+ #include <linux/buffer_head.h>
+ #include <linux/pagemap.h>
+@@ -354,6 +355,31 @@ static long gfs2_ioctl(struct file *filp
+ return -ENOTTY;
+ }
+
++#ifdef CONFIG_COMPAT
++static long gfs2_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
++{
++ switch(cmd) {
++ /* These are just misnamed, they actually get/put from/to user an int */
++ case FS_IOC32_GETFLAGS:
++ cmd = FS_IOC_GETFLAGS;
++ break;
++ case FS_IOC32_SETFLAGS:
++ cmd = FS_IOC_SETFLAGS;
++ break;
++ /* Keep this list in sync with gfs2_ioctl */
++ case FITRIM:
++ case FS_IOC_GETFSLABEL:
++ break;
++ default:
++ return -ENOIOCTLCMD;
++ }
++
++ return gfs2_ioctl(filp, cmd, (unsigned long)compat_ptr(arg));
++}
++#else
++#define gfs2_compat_ioctl NULL
++#endif
++
+ /**
+ * gfs2_size_hint - Give a hint to the size of a write request
+ * @filep: The struct file
+@@ -1294,6 +1320,7 @@ const struct file_operations gfs2_file_f
+ .write_iter = gfs2_file_write_iter,
+ .iopoll = iomap_dio_iopoll,
+ .unlocked_ioctl = gfs2_ioctl,
++ .compat_ioctl = gfs2_compat_ioctl,
+ .mmap = gfs2_mmap,
+ .open = gfs2_open,
+ .release = gfs2_release,
+@@ -1309,6 +1336,7 @@ const struct file_operations gfs2_file_f
+ const struct file_operations gfs2_dir_fops = {
+ .iterate_shared = gfs2_readdir,
+ .unlocked_ioctl = gfs2_ioctl,
++ .compat_ioctl = gfs2_compat_ioctl,
+ .open = gfs2_open,
+ .release = gfs2_release,
+ .fsync = gfs2_fsync,
+@@ -1325,6 +1353,7 @@ const struct file_operations gfs2_file_f
+ .write_iter = gfs2_file_write_iter,
+ .iopoll = iomap_dio_iopoll,
+ .unlocked_ioctl = gfs2_ioctl,
++ .compat_ioctl = gfs2_compat_ioctl,
+ .mmap = gfs2_mmap,
+ .open = gfs2_open,
+ .release = gfs2_release,
+@@ -1338,6 +1367,7 @@ const struct file_operations gfs2_file_f
+ const struct file_operations gfs2_dir_fops_nolock = {
+ .iterate_shared = gfs2_readdir,
+ .unlocked_ioctl = gfs2_ioctl,
++ .compat_ioctl = gfs2_compat_ioctl,
+ .open = gfs2_open,
+ .release = gfs2_release,
+ .fsync = gfs2_fsync,
--- /dev/null
+From da3cc91b8db403728cde03c8a95cba268d8cbf1b Mon Sep 17 00:00:00 2001
+From: Yong Wu <yong.wu@mediatek.com>
+Date: Mon, 4 Nov 2019 15:01:03 +0800
+Subject: iommu/mediatek: Add a new tlb_lock for tlb_flush
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+commit da3cc91b8db403728cde03c8a95cba268d8cbf1b upstream.
+
+The commit 4d689b619445 ("iommu/io-pgtable-arm-v7s: Convert to IOMMU API
+TLB sync") help move the tlb_sync of unmap from v7s into the iommu
+framework. It helps add a new function "mtk_iommu_iotlb_sync", But it
+lacked the lock, then it will cause the variable "tlb_flush_active"
+may be changed unexpectedly, we could see this warning log randomly:
+
+mtk-iommu 10205000.iommu: Partial TLB flush timed out, falling back to
+full flush
+
+The HW requires tlb_flush/tlb_sync in pairs strictly, this patch adds
+a new tlb_lock for tlb operations to fix this issue.
+
+Fixes: 4d689b619445 ("iommu/io-pgtable-arm-v7s: Convert to IOMMU API TLB sync")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/mtk_iommu.c | 23 ++++++++++++++++++++++-
+ drivers/iommu/mtk_iommu.h | 1 +
+ 2 files changed, 23 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -219,22 +219,37 @@ static void mtk_iommu_tlb_sync(void *coo
+ static void mtk_iommu_tlb_flush_walk(unsigned long iova, size_t size,
+ size_t granule, void *cookie)
+ {
++ struct mtk_iommu_data *data = cookie;
++ unsigned long flags;
++
++ spin_lock_irqsave(&data->tlb_lock, flags);
+ mtk_iommu_tlb_add_flush_nosync(iova, size, granule, false, cookie);
+ mtk_iommu_tlb_sync(cookie);
++ spin_unlock_irqrestore(&data->tlb_lock, flags);
+ }
+
+ static void mtk_iommu_tlb_flush_leaf(unsigned long iova, size_t size,
+ size_t granule, void *cookie)
+ {
++ struct mtk_iommu_data *data = cookie;
++ unsigned long flags;
++
++ spin_lock_irqsave(&data->tlb_lock, flags);
+ mtk_iommu_tlb_add_flush_nosync(iova, size, granule, true, cookie);
+ mtk_iommu_tlb_sync(cookie);
++ spin_unlock_irqrestore(&data->tlb_lock, flags);
+ }
+
+ static void mtk_iommu_tlb_flush_page_nosync(struct iommu_iotlb_gather *gather,
+ unsigned long iova, size_t granule,
+ void *cookie)
+ {
++ struct mtk_iommu_data *data = cookie;
++ unsigned long flags;
++
++ spin_lock_irqsave(&data->tlb_lock, flags);
+ mtk_iommu_tlb_add_flush_nosync(iova, granule, granule, true, cookie);
++ spin_unlock_irqrestore(&data->tlb_lock, flags);
+ }
+
+ static const struct iommu_flush_ops mtk_iommu_flush_ops = {
+@@ -453,7 +468,12 @@ static void mtk_iommu_flush_iotlb_all(st
+ static void mtk_iommu_iotlb_sync(struct iommu_domain *domain,
+ struct iommu_iotlb_gather *gather)
+ {
+- mtk_iommu_tlb_sync(mtk_iommu_get_m4u_data());
++ struct mtk_iommu_data *data = mtk_iommu_get_m4u_data();
++ unsigned long flags;
++
++ spin_lock_irqsave(&data->tlb_lock, flags);
++ mtk_iommu_tlb_sync(data);
++ spin_unlock_irqrestore(&data->tlb_lock, flags);
+ }
+
+ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain,
+@@ -733,6 +753,7 @@ static int mtk_iommu_probe(struct platfo
+ if (ret)
+ return ret;
+
++ spin_lock_init(&data->tlb_lock);
+ list_add_tail(&data->list, &m4ulist);
+
+ if (!iommu_present(&platform_bus_type))
+--- a/drivers/iommu/mtk_iommu.h
++++ b/drivers/iommu/mtk_iommu.h
+@@ -58,6 +58,7 @@ struct mtk_iommu_data {
+ struct iommu_group *m4u_group;
+ bool enable_4GB;
+ bool tlb_flush_active;
++ spinlock_t tlb_lock; /* lock for tlb range flush */
+
+ struct iommu_device iommu;
+ const struct mtk_iommu_plat_data *plat_data;
--- /dev/null
+From 2009122f1d83dd8375572661961eab1e7e86bffe Mon Sep 17 00:00:00 2001
+From: Yong Wu <yong.wu@mediatek.com>
+Date: Mon, 4 Nov 2019 15:01:02 +0800
+Subject: iommu/mediatek: Correct the flush_iotlb_all callback
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+commit 2009122f1d83dd8375572661961eab1e7e86bffe upstream.
+
+Use the correct tlb_flush_all instead of the original one.
+
+Fixes: 4d689b619445 ("iommu/io-pgtable-arm-v7s: Convert to IOMMU API TLB sync")
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/iommu/mtk_iommu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/iommu/mtk_iommu.c
++++ b/drivers/iommu/mtk_iommu.c
+@@ -447,7 +447,7 @@ static size_t mtk_iommu_unmap(struct iom
+
+ static void mtk_iommu_flush_iotlb_all(struct iommu_domain *domain)
+ {
+- mtk_iommu_tlb_sync(mtk_iommu_get_m4u_data());
++ mtk_iommu_tlb_flush_all(mtk_iommu_get_m4u_data());
+ }
+
+ static void mtk_iommu_iotlb_sync(struct iommu_domain *domain,
--- /dev/null
+From ee4cce9b9d6421d037ffc002536b918fd7f4aff3 Mon Sep 17 00:00:00 2001
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Date: Sun, 28 Jul 2019 20:09:22 +0300
+Subject: iwlwifi: mvm: consider ieee80211 station max amsdu value
+
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+
+commit ee4cce9b9d6421d037ffc002536b918fd7f4aff3 upstream.
+
+debugfs amsdu_len sets only the max_amsdu_len for ieee80211 station
+so take it into consideration while getting max amsdu
+
+Fixes: af2984e9e625 ("iwlwifi: mvm: add a debugfs entry to set a fixed size AMSDU for all TX packets")
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 8 +++++++-
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 7 ++++++-
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c
+@@ -350,7 +350,13 @@ void iwl_mvm_tlc_update_notif(struct iwl
+ u16 size = le32_to_cpu(notif->amsdu_size);
+ int i;
+
+- if (WARN_ON(sta->max_amsdu_len < size))
++ /*
++ * In debug sta->max_amsdu_len < size
++ * so also check with orig_amsdu_len which holds the original
++ * data before debugfs changed the value
++ */
++ if (WARN_ON(sta->max_amsdu_len < size &&
++ mvmsta->orig_amsdu_len < size))
+ goto out;
+
+ mvmsta->amsdu_enabled = le32_to_cpu(notif->amsdu_enabled);
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -935,7 +935,12 @@ static int iwl_mvm_tx_tso(struct iwl_mvm
+ !(mvmsta->amsdu_enabled & BIT(tid)))
+ return iwl_mvm_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb);
+
+- max_amsdu_len = iwl_mvm_max_amsdu_size(mvm, sta, tid);
++ /*
++ * Take the min of ieee80211 station and mvm station
++ */
++ max_amsdu_len =
++ min_t(unsigned int, sta->max_amsdu_len,
++ iwl_mvm_max_amsdu_size(mvm, sta, tid));
+
+ /*
+ * Limit A-MSDU in A-MPDU to 4095 bytes when VHT is not
--- /dev/null
+From bb99ff9baa02beb9216c86678999342197c849cc Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Fri, 15 Nov 2019 09:27:25 +0200
+Subject: iwlwifi: mvm: fix support for single antenna diversity
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+commit bb99ff9baa02beb9216c86678999342197c849cc upstream.
+
+When the single antenna diversity support was sent upstream, only some
+definitions were sent, due to a bad revert.
+
+Fix this by adding the actual code.
+
+Fixes: 5952e0ec3f05 ("iwlwifi: mvm: add support for single antenna diversity")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -514,6 +514,18 @@ static int iwl_send_phy_cfg_cmd(struct i
+ struct iwl_phy_cfg_cmd phy_cfg_cmd;
+ enum iwl_ucode_type ucode_type = mvm->fwrt.cur_fw_img;
+
++ if (iwl_mvm_has_unified_ucode(mvm) &&
++ !mvm->trans->cfg->tx_with_siso_diversity) {
++ return 0;
++ } else if (mvm->trans->cfg->tx_with_siso_diversity) {
++ /*
++ * TODO: currently we don't set the antenna but letting the NIC
++ * to decide which antenna to use. This should come from BIOS.
++ */
++ phy_cfg_cmd.phy_cfg =
++ cpu_to_le32(FW_PHY_CFG_CHAIN_SAD_ENABLED);
++ }
++
+ /* Set parameters */
+ phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_get_phy_config(mvm));
+
+@@ -1344,12 +1356,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
+ ret = iwl_send_phy_db_data(mvm->phy_db);
+ if (ret)
+ goto error;
+-
+- ret = iwl_send_phy_cfg_cmd(mvm);
+- if (ret)
+- goto error;
+ }
+
++ ret = iwl_send_phy_cfg_cmd(mvm);
++ if (ret)
++ goto error;
++
+ ret = iwl_mvm_send_bt_init_conf(mvm);
+ if (ret)
+ goto error;
--- /dev/null
+From c3df30a01da4955e04fa068c503cd784b31dad92 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Sun, 10 Nov 2019 07:23:38 +0100
+Subject: media: aspeed-video: Fix memory leaks in aspeed_video_probe
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+commit c3df30a01da4955e04fa068c503cd784b31dad92 upstream.
+
+In the implementation of aspeed_video_probe() the allocated memory for
+video should be released if either devm_ioremap_resource()
+or aspeed_video_init() or aspeed_video_setup_video() fails. Replace
+kzalloc() with devm_kzalloc to avoid explicit release for video.
+
+Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Reviewed-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/aspeed-video.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/aspeed-video.c
++++ b/drivers/media/platform/aspeed-video.c
+@@ -1658,7 +1658,8 @@ static int aspeed_video_probe(struct pla
+ {
+ int rc;
+ struct resource *res;
+- struct aspeed_video *video = kzalloc(sizeof(*video), GFP_KERNEL);
++ struct aspeed_video *video =
++ devm_kzalloc(&pdev->dev, sizeof(*video), GFP_KERNEL);
+
+ if (!video)
+ return -ENOMEM;
--- /dev/null
+From a6b8feae7c88343212686120740cf7551dd16e08 Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Tue, 29 Oct 2019 01:00:52 +0100
+Subject: media: cedrus: Use correct H264 8x8 scaling list
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+commit a6b8feae7c88343212686120740cf7551dd16e08 upstream.
+
+Documentation now defines the expected order of scaling lists,
+change to use correct indices.
+
+Fixes: 6eb9b758e307 ("media: cedrus: Add H264 decoding support")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c
+@@ -244,8 +244,8 @@ static void cedrus_write_scaling_lists(s
+ sizeof(scaling->scaling_list_8x8[0]));
+
+ cedrus_h264_write_sram(dev, CEDRUS_SRAM_H264_SCALING_LIST_8x8_1,
+- scaling->scaling_list_8x8[3],
+- sizeof(scaling->scaling_list_8x8[3]));
++ scaling->scaling_list_8x8[1],
++ sizeof(scaling->scaling_list_8x8[1]));
+
+ cedrus_h264_write_sram(dev, CEDRUS_SRAM_H264_SCALING_LIST_4x4,
+ scaling->scaling_list_4x4,
--- /dev/null
+From a3fd80198de6ab98a205cf7fb148d88e9e1c44bb Mon Sep 17 00:00:00 2001
+From: Philipp Zabel <p.zabel@pengutronix.de>
+Date: Thu, 24 Oct 2019 07:32:11 -0300
+Subject: media: coda: fix deadlock between decoder picture run and start command
+
+From: Philipp Zabel <p.zabel@pengutronix.de>
+
+commit a3fd80198de6ab98a205cf7fb148d88e9e1c44bb upstream.
+
+The BIT decoder picture run temporarily locks the bitstream mutex while
+the coda device mutex is locked, to refill the bitstream ring buffer.
+Consequently, the decoder start command, which locks both mutexes when
+flushing the bitstream ring buffer, must lock the coda device mutex
+first as well, to avoid an ABBA deadlock.
+
+Fixes: e7fd95849b3c ("media: coda: flush bitstream ring buffer on decoder restart")
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/coda/coda-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -1084,16 +1084,16 @@ static int coda_decoder_cmd(struct file
+
+ switch (dc->cmd) {
+ case V4L2_DEC_CMD_START:
+- mutex_lock(&ctx->bitstream_mutex);
+ mutex_lock(&dev->coda_mutex);
++ mutex_lock(&ctx->bitstream_mutex);
+ coda_bitstream_flush(ctx);
+- mutex_unlock(&dev->coda_mutex);
+ dst_vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx,
+ V4L2_BUF_TYPE_VIDEO_CAPTURE);
+ vb2_clear_last_buffer_dequeued(dst_vq);
+ ctx->bit_stream_param &= ~CODA_BIT_STREAM_END_FLAG;
+ coda_fill_bitstream(ctx, NULL);
+ mutex_unlock(&ctx->bitstream_mutex);
++ mutex_unlock(&dev->coda_mutex);
+ break;
+ case V4L2_DEC_CMD_STOP:
+ stream_end = false;
--- /dev/null
+From 704c6c80fb471d1bb0ef0d61a94617d1d55743cd Mon Sep 17 00:00:00 2001
+From: Seung-Woo Kim <sw0312.kim@samsung.com>
+Date: Fri, 18 Oct 2019 07:20:52 -0300
+Subject: media: exynos4-is: Fix recursive locking in isp_video_release()
+
+From: Seung-Woo Kim <sw0312.kim@samsung.com>
+
+commit 704c6c80fb471d1bb0ef0d61a94617d1d55743cd upstream.
+
+>From isp_video_release(), &isp->video_lock is held and subsequent
+vb2_fop_release() tries to lock vdev->lock which is same with the
+previous one. Replace vb2_fop_release() with _vb2_fop_release() to
+fix the recursive locking.
+
+Fixes: 1380f5754cb0 ("[media] videobuf2: Add missing lock held on vb2_fop_release")
+Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
+Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/exynos4-is/fimc-isp-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+@@ -313,7 +313,7 @@ static int isp_video_release(struct file
+ ivc->streaming = 0;
+ }
+
+- vb2_fop_release(file);
++ _vb2_fop_release(file, NULL);
+
+ if (v4l2_fh_is_singular_file(file)) {
+ fimc_pipeline_call(&ivc->ve, close);
--- /dev/null
+From e17f08e3166635d2eaa6a894afeb28ca651ddd35 Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Tue, 29 Oct 2019 01:00:53 +0100
+Subject: media: hantro: Do not reorder H264 scaling list
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+commit e17f08e3166635d2eaa6a894afeb28ca651ddd35 upstream.
+
+Scaling list supplied from userspace should be in matrix order
+and can be used without applying the inverse scanning process.
+
+The HW also only support 8x8 scaling list for the Y component, indices 0
+and 1 in the scaling list supplied from userspace.
+
+Remove reordering and write the scaling matrix in an order expected by
+the VPU, also only allocate memory for the two 8x8 lists supported.
+
+Fixes: a9471e25629b ("media: hantro: Add core bits to support H264 decoding")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_h264.c | 51 ++++++-----------------------
+ 1 file changed, 12 insertions(+), 39 deletions(-)
+
+--- a/drivers/staging/media/hantro/hantro_h264.c
++++ b/drivers/staging/media/hantro/hantro_h264.c
+@@ -20,7 +20,7 @@
+ /* Size with u32 units. */
+ #define CABAC_INIT_BUFFER_SIZE (460 * 2)
+ #define POC_BUFFER_SIZE 34
+-#define SCALING_LIST_SIZE (6 * 16 + 6 * 64)
++#define SCALING_LIST_SIZE (6 * 16 + 2 * 64)
+
+ #define POC_CMP(p0, p1) ((p0) < (p1) ? -1 : 1)
+
+@@ -194,23 +194,6 @@ static const u32 h264_cabac_table[] = {
+ 0x1f0c2517, 0x1f261440
+ };
+
+-/*
+- * NOTE: The scaling lists are in zig-zag order, apply inverse scanning process
+- * to get the values in matrix order. In addition, the hardware requires bytes
+- * swapped within each subsequent 4 bytes. Both arrays below include both
+- * transformations.
+- */
+-static const u32 zig_zag_4x4[] = {
+- 3, 2, 7, 11, 6, 1, 0, 5, 10, 15, 14, 9, 4, 8, 13, 12
+-};
+-
+-static const u32 zig_zag_8x8[] = {
+- 3, 2, 11, 19, 10, 1, 0, 9, 18, 27, 35, 26, 17, 8, 7, 6,
+- 15, 16, 25, 34, 43, 51, 42, 33, 24, 23, 14, 5, 4, 13, 22, 31,
+- 32, 41, 50, 59, 58, 49, 40, 39, 30, 21, 12, 20, 29, 38, 47, 48,
+- 57, 56, 55, 46, 37, 28, 36, 45, 54, 63, 62, 53, 44, 52, 61, 60
+-};
+-
+ static void
+ reorder_scaling_list(struct hantro_ctx *ctx)
+ {
+@@ -218,33 +201,23 @@ reorder_scaling_list(struct hantro_ctx *
+ const struct v4l2_ctrl_h264_scaling_matrix *scaling = ctrls->scaling;
+ const size_t num_list_4x4 = ARRAY_SIZE(scaling->scaling_list_4x4);
+ const size_t list_len_4x4 = ARRAY_SIZE(scaling->scaling_list_4x4[0]);
+- const size_t num_list_8x8 = ARRAY_SIZE(scaling->scaling_list_8x8);
+ const size_t list_len_8x8 = ARRAY_SIZE(scaling->scaling_list_8x8[0]);
+ struct hantro_h264_dec_priv_tbl *tbl = ctx->h264_dec.priv.cpu;
+- u8 *dst = tbl->scaling_list;
+- const u8 *src;
++ u32 *dst = (u32 *)tbl->scaling_list;
++ const u32 *src;
+ int i, j;
+
+- BUILD_BUG_ON(ARRAY_SIZE(zig_zag_4x4) != list_len_4x4);
+- BUILD_BUG_ON(ARRAY_SIZE(zig_zag_8x8) != list_len_8x8);
+- BUILD_BUG_ON(ARRAY_SIZE(tbl->scaling_list) !=
+- num_list_4x4 * list_len_4x4 +
+- num_list_8x8 * list_len_8x8);
+-
+- src = &scaling->scaling_list_4x4[0][0];
+- for (i = 0; i < num_list_4x4; ++i) {
+- for (j = 0; j < list_len_4x4; ++j)
+- dst[zig_zag_4x4[j]] = src[j];
+- src += list_len_4x4;
+- dst += list_len_4x4;
++ for (i = 0; i < num_list_4x4; i++) {
++ src = (u32 *)&scaling->scaling_list_4x4[i];
++ for (j = 0; j < list_len_4x4 / 4; j++)
++ *dst++ = swab32(src[j]);
+ }
+
+- src = &scaling->scaling_list_8x8[0][0];
+- for (i = 0; i < num_list_8x8; ++i) {
+- for (j = 0; j < list_len_8x8; ++j)
+- dst[zig_zag_8x8[j]] = src[j];
+- src += list_len_8x8;
+- dst += list_len_8x8;
++ /* Only Intra/Inter Y lists */
++ for (i = 0; i < 2; i++) {
++ src = (u32 *)&scaling->scaling_list_8x8[i];
++ for (j = 0; j < list_len_8x8 / 4; j++)
++ *dst++ = swab32(src[j]);
+ }
+ }
+
--- /dev/null
+From 9db5f87f6723678a7e7e5e3165439c5c4378edbb Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Mon, 9 Sep 2019 04:28:15 -0300
+Subject: media: hantro: h264: Fix the frame_num wraparound case
+
+From: Boris Brezillon <boris.brezillon@collabora.com>
+
+commit 9db5f87f6723678a7e7e5e3165439c5c4378edbb upstream.
+
+Step '8.2.4.1 Decoding process for picture numbers' was missing in the
+reflist creation logic, leading to invalid P reflists when a
+->frame_num wraparound happens.
+
+Fixes: a9471e25629b ("media: hantro: Add core bits to support H264 decoding")
+Reported-by: Francois Buergisser <fbuergisser@google.com>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Tested-by: Philipp Zabel <p.zabel@pengutronix.de>
+Tested-by: Francois Buergisser <fbuergisser@chromium.org>
+Reviewed-by: Tomasz Figa <tfiga@chromium.org>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_h264.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+--- a/drivers/staging/media/hantro/hantro_h264.c
++++ b/drivers/staging/media/hantro/hantro_h264.c
+@@ -271,6 +271,7 @@ struct hantro_h264_reflist_builder {
+ const struct v4l2_h264_dpb_entry *dpb;
+ s32 pocs[HANTRO_H264_DPB_SIZE];
+ u8 unordered_reflist[HANTRO_H264_DPB_SIZE];
++ int frame_nums[HANTRO_H264_DPB_SIZE];
+ s32 curpoc;
+ u8 num_valid;
+ };
+@@ -294,13 +295,20 @@ static void
+ init_reflist_builder(struct hantro_ctx *ctx,
+ struct hantro_h264_reflist_builder *b)
+ {
++ const struct v4l2_ctrl_h264_slice_params *slice_params;
+ const struct v4l2_ctrl_h264_decode_params *dec_param;
++ const struct v4l2_ctrl_h264_sps *sps;
+ struct vb2_v4l2_buffer *buf = hantro_get_dst_buf(ctx);
+ const struct v4l2_h264_dpb_entry *dpb = ctx->h264_dec.dpb;
+ struct vb2_queue *cap_q = &ctx->fh.m2m_ctx->cap_q_ctx.q;
++ int cur_frame_num, max_frame_num;
+ unsigned int i;
+
+ dec_param = ctx->h264_dec.ctrls.decode;
++ slice_params = &ctx->h264_dec.ctrls.slices[0];
++ sps = ctx->h264_dec.ctrls.sps;
++ max_frame_num = 1 << (sps->log2_max_frame_num_minus4 + 4);
++ cur_frame_num = slice_params->frame_num;
+
+ memset(b, 0, sizeof(*b));
+ b->dpb = dpb;
+@@ -318,6 +326,18 @@ init_reflist_builder(struct hantro_ctx *
+ continue;
+
+ buf = to_vb2_v4l2_buffer(vb2_get_buffer(cap_q, buf_idx));
++
++ /*
++ * Handle frame_num wraparound as described in section
++ * '8.2.4.1 Decoding process for picture numbers' of the spec.
++ * TODO: This logic will have to be adjusted when we start
++ * supporting interlaced content.
++ */
++ if (dpb[i].frame_num > cur_frame_num)
++ b->frame_nums[i] = (int)dpb[i].frame_num - max_frame_num;
++ else
++ b->frame_nums[i] = dpb[i].frame_num;
++
+ b->pocs[i] = get_poc(buf->field, dpb[i].top_field_order_cnt,
+ dpb[i].bottom_field_order_cnt);
+ b->unordered_reflist[b->num_valid] = i;
+@@ -353,7 +373,7 @@ static int p_ref_list_cmp(const void *pt
+ * ascending order.
+ */
+ if (!(a->flags & V4L2_H264_DPB_ENTRY_FLAG_LONG_TERM))
+- return b->frame_num - a->frame_num;
++ return builder->frame_nums[idxb] - builder->frame_nums[idxa];
+
+ return a->pic_num - b->pic_num;
+ }
--- /dev/null
+From a2cbf80a842add9663522bf898cf13cb2ac4e423 Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Wed, 6 Nov 2019 23:35:11 +0100
+Subject: media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly
+
+From: Jonas Karlman <jonas@kwiboo.se>
+
+commit a2cbf80a842add9663522bf898cf13cb2ac4e423 upstream.
+
+The FIELDPIC_FLAG_E bit should be set when field_pic_flag exists in stream,
+it is currently set based on field_pic_flag of current frame.
+The PIC_FIELDMODE_E bit is correctly set based on the field_pic_flag.
+
+Fix this by setting the FIELDPIC_FLAG_E bit when frame_mbs_only is not set.
+
+Fixes: dea0a82f3d22 ("media: hantro: Add support for H264 decoding on G1")
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/media/hantro/hantro_g1_h264_dec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/staging/media/hantro/hantro_g1_h264_dec.c
++++ b/drivers/staging/media/hantro/hantro_g1_h264_dec.c
+@@ -63,7 +63,7 @@ static void set_params(struct hantro_ctx
+ /* always use the matrix sent from userspace */
+ reg |= G1_REG_DEC_CTRL2_TYPE1_QUANT_E;
+
+- if (slices[0].flags & V4L2_H264_SLICE_FLAG_FIELD_PIC)
++ if (!(sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY))
+ reg |= G1_REG_DEC_CTRL2_FIELDPIC_FLAG_E;
+ vdpu_write_relaxed(vpu, reg, G1_REG_DEC_CTRL2);
+
--- /dev/null
+From 39034bb0c26b76a2c3abc54aa28c185f18b40c2f Mon Sep 17 00:00:00 2001
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Tue, 3 Sep 2019 17:11:41 -0300
+Subject: media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+commit 39034bb0c26b76a2c3abc54aa28c185f18b40c2f upstream.
+
+Commit da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad
+op get_fmt") converted a former ov6650_g_fmt() video operation callback
+to an ov6650_get_fmt() pad operation callback. However, the converted
+function disregards a format->which flag that pad operations should
+obey and always returns active frame format settings.
+
+That can be fixed by always responding to V4L2_SUBDEV_FORMAT_TRY with
+-EINVAL, or providing the response from a pad config argument, likely
+updated by a former user call to V4L2_SUBDEV_FORMAT_TRY .set_fmt().
+Since implementation of the latter is trivial, go for it.
+
+Fixes: da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad op get_fmt")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/ov6650.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -528,10 +528,16 @@ static int ov6650_get_fmt(struct v4l2_su
+ *mf = ov6650_def_fmt;
+
+ /* update media bus format code and frame size */
+- mf->width = priv->rect.width >> priv->half_scale;
+- mf->height = priv->rect.height >> priv->half_scale;
+- mf->code = priv->code;
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ mf->width = cfg->try_fmt.width;
++ mf->height = cfg->try_fmt.height;
++ mf->code = cfg->try_fmt.code;
+
++ } else {
++ mf->width = priv->rect.width >> priv->half_scale;
++ mf->height = priv->rect.height >> priv->half_scale;
++ mf->code = priv->code;
++ }
+ return 0;
+ }
+
--- /dev/null
+From 5439fa9263cb293e41168bc03711ec18c4f11cba Mon Sep 17 00:00:00 2001
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Tue, 3 Sep 2019 17:11:42 -0300
+Subject: media: ov6650: Fix default format not applied on device probe
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+commit 5439fa9263cb293e41168bc03711ec18c4f11cba upstream.
+
+It is not clear what pixel format is actually configured in hardware on
+reset. MEDIA_BUS_FMT_YUYV8_2X8, assumed on device probe since the
+driver was intiially submitted, is for sure not the one.
+
+Fix it by explicitly applying a known, driver default frame format just
+after initial device reset.
+
+Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/ov6650.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -877,6 +877,11 @@ static int ov6650_video_probe(struct v4l
+ ret = ov6650_reset(client);
+ if (!ret)
+ ret = ov6650_prog_dflt(client);
++ if (!ret) {
++ struct v4l2_mbus_framefmt mf = ov6650_def_fmt;
++
++ ret = ov6650_s_fmt(sd, &mf);
++ }
+ if (!ret)
+ ret = v4l2_ctrl_handler_setup(&priv->hdl);
+
+@@ -1031,8 +1036,6 @@ static int ov6650_probe(struct i2c_clien
+ priv->rect.top = DEF_VSTRT << 1;
+ priv->rect.width = W_CIF;
+ priv->rect.height = H_CIF;
+- priv->half_scale = false;
+- priv->code = MEDIA_BUS_FMT_YUYV8_2X8;
+
+ /* Hardware default frame interval */
+ priv->tpf.numerator = GET_CLKRC_DIV(DEF_CLKRC);
--- /dev/null
+From 12500731895ef09afc5b66b86b76c0884fb9c7bf Mon Sep 17 00:00:00 2001
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Tue, 3 Sep 2019 17:11:39 -0300
+Subject: media: ov6650: Fix incorrect use of JPEG colorspace
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+commit 12500731895ef09afc5b66b86b76c0884fb9c7bf upstream.
+
+Since its initial submission, the driver selects V4L2_COLORSPACE_JPEG
+for supported formats other than V4L2_MBUS_FMT_SBGGR8_1X8. According
+to v4l2-compliance test program, V4L2_COLORSPACE_JPEG applies
+exclusively to V4L2_PIX_FMT_JPEG. Since the sensor does not support
+JPEG format, fix it to always select V4L2_COLORSPACE_SRGB.
+
+Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/ov6650.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -201,7 +201,6 @@ struct ov6650 {
+ unsigned long pclk_max; /* from resolution and format */
+ struct v4l2_fract tpf; /* as requested with s_frame_interval */
+ u32 code;
+- enum v4l2_colorspace colorspace;
+ };
+
+
+@@ -517,7 +516,7 @@ static int ov6650_get_fmt(struct v4l2_su
+ mf->width = priv->rect.width >> priv->half_scale;
+ mf->height = priv->rect.height >> priv->half_scale;
+ mf->code = priv->code;
+- mf->colorspace = priv->colorspace;
++ mf->colorspace = V4L2_COLORSPACE_SRGB;
+ mf->field = V4L2_FIELD_NONE;
+
+ return 0;
+@@ -624,11 +623,6 @@ static int ov6650_s_fmt(struct v4l2_subd
+ priv->pclk_max = 8000000;
+ }
+
+- if (code == MEDIA_BUS_FMT_SBGGR8_1X8)
+- priv->colorspace = V4L2_COLORSPACE_SRGB;
+- else if (code != 0)
+- priv->colorspace = V4L2_COLORSPACE_JPEG;
+-
+ if (half_scale) {
+ dev_dbg(&client->dev, "max resolution: QCIF\n");
+ coma_set |= COMA_QCIF;
+@@ -663,7 +657,6 @@ static int ov6650_s_fmt(struct v4l2_subd
+ priv->code = code;
+
+ if (!ret) {
+- mf->colorspace = priv->colorspace;
+ mf->width = priv->rect.width >> half_scale;
+ mf->height = priv->rect.height >> half_scale;
+ }
+@@ -686,6 +679,7 @@ static int ov6650_set_fmt(struct v4l2_su
+ &mf->height, 2, H_CIF, 1, 0);
+
+ mf->field = V4L2_FIELD_NONE;
++ mf->colorspace = V4L2_COLORSPACE_SRGB;
+
+ switch (mf->code) {
+ case MEDIA_BUS_FMT_Y10_1X10:
+@@ -696,13 +690,11 @@ static int ov6650_set_fmt(struct v4l2_su
+ case MEDIA_BUS_FMT_YUYV8_2X8:
+ case MEDIA_BUS_FMT_VYUY8_2X8:
+ case MEDIA_BUS_FMT_UYVY8_2X8:
+- mf->colorspace = V4L2_COLORSPACE_JPEG;
+ break;
+ default:
+ mf->code = MEDIA_BUS_FMT_SBGGR8_1X8;
+ /* fall through */
+ case MEDIA_BUS_FMT_SBGGR8_1X8:
+- mf->colorspace = V4L2_COLORSPACE_SRGB;
+ break;
+ }
+
+@@ -1008,7 +1000,6 @@ static int ov6650_probe(struct i2c_clien
+ priv->rect.height = H_CIF;
+ priv->half_scale = false;
+ priv->code = MEDIA_BUS_FMT_YUYV8_2X8;
+- priv->colorspace = V4L2_COLORSPACE_JPEG;
+
+ /* Hardware default frame interval */
+ priv->tpf.numerator = GET_CLKRC_DIV(DEF_CLKRC);
--- /dev/null
+From 1c6a2b63095154bbf9e8f38d79487a728331bf65 Mon Sep 17 00:00:00 2001
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Tue, 3 Sep 2019 17:11:40 -0300
+Subject: media: ov6650: Fix some format attributes not under control
+
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+
+commit 1c6a2b63095154bbf9e8f38d79487a728331bf65 upstream.
+
+User arguments passed to .get/set_fmt() pad operation callbacks may
+contain unsupported values. The driver takes control over frame size
+and pixel code as well as colorspace and field attributes but has never
+cared for remainig format attributes, i.e., ycbcr_enc, quantization
+and xfer_func, introduced by commit 11ff030c7365 ("[media]
+v4l2-mediabus: improve colorspace support"). Fix it.
+
+Set up a static v4l2_mbus_framefmt structure with attributes
+initialized to reasonable defaults and use it for updating content of
+user provided arguments. In case of V4L2_SUBDEV_FORMAT_ACTIVE,
+postpone frame size update, now performed from inside ov6650_s_fmt()
+helper, util the user argument is first updated in ov6650_set_fmt() with
+default frame format content. For V4L2_SUBDEV_FORMAT_TRY, don't copy
+all attributes to pad config, only those handled by the driver, then
+fill the response with the default frame format updated with resulting
+pad config format code and frame size.
+
+Fixes: 11ff030c7365 ("[media] v4l2-mediabus: improve colorspace support")
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/ov6650.c | 51 ++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 39 insertions(+), 12 deletions(-)
+
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -213,6 +213,17 @@ static u32 ov6650_codes[] = {
+ MEDIA_BUS_FMT_Y8_1X8,
+ };
+
++static const struct v4l2_mbus_framefmt ov6650_def_fmt = {
++ .width = W_CIF,
++ .height = H_CIF,
++ .code = MEDIA_BUS_FMT_SBGGR8_1X8,
++ .colorspace = V4L2_COLORSPACE_SRGB,
++ .field = V4L2_FIELD_NONE,
++ .ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT,
++ .quantization = V4L2_QUANTIZATION_DEFAULT,
++ .xfer_func = V4L2_XFER_FUNC_DEFAULT,
++};
++
+ /* read a register */
+ static int ov6650_reg_read(struct i2c_client *client, u8 reg, u8 *val)
+ {
+@@ -513,11 +524,13 @@ static int ov6650_get_fmt(struct v4l2_su
+ if (format->pad)
+ return -EINVAL;
+
++ /* initialize response with default media bus frame format */
++ *mf = ov6650_def_fmt;
++
++ /* update media bus format code and frame size */
+ mf->width = priv->rect.width >> priv->half_scale;
+ mf->height = priv->rect.height >> priv->half_scale;
+ mf->code = priv->code;
+- mf->colorspace = V4L2_COLORSPACE_SRGB;
+- mf->field = V4L2_FIELD_NONE;
+
+ return 0;
+ }
+@@ -656,10 +669,6 @@ static int ov6650_s_fmt(struct v4l2_subd
+ if (!ret)
+ priv->code = code;
+
+- if (!ret) {
+- mf->width = priv->rect.width >> half_scale;
+- mf->height = priv->rect.height >> half_scale;
+- }
+ return ret;
+ }
+
+@@ -678,9 +687,6 @@ static int ov6650_set_fmt(struct v4l2_su
+ v4l_bound_align_image(&mf->width, 2, W_CIF, 1,
+ &mf->height, 2, H_CIF, 1, 0);
+
+- mf->field = V4L2_FIELD_NONE;
+- mf->colorspace = V4L2_COLORSPACE_SRGB;
+-
+ switch (mf->code) {
+ case MEDIA_BUS_FMT_Y10_1X10:
+ mf->code = MEDIA_BUS_FMT_Y8_1X8;
+@@ -698,10 +704,31 @@ static int ov6650_set_fmt(struct v4l2_su
+ break;
+ }
+
+- if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE)
+- return ov6650_s_fmt(sd, mf);
+- cfg->try_fmt = *mf;
++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) {
++ /* store media bus format code and frame size in pad config */
++ cfg->try_fmt.width = mf->width;
++ cfg->try_fmt.height = mf->height;
++ cfg->try_fmt.code = mf->code;
++
++ /* return default mbus frame format updated with pad config */
++ *mf = ov6650_def_fmt;
++ mf->width = cfg->try_fmt.width;
++ mf->height = cfg->try_fmt.height;
++ mf->code = cfg->try_fmt.code;
++
++ } else {
++ /* apply new media bus format code and frame size */
++ int ret = ov6650_s_fmt(sd, mf);
+
++ if (ret)
++ return ret;
++
++ /* return default format updated with active size and code */
++ *mf = ov6650_def_fmt;
++ mf->width = priv->rect.width >> priv->half_scale;
++ mf->height = priv->rect.height >> priv->half_scale;
++ mf->code = priv->code;
++ }
+ return 0;
+ }
+
--- /dev/null
+From a0862a40364e2f87109317e31c51c9d7bc89e33f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Niklas=20S=C3=B6derlund?=
+ <niklas.soderlund+renesas@ragnatech.se>
+Date: Wed, 4 Sep 2019 18:54:04 -0300
+Subject: media: rcar-vin: Fix incorrect return statement in rvin_try_format()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+
+commit a0862a40364e2f87109317e31c51c9d7bc89e33f upstream.
+
+While refactoring code the return statement became corrupted, fix it by
+returning the correct return code.
+
+Reported-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Fixes: 897e371389e77514 ("media: rcar-vin: simplify how formats are set and reset"
+Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/rcar-vin/rcar-v4l2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/rcar-vin/rcar-v4l2.c
++++ b/drivers/media/platform/rcar-vin/rcar-v4l2.c
+@@ -208,6 +208,7 @@ static int rvin_try_format(struct rvin_d
+ ret = v4l2_subdev_call(sd, pad, set_fmt, pad_cfg, &format);
+ if (ret < 0 && ret != -ENOIOCTLCMD)
+ goto done;
++ ret = 0;
+
+ v4l2_fill_pix_format(pix, &format.format);
+
+@@ -242,7 +243,7 @@ static int rvin_try_format(struct rvin_d
+ done:
+ v4l2_subdev_free_pad_config(pad_cfg);
+
+- return 0;
++ return ret;
+ }
+
+ static int rvin_querycap(struct file *file, void *priv,
--- /dev/null
+From 2eca8e4c1df4864b937752c3aa2f7925114f4806 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Fri, 13 Sep 2019 16:06:47 -0300
+Subject: media: v4l: cadence: Fix how unsued lanes are handled in 'csi2rx_start()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 2eca8e4c1df4864b937752c3aa2f7925114f4806 upstream.
+
+The 2nd parameter of 'find_first_zero_bit()' is a number of bits, not of
+bytes. So use 'csi2rx->max_lanes' instead of 'sizeof(lanes_used)'.
+
+Fixes: 1fc3b37f34f6 ("media: v4l: cadence: Add Cadence MIPI-CSI2 RX driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/cadence/cdns-csi2rx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/platform/cadence/cdns-csi2rx.c
++++ b/drivers/media/platform/cadence/cdns-csi2rx.c
+@@ -129,7 +129,7 @@ static int csi2rx_start(struct csi2rx_pr
+ */
+ for (i = csi2rx->num_lanes; i < csi2rx->max_lanes; i++) {
+ unsigned int idx = find_first_zero_bit(&lanes_used,
+- sizeof(lanes_used));
++ csi2rx->max_lanes);
+ set_bit(idx, &lanes_used);
+ reg |= CSI2RX_STATIC_CFG_DLANE_MAP(i, i + 1);
+ }
--- /dev/null
+From fb03082a54acd66c61535edfefe96b2ff88ce7e2 Mon Sep 17 00:00:00 2001
+From: Yong Wu <yong.wu@mediatek.com>
+Date: Wed, 9 Oct 2019 19:59:33 +0800
+Subject: memory: mtk-smi: Add PM suspend and resume ops
+
+From: Yong Wu <yong.wu@mediatek.com>
+
+commit fb03082a54acd66c61535edfefe96b2ff88ce7e2 upstream.
+
+In the commit 4f0a1a1ae351 ("memory: mtk-smi: Invoke pm runtime_callback
+to enable clocks"), we use pm_runtime callback to enable/disable the smi
+larb clocks. It will cause the larb's clock may not be disabled when
+suspend. That is because device_prepare will call pm_runtime_get_noresume
+which will keep the larb's PM runtime status still is active when suspend,
+then it won't enter our pm_runtime suspend callback to disable the
+corresponding clocks.
+
+This patch adds suspend pm_ops to force disable the clocks, Use "LATE" to
+make sure it disable the larb's clocks after the multimedia devices.
+
+Fixes: 4f0a1a1ae351 ("memory: mtk-smi: Invoke pm runtime_callback to enable clocks")
+Signed-off-by: Anan Sun <anan.sun@mediatek.com>
+Signed-off-by: Yong Wu <yong.wu@mediatek.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/memory/mtk-smi.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/memory/mtk-smi.c
++++ b/drivers/memory/mtk-smi.c
+@@ -366,6 +366,8 @@ static int __maybe_unused mtk_smi_larb_s
+
+ static const struct dev_pm_ops smi_larb_pm_ops = {
+ SET_RUNTIME_PM_OPS(mtk_smi_larb_suspend, mtk_smi_larb_resume, NULL)
++ SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
++ pm_runtime_force_resume)
+ };
+
+ static struct platform_driver mtk_smi_larb_driver = {
+@@ -507,6 +509,8 @@ static int __maybe_unused mtk_smi_common
+
+ static const struct dev_pm_ops smi_common_pm_ops = {
+ SET_RUNTIME_PM_OPS(mtk_smi_common_suspend, mtk_smi_common_resume, NULL)
++ SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
++ pm_runtime_force_resume)
+ };
+
+ static struct platform_driver mtk_smi_common_driver = {
--- /dev/null
+From dece3c2a320b0a6d891da6ff774ab763969b6860 Mon Sep 17 00:00:00 2001
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+Date: Mon, 4 Nov 2019 21:33:50 +0800
+Subject: MIPS: Loongson: Fix return value of loongson_hwmon_init
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+commit dece3c2a320b0a6d891da6ff774ab763969b6860 upstream.
+
+When call function hwmon_device_register failed, use the actual
+return value instead of always -ENOMEM.
+
+Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver")
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: Huacai Chen <chenhc@lemote.com>
+Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/platform/mips/cpu_hwmon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/platform/mips/cpu_hwmon.c
++++ b/drivers/platform/mips/cpu_hwmon.c
+@@ -161,7 +161,7 @@ static int __init loongson_hwmon_init(vo
+
+ cpu_hwmon_dev = hwmon_device_register(NULL);
+ if (IS_ERR(cpu_hwmon_dev)) {
+- ret = -ENOMEM;
++ ret = PTR_ERR(cpu_hwmon_dev);
+ pr_err("hwmon_device_register fail!\n");
+ goto fail_hwmon_device_register;
+ }
--- /dev/null
+From 37640adbefd66491cb8083a438f7bf366ac09bc7 Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Tue, 19 Nov 2019 12:08:57 +0100
+Subject: MIPS: PCI: remember nasid changed by set interrupt affinity
+
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+
+commit 37640adbefd66491cb8083a438f7bf366ac09bc7 upstream.
+
+When changing interrupt affinity remember the possible changed nasid,
+otherwise an interrupt deactivate/activate sequence will incorrectly
+setup interrupt.
+
+Fixes: e6308b6d35ea ("MIPS: SGI-IP27: abstract chipset irq from bridge")
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/pci/pci-xtalk-bridge.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/pci/pci-xtalk-bridge.c
++++ b/arch/mips/pci/pci-xtalk-bridge.c
+@@ -279,16 +279,15 @@ static int bridge_set_affinity(struct ir
+ struct bridge_irq_chip_data *data = d->chip_data;
+ int bit = d->parent_data->hwirq;
+ int pin = d->hwirq;
+- nasid_t nasid;
+ int ret, cpu;
+
+ ret = irq_chip_set_affinity_parent(d, mask, force);
+ if (ret >= 0) {
+ cpu = cpumask_first_and(mask, cpu_online_mask);
+- nasid = COMPACT_TO_NASID_NODEID(cpu_to_node(cpu));
++ data->nnasid = COMPACT_TO_NASID_NODEID(cpu_to_node(cpu));
+ bridge_write(data->bc, b_int_addr[pin].addr,
+ (((data->bc->intr_addr >> 30) & 0x30000) |
+- bit | (nasid << 8)));
++ bit | (data->nasid << 8)));
+ bridge_read(data->bc, b_wid_tflush);
+ }
+ return ret;
--- /dev/null
+From e3d765a941f6130fd94e47b2064cfee71f4cbadd Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Tue, 19 Nov 2019 12:08:56 +0100
+Subject: MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter
+
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+
+commit e3d765a941f6130fd94e47b2064cfee71f4cbadd upstream.
+
+If number of CPUs are limited by the kernel commandline parameter nr_cpus
+assignment of interrupts accourding to numa rules might not be possibe.
+As a fallback use one of the online CPUs as interrupt destination.
+
+Fixes: 69a07a41d908 ("MIPS: SGI-IP27: rework HUB interrupts")
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Paul Burton <paulburton@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/sgi-ip27/ip27-irq.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/mips/sgi-ip27/ip27-irq.c
++++ b/arch/mips/sgi-ip27/ip27-irq.c
+@@ -73,6 +73,9 @@ static void setup_hub_mask(struct hub_ir
+ int cpu;
+
+ cpu = cpumask_first_and(mask, cpu_online_mask);
++ if (cpu >= nr_cpu_ids)
++ cpu = cpumask_any(cpu_online_mask);
++
+ nasid = COMPACT_TO_NASID_NODEID(cpu_to_node(cpu));
+ hd->cpu = cpu;
+ if (!cputoslice(cpu)) {
+@@ -139,6 +142,7 @@ static int hub_domain_alloc(struct irq_d
+ /* use CPU connected to nearest hub */
+ hub = hub_data(NASID_TO_COMPACT_NODEID(info->nasid));
+ setup_hub_mask(hd, &hub->h_cpus);
++ info->nasid = cpu_to_node(hd->cpu);
+
+ /* Make sure it's not already pending when we connect it. */
+ REMOTE_HUB_CLR_INTR(info->nasid, swlevel);
--- /dev/null
+From a719a75a7761e4139dd099330d9fe3589d844f9b Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 30 Oct 2019 21:48:59 +0300
+Subject: mtd: spi-nor: fix silent truncation in spi_nor_read()
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+commit a719a75a7761e4139dd099330d9fe3589d844f9b upstream.
+
+spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()'
+to the 'int ret' variable, while 'ssize_t' is a 64-bit type and *int*
+is a 32-bit type on the 64-bit machines. This silent truncation isn't
+really valid, so fix up the variable's type.
+
+Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/spi-nor/spi-nor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/spi-nor.c
++++ b/drivers/mtd/spi-nor/spi-nor.c
+@@ -2544,7 +2544,7 @@ static int spi_nor_read(struct mtd_info
+ size_t *retlen, u_char *buf)
+ {
+ struct spi_nor *nor = mtd_to_spi_nor(mtd);
+- int ret;
++ ssize_t ret;
+
+ dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len);
+
--- /dev/null
+From 3d63ee5deb466fd66ed6ffb164a87ce36425cf36 Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 30 Oct 2019 21:53:03 +0300
+Subject: mtd: spi-nor: fix silent truncation in spi_nor_read_raw()
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+commit 3d63ee5deb466fd66ed6ffb164a87ce36425cf36 upstream.
+
+spi_nor_read_raw() assigns the result of 'ssize_t spi_nor_read_data()'
+to the 'int ret' variable, while 'ssize_t' is a 64-bit type and *int*
+is a 32-bit type on the 64-bit machines. This silent truncation isn't
+really valid, so fix up the variable's type.
+
+Fixes: f384b352cbf0 ("mtd: spi-nor: parse Serial Flash Discoverable Parameters (SFDP) tables")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mtd/spi-nor/spi-nor.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mtd/spi-nor/spi-nor.c
++++ b/drivers/mtd/spi-nor/spi-nor.c
+@@ -2865,7 +2865,7 @@ static int spi_nor_hwcaps_pp2cmd(u32 hwc
+ */
+ static int spi_nor_read_raw(struct spi_nor *nor, u32 addr, size_t len, u8 *buf)
+ {
+- int ret;
++ ssize_t ret;
+
+ while (len) {
+ ret = spi_nor_read_data(nor, addr, len, buf);
--- /dev/null
+From 18f428d4e2f7eff162d80b2b21689496c4e82afd Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+Date: Wed, 4 Dec 2019 15:13:54 -0500
+Subject: NFSD fixing possible null pointer derefering in copy offload
+
+From: Olga Kornievskaia <olga.kornievskaia@gmail.com>
+
+commit 18f428d4e2f7eff162d80b2b21689496c4e82afd upstream.
+
+Static checker revealed possible error path leading to possible
+NULL pointer dereferencing.
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: e0639dc5805a: ("NFSD introduce async copy feature")
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/nfs4proc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1298,7 +1298,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struc
+ out:
+ return status;
+ out_err:
+- cleanup_async_copy(async_copy);
++ if (async_copy)
++ cleanup_async_copy(async_copy);
+ goto out;
+ }
+
--- /dev/null
+From c0f05a6ab52535c1bf5f43272eede3e11c5701a5 Mon Sep 17 00:00:00 2001
+From: Remi Pommarel <repk@triplefau.lt>
+Date: Fri, 14 Jun 2019 12:10:59 +0200
+Subject: PCI: aardvark: Fix PCI_EXP_RTCTL register configuration
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+commit c0f05a6ab52535c1bf5f43272eede3e11c5701a5 upstream.
+
+PCI_EXP_RTCTL is used to activate PME interrupt only, so writing into it
+should not modify other interrupts' mask. The ISR mask polarity was also
+inverted, when PCI_EXP_RTCTL_PMEIE is set PCIE_MSG_PM_PME_MASK mask bit
+should actually be cleared.
+
+Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/controller/pci-aardvark.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -428,7 +428,7 @@ advk_pci_bridge_emul_pcie_conf_read(stru
+
+ case PCI_EXP_RTCTL: {
+ u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG);
+- *value = (val & PCIE_MSG_PM_PME_MASK) ? PCI_EXP_RTCTL_PMEIE : 0;
++ *value = (val & PCIE_MSG_PM_PME_MASK) ? 0 : PCI_EXP_RTCTL_PMEIE;
+ return PCI_BRIDGE_EMUL_HANDLED;
+ }
+
+@@ -478,10 +478,15 @@ advk_pci_bridge_emul_pcie_conf_write(str
+ advk_pcie_wait_for_retrain(pcie);
+ break;
+
+- case PCI_EXP_RTCTL:
+- new = (new & PCI_EXP_RTCTL_PMEIE) << 3;
+- advk_writel(pcie, new, PCIE_ISR0_MASK_REG);
++ case PCI_EXP_RTCTL: {
++ /* Only mask/unmask PME interrupt */
++ u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG) &
++ ~PCIE_MSG_PM_PME_MASK;
++ if ((new & PCI_EXP_RTCTL_PMEIE) == 0)
++ val |= PCIE_MSG_PM_PME_MASK;
++ advk_writel(pcie, val, PCIE_ISR0_MASK_REG);
+ break;
++ }
+
+ case PCI_EXP_RTSTA:
+ new = (new & PCI_EXP_RTSTA_PME) >> 9;
--- /dev/null
+From 364b3f1ff8f096d45f042a9c85daf7a1fc78413e Mon Sep 17 00:00:00 2001
+From: Remi Pommarel <repk@triplefau.lt>
+Date: Wed, 22 May 2019 23:33:51 +0200
+Subject: PCI: aardvark: Use LTSSM state to build link training flag
+
+From: Remi Pommarel <repk@triplefau.lt>
+
+commit 364b3f1ff8f096d45f042a9c85daf7a1fc78413e upstream.
+
+Aardvark's PCI_EXP_LNKSTA_LT flag in its link status register is not
+implemented and does not reflect the actual link training state (the
+flag is always set to 0). In order to support link re-training feature
+this flag has to be emulated. The Link Training and Status State
+Machine (LTSSM) flag in Aardvark LMI config register could be used as
+a link training indicator. Indeed if the LTSSM is in L0 or upper state
+then link training has completed (see [1]).
+
+Unfortunately because after asking a link retraining it takes a while
+for the LTSSM state to become less than 0x10 (due to L0s to recovery
+state transition delays), LTSSM can still be in L0 while link training
+has not finished yet. So this waits for link to be in recovery or lesser
+state before returning after asking for a link retrain.
+
+[1] "PCI Express Base Specification", REV. 4.0
+ PCI Express, February 19 2014, Table 4-14
+
+Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space")
+Tested-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Remi Pommarel <repk@triplefau.lt>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/controller/pci-aardvark.c | 29 ++++++++++++++++++++++++++++-
+ 1 file changed, 28 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/pci-aardvark.c
++++ b/drivers/pci/controller/pci-aardvark.c
+@@ -180,6 +180,8 @@
+ #define LINK_WAIT_MAX_RETRIES 10
+ #define LINK_WAIT_USLEEP_MIN 90000
+ #define LINK_WAIT_USLEEP_MAX 100000
++#define RETRAIN_WAIT_MAX_RETRIES 10
++#define RETRAIN_WAIT_USLEEP_US 2000
+
+ #define MSI_IRQ_NUM 32
+
+@@ -239,6 +241,17 @@ static int advk_pcie_wait_for_link(struc
+ return -ETIMEDOUT;
+ }
+
++static void advk_pcie_wait_for_retrain(struct advk_pcie *pcie)
++{
++ size_t retries;
++
++ for (retries = 0; retries < RETRAIN_WAIT_MAX_RETRIES; ++retries) {
++ if (!advk_pcie_link_up(pcie))
++ break;
++ udelay(RETRAIN_WAIT_USLEEP_US);
++ }
++}
++
+ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
+ {
+ u32 reg;
+@@ -426,11 +439,20 @@ advk_pci_bridge_emul_pcie_conf_read(stru
+ return PCI_BRIDGE_EMUL_HANDLED;
+ }
+
++ case PCI_EXP_LNKCTL: {
++ /* u32 contains both PCI_EXP_LNKCTL and PCI_EXP_LNKSTA */
++ u32 val = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg) &
++ ~(PCI_EXP_LNKSTA_LT << 16);
++ if (!advk_pcie_link_up(pcie))
++ val |= (PCI_EXP_LNKSTA_LT << 16);
++ *value = val;
++ return PCI_BRIDGE_EMUL_HANDLED;
++ }
++
+ case PCI_CAP_LIST_ID:
+ case PCI_EXP_DEVCAP:
+ case PCI_EXP_DEVCTL:
+ case PCI_EXP_LNKCAP:
+- case PCI_EXP_LNKCTL:
+ *value = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg);
+ return PCI_BRIDGE_EMUL_HANDLED;
+ default:
+@@ -447,8 +469,13 @@ advk_pci_bridge_emul_pcie_conf_write(str
+
+ switch (reg) {
+ case PCI_EXP_DEVCTL:
++ advk_writel(pcie, new, PCIE_CORE_PCIEXP_CAP + reg);
++ break;
++
+ case PCI_EXP_LNKCTL:
+ advk_writel(pcie, new, PCIE_CORE_PCIEXP_CAP + reg);
++ if (new & PCI_EXP_LNKCTL_RL)
++ advk_pcie_wait_for_retrain(pcie);
+ break;
+
+ case PCI_EXP_RTCTL:
--- /dev/null
+From 1137e61dcb99f7f8b54e77ed83f68b5b485a3e34 Mon Sep 17 00:00:00 2001
+From: Niklas Cassel <niklas.cassel@linaro.org>
+Date: Wed, 4 Sep 2019 18:03:38 +0200
+Subject: PCI: dwc: Fix find_next_bit() usage
+
+From: Niklas Cassel <niklas.cassel@linaro.org>
+
+commit 1137e61dcb99f7f8b54e77ed83f68b5b485a3e34 upstream.
+
+find_next_bit() takes a parameter of size long, and performs arithmetic
+that assumes that the argument is of size long.
+
+Therefore we cannot pass a u32, since this will cause find_next_bit()
+to read outside the stack buffer and will produce the following print:
+BUG: KASAN: stack-out-of-bounds in find_next_bit+0x38/0xb0
+
+Fixes: 1b497e6493c4 ("PCI: dwc: Fix uninitialized variable in dw_handle_msi_irq()")
+Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Niklas Cassel <niklas.cassel@linaro.org>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Acked-by: Gustavo Pimentel <gustavo.pimentel@synopsys.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/controller/dwc/pcie-designware-host.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -78,7 +78,8 @@ static struct msi_domain_info dw_pcie_ms
+ irqreturn_t dw_handle_msi_irq(struct pcie_port *pp)
+ {
+ int i, pos, irq;
+- u32 val, num_ctrls;
++ unsigned long val;
++ u32 status, num_ctrls;
+ irqreturn_t ret = IRQ_NONE;
+
+ num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL;
+@@ -86,14 +87,14 @@ irqreturn_t dw_handle_msi_irq(struct pci
+ for (i = 0; i < num_ctrls; i++) {
+ dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_STATUS +
+ (i * MSI_REG_CTRL_BLOCK_SIZE),
+- 4, &val);
+- if (!val)
++ 4, &status);
++ if (!status)
+ continue;
+
+ ret = IRQ_HANDLED;
++ val = status;
+ pos = 0;
+- while ((pos = find_next_bit((unsigned long *) &val,
+- MAX_MSI_IRQS_PER_CTRL,
++ while ((pos = find_next_bit(&val, MAX_MSI_IRQS_PER_CTRL,
+ pos)) != MAX_MSI_IRQS_PER_CTRL) {
+ irq = irq_find_mapping(pp->irq_domain,
+ (i * MAX_MSI_IRQS_PER_CTRL) +
--- /dev/null
+From 7608158df3ed87a5c938c4a0b91f5b11101a9be1 Mon Sep 17 00:00:00 2001
+From: Rob Herring <robh@kernel.org>
+Date: Mon, 7 Oct 2019 20:23:25 -0500
+Subject: PCI: Fix missing bridge dma_ranges resource list cleanup
+
+From: Rob Herring <robh@kernel.org>
+
+commit 7608158df3ed87a5c938c4a0b91f5b11101a9be1 upstream.
+
+Commit e80a91ad302b ("PCI: Add dma_ranges window list") added a
+dma_ranges resource list, but failed to correctly free the list when
+devm_pci_alloc_host_bridge() is used.
+
+Only the iproc host bridge driver is using the dma_ranges list.
+
+Fixes: e80a91ad302b ("PCI: Add dma_ranges window list")
+Link: https://lore.kernel.org/r/20191008012325.25700-1-robh@kernel.org
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Srinath Mannam <srinath.mannam@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/probe.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -572,6 +572,7 @@ static void devm_pci_release_host_bridge
+ bridge->release_fn(bridge);
+
+ pci_free_resource_list(&bridge->windows);
++ pci_free_resource_list(&bridge->dma_ranges);
+ }
+
+ static void pci_release_host_bridge_dev(struct device *dev)
--- /dev/null
+From ec6a75ef8e33fe33f963b916fd902c52a0be33ff Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 10 Oct 2019 16:54:36 -0500
+Subject: PCI/PM: Clear PCIe PME Status even for legacy power management
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit ec6a75ef8e33fe33f963b916fd902c52a0be33ff upstream.
+
+Previously, pci_pm_resume_noirq() cleared the PME Status bit in the Root
+Status register only if the device had no driver or the driver did not
+implement legacy power management. It should clear PME Status regardless
+of what sort of power management the driver supports, so do this before
+checking for legacy power management.
+
+This affects Root Ports and Root Complex Event Collectors, for which the
+usual driver is the PCIe portdrv, which implements new power management, so
+this change is just on principle, not to fix any actual defects.
+
+Fixes: a39bd851dccf ("PCI/PM: Clear PCIe PME Status bit in core, not PCIe port driver")
+Link: https://lore.kernel.org/r/20191014230016.240912-4-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/pci-driver.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -941,12 +941,11 @@ static int pci_pm_resume_noirq(struct de
+ pci_pm_default_resume_early(pci_dev);
+
+ pci_fixup_device(pci_fixup_resume_early, pci_dev);
++ pcie_pme_root_status_cleanup(pci_dev);
+
+ if (pci_has_legacy_pm_support(pci_dev))
+ return pci_legacy_resume_early(dev);
+
+- pcie_pme_root_status_cleanup(pci_dev);
+-
+ if (drv && drv->pm && drv->pm->resume_noirq)
+ error = drv->pm->resume_noirq(dev);
+
--- /dev/null
+From 127a7709495db52a41012deaebbb7afc231dad91 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Wed, 6 Nov 2019 15:30:48 -0600
+Subject: PCI/PTM: Remove spurious "d" from granularity message
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 127a7709495db52a41012deaebbb7afc231dad91 upstream.
+
+The granularity message has an extra "d":
+
+ pci 0000:02:00.0: PTM enabled, 4dns granularity
+
+Remove the "d" so the message is simply "PTM enabled, 4ns granularity".
+
+Fixes: 8b2ec318eece ("PCI: Add PTM clock granularity information")
+Link: https://lore.kernel.org/r/20191106222420.10216-2-helgaas@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andrew Murray <andrew.murray@arm.com>
+Cc: Jonathan Yong <jonathan.yong@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/pcie/ptm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pci/pcie/ptm.c
++++ b/drivers/pci/pcie/ptm.c
+@@ -21,7 +21,7 @@ static void pci_ptm_info(struct pci_dev
+ snprintf(clock_desc, sizeof(clock_desc), ">254ns");
+ break;
+ default:
+- snprintf(clock_desc, sizeof(clock_desc), "%udns",
++ snprintf(clock_desc, sizeof(clock_desc), "%uns",
+ dev->ptm_granularity);
+ break;
+ }
--- /dev/null
+From 9d72dcef891030545f39ad386a30cf91df517fb2 Mon Sep 17 00:00:00 2001
+From: Oliver O'Halloran <oohall@gmail.com>
+Date: Mon, 18 Nov 2019 17:55:53 +1100
+Subject: powerpc/powernv: Disable native PCIe port management
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+commit 9d72dcef891030545f39ad386a30cf91df517fb2 upstream.
+
+On PowerNV the PCIe topology is (currently) managed by the powernv platform
+code in Linux in cooperation with the platform firmware. Linux's native
+PCIe port service drivers operate independently of both and this can cause
+problems.
+
+The main issue is that the portbus driver will conflict with the platform
+specific hotplug driver (pnv_php) over ownership of the MSI used to notify
+the host when a hotplug event occurs. The portbus driver claims this MSI on
+behalf of the individual port services because the same interrupt is used
+for hotplug events, PMEs (on root ports), and link bandwidth change
+notifications. The portbus driver will always claim the interrupt even if
+the individual port service drivers, such as pciehp, are compiled out.
+
+The second, bigger, problem is that the hotplug port service driver
+fundamentally does not work on PowerNV. The platform assumes that all
+PCI devices have a corresponding arch-specific handle derived from the DT
+node for the device (pci_dn) and without one the platform will not allow
+a PCI device to be enabled. This problem is largely due to historical
+baggage, but it can't be resolved without significant re-factoring of the
+platform PCI support.
+
+We can fix these problems in the interim by setting the
+"pcie_ports_disabled" flag during platform initialisation. The flag
+indicates the platform owns the PCIe ports which stops the portbus driver
+from being registered.
+
+This does have the side effect of disabling all port services drivers
+that is: AER, PME, BW notifications, hotplug, and DPC. However, this is
+not a huge disadvantage on PowerNV since these services are either unused
+or handled through other means.
+
+Fixes: 66725152fb9f ("PCI/hotplug: PowerPC PowerNV PCI hotplug driver")
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191118065553.30362-1-oohall@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/powernv/pci.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -945,6 +945,23 @@ void __init pnv_pci_init(void)
+ if (!firmware_has_feature(FW_FEATURE_OPAL))
+ return;
+
++#ifdef CONFIG_PCIEPORTBUS
++ /*
++ * On PowerNV PCIe devices are (currently) managed in cooperation
++ * with firmware. This isn't *strictly* required, but there's enough
++ * assumptions baked into both firmware and the platform code that
++ * it's unwise to allow the portbus services to be used.
++ *
++ * We need to fix this eventually, but for now set this flag to disable
++ * the portbus driver. The AER service isn't required since that AER
++ * events are handled via EEH. The pciehp hotplug driver can't work
++ * without kernel changes (and portbus binding breaks pnv_php). The
++ * other services also require some thinking about how we're going
++ * to integrate them.
++ */
++ pcie_ports_disabled = true;
++#endif
++
+ /* Look for IODA IO-Hubs. */
+ for_each_compatible_node(np, NULL, "ibm,ioda-hub") {
+ pnv_pci_init_ioda_hub(np);
--- /dev/null
+From 91cbf01178c37086b32148c53e24b04cb77557cf Mon Sep 17 00:00:00 2001
+From: Richard Weinberger <richard@nod.at>
+Date: Thu, 24 Oct 2019 10:25:35 +0200
+Subject: Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path"
+
+From: Richard Weinberger <richard@nod.at>
+
+commit 91cbf01178c37086b32148c53e24b04cb77557cf upstream.
+
+This reverts commit 9163e0184bd7d5f779934d34581843f699ad2ffd.
+
+At the point when ubifs_fill_super() runs, we have already a reference
+to the super block. So upon deactivate_locked_super() c will get
+free()'ed via ->kill_sb().
+
+Cc: Wenwen Wang <wenwen@cs.uga.edu>
+Fixes: 9163e0184bd7 ("ubifs: Fix memory leak bug in alloc_ubifs_info() error path")
+Reported-by: https://twitter.com/grsecurity/status/1180609139359277056
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Tested-by: Romain Izard <romain.izard.pro@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/super.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -2267,10 +2267,8 @@ static struct dentry *ubifs_mount(struct
+ }
+ } else {
+ err = ubifs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0);
+- if (err) {
+- kfree(c);
++ if (err)
+ goto out_deact;
+- }
+ /* We do not support atime */
+ sb->s_flags |= SB_ACTIVE;
+ if (IS_ENABLED(CONFIG_UBIFS_ATIME_SUPPORT))
--- /dev/null
+From c3e12e66b14a043daac6b3d0559df80b9ed7679c Mon Sep 17 00:00:00 2001
+From: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Date: Wed, 23 Oct 2019 14:47:11 +0300
+Subject: rtc: bd70528: Add MODULE ALIAS to autoload module
+
+From: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+
+commit c3e12e66b14a043daac6b3d0559df80b9ed7679c upstream.
+
+The bd70528 RTC driver is probed by MFD driver. Add MODULE_ALIAS
+in order to allow udev to load the module when MFD sub-device cell
+for RTC is added.
+
+I'm not sure if this is a bugfix or feature addition but I guess
+fixes tag won't harm in this case.
+
+Fixes: 32a4a4ebf768 ("rtc: bd70528: Initial support for ROHM bd70528 RTC")
+Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Link: https://lore.kernel.org/r/20191023114711.GA13954@localhost.localdomain
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-bd70528.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/rtc/rtc-bd70528.c
++++ b/drivers/rtc/rtc-bd70528.c
+@@ -491,3 +491,4 @@ module_platform_driver(bd70528_rtc);
+ MODULE_AUTHOR("Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>");
+ MODULE_DESCRIPTION("BD70528 RTC driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platofrm:bd70528-rtc");
--- /dev/null
+From 94303f8930ed78aea0f189b703c9d79fff9555d7 Mon Sep 17 00:00:00 2001
+From: Chuhong Yuan <hslester96@gmail.com>
+Date: Wed, 6 Nov 2019 00:00:43 +0800
+Subject: rtc: brcmstb-waketimer: add missed clk_disable_unprepare
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+commit 94303f8930ed78aea0f189b703c9d79fff9555d7 upstream.
+
+This driver forgets to disable and unprepare clock when remove.
+Add a call to clk_disable_unprepare to fix it.
+
+Fixes: c4f07ecee22e ("rtc: brcmstb-waketimer: Add Broadcom STB wake-timer")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20191105160043.20018-1-hslester96@gmail.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-brcmstb-waketimer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/rtc/rtc-brcmstb-waketimer.c
++++ b/drivers/rtc/rtc-brcmstb-waketimer.c
+@@ -277,6 +277,7 @@ static int brcmstb_waketmr_remove(struct
+ struct brcmstb_waketmr *timer = dev_get_drvdata(&pdev->dev);
+
+ unregister_reboot_notifier(&timer->reboot_notifier);
++ clk_disable_unprepare(timer->clk);
+
+ return 0;
+ }
--- /dev/null
+From e34494c8df0cd96fc432efae121db3212c46ae48 Mon Sep 17 00:00:00 2001
+From: Kars de Jong <jongk@linux-m68k.org>
+Date: Sat, 16 Nov 2019 12:05:48 +0100
+Subject: rtc: msm6242: Fix reading of 10-hour digit
+
+From: Kars de Jong <jongk@linux-m68k.org>
+
+commit e34494c8df0cd96fc432efae121db3212c46ae48 upstream.
+
+The driver was reading the wrong register as the 10-hour digit due to
+a misplaced ')'. It was in fact reading the 1-second digit register due
+to this bug.
+
+Also remove the use of a magic number for the hour mask and use the define
+for it which was already present.
+
+Fixes: 4f9b9bba1dd1 ("rtc: Add an RTC driver for the Oki MSM6242")
+Tested-by: Kars de Jong <jongk@linux-m68k.org>
+Signed-off-by: Kars de Jong <jongk@linux-m68k.org>
+Link: https://lore.kernel.org/r/20191116110548.8562-1-jongk@linux-m68k.org
+Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/rtc/rtc-msm6242.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/rtc/rtc-msm6242.c
++++ b/drivers/rtc/rtc-msm6242.c
+@@ -133,7 +133,8 @@ static int msm6242_read_time(struct devi
+ msm6242_read(priv, MSM6242_SECOND1);
+ tm->tm_min = msm6242_read(priv, MSM6242_MINUTE10) * 10 +
+ msm6242_read(priv, MSM6242_MINUTE1);
+- tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10 & 3)) * 10 +
++ tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10) &
++ MSM6242_HOUR10_HR_MASK) * 10 +
+ msm6242_read(priv, MSM6242_HOUR1);
+ tm->tm_mday = msm6242_read(priv, MSM6242_DAY10) * 10 +
+ msm6242_read(priv, MSM6242_DAY1);
--- /dev/null
+From 091c6e9c083f7ebaff00b37ad13562d51464d175 Mon Sep 17 00:00:00 2001
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Tue, 22 Oct 2019 17:47:03 -0700
+Subject: rtlwifi: Remove unnecessary NULL check in rtl_regd_init
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+commit 091c6e9c083f7ebaff00b37ad13562d51464d175 upstream.
+
+When building with Clang + -Wtautological-pointer-compare:
+
+drivers/net/wireless/realtek/rtlwifi/regd.c:389:33: warning: comparison
+of address of 'rtlpriv->regd' equal to a null pointer is always false
+[-Wtautological-pointer-compare]
+ if (wiphy == NULL || &rtlpriv->regd == NULL)
+ ~~~~~~~~~^~~~ ~~~~
+1 warning generated.
+
+The address of an array member is never NULL unless it is the first
+struct member so remove the unnecessary check. This was addressed in
+the staging version of the driver in commit f986978b32b3 ("Staging:
+rtlwifi: remove unnecessary NULL check").
+
+While we are here, fix the following checkpatch warning:
+
+CHECK: Comparison to NULL could be written "!wiphy"
+35: FILE: drivers/net/wireless/realtek/rtlwifi/regd.c:389:
++ if (wiphy == NULL)
+
+Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
+Link:https://github.com/ClangBuiltLinux/linux/issues/750
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/realtek/rtlwifi/regd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/regd.c
++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c
+@@ -386,7 +386,7 @@ int rtl_regd_init(struct ieee80211_hw *h
+ struct wiphy *wiphy = hw->wiphy;
+ struct country_code_to_enum_rd *country = NULL;
+
+- if (wiphy == NULL || &rtlpriv->regd == NULL)
++ if (!wiphy)
+ return -EINVAL;
+
+ /* init country_code from efuse channel plan */
--- /dev/null
+From b3c424eb6a1a3c485de64619418a471dee6ce849 Mon Sep 17 00:00:00 2001
+From: Victorien Molle <victorien.molle@wifirst.fr>
+Date: Mon, 2 Dec 2019 15:11:38 +0100
+Subject: sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Victorien Molle <victorien.molle@wifirst.fr>
+
+commit b3c424eb6a1a3c485de64619418a471dee6ce849 upstream.
+
+This field has never been checked since introduction in mainline kernel
+
+Signed-off-by: Victorien Molle <victorien.molle@wifirst.fr>
+Signed-off-by: Florent Fourcot <florent.fourcot@wifirst.fr>
+Fixes: 2db6dc2662ba "sch_cake: Make gso-splitting configurable from userspace"
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_cake.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_cake.c
++++ b/net/sched/sch_cake.c
+@@ -2184,6 +2184,7 @@ static const struct nla_policy cake_poli
+ [TCA_CAKE_MPU] = { .type = NLA_U32 },
+ [TCA_CAKE_INGRESS] = { .type = NLA_U32 },
+ [TCA_CAKE_ACK_FILTER] = { .type = NLA_U32 },
++ [TCA_CAKE_SPLIT_GSO] = { .type = NLA_U32 },
+ [TCA_CAKE_FWMARK] = { .type = NLA_U32 },
+ };
+
--- /dev/null
+From 142b2ac82e31c174936c5719fa12ae28f51a55b7 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 15 Mar 2019 13:46:11 +0100
+Subject: scsi: sd: enable compat ioctls for sed-opal
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 142b2ac82e31c174936c5719fa12ae28f51a55b7 upstream.
+
+The sed_ioctl() function is written to be compatible between
+32-bit and 64-bit processes, however compat mode is only
+wired up for nvme, not for sd.
+
+Add the missing call to sed_ioctl() in sd_compat_ioctl().
+
+Fixes: d80210f25ff0 ("sd: add support for TCG OPAL self encrypting disks")
+Cc: linux-scsi@vger.kernel.org
+Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
+Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/sd.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1694,20 +1694,30 @@ static void sd_rescan(struct device *dev
+ static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode,
+ unsigned int cmd, unsigned long arg)
+ {
+- struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device;
++ struct gendisk *disk = bdev->bd_disk;
++ struct scsi_disk *sdkp = scsi_disk(disk);
++ struct scsi_device *sdev = sdkp->device;
++ void __user *p = compat_ptr(arg);
+ int error;
+
++ error = scsi_verify_blk_ioctl(bdev, cmd);
++ if (error < 0)
++ return error;
++
+ error = scsi_ioctl_block_when_processing_errors(sdev, cmd,
+ (mode & FMODE_NDELAY) != 0);
+ if (error)
+ return error;
++
++ if (is_sed_ioctl(cmd))
++ return sed_ioctl(sdkp->opal_dev, cmd, p);
+
+ /*
+ * Let the static ioctl translation table take care of it.
+ */
+ if (!sdev->host->hostt->compat_ioctl)
+ return -ENOIOCTLCMD;
+- return sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg);
++ return sdev->host->hostt->compat_ioctl(sdev, cmd, p);
+ }
+ #endif
+
revert-drm-virtio-switch-virtio_gpu_wait_ioctl-to-gem-helper.patch
drm-amdgpu-cleanup-creating-bos-at-fixed-location-v2.patch
drm-amdgpu-discovery-reserve-discovery-data-at-the-top-of-vram.patch
+scsi-sd-enable-compat-ioctls-for-sed-opal.patch
+arm64-dts-apq8096-db820c-increase-load-on-l21-for-sdcard.patch
+gfs2-add-compat_ioctl-support.patch
+af_unix-add-compat_ioctl-support.patch
+compat_ioctl-handle-siocoutqnsd.patch
+pci-aardvark-use-ltssm-state-to-build-link-training-flag.patch
+pci-aardvark-fix-pci_exp_rtctl-register-configuration.patch
+pci-dwc-fix-find_next_bit-usage.patch
+pci-fix-missing-bridge-dma_ranges-resource-list-cleanup.patch
+pci-pm-clear-pcie-pme-status-even-for-legacy-power-management.patch
+tools-pci-fix-fd-leakage.patch
+pci-ptm-remove-spurious-d-from-granularity-message.patch
+powerpc-powernv-disable-native-pcie-port-management.patch
+mips-pci-remember-nasid-changed-by-set-interrupt-affinity.patch
+mips-loongson-fix-return-value-of-loongson_hwmon_init.patch
+mips-sgi-ip27-fix-crash-when-cpus-are-disabled-via-nr_cpus-parameter.patch
+tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch
+tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch
+arm-8943-1-fix-topology-setup-in-case-of-cpu-hotplug-for-config_sched_mc.patch
+media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch
+media-ov6650-fix-some-format-attributes-not-under-control.patch
+media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-support.patch
+media-ov6650-fix-default-format-not-applied-on-device-probe.patch
+media-rcar-vin-fix-incorrect-return-statement-in-rvin_try_format.patch
+media-hantro-h264-fix-the-frame_num-wraparound-case.patch
+media-v4l-cadence-fix-how-unsued-lanes-are-handled-in-csi2rx_start.patch
+media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch
+media-coda-fix-deadlock-between-decoder-picture-run-and-start-command.patch
+media-cedrus-use-correct-h264-8x8-scaling-list.patch
+media-hantro-do-not-reorder-h264-scaling-list.patch
+media-aspeed-video-fix-memory-leaks-in-aspeed_video_probe.patch
+media-hantro-set-h264-fieldpic_flag_e-flag-correctly.patch
+iommu-mediatek-correct-the-flush_iotlb_all-callback.patch
+iommu-mediatek-add-a-new-tlb_lock-for-tlb_flush.patch
+memory-mtk-smi-add-pm-suspend-and-resume-ops.patch
+revert-ubifs-fix-memory-leak-bug-in-alloc_ubifs_info-error-path.patch
+ubifs-fixed-missed-le64_to_cpu-in-journal.patch
+ubifs-do_kill_orphans-fix-a-memory-leak-bug.patch
+spi-sprd-fix-the-incorrect-spi-register.patch
+mtd-spi-nor-fix-silent-truncation-in-spi_nor_read.patch
+mtd-spi-nor-fix-silent-truncation-in-spi_nor_read_raw.patch
+spi-pxa2xx-set-controller-max_transfer_size-in-dma-mode.patch
+spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch
+spi-rspi-use-platform_get_irq_byname_optional-for-optional-irqs.patch
+spi-lpspi-fix-memory-leak-in-fsl_lpspi_probe.patch
+iwlwifi-mvm-consider-ieee80211-station-max-amsdu-value.patch
+rtlwifi-remove-unnecessary-null-check-in-rtl_regd_init.patch
+iwlwifi-mvm-fix-support-for-single-antenna-diversity.patch
+sch_cake-add-missing-nla-policy-entry-tca_cake_split_gso.patch
+f2fs-fix-potential-overflow.patch
+nfsd-fixing-possible-null-pointer-derefering-in-copy-offload.patch
+rtc-msm6242-fix-reading-of-10-hour-digit.patch
+rtc-brcmstb-waketimer-add-missed-clk_disable_unprepare.patch
+rtc-bd70528-add-module-alias-to-autoload-module.patch
--- /dev/null
+From fed8d8c7a6dc2a76d7764842853d81c770b0788e Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Fri, 18 Oct 2019 17:35:04 +0200
+Subject: spi: atmel: fix handling of cs_change set on non-last xfer
+
+From: Mans Rullgard <mans@mansr.com>
+
+commit fed8d8c7a6dc2a76d7764842853d81c770b0788e upstream.
+
+The driver does the wrong thing when cs_change is set on a non-last
+xfer in a message. When cs_change is set, the driver deactivates the
+CS and leaves it off until a later xfer again has cs_change set whereas
+it should be briefly toggling CS off and on again.
+
+This patch brings the behaviour of the driver back in line with the
+documentation and common sense. The delay of 10 us is the same as is
+used by the default spi_transfer_one_message() function in spi.c.
+[gregory: rebased on for-5.5 from spi tree]
+Fixes: 8090d6d1a415 ("spi: atmel: Refactor spi-atmel to use SPI framework queue")
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Link: https://lore.kernel.org/r/20191018153504.4249-1-gregory.clement@bootlin.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-atmel.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/spi/spi-atmel.c
++++ b/drivers/spi/spi-atmel.c
+@@ -302,7 +302,6 @@ struct atmel_spi {
+ bool use_cs_gpios;
+
+ bool keep_cs;
+- bool cs_active;
+
+ u32 fifo_size;
+ };
+@@ -1374,11 +1373,9 @@ static int atmel_spi_one_transfer(struct
+ &msg->transfers)) {
+ as->keep_cs = true;
+ } else {
+- as->cs_active = !as->cs_active;
+- if (as->cs_active)
+- cs_activate(as, msg->spi);
+- else
+- cs_deactivate(as, msg->spi);
++ cs_deactivate(as, msg->spi);
++ udelay(10);
++ cs_activate(as, msg->spi);
+ }
+ }
+
+@@ -1401,7 +1398,6 @@ static int atmel_spi_transfer_one_messag
+ atmel_spi_lock(as);
+ cs_activate(as, spi);
+
+- as->cs_active = true;
+ as->keep_cs = false;
+
+ msg->status = 0;
--- /dev/null
+From 057b8945f78f76d0b04eeb5c27cd9225e5e7ad86 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Sun, 29 Sep 2019 22:46:01 -0500
+Subject: spi: lpspi: fix memory leak in fsl_lpspi_probe
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+commit 057b8945f78f76d0b04eeb5c27cd9225e5e7ad86 upstream.
+
+In fsl_lpspi_probe an SPI controller is allocated either via
+spi_alloc_slave or spi_alloc_master. In all but one error cases this
+controller is put by going to error handling code. This commit fixes the
+case when pm_runtime_get_sync fails and it should go to the error
+handling path.
+
+Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Link: https://lore.kernel.org/r/20190930034602.1467-1-navid.emamdoost@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-fsl-lpspi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-fsl-lpspi.c
++++ b/drivers/spi/spi-fsl-lpspi.c
+@@ -938,7 +938,7 @@ static int fsl_lpspi_probe(struct platfo
+ ret = pm_runtime_get_sync(fsl_lpspi->dev);
+ if (ret < 0) {
+ dev_err(fsl_lpspi->dev, "failed to enable clock\n");
+- return ret;
++ goto out_controller_put;
+ }
+
+ temp = readl(fsl_lpspi->base + IMX7ULP_PARAM);
--- /dev/null
+From b2662a164f9dc48da8822e56600686d639056282 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Thu, 17 Oct 2019 08:44:26 +0200
+Subject: spi: pxa2xx: Set controller->max_transfer_size in dma mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit b2662a164f9dc48da8822e56600686d639056282 upstream.
+
+In DMA mode we have a maximum transfer size, past that the driver
+falls back to PIO (see the check at the top of pxa2xx_spi_transfer_one).
+Falling back to PIO for big transfers defeats the point of a dma engine,
+hence set the max transfer size to inform spi clients that they need
+to do something smarter.
+
+This was uncovered by the drm_mipi_dbi spi panel code, which does
+large spi transfers, but stopped splitting them after:
+
+commit e143364b4c1774f68e923a5a0bb0fca28ac25888
+Author: Noralf Trønnes <noralf@tronnes.org>
+Date: Fri Jul 19 17:59:10 2019 +0200
+
+ drm/tinydrm: Remove tinydrm_spi_max_transfer_size()
+
+After this commit the code relied on the spi core to split transfers
+into max dma-able blocks, which also papered over the PIO fallback issue.
+
+Fix this by setting the overall max transfer size to the DMA limit,
+but only when the controller runs in DMA mode.
+
+Fixes: e143364b4c17 ("drm/tinydrm: Remove tinydrm_spi_max_transfer_size()")
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Noralf Trønnes <noralf@tronnes.org>
+Cc: Andy Shevchenko <andriy.shevchenko@intel.com>
+Reported-and-tested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
+Cc: Daniel Mack <daniel@zonque.org>
+Cc: Haojian Zhuang <haojian.zhuang@gmail.com>
+Cc: Robert Jarzmik <robert.jarzmik@free.fr>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-spi@vger.kernel.org
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://lore.kernel.org/r/20191017064426.30814-1-daniel.vetter@ffwll.ch
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-pxa2xx.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1612,6 +1612,11 @@ static int pxa2xx_spi_fw_translate_cs(st
+ return cs;
+ }
+
++static size_t pxa2xx_spi_max_dma_transfer_size(struct spi_device *spi)
++{
++ return MAX_DMA_LEN;
++}
++
+ static int pxa2xx_spi_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -1717,6 +1722,8 @@ static int pxa2xx_spi_probe(struct platf
+ } else {
+ controller->can_dma = pxa2xx_spi_can_dma;
+ controller->max_dma_len = MAX_DMA_LEN;
++ controller->max_transfer_size =
++ pxa2xx_spi_max_dma_transfer_size;
+ }
+ }
+
--- /dev/null
+From 2de860b4a7a0bd5a4b5bd3bff0e6a615495df4ba Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 16 Oct 2019 16:31:01 +0200
+Subject: spi: rspi: Use platform_get_irq_byname_optional() for optional irqs
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 2de860b4a7a0bd5a4b5bd3bff0e6a615495df4ba upstream.
+
+As platform_get_irq_byname() now prints an error when the interrupt
+does not exist, scary warnings may be printed for optional interrupts:
+
+ renesas_spi e6b10000.spi: IRQ rx not found
+ renesas_spi e6b10000.spi: IRQ mux not found
+
+Fix this by calling platform_get_irq_byname_optional() instead.
+Remove the no longer needed printing of platform_get_irq errors, as the
+remaining calls to platform_get_irq() and platform_get_irq_byname() take
+care of that.
+
+Fixes: 7723f4c5ecdb8d83 ("driver core: platform: Add an error message to platform_get_irq*()")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Stephen Boyd <swboyd@chromium.org>
+Link: https://lore.kernel.org/r/20191016143101.28738-1-geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-rspi.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/spi/spi-rspi.c
++++ b/drivers/spi/spi-rspi.c
+@@ -1257,9 +1257,9 @@ static int rspi_probe(struct platform_de
+ ctlr->flags = ops->flags;
+ ctlr->dev.of_node = pdev->dev.of_node;
+
+- ret = platform_get_irq_byname(pdev, "rx");
++ ret = platform_get_irq_byname_optional(pdev, "rx");
+ if (ret < 0) {
+- ret = platform_get_irq_byname(pdev, "mux");
++ ret = platform_get_irq_byname_optional(pdev, "mux");
+ if (ret < 0)
+ ret = platform_get_irq(pdev, 0);
+ if (ret >= 0)
+@@ -1270,10 +1270,6 @@ static int rspi_probe(struct platform_de
+ if (ret >= 0)
+ rspi->tx_irq = ret;
+ }
+- if (ret < 0) {
+- dev_err(&pdev->dev, "platform_get_irq error\n");
+- goto error2;
+- }
+
+ if (rspi->rx_irq == rspi->tx_irq) {
+ /* Single multiplexed interrupt */
--- /dev/null
+From 5e9c5236b7b86779b53b762f7e66240c3f18314b Mon Sep 17 00:00:00 2001
+From: Huanpeng Xin <huanpeng.xin@unisoc.com>
+Date: Wed, 4 Dec 2019 15:13:59 +0800
+Subject: spi: sprd: Fix the incorrect SPI register
+
+From: Huanpeng Xin <huanpeng.xin@unisoc.com>
+
+commit 5e9c5236b7b86779b53b762f7e66240c3f18314b upstream.
+
+The original code used an incorrect SPI register to initialize the SPI
+controller in sprd_spi_init_hw(), thus fix it.
+
+Fixes: e7d973a31c24 ("spi: sprd: Add SPI driver for Spreadtrum SC9860")
+Signed-off-by: Huanpeng Xin <huanpeng.xin@unisoc.com>
+Signed-off-by: Baolin Wang <baolin.wang7@gmail.com>
+Link: https://lore.kernel.org/r/b4f7f89ec0fdc595335687bfbd9f962213bc4a1d.1575443510.git.baolin.wang7@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/spi/spi-sprd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-sprd.c
++++ b/drivers/spi/spi-sprd.c
+@@ -674,7 +674,7 @@ static void sprd_spi_init_hw(struct sprd
+ u16 word_delay, interval;
+ u32 val;
+
+- val = readl_relaxed(ss->base + SPRD_SPI_CTL7);
++ val = readl_relaxed(ss->base + SPRD_SPI_CTL0);
+ val &= ~(SPRD_SPI_SCK_REV | SPRD_SPI_NG_TX | SPRD_SPI_NG_RX);
+ /* Set default chip selection, clock phase and clock polarity */
+ val |= ss->hw_mode & SPI_CPHA ? SPRD_SPI_NG_RX : SPRD_SPI_NG_TX;
--- /dev/null
+From 3c379a59b4795d7279d38c623e74b9790345a32b Mon Sep 17 00:00:00 2001
+From: Hewenliang <hewenliang4@huawei.com>
+Date: Fri, 25 Oct 2019 21:35:55 -0400
+Subject: tools: PCI: Fix fd leakage
+
+From: Hewenliang <hewenliang4@huawei.com>
+
+commit 3c379a59b4795d7279d38c623e74b9790345a32b upstream.
+
+We should close fd before the return of run_test.
+
+Fixes: 3f2ed8134834 ("tools: PCI: Add a userspace tool to test PCI endpoint")
+Signed-off-by: Hewenliang <hewenliang4@huawei.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/pci/pcitest.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/pci/pcitest.c
++++ b/tools/pci/pcitest.c
+@@ -129,6 +129,7 @@ static int run_test(struct pci_test *tes
+ }
+
+ fflush(stdout);
++ close(fd);
+ return (ret < 0) ? ret : 1 - ret; /* return 0 if test succeeded */
+ }
+
--- /dev/null
+From 596fd8dffb745afcebc0ec6968e17fe29f02044c Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Thu, 7 Nov 2019 06:42:53 +0000
+Subject: tty: serial: imx: use the sg count from dma_map_sg
+
+From: Peng Fan <peng.fan@nxp.com>
+
+commit 596fd8dffb745afcebc0ec6968e17fe29f02044c upstream.
+
+The dmaengine_prep_slave_sg needs to use sg count returned
+by dma_map_sg, not use sport->dma_tx_nents, because the return
+value of dma_map_sg is not always same with "nents".
+
+Fixes: b4cdc8f61beb ("serial: imx: add DMA support for imx6q")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/1573108875-26530-1-git-send-email-peng.fan@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/imx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -619,7 +619,7 @@ static void imx_uart_dma_tx(struct imx_p
+ dev_err(dev, "DMA mapping error for TX.\n");
+ return;
+ }
+- desc = dmaengine_prep_slave_sg(chan, sgl, sport->dma_tx_nents,
++ desc = dmaengine_prep_slave_sg(chan, sgl, ret,
+ DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT);
+ if (!desc) {
+ dma_unmap_sg(dev, sgl, sport->dma_tx_nents,
--- /dev/null
+From 74887542fdcc92ad06a48c0cca17cdf09fc8aa00 Mon Sep 17 00:00:00 2001
+From: Peng Fan <peng.fan@nxp.com>
+Date: Wed, 13 Nov 2019 05:37:42 +0000
+Subject: tty: serial: pch_uart: correct usage of dma_unmap_sg
+
+From: Peng Fan <peng.fan@nxp.com>
+
+commit 74887542fdcc92ad06a48c0cca17cdf09fc8aa00 upstream.
+
+Per Documentation/DMA-API-HOWTO.txt,
+To unmap a scatterlist, just call:
+ dma_unmap_sg(dev, sglist, nents, direction);
+
+.. note::
+
+ The 'nents' argument to the dma_unmap_sg call must be
+ the _same_ one you passed into the dma_map_sg call,
+ it should _NOT_ be the 'count' value _returned_ from the
+ dma_map_sg call.
+
+However in the driver, priv->nent is directly assigned with value
+returned from dma_map_sg, and dma_unmap_sg use priv->nent for unmap,
+this breaks the API usage.
+
+So introduce a new entry orig_nent to remember 'nents'.
+
+Fixes: da3564ee027e ("pch_uart: add multi-scatter processing")
+Signed-off-by: Peng Fan <peng.fan@nxp.com>
+Link: https://lore.kernel.org/r/1573623259-6339-1-git-send-email-peng.fan@nxp.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/pch_uart.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/pch_uart.c
++++ b/drivers/tty/serial/pch_uart.c
+@@ -233,6 +233,7 @@ struct eg20t_port {
+ struct dma_chan *chan_rx;
+ struct scatterlist *sg_tx_p;
+ int nent;
++ int orig_nent;
+ struct scatterlist sg_rx;
+ int tx_dma_use;
+ void *rx_buf_virt;
+@@ -787,9 +788,10 @@ static void pch_dma_tx_complete(void *ar
+ }
+ xmit->tail &= UART_XMIT_SIZE - 1;
+ async_tx_ack(priv->desc_tx);
+- dma_unmap_sg(port->dev, sg, priv->nent, DMA_TO_DEVICE);
++ dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE);
+ priv->tx_dma_use = 0;
+ priv->nent = 0;
++ priv->orig_nent = 0;
+ kfree(priv->sg_tx_p);
+ pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_TX_INT);
+ }
+@@ -1010,6 +1012,7 @@ static unsigned int dma_handle_tx(struct
+ dev_err(priv->port.dev, "%s:dma_map_sg Failed\n", __func__);
+ return 0;
+ }
++ priv->orig_nent = num;
+ priv->nent = nent;
+
+ for (i = 0; i < nent; i++, sg++) {
--- /dev/null
+From 10256f000932f12596dc043cf880ecf488a32510 Mon Sep 17 00:00:00 2001
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+Date: Tue, 29 Oct 2019 20:58:23 +0800
+Subject: ubifs: do_kill_orphans: Fix a memory leak bug
+
+From: Zhihao Cheng <chengzhihao1@huawei.com>
+
+commit 10256f000932f12596dc043cf880ecf488a32510 upstream.
+
+If there are more than one valid snod on the sleb->nodes list,
+do_kill_orphans will malloc ino more than once without releasing
+previous ino's memory. Finally, it will trigger memory leak.
+
+Fixes: ee1438ce5dc4 ("ubifs: Check link count of inodes when...")
+Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/orphan.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/fs/ubifs/orphan.c
++++ b/fs/ubifs/orphan.c
+@@ -631,12 +631,17 @@ static int do_kill_orphans(struct ubifs_
+ ino_t inum;
+ int i, n, err, first = 1;
+
++ ino = kmalloc(UBIFS_MAX_INO_NODE_SZ, GFP_NOFS);
++ if (!ino)
++ return -ENOMEM;
++
+ list_for_each_entry(snod, &sleb->nodes, list) {
+ if (snod->type != UBIFS_ORPH_NODE) {
+ ubifs_err(c, "invalid node type %d in orphan area at %d:%d",
+ snod->type, sleb->lnum, snod->offs);
+ ubifs_dump_node(c, snod->node);
+- return -EINVAL;
++ err = -EINVAL;
++ goto out_free;
+ }
+
+ orph = snod->node;
+@@ -663,20 +668,18 @@ static int do_kill_orphans(struct ubifs_
+ ubifs_err(c, "out of order commit number %llu in orphan node at %d:%d",
+ cmt_no, sleb->lnum, snod->offs);
+ ubifs_dump_node(c, snod->node);
+- return -EINVAL;
++ err = -EINVAL;
++ goto out_free;
+ }
+ dbg_rcvry("out of date LEB %d", sleb->lnum);
+ *outofdate = 1;
+- return 0;
++ err = 0;
++ goto out_free;
+ }
+
+ if (first)
+ first = 0;
+
+- ino = kmalloc(UBIFS_MAX_INO_NODE_SZ, GFP_NOFS);
+- if (!ino)
+- return -ENOMEM;
+-
+ n = (le32_to_cpu(orph->ch.len) - UBIFS_ORPH_NODE_SZ) >> 3;
+ for (i = 0; i < n; i++) {
+ union ubifs_key key1, key2;
--- /dev/null
+From df22b5b3ecc6233e33bd27f67f14c0cd1b5a5897 Mon Sep 17 00:00:00 2001
+From: "Ben Dooks (Codethink)" <ben.dooks@codethink.co.uk>
+Date: Wed, 16 Oct 2019 11:08:03 +0100
+Subject: ubifs: Fixed missed le64_to_cpu() in journal
+
+From: Ben Dooks (Codethink) <ben.dooks@codethink.co.uk>
+
+commit df22b5b3ecc6233e33bd27f67f14c0cd1b5a5897 upstream.
+
+In the ubifs_jnl_write_inode() functon, it calls ubifs_iget()
+with xent->inum. The xent->inum is __le64, but the ubifs_iget()
+takes native cpu endian.
+
+I think that this should be changed to passing le64_to_cpu(xent->inum)
+to fix the following sparse warning:
+
+fs/ubifs/journal.c:902:58: warning: incorrect type in argument 2 (different base types)
+fs/ubifs/journal.c:902:58: expected unsigned long inum
+fs/ubifs/journal.c:902:58: got restricted __le64 [usertype] inum
+
+Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files")
+Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ubifs/journal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ubifs/journal.c
++++ b/fs/ubifs/journal.c
+@@ -899,7 +899,7 @@ int ubifs_jnl_write_inode(struct ubifs_i
+ fname_name(&nm) = xent->name;
+ fname_len(&nm) = le16_to_cpu(xent->nlen);
+
+- xino = ubifs_iget(c->vfs_sb, xent->inum);
++ xino = ubifs_iget(c->vfs_sb, le64_to_cpu(xent->inum));
+ if (IS_ERR(xino)) {
+ err = PTR_ERR(xino);
+ ubifs_err(c, "dead directory entry '%s', error %d",
projects / thirdparty / kernel / stable-queue.git / commitdiff
