--- /dev/null
+From 734c804811562ec5b44fda7642a3e0eb40efa1bd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 18:10:53 +0200
+Subject: ALSA: hda: hdmi - add Tigerlake support
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 9a11ba7388f165762549903492fc34d29bbb3c04 ]
+
+Add Tigerlake HDMI codec support.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205379
+BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=112171
+Cc: Pan Xiuli <xiuli.pan@linux.intel.com>
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Link: https://lore.kernel.org/r/20191105161053.22958-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_hdmi.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 00796c7727ea2..ff99f5feaace9 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -2703,6 +2703,18 @@ static int patch_i915_icl_hdmi(struct hda_codec *codec)
+ return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map));
+ }
+
++static int patch_i915_tgl_hdmi(struct hda_codec *codec)
++{
++ /*
++ * pin to port mapping table where the value indicate the pin number and
++ * the index indicate the port number with 1 base.
++ */
++ static const int map[] = {0x4, 0x6, 0x8, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf};
++
++ return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map));
++}
++
++
+ /* Intel Baytrail and Braswell; with eld notifier */
+ static int patch_i915_byt_hdmi(struct hda_codec *codec)
+ {
+@@ -3960,6 +3972,7 @@ HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI", patch_i915_hsw_hdmi),
+ HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI", patch_i915_glk_hdmi),
+ HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_glk_hdmi),
+ HDA_CODEC_ENTRY(0x8086280f, "Icelake HDMI", patch_i915_icl_hdmi),
++HDA_CODEC_ENTRY(0x80862812, "Tigerlake HDMI", patch_i915_tgl_hdmi),
+ HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi),
+ HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi),
+ HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI", patch_i915_byt_hdmi),
+--
+2.20.1
+
--- /dev/null
+From 465780ef7ce01491a9b235e4400c44e578ba0bf9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 17:43:43 -0300
+Subject: ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts
+
+From: Fabio Estevam <festevam@gmail.com>
+
+[ Upstream commit 7e5d0bf6afcc7bd72f78e7f33570e2e0945624f0 ]
+
+Since commit a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
+a storm of accelerometer interrupts is seen:
+
+[ 114.211283] irq 260: nobody cared (try booting with the "irqpoll" option)
+[ 114.218108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.4 #1
+[ 114.223960] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+[ 114.230531] [<c0112858>] (unwind_backtrace) from [<c010cdc8>] (show_stack+0x10/0x14)
+[ 114.238301] [<c010cdc8>] (show_stack) from [<c0c1aa1c>] (dump_stack+0xd8/0x110)
+[ 114.245644] [<c0c1aa1c>] (dump_stack) from [<c0193594>] (__report_bad_irq+0x30/0xc0)
+[ 114.253417] [<c0193594>] (__report_bad_irq) from [<c01933ac>] (note_interrupt+0x108/0x298)
+[ 114.261707] [<c01933ac>] (note_interrupt) from [<c018ffe4>] (handle_irq_event_percpu+0x70/0x80)
+[ 114.270433] [<c018ffe4>] (handle_irq_event_percpu) from [<c019002c>] (handle_irq_event+0x38/0x5c)
+[ 114.279326] [<c019002c>] (handle_irq_event) from [<c019438c>] (handle_level_irq+0xc8/0x154)
+[ 114.287701] [<c019438c>] (handle_level_irq) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
+[ 114.296166] [<c018eda0>] (generic_handle_irq) from [<c0534214>] (mxc_gpio_irq_handler+0x30/0xf0)
+[ 114.304975] [<c0534214>] (mxc_gpio_irq_handler) from [<c0534334>] (mx3_gpio_irq_handler+0x60/0xb0)
+[ 114.313955] [<c0534334>] (mx3_gpio_irq_handler) from [<c018eda0>] (generic_handle_irq+0x20/0x34)
+[ 114.322762] [<c018eda0>] (generic_handle_irq) from [<c018f3ac>] (__handle_domain_irq+0x64/0xe0)
+[ 114.331485] [<c018f3ac>] (__handle_domain_irq) from [<c05215a8>] (gic_handle_irq+0x4c/0xa8)
+[ 114.339862] [<c05215a8>] (gic_handle_irq) from [<c0101a70>] (__irq_svc+0x70/0x98)
+[ 114.347361] Exception stack(0xc1301ec0 to 0xc1301f08)
+[ 114.352435] 1ec0: 00000001 00000006 00000000 c130c340 00000001 c130f688 9785636d c13ea2e8
+[ 114.360635] 1ee0: 9784907d 0000001a eaf99d78 0000001a 00000000 c1301f10 c0182b00 c0878de4
+[ 114.368830] 1f00: 20000013 ffffffff
+[ 114.372349] [<c0101a70>] (__irq_svc) from [<c0878de4>] (cpuidle_enter_state+0x168/0x5f4)
+[ 114.380464] [<c0878de4>] (cpuidle_enter_state) from [<c08792ac>] (cpuidle_enter+0x28/0x38)
+[ 114.388751] [<c08792ac>] (cpuidle_enter) from [<c015ef9c>] (do_idle+0x224/0x2a8)
+[ 114.396168] [<c015ef9c>] (do_idle) from [<c015f3b8>] (cpu_startup_entry+0x18/0x20)
+[ 114.403765] [<c015f3b8>] (cpu_startup_entry) from [<c1200e54>] (start_kernel+0x43c/0x500)
+[ 114.411958] handlers:
+[ 114.414302] [<a01028b8>] irq_default_primary_handler threaded [<fd7a3b08>] mma8452_interrupt
+[ 114.422974] Disabling IRQ #260
+
+ CPU0 CPU1
+....
+260: 100001 0 gpio-mxc 31 Level mma8451
+
+The MMA8451 interrupt triggers as low level, so the GPIO6_IO31 pin
+needs to activate its pull up, otherwise it will stay always at low level
+generating multiple interrupts.
+
+The current device tree does not configure the IOMUX for this pin, so
+it uses whathever comes configured from the bootloader.
+
+The IOMUXC_SW_PAD_CTL_PAD_EIM_BCLK register value comes as 0x8000 from
+the bootloader, which has PKE bit cleared, hence disabling the
+pull-up.
+
+Instead of relying on a previous configuration from the bootloader,
+configure the GPIO6_IO31 pin with pull-up enabled in order to fix
+this problem.
+
+Fixes: a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors")
+Signed-off-by: Fabio Estevam <festevam@gmail.com>
+Reviewed-By: Leonard Crestez <leonard.crestez@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+index f3404dd105377..cf628465cd0a3 100644
+--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi
+@@ -230,6 +230,8 @@
+ accelerometer@1c {
+ compatible = "fsl,mma8451";
+ reg = <0x1c>;
++ pinctrl-names = "default";
++ pinctrl-0 = <&pinctrl_mma8451_int>;
+ interrupt-parent = <&gpio6>;
+ interrupts = <31 IRQ_TYPE_LEVEL_LOW>;
+ };
+@@ -628,6 +630,12 @@
+ >;
+ };
+
++ pinctrl_mma8451_int: mma8451intgrp {
++ fsl,pins = <
++ MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0xb0b1
++ >;
++ };
++
+ pinctrl_pwm3: pwm1grp {
+ fsl,pins = <
+ MX6QDL_PAD_SD4_DAT1__PWM3_OUT 0x1b0b1
+--
+2.20.1
+
--- /dev/null
+From 80a3c64a9d8ea6c228e0515aa296a3732e388cb1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 15:31:45 +0100
+Subject: ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c
+
+From: Christophe Roullier <christophe.roullier@st.com>
+
+[ Upstream commit 9df50c2e16de7fd739d11d37303afec9e573b46f ]
+
+Split the 10Kbytes CAN message RAM to be able to use simultaneously
+FDCAN1 and FDCAN2 instances.
+First 5Kbytes are allocated to FDCAN1 and last 5Kbytes are used for
+FDCAN2. To do so, set the offset to 0x1400 in mram-cfg for FDCAN2.
+
+Fixes: d44d6e021301 ("ARM: dts: stm32: change CAN RAM mapping on stm32mp157c")
+Signed-off-by: Christophe Roullier <christophe.roullier@st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/stm32mp157c.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi
+index 0c4e6ebc35291..31556bea2c933 100644
+--- a/arch/arm/boot/dts/stm32mp157c.dtsi
++++ b/arch/arm/boot/dts/stm32mp157c.dtsi
+@@ -914,7 +914,7 @@
+ interrupt-names = "int0", "int1";
+ clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>;
+ clock-names = "hclk", "cclk";
+- bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
++ bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>;
+ status = "disabled";
+ };
+
+@@ -927,7 +927,7 @@
+ interrupt-names = "int0", "int1";
+ clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>;
+ clock-names = "hclk", "cclk";
+- bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>;
++ bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
+ status = "disabled";
+ };
+
+--
+2.20.1
+
--- /dev/null
+From fe9baf0ad487a99d17c35262ee8320bb521faf76 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 22:58:58 +0100
+Subject: ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend
+
+From: Ondrej Jirman <megous@megous.com>
+
+[ Upstream commit e614f341253f8541baf0230a8dc6a016b544b1e2 ]
+
+Without enabling keep-power-in-suspend, we can't wake the device
+up using WOL packet, and the log is flooded with these messages
+on resume:
+
+sunxi-mmc 1c10000.mmc: send stop command failed
+sunxi-mmc 1c10000.mmc: data error, sending stop command
+sunxi-mmc 1c10000.mmc: send stop command failed
+sunxi-mmc 1c10000.mmc: data error, sending stop command
+
+So to make the WiFi really a wakeup-source, we need to keep it powered
+during suspend.
+
+Fixes: 0e23372080def7 ("arm: dts: sun8i: Add the TBS A711 tablet devicetree")
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+index 568b90ece3427..3bec3e0a81b2c 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts
+@@ -192,6 +192,7 @@
+ vqmmc-supply = <®_dldo1>;
+ non-removable;
+ wakeup-source;
++ keep-power-in-suspend;
+ status = "okay";
+
+ brcmf: wifi@1 {
+--
+2.20.1
+
--- /dev/null
+From a12c0a85a9eaf769c50ca4dff12c8e49306e222e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 16:39:23 +0800
+Subject: arm64: dts: imx8mm: fix compatible string for sdma
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit e346ff93f02b1ba81e976d4e67ec56582dbdf7f1 ]
+
+SDMA in i.MX8MM should use same configuration as i.MX8MQ
+So need to change compatible string to be "fsl,imx8mq-sdma".
+
+Fixes: a05ea40eb384 ("arm64: dts: imx: Add i.mx8mm dtsi support")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+index 0d0a6543e5db2..a9824b862c419 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+@@ -370,7 +370,7 @@
+ };
+
+ sdma2: dma-controller@302c0000 {
+- compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
++ compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
+ reg = <0x302c0000 0x10000>;
+ interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MM_CLK_SDMA2_ROOT>,
+@@ -381,7 +381,7 @@
+ };
+
+ sdma3: dma-controller@302b0000 {
+- compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
++ compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
+ reg = <0x302b0000 0x10000>;
+ interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MM_CLK_SDMA3_ROOT>,
+@@ -693,7 +693,7 @@
+ };
+
+ sdma1: dma-controller@30bd0000 {
+- compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma";
++ compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma";
+ reg = <0x30bd0000 0x10000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MM_CLK_SDMA1_ROOT>,
+--
+2.20.1
+
--- /dev/null
+From 77fba1d08e6c5623bb03aae52733bdc01280d504 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Oct 2019 16:33:34 +0800
+Subject: arm64: dts: ls1028a: fix a compatible issue
+
+From: Yuantian Tang <andy.tang@nxp.com>
+
+[ Upstream commit 7eb3894b2fac978f811684e3ccb3cb0ad7820bef ]
+
+The I2C multiplexer used on ls1028aqds is PCA9547, not PCA9847.
+If the wrong compatible was used, this chip will not be able to
+be probed correctly and hence fail to work.
+
+Signed-off-by: Yuantian Tang <andy.tang@nxp.com>
+Acked-by: Li Yang <leoyang.li@nxp.com>
+Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
+index de6ef39f3118a..fce9343dc017a 100644
+--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts
+@@ -99,7 +99,7 @@
+ status = "okay";
+
+ i2c-mux@77 {
+- compatible = "nxp,pca9847";
++ compatible = "nxp,pca9547";
+ reg = <0x77>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+--
+2.20.1
+
--- /dev/null
+From fd47565b791b76ac8c24aa7c03c6521e5dc8199e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 17:46:23 +0100
+Subject: arm64: dts: zii-ultra: fix ARM regulator GPIO handle
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+[ Upstream commit f852497c9a07ec9913bb3f3db5f096a8e2ab7e03 ]
+
+The GPIO handle is referencing the wrong GPIO, so the voltage did not
+actually change as intended. The pinmux is already correct, so just
+correct the GPIO number.
+
+Fixes: 4a13b3bec3b4 (arm64: dts: imx: add Zii Ultra board support)
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
+index 3faa652fdf20d..c25be32ba37e4 100644
+--- a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi
+@@ -100,7 +100,7 @@
+ regulator-name = "0V9_ARM";
+ regulator-min-microvolt = <900000>;
+ regulator-max-microvolt = <1000000>;
+- gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
++ gpios = <&gpio3 16 GPIO_ACTIVE_HIGH>;
+ states = <1000000 0x1
+ 900000 0x0>;
+ regulator-always-on;
+--
+2.20.1
+
--- /dev/null
+From 7cc4a50da565d67ef11f78e11ea24c7983730579 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 21 Oct 2019 10:54:32 +0100
+Subject: ASoC: compress: fix unsigned integer overflow check
+
+From: Xiaojun Sang <xsang@codeaurora.org>
+
+[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ]
+
+Parameter fragments and fragment_size are type of u32. U32_MAX is
+the correct check.
+
+Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Vinod Koul <vkoul@kernel.org>
+Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/core/compress_offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
+index 41905afada63f..f34ce564d92c4 100644
+--- a/sound/core/compress_offload.c
++++ b/sound/core/compress_offload.c
+@@ -528,7 +528,7 @@ static int snd_compress_check_input(struct snd_compr_params *params)
+ {
+ /* first let's check the buffer parameter's */
+ if (params->buffer.fragment_size == 0 ||
+- params->buffer.fragments > INT_MAX / params->buffer.fragment_size ||
++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size ||
+ params->buffer.fragments == 0)
+ return -EINVAL;
+
+--
+2.20.1
+
--- /dev/null
+From 9a1b02e244bf71045d0190edf53678681ff8a3ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 12:06:35 -0500
+Subject: ASoC: hdac_hda: fix race in device removal
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+[ Upstream commit 5dc7d5bc9627eb26d33c7c7eefc467cf217f9326 ]
+
+When ASoC card instance is removed containing a HDA codec,
+hdac_hda_codec_remove() may run in parallel with codec resume.
+This will cause problems if the HDA link is freed with
+snd_hdac_ext_bus_link_put() while the codec is still in
+middle of its resume process.
+
+To fix this, change the order such that pm_runtime_disable()
+is called before the link is freed. This will ensure any
+pending runtime PM action is completed before proceeding
+to free the link.
+
+This issue can be easily hit with e.g. SOF driver by loading and
+unloading the drivers.
+
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191101170635.26389-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/hdac_hda.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c
+index 91242b6f8ea7a..4570f662fb48b 100644
+--- a/sound/soc/codecs/hdac_hda.c
++++ b/sound/soc/codecs/hdac_hda.c
+@@ -410,8 +410,8 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component)
+ return;
+ }
+
+- snd_hdac_ext_bus_link_put(hdev->bus, hlink);
+ pm_runtime_disable(&hdev->dev);
++ snd_hdac_ext_bus_link_put(hdev->bus, hlink);
+ }
+
+ static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = {
+--
+2.20.1
+
--- /dev/null
+From 7b62e8b789f8163f882dbf5ba7d5a4fe905cc926 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:49 +0100
+Subject: ASoC: kirkwood: fix device remove ordering
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit dc39596a906d5b604f4e64597b6e904fc14625e8 ]
+
+The devm conversion of kirkwood was incorrect; on removal, devm takes
+effect after the "remove" function has returned. So, the effect of
+the conversion was to change the order during remove from:
+
+ - snd_soc_unregister_component() (unpublishes interfaces)
+ - clk_disable_unprepare()
+ - cleanup resources
+
+After the conversion, this became:
+
+ - clk_disable_unprepare() - while the device may still be active
+ - snd_soc_unregister_component()
+ - cleanup resources
+
+Hence, it introduces a bug, where the internal clock for the device
+may be shut down before the device itself has been shut down. It is
+known that Marvell SoCs, including Dove, locks up if registers for a
+peripheral that has its clocks disabled are accessed.
+
+Fixes: f98fc0f8154e ("ASoC: kirkwood: replace platform to component")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyP-0004oN-BA@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index c323ae314b554..eb38cdb37f0ea 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -591,7 +591,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ priv->ctl_rec |= KIRKWOOD_RECCTL_BURST_128;
+ }
+
+- err = devm_snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
++ err = snd_soc_register_component(&pdev->dev, &kirkwood_soc_component,
+ soc_dai, 2);
+ if (err) {
+ dev_err(&pdev->dev, "snd_soc_register_component failed\n");
+@@ -614,6 +614,7 @@ static int kirkwood_i2s_dev_remove(struct platform_device *pdev)
+ {
+ struct kirkwood_dma_data *priv = dev_get_drvdata(&pdev->dev);
+
++ snd_soc_unregister_component(&pdev->dev);
+ if (!IS_ERR(priv->extclk))
+ clk_disable_unprepare(priv->extclk);
+ clk_disable_unprepare(priv->clk);
+--
+2.20.1
+
--- /dev/null
+From ffdfb014c063c839b7163f5d7dc80b3cfaba9802 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 14:46:44 +0100
+Subject: ASoC: kirkwood: fix external clock probe defer
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ]
+
+When our call to get the external clock fails, we forget to clean up
+the enabled internal clock correctly. Enable the clock after we have
+obtained all our resources.
+
+Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
+index 3446a113f482e..c323ae314b554 100644
+--- a/sound/soc/kirkwood/kirkwood-i2s.c
++++ b/sound/soc/kirkwood/kirkwood-i2s.c
+@@ -559,10 +559,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ return PTR_ERR(priv->clk);
+ }
+
+- err = clk_prepare_enable(priv->clk);
+- if (err < 0)
+- return err;
+-
+ priv->extclk = devm_clk_get(&pdev->dev, "extclk");
+ if (IS_ERR(priv->extclk)) {
+ if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
+@@ -578,6 +574,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev)
+ }
+ }
+
++ err = clk_prepare_enable(priv->clk);
++ if (err < 0)
++ return err;
++
+ /* Some sensible defaults - this reflects the powerup values */
+ priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
+ priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
+--
+2.20.1
+
--- /dev/null
+From 67658322ca38b83e8b7e0e4bea0f967d254539ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 20 Oct 2019 17:30:06 +0200
+Subject: ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX
+
+From: Stephan Gerhold <stephan@gerhold.net>
+
+[ Upstream commit 9110d1b0e229cebb1ffce0c04db2b22beffd513d ]
+
+According to the PM8916 Hardware Register Description,
+CDC_D_CDC_CONN_HPHR_DAC_CTL has only a single bit (RX_SEL)
+to switch between RX1 (0) and RX2 (1). It is not possible to
+disable it entirely to achieve the "ZERO" state.
+
+However, at the moment the "RDAC2 MUX" mixer defines three possible
+values ("ZERO", "RX2" and "RX1"). Setting the mixer to "ZERO"
+actually configures it to RX1. Setting the mixer to "RX1" has
+(seemingly) no effect.
+
+Remove "ZERO" and replace it with "RX1" to fix this.
+
+Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec")
+Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
+Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Link: https://lore.kernel.org/r/20191020153007.206070-1-stephan@gerhold.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/msm8916-wcd-analog.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c
+index 368b6c09474bb..aa9a8ac987dc0 100644
+--- a/sound/soc/codecs/msm8916-wcd-analog.c
++++ b/sound/soc/codecs/msm8916-wcd-analog.c
+@@ -306,7 +306,7 @@ struct pm8916_wcd_analog_priv {
+ };
+
+ static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" };
+-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" };
++static const char *const rdac2_mux_text[] = { "RX1", "RX2" };
+ static const char *const hph_text[] = { "ZERO", "Switch", };
+
+ static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT(
+@@ -321,7 +321,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT(
+
+ /* RDAC2 MUX */
+ static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE(
+- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text);
++ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text);
+
+ static const struct snd_kcontrol_new spkr_switch[] = {
+ SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0)
+--
+2.20.1
+
--- /dev/null
+From 1081be20fc90c81652fd018eff06a8838203c10b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 17:52:29 +0800
+Subject: ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset
+ detection
+
+From: Cheng-Yi Chiang <cychiang@chromium.org>
+
+[ Upstream commit 07c1b73e2a027ea9a52677beeb6a943a3e357139 ]
+
+max98090 spec states that chip needs to be in turned-on state to supply
+mic bias. Enable SHDN dapm widget along with MICBIAS widget to
+actually turn on mic bias for proper headset button detection.
+This is similar to cht_ti_jack_event in
+sound/soc/intel/boards/cht_bsw_max98090_ti.c.
+
+Note that due to ts3a227e reports the jack event right away before the
+notifier is registered, if headset is plugged on boot, headset button
+will not get detected until headset is unplugged and plugged. This is
+still an issue to be fixed.
+
+Signed-off-by: Cheng-Yi Chiang <cychiang@chromium.org>
+Link: https://lore.kernel.org/r/20191028095229.99438-1-cychiang@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_max98090.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/rockchip/rockchip_max98090.c b/sound/soc/rockchip/rockchip_max98090.c
+index 782e534d4c0dd..f2add1fe2e79d 100644
+--- a/sound/soc/rockchip/rockchip_max98090.c
++++ b/sound/soc/rockchip/rockchip_max98090.c
+@@ -67,10 +67,13 @@ static int rk_jack_event(struct notifier_block *nb, unsigned long event,
+ struct snd_soc_jack *jack = (struct snd_soc_jack *)data;
+ struct snd_soc_dapm_context *dapm = &jack->card->dapm;
+
+- if (event & SND_JACK_MICROPHONE)
++ if (event & SND_JACK_MICROPHONE) {
+ snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+- else
++ snd_soc_dapm_force_enable_pin(dapm, "SHDN");
++ } else {
+ snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ snd_soc_dapm_disable_pin(dapm, "SHDN");
++ }
+
+ snd_soc_dapm_sync(dapm);
+
+--
+2.20.1
+
--- /dev/null
+From e31bf2ff0f173a04fcdd17f5994fe843942da81e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 27 Oct 2019 16:53:24 -0500
+Subject: ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data
+
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+
+[ Upstream commit 45c1380358b12bf2d1db20a5874e9544f56b34ab ]
+
+In the implementation of sof_set_get_large_ctrl_data() there is a memory
+leak in case an error. Release partdata if sof_get_ctrl_copy_params()
+fails.
+
+Fixes: 54d198d5019d ("ASoC: SOF: Propagate sof_get_ctrl_copy_params() error properly")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Link: https://lore.kernel.org/r/20191027215330.12729-1-navid.emamdoost@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/ipc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/sof/ipc.c b/sound/soc/sof/ipc.c
+index 20dfca9c93b76..c4086186722f3 100644
+--- a/sound/soc/sof/ipc.c
++++ b/sound/soc/sof/ipc.c
+@@ -578,8 +578,10 @@ static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev,
+ else
+ err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata,
+ sparams);
+- if (err < 0)
++ if (err < 0) {
++ kfree(partdata);
+ return err;
++ }
+
+ msg_bytes = sparams->msg_bytes;
+ pl_size = sparams->pl_size;
+--
+2.20.1
+
--- /dev/null
+From 2bfa7835c9b80ffad7f0e9bb118013035a60d51c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 08:58:16 -0600
+Subject: ASoC: SOF: topology: Fix bytes control size checks
+
+From: Dragos Tarcatu <dragos_tarcatu@mentor.com>
+
+[ Upstream commit 9508ef5a980f5d847cad9b932b6ada8f2a3466c1 ]
+
+When using the example SOF amp widget topology, KASAN dumps this
+when the AMP bytes kcontrol gets loaded:
+
+[ 9.579548] BUG: KASAN: slab-out-of-bounds in
+sof_control_load+0x8cc/0xac0 [snd_sof]
+[ 9.588194] Write of size 40 at addr ffff8882314559dc by task
+systemd-udevd/2411
+
+Fix that by rejecting the topology if the bytes data size > max_size
+
+Fixes: 311ce4fe7637d ("ASoC: SOF: Add support for loading topologies")
+Reviewed-by: Jaska Uimonen <jaska.uimonen@intel.com>
+Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Dragos Tarcatu <dragos_tarcatu@mentor.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20191106145816.9367-1-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sof/topology.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c
+index 96230329e678f..355f04663f576 100644
+--- a/sound/soc/sof/topology.c
++++ b/sound/soc/sof/topology.c
+@@ -533,15 +533,16 @@ static int sof_control_load_bytes(struct snd_soc_component *scomp,
+ struct soc_bytes_ext *sbe = (struct soc_bytes_ext *)kc->private_value;
+ int max_size = sbe->max;
+
+- if (le32_to_cpu(control->priv.size) > max_size) {
++ /* init the get/put bytes data */
++ scontrol->size = sizeof(struct sof_ipc_ctrl_data) +
++ le32_to_cpu(control->priv.size);
++
++ if (scontrol->size > max_size) {
+ dev_err(sdev->dev, "err: bytes data size %d exceeds max %d.\n",
+- control->priv.size, max_size);
++ scontrol->size, max_size);
+ return -EINVAL;
+ }
+
+- /* init the get/put bytes data */
+- scontrol->size = sizeof(struct sof_ipc_ctrl_data) +
+- le32_to_cpu(control->priv.size);
+ scontrol->control_data = kzalloc(max_size, GFP_KERNEL);
+ cdata = scontrol->control_data;
+ if (!scontrol->control_data)
+--
+2.20.1
+
--- /dev/null
+From 7a0863db181385c05d826e4c2ec93f4c56017427 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 14:36:54 +0100
+Subject: ASoC: stm32: sai: add restriction on mmap support
+
+From: Olivier Moysan <olivier.moysan@st.com>
+
+[ Upstream commit eaf072e512d54c95b0977eda06cbca3151ace1e5 ]
+
+Do not support mmap in S/PDIF mode. In S/PDIF mode
+the buffer has to be copied, to allow the channel status
+bits insertion.
+
+Signed-off-by: Olivier Moysan <olivier.moysan@st.com>
+Link: https://lore.kernel.org/r/20191104133654.28750-1-olivier.moysan@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/stm/stm32_sai_sub.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c
+index d7501f88aaa63..34e73071d4db8 100644
+--- a/sound/soc/stm/stm32_sai_sub.c
++++ b/sound/soc/stm/stm32_sai_sub.c
+@@ -1217,6 +1217,16 @@ static int stm32_sai_pcm_process_spdif(struct snd_pcm_substream *substream,
+ return 0;
+ }
+
++/* No support of mmap in S/PDIF mode */
++static const struct snd_pcm_hardware stm32_sai_pcm_hw_spdif = {
++ .info = SNDRV_PCM_INFO_INTERLEAVED,
++ .buffer_bytes_max = 8 * PAGE_SIZE,
++ .period_bytes_min = 1024,
++ .period_bytes_max = PAGE_SIZE,
++ .periods_min = 2,
++ .periods_max = 8,
++};
++
+ static const struct snd_pcm_hardware stm32_sai_pcm_hw = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP,
+ .buffer_bytes_max = 8 * PAGE_SIZE,
+@@ -1269,7 +1279,7 @@ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = {
+ };
+
+ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config_spdif = {
+- .pcm_hardware = &stm32_sai_pcm_hw,
++ .pcm_hardware = &stm32_sai_pcm_hw_spdif,
+ .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config,
+ .process = stm32_sai_pcm_process_spdif,
+ };
+--
+2.20.1
+
--- /dev/null
+From edd6d0de5dcf0bfa31ba4fc241398cf51974a765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 13:52:07 +0200
+Subject: ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma
+ names
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit dd7e8d903e1eef5a9234a2d69663dcbfeab79571 ]
+
+When non standard names are used it is possible that one of the directions
+are not provided, thus the flags needs to be present to tell the core that
+we have half duplex setup.
+
+Fixes: 642aafea8889 ("ASoC: ti: remove compat dma probing")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20191028115207.5142-1-peter.ujfalusi@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/sdma-pcm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/ti/sdma-pcm.c b/sound/soc/ti/sdma-pcm.c
+index a236350beb102..2b0bc234e1b69 100644
+--- a/sound/soc/ti/sdma-pcm.c
++++ b/sound/soc/ti/sdma-pcm.c
+@@ -62,7 +62,7 @@ int sdma_pcm_platform_register(struct device *dev,
+ config->chan_names[0] = txdmachan;
+ config->chan_names[1] = rxdmachan;
+
+- return devm_snd_dmaengine_pcm_register(dev, config, 0);
++ return devm_snd_dmaengine_pcm_register(dev, config, flags);
+ }
+ EXPORT_SYMBOL_GPL(sdma_pcm_platform_register);
+
+--
+2.20.1
+
--- /dev/null
+From c7b4e2e0f336f135f51c83ee9a67f9f8d0c2476d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 10:48:47 +0300
+Subject: block: drbd: remove a stray unlock in __drbd_send_protocol()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ]
+
+There are two callers of this function and they both unlock the mutex so
+this ends up being a double unlock.
+
+Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_main.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
+index 5b248763a6724..a18155cdce416 100644
+--- a/drivers/block/drbd/drbd_main.c
++++ b/drivers/block/drbd/drbd_main.c
+@@ -786,7 +786,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm
+
+ if (nc->tentative && connection->agreed_pro_version < 92) {
+ rcu_read_unlock();
+- mutex_unlock(&sock->mutex);
+ drbd_err(connection, "--dry-run is not supported by peer");
+ return -EOPNOTSUPP;
+ }
+--
+2.20.1
+
--- /dev/null
+From 331ea66dc2ef884df1de4ad2983a43425ee661e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 13:29:02 +0100
+Subject: bpf: Allow narrow loads of bpf_sysctl fields with offset > 0
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 7541c87c9b7a7e07c84481f37f2c19063b44469b ]
+
+"ctx:file_pos sysctl:read read ok narrow" works on s390 by accident: it
+reads the wrong byte, which happens to have the expected value of 0.
+Improve the test by seeking to the 4th byte and expecting 4 instead of
+0.
+
+This makes the latent problem apparent: the test attempts to read the
+first byte of bpf_sysctl.file_pos, assuming this is the least-significant
+byte, which is not the case on big-endian machines: a non-zero offset is
+needed.
+
+The point of the test is to verify narrow loads, so we cannot cheat our
+way out by simply using BPF_W. The existence of the test means that such
+loads have to be supported, most likely because llvm can generate them.
+Fix the test by adding a big-endian variant, which uses an offset to
+access the least-significant byte of bpf_sysctl.file_pos.
+
+This reveals the final problem: verifier rejects accesses to bpf_sysctl
+fields with offset > 0. Such accesses are already allowed for a wide
+range of structs: __sk_buff, bpf_sock_addr and sk_msg_md to name a few.
+Extend this support to bpf_sysctl by using bpf_ctx_range instead of
+offsetof when matching field offsets.
+
+Fixes: 7b146cebe30c ("bpf: Sysctl hook")
+Fixes: e1550bfe0de4 ("bpf: Add file_pos field to bpf_sysctl ctx")
+Fixes: 9a1027e52535 ("selftests/bpf: Test file_pos field in bpf_sysctl ctx")
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrey Ignatov <rdna@fb.com>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20191028122902.9763-1-iii@linux.ibm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/cgroup.c | 4 ++--
+ tools/testing/selftests/bpf/test_sysctl.c | 8 +++++++-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
+index 0a00eaca6fae6..9ad7cd3267f52 100644
+--- a/kernel/bpf/cgroup.c
++++ b/kernel/bpf/cgroup.c
+@@ -1302,12 +1302,12 @@ static bool sysctl_is_valid_access(int off, int size, enum bpf_access_type type,
+ return false;
+
+ switch (off) {
+- case offsetof(struct bpf_sysctl, write):
++ case bpf_ctx_range(struct bpf_sysctl, write):
+ if (type != BPF_READ)
+ return false;
+ bpf_ctx_record_field_size(info, size_default);
+ return bpf_ctx_narrow_access_ok(off, size, size_default);
+- case offsetof(struct bpf_sysctl, file_pos):
++ case bpf_ctx_range(struct bpf_sysctl, file_pos):
+ if (type == BPF_READ) {
+ bpf_ctx_record_field_size(info, size_default);
+ return bpf_ctx_narrow_access_ok(off, size, size_default);
+diff --git a/tools/testing/selftests/bpf/test_sysctl.c b/tools/testing/selftests/bpf/test_sysctl.c
+index a3bebd7c68ddc..c938f1767ca72 100644
+--- a/tools/testing/selftests/bpf/test_sysctl.c
++++ b/tools/testing/selftests/bpf/test_sysctl.c
+@@ -158,9 +158,14 @@ static struct sysctl_test tests[] = {
+ .descr = "ctx:file_pos sysctl:read read ok narrow",
+ .insns = {
+ /* If (file_pos == X) */
++#if __BYTE_ORDER == __LITTLE_ENDIAN
+ BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1,
+ offsetof(struct bpf_sysctl, file_pos)),
+- BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 2),
++#else
++ BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1,
++ offsetof(struct bpf_sysctl, file_pos) + 3),
++#endif
++ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 4, 2),
+
+ /* return ALLOW; */
+ BPF_MOV64_IMM(BPF_REG_0, 1),
+@@ -173,6 +178,7 @@ static struct sysctl_test tests[] = {
+ .attach_type = BPF_CGROUP_SYSCTL,
+ .sysctl = "kernel/ostype",
+ .open_flags = O_RDONLY,
++ .seek = 4,
+ .result = SUCCESS,
+ },
+ {
+--
+2.20.1
+
--- /dev/null
+From 41b2e881ee05eb3f8f6797f46fdc07d8ad03b1ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 16:43:07 +0100
+Subject: bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit ff1c08e1f74b6864854c39be48aa799a6a2e4d2b ]
+
+The functions bpf_map_area_alloc() and bpf_map_charge_init() prior
+this commit passed the size parameter as size_t. In this commit this
+is changed to u64.
+
+All users of these functions avoid size_t overflows on 32-bit systems,
+by explicitly using u64 when calculating the allocation size and
+memory charge cost. However, since the result was narrowed by the
+size_t when passing size and cost to the functions, the overflow
+handling was in vain.
+
+Instead of changing all call sites to size_t and handle overflow at
+the call site, the parameter is changed to u64 and checked in the
+functions above.
+
+Fixes: d407bd25a204 ("bpf: don't trigger OOM killer under pressure with map alloc")
+Fixes: c85d69135a91 ("bpf: move memory size checks to bpf_map_charge_init()")
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Link: https://lore.kernel.org/bpf/20191029154307.23053-1-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/bpf.h | 4 ++--
+ kernel/bpf/syscall.c | 7 +++++--
+ 2 files changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 18f4cc2c6acd4..5d177c0c7fe37 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -651,11 +651,11 @@ void bpf_map_put_with_uref(struct bpf_map *map);
+ void bpf_map_put(struct bpf_map *map);
+ int bpf_map_charge_memlock(struct bpf_map *map, u32 pages);
+ void bpf_map_uncharge_memlock(struct bpf_map *map, u32 pages);
+-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size);
++int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size);
+ void bpf_map_charge_finish(struct bpf_map_memory *mem);
+ void bpf_map_charge_move(struct bpf_map_memory *dst,
+ struct bpf_map_memory *src);
+-void *bpf_map_area_alloc(size_t size, int numa_node);
++void *bpf_map_area_alloc(u64 size, int numa_node);
+ void bpf_map_area_free(void *base);
+ void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr);
+
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index aac966b32c42e..ee3087462bc97 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -126,7 +126,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr)
+ return map;
+ }
+
+-void *bpf_map_area_alloc(size_t size, int numa_node)
++void *bpf_map_area_alloc(u64 size, int numa_node)
+ {
+ /* We really just want to fail instead of triggering OOM killer
+ * under memory pressure, therefore we set __GFP_NORETRY to kmalloc,
+@@ -141,6 +141,9 @@ void *bpf_map_area_alloc(size_t size, int numa_node)
+ const gfp_t flags = __GFP_NOWARN | __GFP_ZERO;
+ void *area;
+
++ if (size >= SIZE_MAX)
++ return NULL;
++
+ if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
+ area = kmalloc_node(size, GFP_USER | __GFP_NORETRY | flags,
+ numa_node);
+@@ -197,7 +200,7 @@ static void bpf_uncharge_memlock(struct user_struct *user, u32 pages)
+ atomic_long_sub(pages, &user->locked_vm);
+ }
+
+-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size)
++int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size)
+ {
+ u32 pages = round_up(size, PAGE_SIZE) >> PAGE_SHIFT;
+ struct user_struct *user;
+--
+2.20.1
+
--- /dev/null
+From 9e426331ecc115bf0e84b92e1c98679f59a20238 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 20:54:28 +0100
+Subject: bridge: ebtables: don't crash when using dnat target in output chains
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ]
+
+xt_in() returns NULL in the output hook, skip the pkt_type change for
+that case, redirection only makes sense in broute/prerouting hooks.
+
+Reported-by: Tom Yan <tom.ty89@gmail.com>
+Cc: Linus Lüssing <linus.luessing@c0d3.blue>
+Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
+index ed91ea31978af..12a4f4d936810 100644
+--- a/net/bridge/netfilter/ebt_dnat.c
++++ b/net/bridge/netfilter/ebt_dnat.c
+@@ -20,7 +20,6 @@ static unsigned int
+ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ {
+ const struct ebt_nat_info *info = par->targinfo;
+- struct net_device *dev;
+
+ if (skb_ensure_writable(skb, ETH_ALEN))
+ return EBT_DROP;
+@@ -33,10 +32,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par)
+ else
+ skb->pkt_type = PACKET_MULTICAST;
+ } else {
+- if (xt_hooknum(par) != NF_BR_BROUTING)
+- dev = br_port_get_rcu(xt_in(par))->br->dev;
+- else
++ const struct net_device *dev;
++
++ switch (xt_hooknum(par)) {
++ case NF_BR_BROUTING:
+ dev = xt_in(par);
++ break;
++ case NF_BR_PRE_ROUTING:
++ dev = br_port_get_rcu(xt_in(par))->br->dev;
++ break;
++ default:
++ dev = NULL;
++ break;
++ }
++
++ if (!dev) /* NF_BR_LOCAL_OUT */
++ return info->target;
+
+ if (ether_addr_equal(info->mac, dev->dev_addr))
+ skb->pkt_type = PACKET_HOST;
+--
+2.20.1
+
--- /dev/null
+From 4a3b70f586e6dcf1f799e04746c1a88b92aaace5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 21:01:20 +0000
+Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on
+ open
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ]
+
+When the CAN interface is closed it the hardwre is put in power down
+mode, but does not reset the error counters / state. Reset the D_CAN on
+open, so the reported state and the actual state match.
+
+According to [1], the C_CAN module doesn't have the software reset.
+
+[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 9b61bfbea6cd1..24c6015f6c92b 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -52,6 +52,7 @@
+ #define CONTROL_EX_PDR BIT(8)
+
+ /* control register */
++#define CONTROL_SWR BIT(15)
+ #define CONTROL_TEST BIT(7)
+ #define CONTROL_CCE BIT(6)
+ #define CONTROL_DISABLE_AR BIT(5)
+@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ IF_MCONT_RCV_EOB);
+ }
+
++static int c_can_software_reset(struct net_device *dev)
++{
++ struct c_can_priv *priv = netdev_priv(dev);
++ int retry = 0;
++
++ if (priv->type != BOSCH_D_CAN)
++ return 0;
++
++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT);
++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) {
++ msleep(20);
++ if (retry++ > 100) {
++ netdev_err(dev, "CCTRL: software reset failed\n");
++ return -EIO;
++ }
++ }
++
++ return 0;
++}
++
+ /*
+ * Configure C_CAN chip:
+ * - enable/disable auto-retransmission
+@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev)
+ static int c_can_chip_config(struct net_device *dev)
+ {
+ struct c_can_priv *priv = netdev_priv(dev);
++ int err;
++
++ err = c_can_software_reset(dev);
++ if (err)
++ return err;
+
+ /* enable automatic retransmission */
+ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR);
+--
+2.20.1
+
--- /dev/null
+From a7ed4b386c51d5dbe54c41dd46506fb3b5fc5b3f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 15 Jul 2019 20:53:08 +0200
+Subject: can: flexcan: increase error counters if skb enqueueing via
+ can_rx_offload_queue_sorted() fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 758124335a9dd649ab820bfb5b328170919ee7dc ]
+
+The call to can_rx_offload_queue_sorted() may fail and return an error
+(in the current implementation due to resource shortage). The passed skb
+is consumed.
+
+This patch adds incrementing of the appropriate error counters to let
+the device statistics reflect that there's a problem.
+
+Reported-by: Martin Hundebøll <martin@geanix.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/flexcan.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 56fa98d7aa90c..a4f0fa94d136a 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -658,6 +658,7 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ struct can_frame *cf;
+ bool rx_errors = false, tx_errors = false;
+ u32 timestamp;
++ int err;
+
+ timestamp = priv->read(®s->timer) << 16;
+
+@@ -706,7 +707,9 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr)
+ if (tx_errors)
+ dev->stats.tx_errors++;
+
+- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ if (err)
++ dev->stats.rx_fifo_errors++;
+ }
+
+ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+@@ -719,6 +722,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ int flt;
+ struct can_berr_counter bec;
+ u32 timestamp;
++ int err;
+
+ timestamp = priv->read(®s->timer) << 16;
+
+@@ -750,7 +754,9 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr)
+ if (unlikely(new_state == CAN_STATE_BUS_OFF))
+ can_bus_off(dev);
+
+- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp);
++ if (err)
++ dev->stats.rx_fifo_errors++;
+ }
+
+ static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload)
+--
+2.20.1
+
--- /dev/null
+From bdc62cb3fa0ed10d568b412f1cd323cf1930fc54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 11 Oct 2019 15:38:19 +0200
+Subject: can: mcp251x: mcp251x_restart_work_handler(): Fix potential
+ force_quit race condition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Timo Schlüßler <schluessler@krause.de>
+
+[ Upstream commit 27a0e54bae09d2dd023a01254db506d61cc50ba1 ]
+
+In mcp251x_restart_work_handler() the variable to stop the interrupt
+handler (priv->force_quit) is reset after the chip is restarted and thus
+a interrupt might occur.
+
+This patch fixes the potential race condition by resetting force_quit
+before enabling interrupts.
+
+Signed-off-by: Timo Schlüßler <schluessler@krause.de>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index 5d6f8977df3f8..c0ee0fa909702 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -759,6 +759,7 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ if (priv->after_suspend) {
+ mcp251x_hw_reset(spi);
+ mcp251x_setup(net, spi);
++ priv->force_quit = 0;
+ if (priv->after_suspend & AFTER_SUSPEND_RESTART) {
+ mcp251x_set_normal_mode(spi);
+ } else if (priv->after_suspend & AFTER_SUSPEND_UP) {
+@@ -770,7 +771,6 @@ static void mcp251x_restart_work_handler(struct work_struct *ws)
+ mcp251x_hw_sleep(spi);
+ }
+ priv->after_suspend = 0;
+- priv->force_quit = 0;
+ }
+
+ if (priv->restart_tx) {
+--
+2.20.1
+
--- /dev/null
+From 1eadcb53e4299ea38ec7d2d050ea85f197bd987a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 25 Sep 2019 08:58:45 +0000
+Subject: can: peak_usb: report bus recovery as well
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ]
+
+While the state changes are reported when the error counters increase
+and decrease, there is no event when the bus recovers and the error
+counters decrease again. So add those as well.
+
+Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING ->
+ERROR_ACTIVE instead of directly to ERROR_ACTIVE again.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Cc: Stephane Grosjean <s.grosjean@peak-system.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c
+index 5a66c9f53aae6..d2539c95adb65 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
+@@ -436,8 +436,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+ if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) {
+ /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ new_state = CAN_STATE_ERROR_ACTIVE;
++ break;
+ }
+ break;
+
+@@ -460,9 +460,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ }
+
+ if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) {
+- /* no error (back to active state) */
+- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE;
+- return 0;
++ /* no error (back to warning state) */
++ new_state = CAN_STATE_ERROR_WARNING;
++ break;
+ }
+ break;
+
+@@ -501,6 +501,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n,
+ mc->pdev->dev.can.can_stats.error_warning++;
+ break;
+
++ case CAN_STATE_ERROR_ACTIVE:
++ cf->can_id |= CAN_ERR_CRTL;
++ cf->data[1] = CAN_ERR_CRTL_ACTIVE;
++ break;
++
+ default:
+ /* CAN_STATE_MAX (trick to handle other errors) */
+ cf->can_id |= CAN_ERR_CRTL;
+--
+2.20.1
+
--- /dev/null
+From 4d3115622e80135603714b3679aa018025d2465f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 1f7f504dcd9d1262437bdcf4fa071e41dec1af03 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+If the hardware FIFO is empty can_rx_offload_offload_one() will return
+NULL.
+
+In case a CAN frame was read from the hardware,
+can_rx_offload_offload_one() returns the skb containing it.
+
+Without this patch can_rx_offload_irq_offload_fifo() bails out if no skb
+returned, regardless of the reason.
+
+Similar to can_rx_offload_irq_offload_timestamp() in case of a resource
+shortage the whole FIFO should be discarded, to avoid an IRQ storm and
+give the system some time to recover. However if the FIFO is empty the
+loop can be left.
+
+With this patch the loop is left in case of empty FIFO, but not on
+errors.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 2ea8676579a9c..84cae167e42f6 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -248,7 +248,9 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+
+ while (1) {
+ skb = can_rx_offload_offload_one(offload, 0);
+- if (IS_ERR_OR_NULL(skb))
++ if (IS_ERR(skb))
++ continue;
++ if (!skb)
+ break;
+
+ skb_queue_tail(&offload->skb_queue, skb);
+--
+2.20.1
+
--- /dev/null
+From f0f27a98990406f1f1fe6cf494f227f6faea4b95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 18:45:38 +0000
+Subject: can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on
+ error
+
+From: Jeroen Hofstee <jhofstee@victronenergy.com>
+
+[ Upstream commit c2a9f74c9d18acfdcabd3361adc7eac82c537a66 ]
+
+In case of a resource shortage, i.e. the rx_offload queue will overflow
+or a skb fails to be allocated (due to OOM),
+can_rx_offload_offload_one() will call mailbox_read() to discard the
+mailbox and return an ERR_PTR.
+
+However can_rx_offload_irq_offload_timestamp() bails out in the error
+case. In case of a resource shortage all mailboxes should be discarded,
+to avoid an IRQ storm and give the system some time to recover.
+
+Since can_rx_offload_irq_offload_timestamp() is typically called from a
+while loop, all message will eventually be discarded. So let's continue
+on error instead to discard them directly.
+
+Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 3f5e040f0c712..2ea8676579a9c 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -216,7 +216,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+
+ skb = can_rx_offload_offload_one(offload, i);
+ if (IS_ERR_OR_NULL(skb))
+- break;
++ continue;
+
+ __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+ }
+--
+2.20.1
+
--- /dev/null
+From edea258ced89e3d5912c3585cd298f24aaddf730 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 16:03:18 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): do not increase the
+ skb_queue beyond skb_queue_len_max
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 ]
+
+The skb_queue is a linked list, holding the skb to be processed in the
+next NAPI call.
+
+Without this patch, the queue length in can_rx_offload_offload_one() is
+limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no
+array or other resources are accessed out-of-bound, however this
+behaviour is counterintuitive.
+
+This patch limits the rx-offload skb_queue length to skb_queue_len_max.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index d1c8634099450..bdc27481b57f9 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -115,7 +115,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+ int ret;
+
+ /* If queue is full or skb not available, read to discard mailbox */
+- if (likely(skb_queue_len(&offload->skb_queue) <=
++ if (likely(skb_queue_len(&offload->skb_queue) <
+ offload->skb_queue_len_max))
+ skb = alloc_can_skb(offload->dev, &cf);
+
+--
+2.20.1
+
--- /dev/null
+From c82f748709d467ec7898ae30220ebd8b97bdd529 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:15:07 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): increment
+ rx_fifo_errors on queue overflow or OOM
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 4e9016bee3bf0c24963097edace034ff205b565c ]
+
+If the rx-offload skb_queue is full or the skb allocation fails (due to OOM),
+the mailbox contents is discarded.
+
+This patch adds the incrementing of the rx_fifo_errors statistics counter.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index bdc27481b57f9..e224530a06300 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -125,8 +125,10 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload
+
+ ret = offload->mailbox_read(offload, &cf_overflow,
+ ×tamp, n);
+- if (ret)
++ if (ret) {
+ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++ }
+
+ return NULL;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0edfe975e13425fe6dc53814f5cc10615d34a59b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 21:00:32 +0200
+Subject: can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to
+ propagate error value in case of errors
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit d763ab3044f0bf50bd0e6179f6b2cf1c125d1d94 ]
+
+Before this patch can_rx_offload_offload_one() returns a pointer to a
+skb containing the read CAN frame or a NULL pointer.
+
+However the meaning of the NULL pointer is ambiguous, it can either mean
+the requested mailbox is empty or there was an error.
+
+This patch fixes this situation by returning:
+- pointer to skb on success
+- NULL pointer if mailbox is empty
+- ERR_PTR() in case of an error
+
+All users of can_rx_offload_offload_one() have been adopted, no
+functional change intended.
+
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 86 ++++++++++++++++++++++++++++++------
+ 1 file changed, 73 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index e224530a06300..3f5e040f0c712 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -107,39 +107,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b)
+ return cb_b->timestamp - cb_a->timestamp;
+ }
+
+-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
++/**
++ * can_rx_offload_offload_one() - Read one CAN frame from HW
++ * @offload: pointer to rx_offload context
++ * @n: number of mailbox to read
++ *
++ * The task of this function is to read a CAN frame from mailbox @n
++ * from the device and return the mailbox's content as a struct
++ * sk_buff.
++ *
++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue
++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be
++ * allocated, the mailbox contents is discarded by reading it into an
++ * overflow buffer. This way the mailbox is marked as free by the
++ * driver.
++ *
++ * Return: A pointer to skb containing the CAN frame on success.
++ *
++ * NULL if the mailbox @n is empty.
++ *
++ * ERR_PTR() in case of an error
++ */
++static struct sk_buff *
++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n)
+ {
+- struct sk_buff *skb = NULL;
++ struct sk_buff *skb = NULL, *skb_error = NULL;
+ struct can_rx_offload_cb *cb;
+ struct can_frame *cf;
+ int ret;
+
+- /* If queue is full or skb not available, read to discard mailbox */
+ if (likely(skb_queue_len(&offload->skb_queue) <
+- offload->skb_queue_len_max))
++ offload->skb_queue_len_max)) {
+ skb = alloc_can_skb(offload->dev, &cf);
++ if (unlikely(!skb))
++ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */
++ } else {
++ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */
++ }
+
+- if (!skb) {
++ /* If queue is full or skb not available, drop by reading into
++ * overflow buffer.
++ */
++ if (unlikely(skb_error)) {
+ struct can_frame cf_overflow;
+ u32 timestamp;
+
+ ret = offload->mailbox_read(offload, &cf_overflow,
+ ×tamp, n);
+- if (ret) {
+- offload->dev->stats.rx_dropped++;
+- offload->dev->stats.rx_fifo_errors++;
+- }
+
+- return NULL;
++ /* Mailbox was empty. */
++ if (unlikely(!ret))
++ return NULL;
++
++ /* Mailbox has been read and we're dropping it or
++ * there was a problem reading the mailbox.
++ *
++ * Increment error counters in any case.
++ */
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ /* There was a problem reading the mailbox, propagate
++ * error value.
++ */
++ if (unlikely(ret < 0))
++ return ERR_PTR(ret);
++
++ return skb_error;
+ }
+
+ cb = can_rx_offload_get_cb(skb);
+ ret = offload->mailbox_read(offload, cf, &cb->timestamp, n);
+- if (!ret) {
++
++ /* Mailbox was empty. */
++ if (unlikely(!ret)) {
+ kfree_skb(skb);
+ return NULL;
+ }
+
++ /* There was a problem reading the mailbox, propagate error value. */
++ if (unlikely(ret < 0)) {
++ kfree_skb(skb);
++
++ offload->dev->stats.rx_dropped++;
++ offload->dev->stats.rx_fifo_errors++;
++
++ return ERR_PTR(ret);
++ }
++
++ /* Mailbox was read. */
+ return skb;
+ }
+
+@@ -159,7 +215,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen
+ continue;
+
+ skb = can_rx_offload_offload_one(offload, i);
+- if (!skb)
++ if (IS_ERR_OR_NULL(skb))
+ break;
+
+ __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare);
+@@ -190,7 +246,11 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload)
+ struct sk_buff *skb;
+ int received = 0;
+
+- while ((skb = can_rx_offload_offload_one(offload, 0))) {
++ while (1) {
++ skb = can_rx_offload_offload_one(offload, 0);
++ if (IS_ERR_OR_NULL(skb))
++ break;
++
+ skb_queue_tail(&offload->skb_queue, skb);
+ received++;
+ }
+--
+2.20.1
+
--- /dev/null
+From ff1b45a76b42e697278769f877872d97552662d2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:48:48 +0200
+Subject: can: rx-offload: can_rx_offload_queue_tail(): fix error handling,
+ avoid skb mem leak
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+[ Upstream commit 6caf8a6d6586d44fd72f4aa1021d14aa82affafb ]
+
+If the rx-offload skb_queue is full can_rx_offload_queue_tail() will not
+queue the skb and return with an error.
+
+This patch frees the skb in case of a full queue, which brings
+can_rx_offload_queue_tail() in line with the
+can_rx_offload_queue_sorted() function, which has been adjusted in the
+previous patch.
+
+The return value is adjusted to -ENOBUFS to better reflect the actual
+problem.
+
+The device stats handling is left to the caller.
+
+Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading")
+Reported-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rx-offload.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c
+index 663697439d1c7..d1c8634099450 100644
+--- a/drivers/net/can/rx-offload.c
++++ b/drivers/net/can/rx-offload.c
+@@ -252,8 +252,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload,
+ struct sk_buff *skb)
+ {
+ if (skb_queue_len(&offload->skb_queue) >
+- offload->skb_queue_len_max)
+- return -ENOMEM;
++ offload->skb_queue_len_max) {
++ kfree_skb(skb);
++ return -ENOBUFS;
++ }
+
+ skb_queue_tail(&offload->skb_queue, skb);
+ can_rx_offload_schedule(offload);
+--
+2.20.1
+
--- /dev/null
+From 9d2967f848025d777acf0a34ed876154a8f22213 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 09:39:32 -0500
+Subject: ceph: return -EINVAL if given fsc mount option on kernel w/o support
+
+From: Jeff Layton <jlayton@kernel.org>
+
+[ Upstream commit ff29fde84d1fc82f233c7da0daa3574a3942bec7 ]
+
+If someone requests fscache on the mount, and the kernel doesn't
+support it, it should fail the mount.
+
+[ Drop ceph prefix -- it's provided by pr_err. ]
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ceph/super.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index ab4868c7308ec..b565c55ed0648 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -255,6 +255,7 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ break;
+ case Opt_fscache_uniq:
++#ifdef CONFIG_CEPH_FSCACHE
+ kfree(fsopt->fscache_uniq);
+ fsopt->fscache_uniq = kstrndup(argstr[0].from,
+ argstr[0].to-argstr[0].from,
+@@ -263,7 +264,10 @@ static int parse_fsopt_token(char *c, void *private)
+ return -ENOMEM;
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ break;
+- /* misc */
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_wsize:
+ if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE)
+ return -EINVAL;
+@@ -340,10 +344,15 @@ static int parse_fsopt_token(char *c, void *private)
+ fsopt->flags &= ~CEPH_MOUNT_OPT_INO32;
+ break;
+ case Opt_fscache:
++#ifdef CONFIG_CEPH_FSCACHE
+ fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE;
+ kfree(fsopt->fscache_uniq);
+ fsopt->fscache_uniq = NULL;
+ break;
++#else
++ pr_err("fscache support is disabled\n");
++ return -EINVAL;
++#endif
+ case Opt_nofscache:
+ fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE;
+ kfree(fsopt->fscache_uniq);
+--
+2.20.1
+
--- /dev/null
+From 3f15ee676b5610a11256b19fa4a6b2ef68fd4bcc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Sep 2019 17:39:06 +0200
+Subject: clk: at91: avoid sleeping early
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Alexandre Belloni <alexandre.belloni@bootlin.com>
+
+[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ]
+
+It is not allowed to sleep to early in the boot process and this may lead
+to kernel issues if the bootloader didn't prepare the slow clock and main
+clock.
+
+This results in the following error and dump stack on the AriettaG25:
+ bad: scheduling from the idle thread!
+
+Ensure it is possible to sleep, else simply have a delay.
+
+Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com
+Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver")
+Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/clk-main.c | 5 ++++-
+ drivers/clk/at91/sckc.c | 20 ++++++++++++++++----
+ 2 files changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
+index 311cea0c3ae2b..54b2b2dd2bb57 100644
+--- a/drivers/clk/at91/clk-main.c
++++ b/drivers/clk/at91/clk-main.c
+@@ -297,7 +297,10 @@ static int clk_main_probe_frequency(struct regmap *regmap)
+ regmap_read(regmap, AT91_CKGR_MCFR, &mcfr);
+ if (mcfr & AT91_PMC_MAINRDY)
+ return 0;
+- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(MAINF_LOOP_MIN_WAIT);
++ else
++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+ } while (time_before(prep_time, timeout));
+
+ return -ETIMEDOUT;
+diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c
+index 9bfe9a28294a7..fac0ca56d42d9 100644
+--- a/drivers/clk/at91/sckc.c
++++ b/drivers/clk/at91/sckc.c
+@@ -76,7 +76,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw)
+
+ writel(tmp | osc->bits->cr_osc32en, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -187,7 +190,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw)
+
+ writel(readl(sckcr) | osc->bits->cr_rcen, sckcr);
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+
+ return 0;
+ }
+@@ -288,7 +294,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index)
+
+ writel(tmp, sckcr);
+
+- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(SLOWCK_SW_TIME_USEC);
++ else
++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+
+ return 0;
+ }
+@@ -533,7 +542,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw)
+ return 0;
+ }
+
+- usleep_range(osc->startup_usec, osc->startup_usec + 1);
++ if (system_state < SYSTEM_RUNNING)
++ udelay(osc->startup_usec);
++ else
++ usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ osc->prepared = true;
+
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From 4a6167374b8748547e44d994990d4c5825fa912c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Sep 2019 10:39:09 +0000
+Subject: clk: at91: sam9x60: fix programmable clock
+
+From: Eugen Hristev <eugen.hristev@microchip.com>
+
+[ Upstream commit 2200ab6a7403f4fcd052c55ca328fc942f9392b6 ]
+
+The prescaler mask for sam9x60 must be 0xff (8 bits).
+Being set to 0, means that we cannot set any prescaler, thus the
+programmable clocks do not work (except the case with prescaler 0)
+Set the mask accordingly in layout struct.
+
+Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver")
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Link: https://lkml.kernel.org/r/1569321191-27606-1-git-send-email-eugen.hristev@microchip.com
+Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/at91/sam9x60.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c
+index 9790ddfa5b3cb..86238d5ecb4da 100644
+--- a/drivers/clk/at91/sam9x60.c
++++ b/drivers/clk/at91/sam9x60.c
+@@ -43,6 +43,7 @@ static const struct clk_pll_characteristics upll_characteristics = {
+ };
+
+ static const struct clk_programmable_layout sam9x60_programmable_layout = {
++ .pres_mask = 0xff,
+ .pres_shift = 8,
+ .css_mask = 0x1f,
+ .have_slck_mck = 0,
+--
+2.20.1
+
--- /dev/null
+From a896f30d4be55e1d79bf22097a0338f779d4a940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 21 Sep 2019 17:04:11 +0200
+Subject: clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate
+
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+
+[ Upstream commit 44b09b11b813b8550e6b976ea51593bc23bba8d1 ]
+
+The meson-saradc driver manually sets the input clock for
+sar_adc_clk_sel. Update the GXBB clock driver (which is used on GXBB,
+GXL and GXM) so the rate settings on sar_adc_clk_div are propagated up
+to sar_adc_clk_sel which will let the common clock framework select the
+best matching parent clock if we want that.
+
+This makes sar_adc_clk_div consistent with the axg-aoclk and g12a-aoclk
+drivers, which both also specify CLK_SET_RATE_PARENT.
+
+Fixes: 33d0fcdfe0e870 ("clk: gxbb: add the SAR ADC clocks and expose them")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/meson/gxbb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c
+index dab16d9b1af8b..9834eb2c1b674 100644
+--- a/drivers/clk/meson/gxbb.c
++++ b/drivers/clk/meson/gxbb.c
+@@ -866,6 +866,7 @@ static struct clk_regmap gxbb_sar_adc_clk_div = {
+ .ops = &clk_regmap_divider_ops,
+ .parent_names = (const char *[]){ "sar_adc_clk_sel" },
+ .num_parents = 1,
++ .flags = CLK_SET_RATE_PARENT,
+ },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 4dc2085522eb08551f4020245a2e8e6ebde48ff4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 11:02:01 +0200
+Subject: clk: samsung: exynos5420: Preserve PLL configuration during
+ suspend/resume
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ]
+
+Properly save and restore all top PLL related configuration registers
+during suspend/resume cycle. So far driver only handled EPLL and RPLL
+clocks, all other were reset to default values after suspend/resume cycle.
+This caused for example lower G3D (MALI Panfrost) performance after system
+resume, even if performance governor has been selected.
+
+Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index dfa862d55246e..31466cd1842f8 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -165,12 +165,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = {
+ GATE_BUS_CPU,
+ GATE_SCLK_CPU,
+ CLKOUT_CMU_CPU,
++ CPLL_CON0,
++ DPLL_CON0,
+ EPLL_CON0,
+ EPLL_CON1,
+ EPLL_CON2,
+ RPLL_CON0,
+ RPLL_CON1,
+ RPLL_CON2,
++ IPLL_CON0,
++ SPLL_CON0,
++ VPLL_CON0,
++ MPLL_CON0,
+ SRC_TOP0,
+ SRC_TOP1,
+ SRC_TOP2,
+--
+2.20.1
+
--- /dev/null
+From af66b74cc6d04c5432f1ef7a569b3e59c352923f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 09:41:18 +0200
+Subject: clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit c9f7567aff31348a3dcf54845f7e389f5df0c0c1 ]
+
+G3D clocks require special handling of their parent bus clock during power
+domain on/off sequences. Those clocks were not initially added to the
+sub-CMU handler, because that time there was no open-source driver for the
+G3D (MALI Panfrost) hardware module and it was not possible to test it.
+
+This patch fixes this issue. Parent clock for G3D hardware block is now
+properly preserved during G3D power domain on/off sequence. This restores
+proper MALI Panfrost performance broken by commit 8686764fc071
+("ARM: dts: exynos: Add G3D power domain to Exynos542x").
+
+Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Fixes: b06a532bf1fa ("clk: samsung: Add Exynos5 sub-CMU clock driver")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Tested-by: Marian Mihailescu <mihailescu2m@gmail.com>
+Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5420.c | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c
+index 7670cc596c742..dfa862d55246e 100644
+--- a/drivers/clk/samsung/clk-exynos5420.c
++++ b/drivers/clk/samsung/clk-exynos5420.c
+@@ -1172,8 +1172,6 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = {
+ GATE(CLK_SCLK_ISP_SENSOR2, "sclk_isp_sensor2", "dout_isp_sensor2",
+ GATE_TOP_SCLK_ISP, 12, CLK_SET_RATE_PARENT, 0),
+
+- GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0),
+-
+ /* CDREX */
+ GATE(CLK_CLKM_PHY0, "clkm_phy0", "dout_sclk_cdrex",
+ GATE_BUS_CDREX0, 0, 0, 0),
+@@ -1248,6 +1246,15 @@ static struct exynos5_subcmu_reg_dump exynos5x_gsc_suspend_regs[] = {
+ { DIV2_RATIO0, 0, 0x30 }, /* DIV dout_gscl_blk_300 */
+ };
+
++static const struct samsung_gate_clock exynos5x_g3d_gate_clks[] __initconst = {
++ GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0),
++};
++
++static struct exynos5_subcmu_reg_dump exynos5x_g3d_suspend_regs[] = {
++ { GATE_IP_G3D, 0x3ff, 0x3ff }, /* G3D gates */
++ { SRC_TOP5, 0, BIT(16) }, /* MUX mout_user_aclk_g3d */
++};
++
+ static const struct samsung_div_clock exynos5x_mfc_div_clks[] __initconst = {
+ DIV(0, "dout_mfc_blk", "mout_user_aclk333", DIV4_RATIO, 0, 2),
+ };
+@@ -1320,6 +1327,14 @@ static const struct exynos5_subcmu_info exynos5x_gsc_subcmu = {
+ .pd_name = "GSC",
+ };
+
++static const struct exynos5_subcmu_info exynos5x_g3d_subcmu = {
++ .gate_clks = exynos5x_g3d_gate_clks,
++ .nr_gate_clks = ARRAY_SIZE(exynos5x_g3d_gate_clks),
++ .suspend_regs = exynos5x_g3d_suspend_regs,
++ .nr_suspend_regs = ARRAY_SIZE(exynos5x_g3d_suspend_regs),
++ .pd_name = "G3D",
++};
++
+ static const struct exynos5_subcmu_info exynos5x_mfc_subcmu = {
+ .div_clks = exynos5x_mfc_div_clks,
+ .nr_div_clks = ARRAY_SIZE(exynos5x_mfc_div_clks),
+@@ -1351,6 +1366,7 @@ static const struct exynos5_subcmu_info exynos5800_mau_subcmu = {
+ static const struct exynos5_subcmu_info *exynos5x_subcmus[] = {
+ &exynos5x_disp_subcmu,
+ &exynos5x_gsc_subcmu,
++ &exynos5x_g3d_subcmu,
+ &exynos5x_mfc_subcmu,
+ &exynos5x_mscl_subcmu,
+ };
+@@ -1358,6 +1374,7 @@ static const struct exynos5_subcmu_info *exynos5x_subcmus[] = {
+ static const struct exynos5_subcmu_info *exynos5800_subcmus[] = {
+ &exynos5x_disp_subcmu,
+ &exynos5x_gsc_subcmu,
++ &exynos5x_g3d_subcmu,
+ &exynos5x_mfc_subcmu,
+ &exynos5x_mscl_subcmu,
+ &exynos5800_mau_subcmu,
+--
+2.20.1
+
--- /dev/null
+From d71648b3355643772480e725701af8d3a21f25c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 10:53:09 +0200
+Subject: clk: samsung: exynos5433: Fix error paths
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit faac3604d05e8015567124e5ee79edc3f1568a89 ]
+
+Add checking the value returned by samsung_clk_alloc_reg_dump() and
+devm_kcalloc(). While fixing this, also release all gathered clocks.
+
+Fixes: 523d3de41f02 ("clk: samsung: exynos5433: Add support for runtime PM")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
+Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
+[s.nawrocki: squashed patch from K. Kozlowski adding missing slab.h header]
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/samsung/clk-exynos5433.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c
+index 7824c2ba3d8e6..4b1aa9382ad28 100644
+--- a/drivers/clk/samsung/clk-exynos5433.c
++++ b/drivers/clk/samsung/clk-exynos5433.c
+@@ -13,6 +13,7 @@
+ #include <linux/of_device.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
++#include <linux/slab.h>
+
+ #include <dt-bindings/clock/exynos5433.h>
+
+@@ -5584,6 +5585,8 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+
+ data->clk_save = samsung_clk_alloc_reg_dump(info->clk_regs,
+ info->nr_clk_regs);
++ if (!data->clk_save)
++ return -ENOMEM;
+ data->nr_clk_save = info->nr_clk_regs;
+ data->clk_suspend = info->suspend_regs;
+ data->nr_clk_suspend = info->nr_suspend_regs;
+@@ -5592,12 +5595,19 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev)
+ if (data->nr_pclks > 0) {
+ data->pclks = devm_kcalloc(dev, sizeof(struct clk *),
+ data->nr_pclks, GFP_KERNEL);
+-
++ if (!data->pclks) {
++ kfree(data->clk_save);
++ return -ENOMEM;
++ }
+ for (i = 0; i < data->nr_pclks; i++) {
+ struct clk *clk = of_clk_get(dev->of_node, i);
+
+- if (IS_ERR(clk))
++ if (IS_ERR(clk)) {
++ kfree(data->clk_save);
++ while (--i >= 0)
++ clk_put(data->pclks[i]);
+ return PTR_ERR(clk);
++ }
+ data->pclks[i] = clk;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 3245a9222278994c94cdb8ef6637ba035151c0e3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 09:50:54 -0700
+Subject: clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit afdc74ed2d57e86c10b1d6831339770a802bab9a ]
+
+r375326 in Clang exposes an issue with operator precedence in
+sunxi_div_clk_setup:
+
+drivers/clk/sunxi/clk-sunxi.c:1083:30: warning: operator '?:' has lower
+precedence than '|'; '|' will be evaluated first
+[-Wbitwise-conditional-parentheses]
+ data->div[i].critical ?
+ ~~~~~~~~~~~~~~~~~~~~~ ^
+drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
+the '|' expression to silence this warning
+ data->div[i].critical ?
+ ^
+ )
+drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around
+the '?:' expression to evaluate it first
+ data->div[i].critical ?
+ ^
+ (
+1 warning generated.
+
+It appears that the intention was for ?: to be evaluated first so that
+CLK_IS_CRITICAL could be added to clkflags if the critical boolean was
+set; right now, | is being evaluated first. Add parentheses around the
+?: block to have it be evaluated first.
+
+Fixes: 9919d44ff297 ("clk: sunxi: Use CLK_IS_CRITICAL flag for critical clks")
+Link: https://github.com/ClangBuiltLinux/linux/issues/745
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi/clk-sunxi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c
+index d3a43381a7927..27201fd26e442 100644
+--- a/drivers/clk/sunxi/clk-sunxi.c
++++ b/drivers/clk/sunxi/clk-sunxi.c
+@@ -1080,8 +1080,8 @@ static struct clk ** __init sunxi_divs_clk_setup(struct device_node *node,
+ rate_hw, rate_ops,
+ gate_hw, &clk_gate_ops,
+ clkflags |
+- data->div[i].critical ?
+- CLK_IS_CRITICAL : 0);
++ (data->div[i].critical ?
++ CLK_IS_CRITICAL : 0));
+
+ WARN_ON(IS_ERR(clk_data->clks[i]));
+ }
+--
+2.20.1
+
--- /dev/null
+From 88b2dcd84417ec945f3ba33ee72ed35718e758de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 12:28:09 +0100
+Subject: clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit cdfc2e2086bf9c465f44e2db25561373b084a113 ]
+
+The zero'ing of bits 16 and 18 is incorrect. Currently the code
+is masking with the bitwise-and of BIT(16) & BIT(18) which is
+0, so the updated value for val is always zero. Fix this by bitwise
+and-ing value with the correct mask that will zero bits 16 and 18.
+
+Addresses-Coverity: (" Suspicious &= or |= constant expression")
+Fixes: b8eb71dcdd08 ("clk: sunxi-ng: Add A80 CCU")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Maxime Ripard <mripard@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun9i-a80.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+index dcac1391767f6..ef29582676f6e 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c
+@@ -1224,7 +1224,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev)
+
+ /* Enforce d1 = 0, d2 = 0 for Audio PLL */
+ val = readl(reg + SUN9I_A80_PLL_AUDIO_REG);
+- val &= (BIT(16) & BIT(18));
++ val &= ~(BIT(16) | BIT(18));
+ writel(val, reg + SUN9I_A80_PLL_AUDIO_REG);
+
+ /* Enforce P = 1 for both CPU cluster PLLs */
+--
+2.20.1
+
--- /dev/null
+From f6d656d4a1a3ef9a5ddf61a006ef1f0fb66b1ddd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 30 Sep 2019 08:40:01 -0700
+Subject: clk: ti: clkctrl: Fix failed to enable error with double udelay
+ timeout
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit 81a41901ffd46bac6df4c95b8290ac259e0feda8 ]
+
+Commit 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if
+timekeeping is suspended") added handling for cases when timekeeping is
+suspended. But looks like we can still get occasional "failed to enable"
+errors on the PM runtime resume path with udelay() returning faster than
+expected.
+
+With ti-sysc interconnect target module driver this leads into device
+failure with PM runtime failing with "failed to enable" clkctrl error.
+
+Let's fix the issue with a delay of two times the desired delay as in
+often done for udelay() to account for the inaccuracy.
+
+Fixes: 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if timekeeping is suspended")
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Tero Kristo <t-kristo@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Link: https://lkml.kernel.org/r/20190930154001.46581-1-tony@atomide.com
+Tested-by: Keerthy <j-keerthy@ti.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clkctrl.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c
+index 975995eea15cb..b0c0690a5a121 100644
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -100,11 +100,12 @@ static bool _omap4_is_timeout(union omap4_timeout *time, u32 timeout)
+ * can be from a timer that requires pm_runtime access, which
+ * will eventually bring us here with timekeeping_suspended,
+ * during both suspend entry and resume paths. This happens
+- * at least on am43xx platform.
++ * at least on am43xx platform. Account for flakeyness
++ * with udelay() by multiplying the timeout value by 2.
+ */
+ if (unlikely(_early_timeout || timekeeping_suspended)) {
+ if (time->cycles++ < timeout) {
+- udelay(1);
++ udelay(1 * 2);
+ return false;
+ }
+ } else {
+--
+2.20.1
+
--- /dev/null
+From f9b3ad804a214665cd6516603c958d2b4a03f725 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 2 Oct 2019 11:34:36 +0300
+Subject: clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+[ Upstream commit 9982b0f69b49931b652d35f86f519be2ccfc7027 ]
+
+ti_clk_register() calls it already so the driver should not create
+duplicated alias.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lkml.kernel.org/r/20191002083436.10194-1-peter.ujfalusi@ti.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/ti/clk-dra7-atl.c | 6 ------
+ 1 file changed, 6 deletions(-)
+
+diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
+index a01ca9395179a..f65e16c4f3c4b 100644
+--- a/drivers/clk/ti/clk-dra7-atl.c
++++ b/drivers/clk/ti/clk-dra7-atl.c
+@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ struct clk_init_data init = { NULL };
+ const char **parent_names = NULL;
+ struct clk *clk;
+- int ret;
+
+ clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL);
+ if (!clk_hw) {
+@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node)
+ clk = ti_clk_register(NULL, &clk_hw->hw, node->name);
+
+ if (!IS_ERR(clk)) {
+- ret = ti_clk_add_alias(NULL, clk, node->name);
+- if (ret) {
+- clk_unregister(clk);
+- goto cleanup;
+- }
+ of_clk_add_provider(node, of_clk_src_simple_get, clk);
+ kfree(parent_names);
+ return;
+--
+2.20.1
+
--- /dev/null
+From 21bbe7dadbfd43ac6006fdc81d995c141bcd103a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 21:13:15 +0200
+Subject: clocksource/drivers/mediatek: Fix error handling
+
+From: Fabien Parent <fparent@baylibre.com>
+
+[ Upstream commit 41d49e7939de5ec532d86494185b2ca2e99c848a ]
+
+When timer_of_init fails, it cleans up after itself by undoing
+everything it did during the initialization function.
+
+mtk_syst_init and mtk_gpt_init both call timer_of_cleanup if
+timer_of_init fails. timer_of_cleanup try to release the resource
+taken. Since these resources have already been cleaned up by
+timer_of_init, we end up getting a few warnings printed:
+
+[ 0.001935] WARNING: CPU: 0 PID: 0 at __clk_put+0xe8/0x128
+[ 0.002650] Modules linked in:
+[ 0.003058] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.67+ #1
+[ 0.003852] Hardware name: MediaTek MT8183 (DT)
+[ 0.004446] pstate: 20400085 (nzCv daIf +PAN -UAO)
+[ 0.005073] pc : __clk_put+0xe8/0x128
+[ 0.005555] lr : clk_put+0xc/0x14
+[ 0.005988] sp : ffffff80090b3ea0
+[ 0.006422] x29: ffffff80090b3ea0 x28: 0000000040e20018
+[ 0.007121] x27: ffffffc07bfff780 x26: 0000000000000001
+[ 0.007819] x25: ffffff80090bda80 x24: ffffff8008ec5828
+[ 0.008517] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
+[ 0.009216] x21: 0000000000000001 x20: fffffffffffffdfb
+[ 0.009914] x19: ffffff8009166180 x18: 00000000002bffa8
+[ 0.010612] x17: ffffffc012996980 x16: 0000000000000000
+[ 0.011311] x15: ffffffbf004a6800 x14: 3536343038393334
+[ 0.012009] x13: 2079726576652073 x12: 7eb9c62c5c38f100
+[ 0.012707] x11: ffffff80090b3ba0 x10: ffffff80090b3ba0
+[ 0.013405] x9 : 0000000000000004 x8 : 0000000000000040
+[ 0.014103] x7 : ffffffc079400270 x6 : 0000000000000000
+[ 0.014801] x5 : ffffffc079400248 x4 : 0000000000000000
+[ 0.015499] x3 : 0000000000000000 x2 : 0000000000000000
+[ 0.016197] x1 : ffffff80091661c0 x0 : fffffffffffffdfb
+[ 0.016896] Call trace:
+[ 0.017218] __clk_put+0xe8/0x128
+[ 0.017654] clk_put+0xc/0x14
+[ 0.018048] timer_of_cleanup+0x60/0x7c
+[ 0.018551] mtk_syst_init+0x8c/0x9c
+[ 0.019020] timer_probe+0x6c/0xe0
+[ 0.019469] time_init+0x14/0x44
+[ 0.019893] start_kernel+0x2d0/0x46c
+[ 0.020378] ---[ end trace 8c1efabea1267649 ]---
+[ 0.020982] ------------[ cut here ]------------
+[ 0.021586] Trying to vfree() nonexistent vm area ((____ptrval____))
+[ 0.022427] WARNING: CPU: 0 PID: 0 at __vunmap+0xd0/0xd8
+[ 0.023119] Modules linked in:
+[ 0.023524] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 4.19.67+ #1
+[ 0.024498] Hardware name: MediaTek MT8183 (DT)
+[ 0.025091] pstate: 60400085 (nZCv daIf +PAN -UAO)
+[ 0.025718] pc : __vunmap+0xd0/0xd8
+[ 0.026176] lr : __vunmap+0xd0/0xd8
+[ 0.026632] sp : ffffff80090b3e90
+[ 0.027066] x29: ffffff80090b3e90 x28: 0000000040e20018
+[ 0.027764] x27: ffffffc07bfff780 x26: 0000000000000001
+[ 0.028462] x25: ffffff80090bda80 x24: ffffff8008ec5828
+[ 0.029160] x23: ffffff80090bd000 x22: ffffff8008d8b2e8
+[ 0.029858] x21: 0000000000000000 x20: 0000000000000000
+[ 0.030556] x19: ffffff800800d000 x18: 00000000002bffa8
+[ 0.031254] x17: 0000000000000000 x16: 0000000000000000
+[ 0.031952] x15: ffffffbf004a6800 x14: 3536343038393334
+[ 0.032651] x13: 2079726576652073 x12: 7eb9c62c5c38f100
+[ 0.033349] x11: ffffff80090b3b40 x10: ffffff80090b3b40
+[ 0.034047] x9 : 0000000000000005 x8 : 5f5f6c6176727470
+[ 0.034745] x7 : 5f5f5f5f28282061 x6 : ffffff80091c86ef
+[ 0.035443] x5 : ffffff800852b690 x4 : 0000000000000000
+[ 0.036141] x3 : 0000000000000002 x2 : 0000000000000002
+[ 0.036839] x1 : 7eb9c62c5c38f100 x0 : 7eb9c62c5c38f100
+[ 0.037536] Call trace:
+[ 0.037859] __vunmap+0xd0/0xd8
+[ 0.038271] vunmap+0x24/0x30
+[ 0.038664] __iounmap+0x2c/0x34
+[ 0.039088] timer_of_cleanup+0x70/0x7c
+[ 0.039591] mtk_syst_init+0x8c/0x9c
+[ 0.040060] timer_probe+0x6c/0xe0
+[ 0.040507] time_init+0x14/0x44
+[ 0.040932] start_kernel+0x2d0/0x46c
+
+This commit remove the calls to timer_of_cleanup when timer_of_init
+fails since it is unnecessary and actually cause warnings to be printed.
+
+Fixes: a0858f937960 ("mediatek: Convert the driver to timer-of")
+Signed-off-by: Fabien Parent <fparent@baylibre.com>
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+Link: https://lore.kernel.org/linux-arm-kernel/20190919191315.25190-1-fparent@baylibre.com/
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clocksource/timer-mediatek.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c
+index a562f491b0f8d..9318edcd89635 100644
+--- a/drivers/clocksource/timer-mediatek.c
++++ b/drivers/clocksource/timer-mediatek.c
+@@ -268,15 +268,12 @@ static int __init mtk_syst_init(struct device_node *node)
+
+ ret = timer_of_init(node, &to);
+ if (ret)
+- goto err;
++ return ret;
+
+ clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
+ TIMER_SYNC_TICKS, 0xffffffff);
+
+ return 0;
+-err:
+- timer_of_cleanup(&to);
+- return ret;
+ }
+
+ static int __init mtk_gpt_init(struct device_node *node)
+@@ -293,7 +290,7 @@ static int __init mtk_gpt_init(struct device_node *node)
+
+ ret = timer_of_init(node, &to);
+ if (ret)
+- goto err;
++ return ret;
+
+ /* Configure clock source */
+ mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN);
+@@ -311,9 +308,6 @@ static int __init mtk_gpt_init(struct device_node *node)
+ mtk_gpt_enable_irq(&to, TIMER_CLK_EVT);
+
+ return 0;
+-err:
+- timer_of_cleanup(&to);
+- return ret;
+ }
+ TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init);
+ TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init);
+--
+2.20.1
+
--- /dev/null
+From 09e8dbba9e3823bf89792dc99c37ae7180ad6b56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 18:16:38 +0800
+Subject: drm/amd/swSMU: fix smu workload bit map error
+
+From: Kevin Wang <kevin1.wang@amd.com>
+
+[ Upstream commit 38264de0dce80d223f358ce47512378fae0de586 ]
+
+fix workload bit (WORKLOAD_PPLIB_COMPUTE_BIT) map error
+on vega20 and navi asic.
+
+fix commit:
+drm/amd/powerplay: add function get_workload_type_map for swsmu
+
+Signed-off-by: Kevin Wang <kevin1.wang@amd.com>
+Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/navi10_ppt.c | 2 +-
+ drivers/gpu/drm/amd/powerplay/vega20_ppt.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
+index 8bf9f541e7fe7..a0ef44d025d61 100644
+--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
++++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c
+@@ -205,7 +205,7 @@ static int navi10_workload_map[] = {
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING, WORKLOAD_PPLIB_POWER_SAVING_BIT),
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO, WORKLOAD_PPLIB_VIDEO_BIT),
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR, WORKLOAD_PPLIB_VR_BIT),
+- WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_CUSTOM_BIT),
++ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_COMPUTE_BIT),
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM, WORKLOAD_PPLIB_CUSTOM_BIT),
+ };
+
+diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
+index 6a14497257e43..33ca6c581f219 100644
+--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
++++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c
+@@ -219,7 +219,7 @@ static int vega20_workload_map[] = {
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING, WORKLOAD_PPLIB_POWER_SAVING_BIT),
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO, WORKLOAD_PPLIB_VIDEO_BIT),
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR, WORKLOAD_PPLIB_VR_BIT),
+- WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_CUSTOM_BIT),
++ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_COMPUTE_BIT),
+ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM, WORKLOAD_PPLIB_CUSTOM_BIT),
+ };
+
+--
+2.20.1
+
--- /dev/null
+From e648d5b4bfd24488027d171145a8eec24d99ea2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 18:29:12 +0800
+Subject: drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: changzhu <Changfeng.Zhu@amd.com>
+
+[ Upstream commit 440a7a54e7ec012ec8b27c27e460dfd6f9a24ddb ]
+
+It needs to add warning to update firmware in gfx9
+in case that firmware is too old to have function to
+realize dummy read in cp firmware.
+
+Signed-off-by: changzhu <Changfeng.Zhu@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+index 75faa56f243a4..b1388d3e72f74 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+@@ -538,6 +538,13 @@ static void gfx_v9_0_check_fw_write_wait(struct amdgpu_device *adev)
+ adev->gfx.me_fw_write_wait = false;
+ adev->gfx.mec_fw_write_wait = false;
+
++ if ((adev->gfx.mec_fw_version < 0x000001a5) ||
++ (adev->gfx.mec_feature_version < 46) ||
++ (adev->gfx.pfp_fw_version < 0x000000b7) ||
++ (adev->gfx.pfp_feature_version < 46))
++ DRM_WARN_ONCE("Warning: check cp_fw_version and update it to realize \
++ GRBM requires 1-cycle delay in cp firmware\n");
++
+ switch (adev->asic_type) {
+ case CHIP_VEGA10:
+ if ((adev->gfx.me_fw_version >= 0x0000009c) &&
+--
+2.20.1
+
--- /dev/null
+From 8dea04a7af55ceb2593a9ccb2cab876bbb2872c0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 14:20:46 +0530
+Subject: drm/amdgpu: dont schedule jobs while in reset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Shirish S <shirish.s@amd.com>
+
+[ Upstream commit f2efc6e60089c99c342a6b7da47f1037e06c4296 ]
+
+[Why]
+
+doing kthread_park()/unpark() from drm_sched_entity_fini
+while GPU reset is in progress defeats all the purpose of
+drm_sched_stop->kthread_park.
+If drm_sched_entity_fini->kthread_unpark() happens AFTER
+drm_sched_stop->kthread_park nothing prevents from another
+(third) thread to keep submitting job to HW which will be
+picked up by the unparked scheduler thread and try to submit
+to HW but fail because the HW ring is deactivated.
+
+[How]
+grab the reset lock before calling drm_sched_entity_fini()
+
+Signed-off-by: Shirish S <shirish.s@amd.com>
+Suggested-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Andrey Grodzovsky <andrey.grodzovsky@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+index 7398b4850649b..b7633484d15f2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c
+@@ -597,8 +597,11 @@ void amdgpu_ctx_mgr_entity_fini(struct amdgpu_ctx_mgr *mgr)
+ continue;
+ }
+
+- for (i = 0; i < num_entities; i++)
++ for (i = 0; i < num_entities; i++) {
++ mutex_lock(&ctx->adev->lock_reset);
+ drm_sched_entity_fini(&ctx->entities[0][i].entity);
++ mutex_unlock(&ctx->adev->lock_reset);
++ }
+ }
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0f6298915397d3517c86a80034cb01f6990105a4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 18:13:49 +0800
+Subject: drm/amdgpu: register gpu instance before fan boost feature enablment
+
+From: Evan Quan <evan.quan@amd.com>
+
+[ Upstream commit 6a299d7aaa97dfde5988d8f9e2fa2c046b5793ff ]
+
+Otherwise, the feature enablement will be skipped due to wrong count.
+
+Fixes: beff74bc6e0fa91 ("drm/amdgpu: fix a race in GPU reset with IB test (v2)")
+Signed-off-by: Evan Quan <evan.quan@amd.com>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 1 -
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+index 5a7f893cf7244..2877ce84aef2b 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2788,6 +2788,13 @@ fence_driver_init:
+ DRM_INFO("amdgpu: acceleration disabled, skipping benchmarks\n");
+ }
+
++ /*
++ * Register gpu instance before amdgpu_device_enable_mgpu_fan_boost.
++ * Otherwise the mgpu fan boost feature will be skipped due to the
++ * gpu instance is counted less.
++ */
++ amdgpu_register_gpu_instance(adev);
++
+ /* enable clockgating, etc. after ib tests, etc. since some blocks require
+ * explicit gating rather than handling it automatically.
+ */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+index 65f6619f0c0c4..e531ba9195a0f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -190,7 +190,6 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags)
+ pm_runtime_put_autosuspend(dev->dev);
+ }
+
+- amdgpu_register_gpu_instance(adev);
+ out:
+ if (r) {
+ /* balance pm_runtime_get_sync in amdgpu_driver_unload_kms */
+--
+2.20.1
+
--- /dev/null
+From ccd61312d80450e60121c4b771244abeeaf32edc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 27 Sep 2019 11:47:08 +0200
+Subject: fbdev: c2p: Fix link failure on non-inlining
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+[ Upstream commit b330f3972f4f2a829d41fb9e9b552bec7d73a840 ]
+
+When the compiler decides not to inline the Chunky-to-Planar core
+functions, the build fails with:
+
+ c2p_planar.c:(.text+0xd6): undefined reference to `c2p_unsupported'
+ c2p_planar.c:(.text+0x1dc): undefined reference to `c2p_unsupported'
+ c2p_iplan2.c:(.text+0xc4): undefined reference to `c2p_unsupported'
+ c2p_iplan2.c:(.text+0x150): undefined reference to `c2p_unsupported'
+
+Fix this by marking the functions __always_inline.
+
+While this could be triggered before by manually enabling both
+CONFIG_OPTIMIZE_INLINING and CONFIG_CC_OPTIMIZE_FOR_SIZE, it was exposed
+in the m68k defconfig by commit ac7c3e4ff401b304 ("compiler: enable
+CONFIG_OPTIMIZE_INLINING forcibly").
+
+Fixes: 9012d011660ea5cf ("compiler: allow all arches to enable CONFIG_OPTIMIZE_INLINING")
+Reported-by: noreply@ellerman.id.au
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Reviewed-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190927094708.11563-1-geert@linux-m68k.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/c2p_core.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/video/fbdev/c2p_core.h b/drivers/video/fbdev/c2p_core.h
+index e1035a865fb94..45a6d895a7d72 100644
+--- a/drivers/video/fbdev/c2p_core.h
++++ b/drivers/video/fbdev/c2p_core.h
+@@ -29,7 +29,7 @@ static inline void _transp(u32 d[], unsigned int i1, unsigned int i2,
+
+ extern void c2p_unsupported(void);
+
+-static inline u32 get_mask(unsigned int n)
++static __always_inline u32 get_mask(unsigned int n)
+ {
+ switch (n) {
+ case 1:
+@@ -57,7 +57,7 @@ static inline u32 get_mask(unsigned int n)
+ * Transpose operations on 8 32-bit words
+ */
+
+-static inline void transp8(u32 d[], unsigned int n, unsigned int m)
++static __always_inline void transp8(u32 d[], unsigned int n, unsigned int m)
+ {
+ u32 mask = get_mask(n);
+
+@@ -99,7 +99,7 @@ static inline void transp8(u32 d[], unsigned int n, unsigned int m)
+ * Transpose operations on 4 32-bit words
+ */
+
+-static inline void transp4(u32 d[], unsigned int n, unsigned int m)
++static __always_inline void transp4(u32 d[], unsigned int n, unsigned int m)
+ {
+ u32 mask = get_mask(n);
+
+@@ -126,7 +126,7 @@ static inline void transp4(u32 d[], unsigned int n, unsigned int m)
+ * Transpose operations on 4 32-bit words (reverse order)
+ */
+
+-static inline void transp4x(u32 d[], unsigned int n, unsigned int m)
++static __always_inline void transp4x(u32 d[], unsigned int n, unsigned int m)
+ {
+ u32 mask = get_mask(n);
+
+--
+2.20.1
+
--- /dev/null
+From 39a7d44b1f2811fef7028f6230fa832c610815dc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 06:24:04 -0800
+Subject: i40e: Fix for ethtool -m issue on X722 NIC
+
+From: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+
+[ Upstream commit 4c9da6f2b8a029052c75bd4a61ae229135831177 ]
+
+This patch contains fix for a problem with command:
+'ethtool -m <dev>'
+which breaks functionality of:
+'ethtool <dev>'
+when called on X722 NIC
+
+Disallowed update of link phy_types on X722 NIC
+Currently correct value cannot be obtained from FW
+Previously wrong value returned by FW was used and was
+a root cause for incorrect output of 'ethtool <dev>' command
+
+Signed-off-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_common.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index 906cf68d3453a..4a53bfc017b13 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -1861,7 +1861,8 @@ i40e_status i40e_aq_get_link_info(struct i40e_hw *hw,
+ hw->aq.fw_min_ver < 40)) && hw_link_info->phy_type == 0xE)
+ hw_link_info->phy_type = I40E_PHY_TYPE_10GBASE_SFPP_CU;
+
+- if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE) {
++ if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE &&
++ hw->mac.type != I40E_MAC_X722) {
+ __le32 tmp;
+
+ memcpy(&tmp, resp->link_type, sizeof(tmp));
+--
+2.20.1
+
--- /dev/null
+From 41e4c922e3d0597c173acacfb0428a38ad3d71aa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 04:22:14 -0800
+Subject: iavf: initialize ITRN registers with correct values
+
+From: Nicholas Nunley <nicholas.d.nunley@intel.com>
+
+[ Upstream commit 4eda4e0096842764d725bcfd77471a419832b074 ]
+
+Since commit 92418fb14750 ("i40e/i40evf: Use usec value instead of reg
+value for ITR defines") the driver tracks the interrupt throttling
+intervals in single usec units, although the actual ITRN registers are
+programmed in 2 usec units. Most register programming flows in the driver
+correctly handle the conversion, although it is currently not applied when
+the registers are initialized to their default values. Most of the time
+this doesn't present a problem since the default values are usually
+immediately overwritten through the standard adaptive throttling mechanism,
+or updated manually by the user, but if adaptive throttling is disabled and
+the interval values are left alone then the incorrect value will persist.
+
+Since the intended default interval of 50 usecs (vs. 100 usecs as
+programmed) performs better for most traffic workloads, this can lead to
+performance regressions.
+
+This patch adds the correct conversion when writing the initial values to
+the ITRN registers.
+
+Signed-off-by: Nicholas Nunley <nicholas.d.nunley@intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
+index 9d2b50964a08f..fa857b60ba2b6 100644
+--- a/drivers/net/ethernet/intel/iavf/iavf_main.c
++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
+@@ -336,7 +336,7 @@ iavf_map_vector_to_rxq(struct iavf_adapter *adapter, int v_idx, int r_idx)
+ q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting);
+ q_vector->ring_mask |= BIT(r_idx);
+ wr32(hw, IAVF_VFINT_ITRN1(IAVF_RX_ITR, q_vector->reg_idx),
+- q_vector->rx.current_itr);
++ q_vector->rx.current_itr >> 1);
+ q_vector->rx.current_itr = q_vector->rx.target_itr;
+ }
+
+@@ -362,7 +362,7 @@ iavf_map_vector_to_txq(struct iavf_adapter *adapter, int v_idx, int t_idx)
+ q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting);
+ q_vector->num_ringpairs++;
+ wr32(hw, IAVF_VFINT_ITRN1(IAVF_TX_ITR, q_vector->reg_idx),
+- q_vector->tx.target_itr);
++ q_vector->tx.target_itr >> 1);
+ q_vector->tx.current_itr = q_vector->tx.target_itr;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 864ca0bf8c04953e746abdb8ac20b5c1efbbd45b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 14:00:17 +0000
+Subject: ice: fix potential infinite loop because loop counter being too small
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 615457a226f042bffc3a1532afb244cab37460d4 ]
+
+Currently the for-loop counter i is a u8 however it is being checked
+against a maximum value hw->num_tx_sched_layers which is a u16. Hence
+there is a potential wrap-around of counter i back to zero if
+hw->num_tx_sched_layers is greater than 255. Fix this by making i
+a u16.
+
+Addresses-Coverity: ("Infinite loop")
+Fixes: b36c598c999c ("ice: Updates to Tx scheduler code")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ice/ice_sched.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c
+index 2a232504379d2..602b0fd84c29e 100644
+--- a/drivers/net/ethernet/intel/ice/ice_sched.c
++++ b/drivers/net/ethernet/intel/ice/ice_sched.c
+@@ -1052,7 +1052,7 @@ enum ice_status ice_sched_query_res_alloc(struct ice_hw *hw)
+ struct ice_aqc_query_txsched_res_resp *buf;
+ enum ice_status status = 0;
+ __le16 max_sibl;
+- u8 i;
++ u16 i;
+
+ if (hw->layer_info)
+ return status;
+--
+2.20.1
+
--- /dev/null
+From ed76b3ddc86a7b51937d4271f93fba9d6d9c4953 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 2 Nov 2019 00:25:08 -0400
+Subject: idr: Fix idr_alloc_u32 on 32-bit systems
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit b7e9728f3d7fc5c5c8508d99f1675212af5cfd49 ]
+
+Attempting to allocate an entry at 0xffffffff when one is already
+present would succeed in allocating one at 2^32, which would confuse
+everything. Return -ENOSPC in this case, as expected.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/radix-tree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/radix-tree.c b/lib/radix-tree.c
+index 18c1dfbb17654..c8fa1d2745302 100644
+--- a/lib/radix-tree.c
++++ b/lib/radix-tree.c
+@@ -1529,7 +1529,7 @@ void __rcu **idr_get_free(struct radix_tree_root *root,
+ offset = radix_tree_find_next_bit(node, IDR_FREE,
+ offset + 1);
+ start = next_index(start, node, offset);
+- if (start > max)
++ if (start > max || start == 0)
+ return ERR_PTR(-ENOSPC);
+ while (offset == RADIX_TREE_MAP_SIZE) {
+ offset = node->offset + 1;
+--
+2.20.1
+
--- /dev/null
+From 3ca3ea6a462284fa1204e48ca0016c1efc95ffa1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 21:36:39 -0400
+Subject: idr: Fix idr_get_next_ul race with idr_remove
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit 5a74ac4c4a97bd8b7dba054304d598e2a882fea6 ]
+
+Commit 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
+neglected to fix idr_get_next_ul(). As far as I can tell, nobody's
+actually using this interface under the RCU read lock, but fix it now
+before anybody decides to use it.
+
+Fixes: 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove")
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/idr.c | 31 +++++++++++--------------------
+ 1 file changed, 11 insertions(+), 20 deletions(-)
+
+diff --git a/lib/idr.c b/lib/idr.c
+index 66a3748924828..c2cf2c52bbde5 100644
+--- a/lib/idr.c
++++ b/lib/idr.c
+@@ -215,7 +215,7 @@ int idr_for_each(const struct idr *idr,
+ EXPORT_SYMBOL(idr_for_each);
+
+ /**
+- * idr_get_next() - Find next populated entry.
++ * idr_get_next_ul() - Find next populated entry.
+ * @idr: IDR handle.
+ * @nextid: Pointer to an ID.
+ *
+@@ -224,7 +224,7 @@ EXPORT_SYMBOL(idr_for_each);
+ * to the ID of the found value. To use in a loop, the value pointed to by
+ * nextid must be incremented by the user.
+ */
+-void *idr_get_next(struct idr *idr, int *nextid)
++void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
+ {
+ struct radix_tree_iter iter;
+ void __rcu **slot;
+@@ -245,18 +245,14 @@ void *idr_get_next(struct idr *idr, int *nextid)
+ }
+ if (!slot)
+ return NULL;
+- id = iter.index + base;
+-
+- if (WARN_ON_ONCE(id > INT_MAX))
+- return NULL;
+
+- *nextid = id;
++ *nextid = iter.index + base;
+ return entry;
+ }
+-EXPORT_SYMBOL(idr_get_next);
++EXPORT_SYMBOL(idr_get_next_ul);
+
+ /**
+- * idr_get_next_ul() - Find next populated entry.
++ * idr_get_next() - Find next populated entry.
+ * @idr: IDR handle.
+ * @nextid: Pointer to an ID.
+ *
+@@ -265,22 +261,17 @@ EXPORT_SYMBOL(idr_get_next);
+ * to the ID of the found value. To use in a loop, the value pointed to by
+ * nextid must be incremented by the user.
+ */
+-void *idr_get_next_ul(struct idr *idr, unsigned long *nextid)
++void *idr_get_next(struct idr *idr, int *nextid)
+ {
+- struct radix_tree_iter iter;
+- void __rcu **slot;
+- unsigned long base = idr->idr_base;
+ unsigned long id = *nextid;
++ void *entry = idr_get_next_ul(idr, &id);
+
+- id = (id < base) ? 0 : id - base;
+- slot = radix_tree_iter_find(&idr->idr_rt, &iter, id);
+- if (!slot)
++ if (WARN_ON_ONCE(id > INT_MAX))
+ return NULL;
+-
+- *nextid = iter.index + base;
+- return rcu_dereference_raw(*slot);
++ *nextid = id;
++ return entry;
+ }
+-EXPORT_SYMBOL(idr_get_next_ul);
++EXPORT_SYMBOL(idr_get_next);
+
+ /**
+ * idr_replace() - replace pointer for given ID.
+--
+2.20.1
+
--- /dev/null
+From dd38d03703a7066bcf9c18c61e88d192b1f48bca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 3 Nov 2019 06:36:43 -0500
+Subject: idr: Fix integer overflow in idr_for_each_entry
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit f6341c5af4e6e15041be39976d16deca789555fa ]
+
+If there is an entry at INT_MAX then idr_for_each_entry() will increment
+id after handling it. This is undefined behaviour, and is caught by
+UBSAN. Adding 1U to id forces the operation to be carried out as an
+unsigned addition which (when assigned to id) will result in INT_MIN.
+Since there is never an entry stored at INT_MIN, idr_get_next() will
+return NULL, ending the loop as expected.
+
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/idr.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/idr.h b/include/linux/idr.h
+index 4ec8986e5dfb6..ac6e946b6767b 100644
+--- a/include/linux/idr.h
++++ b/include/linux/idr.h
+@@ -185,7 +185,7 @@ static inline void idr_preload_end(void)
+ * is convenient for a "not found" value.
+ */
+ #define idr_for_each_entry(idr, entry, id) \
+- for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id)
++ for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U)
+
+ /**
+ * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.
+--
+2.20.1
+
--- /dev/null
+From c8d4bc435beb2e8bba2eb07f6666a773b052f02b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 15:41:11 +0100
+Subject: mac80211: fix ieee80211_txq_setup_flows() failure path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+[ Upstream commit 6dd47d9754ff0589715054b11294771f2c9a16ac ]
+
+If ieee80211_txq_setup_flows() fails, we don't clean up LED
+state properly, leading to crashes later on, fix that.
+
+Fixes: dc8b274f0952 ("mac80211: Move up init of TXQs")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Link: https://lore.kernel.org/r/20191105154110.1ccf7112ba5d.I0ba865792446d051867b33153be65ce6b063d98c@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/mac80211/main.c b/net/mac80211/main.c
+index 4c2702f128f3a..868705ed5cbbb 100644
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1297,8 +1297,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
+ ieee80211_remove_interfaces(local);
+ fail_rate:
+ rtnl_unlock();
+- ieee80211_led_exit(local);
+ fail_flows:
++ ieee80211_led_exit(local);
+ destroy_workqueue(local->workqueue);
+ fail_workqueue:
+ wiphy_unregister(local->hw.wiphy);
+--
+2.20.1
+
--- /dev/null
+From 10725b2e29c587d010817ed9004a407dbc7faff5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 06:12:43 -0600
+Subject: mac80211: fix station inactive_time shortly after boot
+
+From: Ahmed Zaki <anzaki@gmail.com>
+
+[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ]
+
+In the first 5 minutes after boot (time of INITIAL_JIFFIES),
+ieee80211_sta_last_active() returns zero if last_ack is zero. This
+leads to "inactive time" showing jiffies_to_msecs(jiffies).
+
+ # iw wlan0 station get fc:ec:da:64:a6:dd
+ Station fc:ec:da:64:a6:dd (on wlan0)
+ inactive time: 4294894049 ms
+ .
+ .
+ connected time: 70 seconds
+
+Fix by returning last_rx if last_ack == 0.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/sta_info.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index 5fb368cc26338..0030b13c2f501 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -2455,7 +2455,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta)
+ {
+ struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta);
+
+- if (time_after(stats->last_rx, sta->status_stats.last_ack))
++ if (!sta->status_stats.last_ack ||
++ time_after(stats->last_rx, sta->status_stats.last_ack))
+ return stats->last_rx;
+ return sta->status_stats.last_ack;
+ }
+--
+2.20.1
+
--- /dev/null
+From d492791454af65051a43446eaf80c9f0875c9f20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 21:16:24 -0800
+Subject: mm/gup_benchmark: fix MAP_HUGETLB case
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: John Hubbard <jhubbard@nvidia.com>
+
+[ Upstream commit 64801d19eba156170340c76f70ade743defcb8ce ]
+
+The MAP_HUGETLB ("-H" option) of gup_benchmark fails:
+
+ $ sudo ./gup_benchmark -H
+ mmap: Invalid argument
+
+This is because gup_benchmark.c is passing in a file descriptor to
+mmap(), but the fd came from opening up the /dev/zero file. This
+confuses the mmap syscall implementation, which thinks that, if the
+caller did not specify MAP_ANONYMOUS, then the file must be a huge page
+file. So it attempts to verify that the file really is a huge page
+file, as you can see here:
+
+ksys_mmap_pgoff()
+{
+ if (!(flags & MAP_ANONYMOUS)) {
+ retval = -EINVAL;
+ if (unlikely(flags & MAP_HUGETLB && !is_file_hugepages(file)))
+ goto out_fput; /* THIS IS WHERE WE END UP */
+
+ else if (flags & MAP_HUGETLB) {
+ ...proceed normally, /dev/zero is ok here...
+
+...and of course is_file_hugepages() returns "false" for the /dev/zero
+file.
+
+The problem is that the user space program, gup_benchmark.c, really just
+wants anonymous memory here. The simplest way to get that is to pass
+MAP_ANONYMOUS whenever MAP_HUGETLB is specified, so that's what this
+patch does.
+
+Link: http://lkml.kernel.org/r/20191021212435.398153-2-jhubbard@nvidia.com
+Signed-off-by: John Hubbard <jhubbard@nvidia.com>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Reviewed-by: Jérôme Glisse <jglisse@redhat.com>
+Cc: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/vm/gup_benchmark.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c
+index c0534e298b512..8e9929ce64cdb 100644
+--- a/tools/testing/selftests/vm/gup_benchmark.c
++++ b/tools/testing/selftests/vm/gup_benchmark.c
+@@ -71,7 +71,7 @@ int main(int argc, char **argv)
+ flags |= MAP_SHARED;
+ break;
+ case 'H':
+- flags |= MAP_HUGETLB;
++ flags |= (MAP_HUGETLB | MAP_ANONYMOUS);
+ break;
+ default:
+ return -1;
+--
+2.20.1
+
--- /dev/null
+From 7869ff3a0317a5af8802e5f96e2c6a6f4adb8fea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 11:07:26 -0800
+Subject: net: bcmgenet: reapply manual settings to the PHY
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 0686bd9d5e6863f60e4bb1e78e6fe7bb217a0890 ]
+
+The phy_init_hw() function may reset the PHY to a configuration
+that does not match manual network settings stored in the phydev
+structure. If the phy state machine is polled rather than event
+driven this can create a timing hazard where the phy state machine
+might alter the settings stored in the phydev structure from the
+value read from the BMCR.
+
+This commit follows invocations of phy_init_hw() by the bcmgenet
+driver with invocations of the genphy_config_aneg() function to
+ensure that the BMCR is written to match the settings held in the
+phydev structure. This prevents the risk of manual settings being
+accidentally altered.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 4c90923d7a1c8..2f0011465af0c 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -2617,8 +2617,10 @@ static void bcmgenet_irq_task(struct work_struct *work)
+ spin_unlock_irq(&priv->lock);
+
+ if (status & UMAC_IRQ_PHY_DET_R &&
+- priv->dev->phydev->autoneg != AUTONEG_ENABLE)
++ priv->dev->phydev->autoneg != AUTONEG_ENABLE) {
+ phy_init_hw(priv->dev->phydev);
++ genphy_config_aneg(priv->dev->phydev);
++ }
+
+ /* Link UP/DOWN event */
+ if (status & UMAC_IRQ_LINK_EVENT)
+@@ -3641,6 +3643,7 @@ static int bcmgenet_resume(struct device *d)
+ phy_init_hw(dev->phydev);
+
+ /* Speed settings must be restored */
++ genphy_config_aneg(dev->phydev);
+ bcmgenet_mii_config(priv->dev, false);
+
+ bcmgenet_set_hw_addr(priv, dev->dev_addr);
+--
+2.20.1
+
--- /dev/null
+From 022e7bdba663f3ebb34a8a1d23265d9fa482003d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 11:07:24 -0800
+Subject: net: bcmgenet: use RGMII loopback for MAC reset
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 3a55402c93877d291b0a612d25edb03d1b4b93ac ]
+
+As noted in commit 28c2d1a7a0bf ("net: bcmgenet: enable loopback
+during UniMAC sw_reset") the UniMAC must be clocked while sw_reset
+is asserted for its state machines to reset cleanly.
+
+The transmit and receive clocks used by the UniMAC are derived from
+the signals used on its PHY interface. The bcmgenet MAC can be
+configured to work with different PHY interfaces including MII,
+GMII, RGMII, and Reverse MII on internal and external interfaces.
+Unfortunately for the UniMAC, when configured for MII the Tx clock
+is always driven from the PHY which places it outside of the direct
+control of the MAC.
+
+The earlier commit enabled a local loopback mode within the UniMAC
+so that the receive clock would be derived from the transmit clock
+which addressed the observed issue with an external GPHY disabling
+it's Rx clock. However, when a Tx clock is not available this
+loopback is insufficient.
+
+This commit implements a workaround that leverages the fact that
+the MAC can reliably generate all of its necessary clocking by
+enterring the external GPHY RGMII interface mode with the UniMAC in
+local loopback during the sw_reset interval. Unfortunately, this
+has the undesirable side efect of the RGMII GTXCLK signal being
+driven during the same window.
+
+In most configurations this is a benign side effect as the signal
+is either not routed to a pin or is already expected to drive the
+pin. The one exception is when an external MII PHY is expected to
+drive the same pin with its TX_CLK output creating output driver
+contention.
+
+This commit exploits the IEEE 802.3 clause 22 standard defined
+isolate mode to force an external MII PHY to present a high
+impedance on its TX_CLK output during the window to prevent any
+contention at the pin.
+
+The MII interface is used internally with the 40nm internal EPHY
+which agressively disables its clocks for power savings leading to
+incomplete resets of the UniMAC and many instabilities observed
+over the years. The workaround of this commit is expected to put
+an end to those problems.
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/broadcom/genet/bcmgenet.c | 2 --
+ drivers/net/ethernet/broadcom/genet/bcmmii.c | 33 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 06e2581b28eaf..4c90923d7a1c8 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1996,8 +1996,6 @@ static void reset_umac(struct bcmgenet_priv *priv)
+
+ /* issue soft reset with (rg)mii loopback to ensure a stable rxclk */
+ bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD);
+- udelay(2);
+- bcmgenet_umac_writel(priv, 0, UMAC_CMD);
+ }
+
+ static void bcmgenet_intr_disable(struct bcmgenet_priv *priv)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index e7c291bf4ed17..dbe18cdf6c1b8 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -181,8 +181,38 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ const char *phy_name = NULL;
+ u32 id_mode_dis = 0;
+ u32 port_ctrl;
++ int bmcr = -1;
++ int ret;
+ u32 reg;
+
++ /* MAC clocking workaround during reset of umac state machines */
++ reg = bcmgenet_umac_readl(priv, UMAC_CMD);
++ if (reg & CMD_SW_RESET) {
++ /* An MII PHY must be isolated to prevent TXC contention */
++ if (priv->phy_interface == PHY_INTERFACE_MODE_MII) {
++ ret = phy_read(phydev, MII_BMCR);
++ if (ret >= 0) {
++ bmcr = ret;
++ ret = phy_write(phydev, MII_BMCR,
++ bmcr | BMCR_ISOLATE);
++ }
++ if (ret) {
++ netdev_err(dev, "failed to isolate PHY\n");
++ return ret;
++ }
++ }
++ /* Switch MAC clocking to RGMII generated clock */
++ bcmgenet_sys_writel(priv, PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
++ /* Ensure 5 clks with Rx disabled
++ * followed by 5 clks with Reset asserted
++ */
++ udelay(4);
++ reg &= ~(CMD_SW_RESET | CMD_LCL_LOOP_EN);
++ bcmgenet_umac_writel(priv, reg, UMAC_CMD);
++ /* Ensure 5 more clocks before Rx is enabled */
++ udelay(2);
++ }
++
+ priv->ext_phy = !priv->internal_phy &&
+ (priv->phy_interface != PHY_INTERFACE_MODE_MOCA);
+
+@@ -214,6 +244,9 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
+ phy_set_max_speed(phydev, SPEED_100);
+ bcmgenet_sys_writel(priv,
+ PORT_MODE_EXT_EPHY, SYS_PORT_CTRL);
++ /* Restore the MII PHY after isolation */
++ if (bmcr >= 0)
++ phy_write(phydev, MII_BMCR, bmcr);
+ break;
+
+ case PHY_INTERFACE_MODE_REVMII:
+--
+2.20.1
+
--- /dev/null
+From b22ae6ddf4bb6d95107c73180d9ba188eecea5e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 23:50:00 +0800
+Subject: net: fec: add missed clk_disable_unprepare in remove
+
+From: Chuhong Yuan <hslester96@gmail.com>
+
+[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ]
+
+This driver forgets to disable and unprepare clks when remove.
+Add calls to clk_disable_unprepare to fix it.
+
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fec_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
+index e5610a4da5390..9cb1d6ab19d5b 100644
+--- a/drivers/net/ethernet/freescale/fec_main.c
++++ b/drivers/net/ethernet/freescale/fec_main.c
+@@ -3589,6 +3589,8 @@ fec_drv_remove(struct platform_device *pdev)
+ regulator_disable(fep->reg_phy);
+ pm_runtime_put(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++ clk_disable_unprepare(fep->clk_ahb);
++ clk_disable_unprepare(fep->clk_ipg);
+ if (of_phy_is_fixed_link(np))
+ of_phy_deregister_fixed_link(np);
+ of_node_put(fep->phy_node);
+--
+2.20.1
+
--- /dev/null
+From 614c890c99ef5334a004c1b41c6c6c54620e2179 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 16:57:50 +0100
+Subject: net/fq_impl: Switch to kvmalloc() for memory allocation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 71e67c3bd127cfe7863f54e4b087eba1cc8f9a7a ]
+
+The FQ implementation used by mac80211 allocates memory using kmalloc(),
+which can fail; and Johannes reported that this actually happens in
+practice.
+
+To avoid this, switch the allocation to kvmalloc() instead; this also
+brings fq_impl in line with all the FQ qdiscs.
+
+Fixes: 557fc4a09803 ("fq: add fair queuing framework")
+Reported-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20191105155750.547379-1-toke@redhat.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/fq_impl.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h
+index 107c0d700ed6f..38a9a3d1222b7 100644
+--- a/include/net/fq_impl.h
++++ b/include/net/fq_impl.h
+@@ -313,7 +313,7 @@ static int fq_init(struct fq *fq, int flows_cnt)
+ fq->limit = 8192;
+ fq->memory_limit = 16 << 20; /* 16 MBytes */
+
+- fq->flows = kcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
++ fq->flows = kvcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL);
+ if (!fq->flows)
+ return -ENOMEM;
+
+@@ -331,7 +331,7 @@ static void fq_reset(struct fq *fq,
+ for (i = 0; i < fq->flows_cnt; i++)
+ fq_flow_reset(fq, &fq->flows[i], free_func);
+
+- kfree(fq->flows);
++ kvfree(fq->flows);
+ fq->flows = NULL;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 2337db17bfbff724a516b93ea93b4b2670583c53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 19:13:58 +0200
+Subject: net/mlx5e: Fix eswitch debug print of max fdb flow
+
+From: Roi Dayan <roid@mellanox.com>
+
+[ Upstream commit f382b0df6946d48fae80a2201ccff43b41382099 ]
+
+The value is already the calculation so remove the log prefix.
+
+Fixes: e52c28024008 ("net/mlx5: E-Switch, Add chains and priorities")
+Signed-off-by: Roi Dayan <roid@mellanox.com>
+Reviewed-by: Eli Britstein <elibr@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+index 35945cdd0a618..3ac6104e9924c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+@@ -1085,7 +1085,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports)
+ MLX5_CAP_GEN(dev, max_flow_counter_15_0);
+ fdb_max = 1 << MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size);
+
+- esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(2^%d))\n",
++ esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(%d))\n",
+ MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size),
+ max_flow_counter, ESW_OFFLOADS_NUM_GROUPS,
+ fdb_max);
+--
+2.20.1
+
--- /dev/null
+From 6496d630bc588d303459a6e3431cf0efa72b85ef Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 11:44:24 +0200
+Subject: net/mlx5e: Use correct enum to determine uplink port
+
+From: Dmytro Linkin <dmitrolin@mellanox.com>
+
+[ Upstream commit 950d3af70ea89cf7ac51d734a634174013631192 ]
+
+For vlan push action, if eswitch flow source capability is enabled, flow
+source value compared with MLX5_VPORT_UPLINK enum, to determine uplink
+port. This lead to syndrome in dmesg if try to add vlan push action.
+For example:
+ $ tc filter add dev vxlan0 ingress protocol ip prio 1 flower \
+ enc_dst_port 4789 \
+ action tunnel_key unset pipe \
+ action vlan push id 20 pipe \
+ action mirred egress redirect dev ens1f0_0
+ $ dmesg
+ ...
+ [ 2456.883693] mlx5_core 0000:82:00.0: mlx5_cmd_check:756:(pid 5273): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xa9c090)
+Use the correct enum value MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK.
+
+Fixes: bb204dcf39fe ("net/mlx5e: Determine source port properly for vlan push action")
+Signed-off-by: Dmytro Linkin <dmitrolin@mellanox.com>
+Reviewed-by: Vlad Buslov <vladbu@mellanox.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+index 7879e1746297c..366bda1bb1c32 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+@@ -183,7 +183,8 @@ static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw,
+ u32 port_mask, port_value;
+
+ if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source))
+- return spec->flow_context.flow_source == MLX5_VPORT_UPLINK;
++ return spec->flow_context.flow_source ==
++ MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK;
+
+ port_mask = MLX5_GET(fte_match_param, spec->match_criteria,
+ misc_parameters.source_port);
+--
+2.20.1
+
--- /dev/null
+From a3d9579f8f9770f73fd3f2e6341dfb8676ff8998 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 00:01:40 +0200
+Subject: net: mscc: ocelot: fix __ocelot_rmw_ix prototype
+
+From: Vladimir Oltean <olteanv@gmail.com>
+
+[ Upstream commit 17fdd7638cb687cd7f15a48545f25d738f0101e0 ]
+
+The "read-modify-write register index" function is declared with a
+confusing prototype: the "mask" and "reg" arguments are swapped.
+
+Fortunately, this does not affect callers so far. Both arguments are
+u32, and the wrapper macros (ocelot_rmw_ix etc) have the arguments in
+the correct order (the one from ocelot_io.c).
+
+Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mscc/ocelot.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mscc/ocelot.h b/drivers/net/ethernet/mscc/ocelot.h
+index f7eeb4806897d..aa372aba66c8c 100644
+--- a/drivers/net/ethernet/mscc/ocelot.h
++++ b/drivers/net/ethernet/mscc/ocelot.h
+@@ -479,7 +479,7 @@ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset);
+ #define ocelot_write_rix(ocelot, val, reg, ri) __ocelot_write_ix(ocelot, val, reg, reg##_RSZ * (ri))
+ #define ocelot_write(ocelot, val, reg) __ocelot_write_ix(ocelot, val, reg, 0)
+
+-void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 mask,
++void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg,
+ u32 offset);
+ #define ocelot_rmw_ix(ocelot, val, m, reg, gi, ri) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi) + reg##_RSZ * (ri))
+ #define ocelot_rmw_gix(ocelot, val, m, reg, gi) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi))
+--
+2.20.1
+
--- /dev/null
+From edfa3cd1fdafaa30b6ff4343c67abe29410c2dac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 16:02:55 +0100
+Subject: net: stmmac: gmac4: bitrev32 returns u32
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 4d7c47e34fab0d25790bb6e85b85e26fdf0090d5 ]
+
+The bitrev32 function returns an u32 var, not an int. Fix it.
+
+Fixes: 477286b53f55 ("stmmac: add GMAC4 core support")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 9c73fb759b575..ff830bb5fcaf7 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -438,7 +438,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw,
+ * bits used depends on the hardware configuration
+ * selected at core configuration time.
+ */
+- int bit_nr = bitrev32(~crc32_le(~0, ha->addr,
++ u32 bit_nr = bitrev32(~crc32_le(~0, ha->addr,
+ ETH_ALEN)) >> (32 - mcbitslog2);
+ /* The most significant bit determines the register to
+ * use (H/L) while the other 5 bits determine the bit
+--
+2.20.1
+
--- /dev/null
+From 26fb6db31900bc2ff016893036c0f3cb8f0de491 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 16:02:56 +0100
+Subject: net: stmmac: xgmac: bitrev32 returns u32
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 3d00e45d498fd5347cea653ef494c56731b651e0 ]
+
+The bitrev32 function returns an u32 var, not an int. Fix it.
+
+Fixes: 0efedbf11f07 ("net: stmmac: xgmac: Fix XGMAC selftests")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+index 46d74f407aab6..91d7dec2540a1 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -361,7 +361,7 @@ static void dwxgmac2_set_filter(struct mac_device_info *hw,
+ value |= XGMAC_FILTER_HMC;
+
+ netdev_for_each_mc_addr(ha, dev) {
+- int nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >>
++ u32 nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >>
+ (32 - mcbitslog2));
+ mc_filter[nr >> 5] |= (1 << (nr & 0x1F));
+ }
+--
+2.20.1
+
--- /dev/null
+From b66499ef18299e2fea92c4fba403759040916541 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 16:03:01 +0100
+Subject: net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in
+ AV
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 132f2f20c9866325d12c155aca06d260f358d3cb ]
+
+When in AVB mode we need to disable flow control to prevent MAC from
+pausing in TX side.
+
+Fixes: ec6ea8e3eee9 ("net: stmmac: Add CBS support in XGMAC2")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+index a4f236e3593e7..28dc3b33606e1 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c
+@@ -441,6 +441,7 @@ static void dwxgmac2_enable_tso(void __iomem *ioaddr, bool en, u32 chan)
+ static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode)
+ {
+ u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
++ u32 flow = readl(ioaddr + XGMAC_RX_FLOW_CTRL);
+
+ value &= ~XGMAC_TXQEN;
+ if (qmode != MTL_QUEUE_AVB) {
+@@ -448,6 +449,7 @@ static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode)
+ writel(0, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(channel));
+ } else {
+ value |= 0x1 << XGMAC_TXQEN_SHIFT;
++ writel(flow & (~XGMAC_RFE), ioaddr + XGMAC_RX_FLOW_CTRL);
+ }
+
+ writel(value, ioaddr + XGMAC_MTL_TXQ_OPMODE(channel));
+--
+2.20.1
+
--- /dev/null
+From 8b6ce55923fc6ffc4410cd10e3a786aeca39b954 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 6 Nov 2019 16:02:59 +0100
+Subject: net: stmmac: xgmac: Fix TSA selection
+
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+
+[ Upstream commit 97add93fbcfa566735d6a4b96684110d356ebd35 ]
+
+When we change between Transmission Scheduling Algorithms, we need to
+clear previous values so that the new chosen algorithm is correctly
+selected.
+
+Fixes: ec6ea8e3eee9 ("net: stmmac: Add CBS support in XGMAC2")
+Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+index 91d7dec2540a1..341c7a70fc71a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -196,6 +196,7 @@ static void dwxgmac2_config_cbs(struct mac_device_info *hw,
+ writel(low_credit, ioaddr + XGMAC_MTL_TCx_LOCREDIT(queue));
+
+ value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
++ value &= ~XGMAC_TSA;
+ value |= XGMAC_CC | XGMAC_CBS;
+ writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue));
+ }
+--
+2.20.1
+
--- /dev/null
+From d9a168b8fb2684607156ebed6f49b375626c02f4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 17:13:18 +0100
+Subject: netfilter: ipset: Fix nla_policies to fully support
+ NL_VALIDATE_STRICT
+
+From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+
+[ Upstream commit 1289975643f4cdecb071dc641059a47679fd170f ]
+
+Since v5.2 (commit "netlink: re-add parse/validate functions in strict
+mode") NL_VALIDATE_STRICT is enabled. Fix the ipset nla_policies which did
+not support strict mode and convert from deprecated parsings to verified ones.
+
+Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_core.c | 41 ++++++++++++++++--------
+ net/netfilter/ipset/ip_set_hash_net.c | 1 +
+ net/netfilter/ipset/ip_set_hash_netnet.c | 1 +
+ 3 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index e7288eab75126..d73d1828216a6 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -296,7 +296,8 @@ ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr)
+
+ if (unlikely(!flag_nested(nla)))
+ return -IPSET_ERR_PROTOCOL;
+- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
++ if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
++ ipaddr_policy, NULL))
+ return -IPSET_ERR_PROTOCOL;
+ if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4)))
+ return -IPSET_ERR_PROTOCOL;
+@@ -314,7 +315,8 @@ ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr)
+ if (unlikely(!flag_nested(nla)))
+ return -IPSET_ERR_PROTOCOL;
+
+- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL))
++ if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla,
++ ipaddr_policy, NULL))
+ return -IPSET_ERR_PROTOCOL;
+ if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6)))
+ return -IPSET_ERR_PROTOCOL;
+@@ -934,7 +936,8 @@ static int ip_set_create(struct net *net, struct sock *ctnl,
+
+ /* Without holding any locks, create private part. */
+ if (attr[IPSET_ATTR_DATA] &&
+- nla_parse_nested_deprecated(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA], set->type->create_policy, NULL)) {
++ nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA],
++ set->type->create_policy, NULL)) {
+ ret = -IPSET_ERR_PROTOCOL;
+ goto put_out;
+ }
+@@ -1281,6 +1284,14 @@ dump_attrs(struct nlmsghdr *nlh)
+ }
+ }
+
++static const struct nla_policy
++ip_set_dump_policy[IPSET_ATTR_CMD_MAX + 1] = {
++ [IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 },
++ [IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING,
++ .len = IPSET_MAXNAMELEN - 1 },
++ [IPSET_ATTR_FLAGS] = { .type = NLA_U32 },
++};
++
+ static int
+ dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
+ {
+@@ -1292,9 +1303,9 @@ dump_init(struct netlink_callback *cb, struct ip_set_net *inst)
+ ip_set_id_t index;
+ int ret;
+
+- ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr,
+- nlh->nlmsg_len - min_len,
+- ip_set_setname_policy, NULL);
++ ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, attr,
++ nlh->nlmsg_len - min_len,
++ ip_set_dump_policy, NULL);
+ if (ret)
+ return ret;
+
+@@ -1543,9 +1554,9 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set,
+ memcpy(&errmsg->msg, nlh, nlh->nlmsg_len);
+ cmdattr = (void *)&errmsg->msg + min_len;
+
+- ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr,
+- nlh->nlmsg_len - min_len,
+- ip_set_adt_policy, NULL);
++ ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr,
++ nlh->nlmsg_len - min_len, ip_set_adt_policy,
++ NULL);
+
+ if (ret) {
+ nlmsg_free(skb2);
+@@ -1596,7 +1607,9 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
+
+ use_lineno = !!attr[IPSET_ATTR_LINENO];
+ if (attr[IPSET_ATTR_DATA]) {
+- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
++ if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX,
++ attr[IPSET_ATTR_DATA],
++ set->type->adt_policy, NULL))
+ return -IPSET_ERR_PROTOCOL;
+ ret = call_ad(ctnl, skb, set, tb, adt, flags,
+ use_lineno);
+@@ -1606,7 +1619,8 @@ static int ip_set_ad(struct net *net, struct sock *ctnl,
+ nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) {
+ if (nla_type(nla) != IPSET_ATTR_DATA ||
+ !flag_nested(nla) ||
+- nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, nla, set->type->adt_policy, NULL))
++ nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla,
++ set->type->adt_policy, NULL))
+ return -IPSET_ERR_PROTOCOL;
+ ret = call_ad(ctnl, skb, set, tb, adt,
+ flags, use_lineno);
+@@ -1655,7 +1669,8 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb,
+ if (!set)
+ return -ENOENT;
+
+- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL))
++ if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA],
++ set->type->adt_policy, NULL))
+ return -IPSET_ERR_PROTOCOL;
+
+ rcu_read_lock_bh();
+@@ -1961,7 +1976,7 @@ static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = {
+ [IPSET_CMD_LIST] = {
+ .call = ip_set_dump,
+ .attr_count = IPSET_ATTR_CMD_MAX,
+- .policy = ip_set_setname_policy,
++ .policy = ip_set_dump_policy,
+ },
+ [IPSET_CMD_SAVE] = {
+ .call = ip_set_dump,
+diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
+index c259cbc3ef453..3d932de0ad295 100644
+--- a/net/netfilter/ipset/ip_set_hash_net.c
++++ b/net/netfilter/ipset/ip_set_hash_net.c
+@@ -368,6 +368,7 @@ static struct ip_set_type hash_net_type __read_mostly = {
+ [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED },
+ [IPSET_ATTR_CIDR] = { .type = NLA_U8 },
+ [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
++ [IPSET_ATTR_LINENO] = { .type = NLA_U32 },
+ [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
+ [IPSET_ATTR_BYTES] = { .type = NLA_U64 },
+ [IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
+diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
+index a3ae69bfee668..4398322fad592 100644
+--- a/net/netfilter/ipset/ip_set_hash_netnet.c
++++ b/net/netfilter/ipset/ip_set_hash_netnet.c
+@@ -476,6 +476,7 @@ static struct ip_set_type hash_netnet_type __read_mostly = {
+ [IPSET_ATTR_CIDR] = { .type = NLA_U8 },
+ [IPSET_ATTR_CIDR2] = { .type = NLA_U8 },
+ [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 },
++ [IPSET_ATTR_LINENO] = { .type = NLA_U32 },
+ [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 },
+ [IPSET_ATTR_BYTES] = { .type = NLA_U64 },
+ [IPSET_ATTR_PACKETS] = { .type = NLA_U64 },
+--
+2.20.1
+
--- /dev/null
+From 4c0e436e8fb9502ddf94907ed86008430e03dfec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 14:52:41 +0100
+Subject: netfilter: nf_tables: bogus EOPNOTSUPP on basechain update
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 1ed012f6fd83e7ee7efd22e2c32f23efff015b30 ]
+
+Userspace never includes the NFT_BASE_CHAIN flag, this flag is inferred
+from the NFTA_CHAIN_HOOK atribute. The chain update path does not allow
+to update flags at this stage, the existing sanity check bogusly hits
+EOPNOTSUPP in the basechain case if the offload flag is set on.
+
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_api.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 3b81323fa0171..5dbc6bfb532cd 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1922,6 +1922,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk,
+ if (nlh->nlmsg_flags & NLM_F_REPLACE)
+ return -EOPNOTSUPP;
+
++ flags |= chain->flags & NFT_BASE_CHAIN;
+ return nf_tables_updchain(&ctx, genmask, policy, flags);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 6716ec16992741e49556d85f4d25bcff4fb1a356 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 4 Nov 2019 14:52:42 +0100
+Subject: netfilter: nf_tables_offload: skip EBUSY on chain update
+
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+
+[ Upstream commit 88c749840dff58e7a40e18bf9bdace15f27ef259 ]
+
+Do not try to bind a chain again if it exists, otherwise the driver
+returns EBUSY.
+
+Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nf_tables_offload.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
+index c0d18c1d77ac0..04fbab60e8080 100644
+--- a/net/netfilter/nf_tables_offload.c
++++ b/net/netfilter/nf_tables_offload.c
+@@ -241,7 +241,8 @@ int nft_flow_rule_offload_commit(struct net *net)
+
+ switch (trans->msg_type) {
+ case NFT_MSG_NEWCHAIN:
+- if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
++ if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
++ nft_trans_chain_update(trans))
+ continue;
+
+ err = nft_flow_offload_chain(trans, FLOW_BLOCK_BIND);
+--
+2.20.1
+
--- /dev/null
+From 663618e4b986a4a7f90ece42bb8121bd8d5d3f17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 1 Nov 2019 17:27:55 -0700
+Subject: nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths
+
+From: Anton Eidelman <anton@lightbitslabs.com>
+
+[ Upstream commit 763303a83a095a88c3a8a0d1abf97165db2e8bf5 ]
+
+nvme_mpath_clear_ctrl_paths() iterates through
+the ctrl->namespaces list while holding ctrl->scan_lock.
+This does not seem to be the correct way of protecting
+from concurrent list modification.
+
+Specifically, nvme_scan_work() sorts ctrl->namespaces
+AFTER unlocking scan_lock.
+
+This may result in the following (rare) crash in ctrl disconnect
+during scan_work:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000050
+ Oops: 0000 [#1] SMP PTI
+ CPU: 0 PID: 3995 Comm: nvme 5.3.5-050305-generic
+ RIP: 0010:nvme_mpath_clear_current_path+0xe/0x90 [nvme_core]
+ ...
+ Call Trace:
+ nvme_mpath_clear_ctrl_paths+0x3c/0x70 [nvme_core]
+ nvme_remove_namespaces+0x35/0xe0 [nvme_core]
+ nvme_do_delete_ctrl+0x47/0x90 [nvme_core]
+ nvme_sysfs_delete+0x49/0x60 [nvme_core]
+ dev_attr_store+0x17/0x30
+ sysfs_kf_write+0x3e/0x50
+ kernfs_fop_write+0x11e/0x1a0
+ __vfs_write+0x1b/0x40
+ vfs_write+0xb9/0x1a0
+ ksys_write+0x67/0xe0
+ __x64_sys_write+0x1a/0x20
+ do_syscall_64+0x5a/0x130
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+ RIP: 0033:0x7f8d02bfb154
+
+Fix:
+After taking scan_lock in nvme_mpath_clear_ctrl_paths()
+down_read(&ctrl->namespaces_rwsem) as well to make list traversal safe.
+This will not cause deadlocks because taking scan_lock never happens
+while holding the namespaces_rwsem.
+Moreover, scan work downs namespaces_rwsem in the same order.
+
+Alternative: sort ctrl->namespaces in nvme_scan_work()
+while still holding the scan_lock.
+This would leave nvme_mpath_clear_ctrl_paths() without correct protection
+against ctrl->namespaces modification by anyone other than scan_work.
+
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Anton Eidelman <anton@lightbitslabs.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/multipath.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
+index d320684d25b20..a5c809c85f6d2 100644
+--- a/drivers/nvme/host/multipath.c
++++ b/drivers/nvme/host/multipath.c
+@@ -158,9 +158,11 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl)
+ struct nvme_ns *ns;
+
+ mutex_lock(&ctrl->scan_lock);
++ down_read(&ctrl->namespaces_rwsem);
+ list_for_each_entry(ns, &ctrl->namespaces, list)
+ if (nvme_mpath_clear_current_path(ns))
+ kblockd_schedule_work(&ns->head->requeue_work);
++ up_read(&ctrl->namespaces_rwsem);
+ mutex_unlock(&ctrl->scan_lock);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From a075377a902f0eba1f0856e7f816968490b25957 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 16:42:27 +0200
+Subject: nvme-rdma: fix a segmentation fault during module unload
+
+From: Max Gurtovoy <maxg@mellanox.com>
+
+[ Upstream commit 9ad9e8d6ca29c1446d81c6518ae634a2141dfd22 ]
+
+In case there are controllers that are not associated with any RDMA
+device (e.g. during unsuccessful reconnection) and the user will unload
+the module, these controllers will not be freed and will access already
+freed memory. The same logic appears in other fabric drivers as well.
+
+Fixes: 87fd125344d6 ("nvme-rdma: remove redundant reference between ib_device and tagset")
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: Max Gurtovoy <maxg@mellanox.com>
+Signed-off-by: Keith Busch <kbusch@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvme/host/rdma.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 842ef876724f7..439e66769f250 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -2118,8 +2118,16 @@ err_unreg_client:
+
+ static void __exit nvme_rdma_cleanup_module(void)
+ {
++ struct nvme_rdma_ctrl *ctrl;
++
+ nvmf_unregister_transport(&nvme_rdma_transport);
+ ib_unregister_client(&nvme_rdma_ib_client);
++
++ mutex_lock(&nvme_rdma_ctrl_mutex);
++ list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list)
++ nvme_delete_ctrl(&ctrl->ctrl);
++ mutex_unlock(&nvme_rdma_ctrl_mutex);
++ flush_workqueue(nvme_delete_wq);
+ }
+
+ module_init(nvme_rdma_init_module);
+--
+2.20.1
+
--- /dev/null
+From ac02cfc5ca7c156418e49f9b397712030acc20cc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 17:05:22 -0400
+Subject: perf scripting engines: Iterate on tep event arrays directly
+
+From: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+[ Upstream commit 443b0636ea7386d01dc460b4a4264e125f710b53 ]
+
+Instead of calling a useless (and broken) helper function to get the
+next event of a tep event array, just get the array directly and iterate
+over it.
+
+Note, the broken part was from trace_find_next_event() which after this
+will no longer be used, and can be removed.
+
+Committer notes:
+
+This fixes a segfault when generating python scripts from perf.data
+files with multiple tracepoint events, i.e. the following use case is
+fixed by this patch:
+
+ # perf record -e sched:* sleep 1
+ [ perf record: Woken up 31 times to write data ]
+ [ perf record: Captured and wrote 0.031 MB perf.data (9 samples) ]
+ # perf script -g python
+ Segmentation fault (core dumped)
+ #
+
+Reported-by: Daniel Bristot de Oliveira <bristot@redhat.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
+Cc: linux-trace-devel@vger.kernel.org
+Link: http://lkml.kernel.org/r/20191017153733.630cd5eb@gandalf.local.home
+Link: http://lore.kernel.org/lkml/20191017210636.061448713@goodmis.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/scripting-engines/trace-event-perl.c | 8 ++++++--
+ tools/perf/util/scripting-engines/trace-event-python.c | 9 +++++++--
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c
+index 61aa7f3df915b..6a0dcaee3f3ee 100644
+--- a/tools/perf/util/scripting-engines/trace-event-perl.c
++++ b/tools/perf/util/scripting-engines/trace-event-perl.c
+@@ -539,10 +539,11 @@ static int perl_stop_script(void)
+
+ static int perl_generate_script(struct tep_handle *pevent, const char *outfile)
+ {
++ int i, not_first, count, nr_events;
++ struct tep_event **all_events;
+ struct tep_event *event = NULL;
+ struct tep_format_field *f;
+ char fname[PATH_MAX];
+- int not_first, count;
+ FILE *ofp;
+
+ sprintf(fname, "%s.pl", outfile);
+@@ -603,8 +604,11 @@ sub print_backtrace\n\
+ }\n\n\
+ ");
+
++ nr_events = tep_get_events_count(pevent);
++ all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID);
+
+- while ((event = trace_find_next_event(pevent, event))) {
++ for (i = 0; all_events && i < nr_events; i++) {
++ event = all_events[i];
+ fprintf(ofp, "sub %s::%s\n{\n", event->system, event->name);
+ fprintf(ofp, "\tmy (");
+
+diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
+index 25dc1d765553b..df5ebb6af9fc8 100644
+--- a/tools/perf/util/scripting-engines/trace-event-python.c
++++ b/tools/perf/util/scripting-engines/trace-event-python.c
+@@ -1687,10 +1687,11 @@ static int python_stop_script(void)
+
+ static int python_generate_script(struct tep_handle *pevent, const char *outfile)
+ {
++ int i, not_first, count, nr_events;
++ struct tep_event **all_events;
+ struct tep_event *event = NULL;
+ struct tep_format_field *f;
+ char fname[PATH_MAX];
+- int not_first, count;
+ FILE *ofp;
+
+ sprintf(fname, "%s.py", outfile);
+@@ -1735,7 +1736,11 @@ static int python_generate_script(struct tep_handle *pevent, const char *outfile
+ fprintf(ofp, "def trace_end():\n");
+ fprintf(ofp, "\tprint(\"in trace_end\")\n\n");
+
+- while ((event = trace_find_next_event(pevent, event))) {
++ nr_events = tep_get_events_count(pevent);
++ all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID);
++
++ for (i = 0; all_events && i < nr_events; i++) {
++ event = all_events[i];
+ fprintf(ofp, "def %s__%s(", event->system, event->name);
+ fprintf(ofp, "event_name, ");
+ fprintf(ofp, "context, ");
+--
+2.20.1
+
--- /dev/null
+From 137b4f5c1b5276036de0832d3eb75d97ed3e2d56 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 16:34:41 +0300
+Subject: pinctrl: cherryview: Allocate IRQ chip dynamic
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit 67d33aecd030226f0a577eb683aaa6853ecf8f91 ]
+
+Keeping the IRQ chip definition static shares it with multiple instances
+of the GPIO chip in the system. This is bad and now we get this warning
+from GPIO library:
+
+"detected irqchip that is shared with multiple gpiochips: please fix the driver."
+
+Hence, move the IRQ chip definition from being driver static into the struct
+intel_pinctrl. So a unique IRQ chip is used for each GPIO chip instance.
+
+This patch is heavily based on the attachment to the bug by Christoph Marz.
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=202543
+Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support")
+Depends-on: 83b9dc11312f ("pinctrl: cherryview: Associate IRQ descriptors to irqdomain")
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pinctrl/intel/pinctrl-cherryview.c | 24 +++++++++++-----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index 17a248b723b9b..8dfaf8e8c3a09 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -147,6 +147,7 @@ struct chv_pin_context {
+ * @pctldesc: Pin controller description
+ * @pctldev: Pointer to the pin controller device
+ * @chip: GPIO chip in this pin controller
++ * @irqchip: IRQ chip in this pin controller
+ * @regs: MMIO registers
+ * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO
+ * offset (in GPIO number space)
+@@ -162,6 +163,7 @@ struct chv_pinctrl {
+ struct pinctrl_desc pctldesc;
+ struct pinctrl_dev *pctldev;
+ struct gpio_chip chip;
++ struct irq_chip irqchip;
+ void __iomem *regs;
+ unsigned intr_lines[16];
+ const struct chv_community *community;
+@@ -1466,16 +1468,6 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned int type)
+ return 0;
+ }
+
+-static struct irq_chip chv_gpio_irqchip = {
+- .name = "chv-gpio",
+- .irq_startup = chv_gpio_irq_startup,
+- .irq_ack = chv_gpio_irq_ack,
+- .irq_mask = chv_gpio_irq_mask,
+- .irq_unmask = chv_gpio_irq_unmask,
+- .irq_set_type = chv_gpio_irq_type,
+- .flags = IRQCHIP_SKIP_SET_WAKE,
+-};
+-
+ static void chv_gpio_irq_handler(struct irq_desc *desc)
+ {
+ struct gpio_chip *gc = irq_desc_get_handler_data(desc);
+@@ -1615,7 +1607,15 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ }
+ }
+
+- ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
++ pctrl->irqchip.name = "chv-gpio";
++ pctrl->irqchip.irq_startup = chv_gpio_irq_startup;
++ pctrl->irqchip.irq_ack = chv_gpio_irq_ack;
++ pctrl->irqchip.irq_mask = chv_gpio_irq_mask;
++ pctrl->irqchip.irq_unmask = chv_gpio_irq_unmask;
++ pctrl->irqchip.irq_set_type = chv_gpio_irq_type;
++ pctrl->irqchip.flags = IRQCHIP_SKIP_SET_WAKE;
++
++ ret = gpiochip_irqchip_add(chip, &pctrl->irqchip, 0,
+ handle_bad_irq, IRQ_TYPE_NONE);
+ if (ret) {
+ dev_err(pctrl->dev, "failed to add IRQ chip\n");
+@@ -1632,7 +1632,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ }
+ }
+
+- gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq,
++ gpiochip_set_chained_irqchip(chip, &pctrl->irqchip, irq,
+ chv_gpio_irq_handler);
+ return 0;
+ }
+--
+2.20.1
+
--- /dev/null
+From 0e38d1a074410d28ea603a40ac3d8e9a515ce80a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Oct 2019 20:34:44 -0700
+Subject: powerpc/bpf: Fix tail call implementation
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 7de086909365cd60a5619a45af3f4152516fd75c ]
+
+We have seen many crashes on powerpc hosts while loading bpf programs.
+
+The problem here is that bpf_int_jit_compile() does a first pass
+to compute the program length.
+
+Then it allocates memory to store the generated program and
+calls bpf_jit_build_body() a second time (and a third time
+later)
+
+What I have observed is that the second bpf_jit_build_body()
+could end up using few more words than expected.
+
+If bpf_jit_binary_alloc() put the space for the program
+at the end of the allocated page, we then write on
+a non mapped memory.
+
+It appears that bpf_jit_emit_tail_call() calls
+bpf_jit_emit_common_epilogue() while ctx->seen might not
+be stable.
+
+Only after the second pass we can be sure ctx->seen wont be changed.
+
+Trying to avoid a second pass seems quite complex and probably
+not worth it.
+
+Fixes: ce0761419faef ("powerpc/bpf: Implement support for tail calls")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Naveen N. Rao <naveen.n.rao@linux.ibm.com>
+Cc: Sandipan Das <sandipan@linux.ibm.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Martin KaFai Lau <kafai@fb.com>
+Cc: Song Liu <songliubraving@fb.com>
+Cc: Yonghong Song <yhs@fb.com>
+Link: https://lore.kernel.org/bpf/20191101033444.143741-1-edumazet@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/net/bpf_jit_comp64.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
+index 02a59946a78af..be3517ef0574d 100644
+--- a/arch/powerpc/net/bpf_jit_comp64.c
++++ b/arch/powerpc/net/bpf_jit_comp64.c
+@@ -1141,6 +1141,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
+ goto out_addrs;
+ }
+
++ /*
++ * If we have seen a tail call, we need a second pass.
++ * This is because bpf_jit_emit_common_epilogue() is called
++ * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen.
++ */
++ if (cgctx.seen & SEEN_TAILCALL) {
++ cgctx.idx = 0;
++ if (bpf_jit_build_body(fp, 0, &cgctx, addrs, false)) {
++ fp = org_fp;
++ goto out_addrs;
++ }
++ }
++
+ /*
+ * Pretend to build prologue, given the features we've seen. This will
+ * update ctgtx.idx as it pretends to output instructions, then we can
+--
+2.20.1
+
--- /dev/null
+From 50cf1f85b01bcd96da2bf4aa685fa3d10cba1940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 17 Oct 2019 21:22:18 +0200
+Subject: pwm: bcm-iproc: Prevent unloading the driver module while in use
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+
+[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ]
+
+The owner member of struct pwm_ops must be set to THIS_MODULE to
+increase the reference count of the module such that the module cannot
+be removed while its code is in use.
+
+Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller")
+Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/pwm/pwm-bcm-iproc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
+index d961a8207b1cb..31b01035d0ab3 100644
+--- a/drivers/pwm/pwm-bcm-iproc.c
++++ b/drivers/pwm/pwm-bcm-iproc.c
+@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ static const struct pwm_ops iproc_pwm_ops = {
+ .apply = iproc_pwmc_apply,
+ .get_state = iproc_pwmc_get_state,
++ .owner = THIS_MODULE,
+ };
+
+ static int iproc_pwmc_probe(struct platform_device *pdev)
+--
+2.20.1
+
--- /dev/null
+From 57d2b264a1a3b351e73ec2aeb479bf393874bb54 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 14:06:23 +0530
+Subject: reset: Fix memory leak in reset_control_array_put()
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 532f9cd6ee994ed10403e856ca27501428048597 ]
+
+Memory allocated for 'struct reset_control_array' in
+of_reset_control_array_get() is never freed in
+reset_control_array_put() resulting in kmemleak showing
+the following backtrace.
+
+ backtrace:
+ [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0
+ [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180
+ [<000000004cc02754>] 0xffff800008c669e4
+ [<0000000050a83b24>] platform_drv_probe+0x50/0xa0
+ [<00000000d3a0b0bc>] really_probe+0x108/0x348
+ [<000000005aa458ac>] driver_probe_device+0x58/0x100
+ [<000000008853626c>] device_driver_attach+0x6c/0x90
+ [<0000000085308d19>] __driver_attach+0x84/0xc8
+ [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8
+ [<00000000dd7f015b>] driver_attach+0x20/0x28
+ [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0
+ [<0000000061473b66>] driver_register+0x60/0x110
+ [<00000000c5bec167>] __platform_driver_register+0x40/0x48
+ [<000000007c764b4f>] 0xffff800008c6c020
+ [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0
+ [<0000000093d4b50d>] do_init_module+0x54/0x1d0
+
+Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets")
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/reset/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index 213ff40dda110..36b1ff69b1e2a 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -748,6 +748,7 @@ static void reset_control_array_put(struct reset_control_array *resets)
+ for (i = 0; i < resets->num_rstcs; i++)
+ __reset_control_put_internal(resets->rstc[i]);
+ mutex_unlock(&reset_list_mutex);
++ kfree(resets);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 6235cf6ddf236a21608ed8027aa2857a9ea21470 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 22 Oct 2019 20:57:06 -0700
+Subject: reset: fix reset_control_ops kerneldoc comment
+
+From: Randy Dunlap <rdunlap@infradead.org>
+
+[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ]
+
+Add a missing short description to the reset_control_ops documentation.
+
+Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
+[p.zabel@pengutronix.de: rebased and updated commit message]
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/reset-controller.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h
+index 9326d671b6e6c..8675ec64987bb 100644
+--- a/include/linux/reset-controller.h
++++ b/include/linux/reset-controller.h
+@@ -7,7 +7,7 @@
+ struct reset_controller_dev;
+
+ /**
+- * struct reset_control_ops
++ * struct reset_control_ops - reset controller driver callbacks
+ *
+ * @reset: for self-deasserting resets, does all necessary
+ * things to reset the device
+--
+2.20.1
+
--- /dev/null
+From f22c05c7196211dc3fbb48b258b7cfb5d725ea39 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Oct 2019 13:33:07 +0200
+Subject: samples/bpf: fix build by setting HAVE_ATTR_TEST to zero
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Björn Töpel <bjorn.topel@intel.com>
+
+[ Upstream commit 04ec044b7d30800296824783df7d9728d16d7567 ]
+
+To remove that test_attr__{enabled/open} are used by perf-sys.h, we
+set HAVE_ATTR_TEST to zero.
+
+Signed-off-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: KP Singh <kpsingh@google.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Alexei Starovoitov <ast@kernel.org>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: bpf@vger.kernel.org
+Cc: netdev@vger.kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Link: http://lore.kernel.org/bpf/20191001113307.27796-3-bjorn.topel@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ samples/bpf/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile
+index 1d9be26b4edd7..42b571cde1778 100644
+--- a/samples/bpf/Makefile
++++ b/samples/bpf/Makefile
+@@ -176,6 +176,7 @@ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/bpf/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/testing/selftests/bpf/
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/ -I$(srctree)/tools/include
+ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/perf
++KBUILD_HOSTCFLAGS += -DHAVE_ATTR_TEST=0
+
+ HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable
+
+--
+2.20.1
+
--- /dev/null
+From 406ed3e3d140daf5dfe1eaf1ef6af3e53c540aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 5 Nov 2019 21:17:06 -0800
+Subject: scripts/gdb: fix debugging modules compiled with hot/cold
+ partitioning
+
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+
+[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ]
+
+gcc's -freorder-blocks-and-partition option makes it group frequently
+and infrequently used code in .text.hot and .text.unlikely sections
+respectively. At least when building modules on s390, this option is
+used by default.
+
+gdb assumes that all code is located in .text section, and that .text
+section is located at module load address. With such modules this is no
+longer the case: there is code in .text.hot and .text.unlikely, and
+either of them might precede .text.
+
+Fix by explicitly telling gdb the addresses of code sections.
+
+It might be tempting to do this for all sections, not only the ones in
+the white list. Unfortunately, gdb appears to have an issue, when
+telling it about e.g. loadable .note.gnu.build-id section causes it to
+think that non-loadable .note.Linux section is loaded at address 0,
+which in turn causes NULL pointers to be resolved to bogus symbols. So
+keep using the white list approach for the time being.
+
+Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Kieran Bingham <kbingham@kernel.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/gdb/linux/symbols.py | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py
+index 2f5b95f09fa03..3c29504302896 100644
+--- a/scripts/gdb/linux/symbols.py
++++ b/scripts/gdb/linux/symbols.py
+@@ -99,7 +99,8 @@ lx-symbols command."""
+ attrs[n]['name'].string(): attrs[n]['address']
+ for n in range(int(sect_attrs['nsections']))}
+ args = []
+- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]:
++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss",
++ ".text", ".text.hot", ".text.unlikely"]:
+ address = section_name_to_address.get(section_name)
+ if address:
+ args.append(" -s {name} {addr}".format(
+--
+2.20.1
+
io_uring-async-workers-should-inherit-the-user-creds.patch
net-separate-out-the-msghdr-copy-from-___sys_-send-r.patch
net-disallow-ancillary-data-for-__sys_-send-recv-msg.patch
+xarray-fix-xas_next-with-a-single-entry-at-0.patch
+clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch
+clk-at91-sam9x60-fix-programmable-clock.patch
+thunderbolt-read-dp-in-adapter-first-two-dwords-in-o.patch
+thunderbolt-fix-lockdep-circular-locking-depedency-w.patch
+clocksource-drivers-mediatek-fix-error-handling.patch
+soundwire-intel-fix-intel_register_dai-pdi-offsets-a.patch
+asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch
+asoc-compress-fix-unsigned-integer-overflow-check.patch
+reset-fix-memory-leak-in-reset_control_array_put.patch
+clk-samsung-exynos5433-fix-error-paths.patch
+clk-samsung-exynos542x-move-g3d-subsystem-clocks-to-.patch
+asoc-kirkwood-fix-external-clock-probe-defer.patch
+asoc-kirkwood-fix-device-remove-ordering.patch
+arm64-dts-ls1028a-fix-a-compatible-issue.patch
+clk-samsung-exynos5420-preserve-pll-configuration-du.patch
+pinctrl-cherryview-allocate-irq-chip-dynamic.patch
+arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch
+soc-imx-gpc-fix-initialiser-format.patch
+reset-fix-reset_control_ops-kerneldoc-comment.patch
+arm64-dts-imx8mm-fix-compatible-string-for-sdma.patch
+asoc-sof-ipc-fix-memory-leak-in-sof_set_get_large_ct.patch
+asoc-ti-sdma-pcm-add-back-the-flags-parameter-for-no.patch
+asoc-rockchip-rockchip_max98090-enable-shdn-to-fix-h.patch
+clk-at91-avoid-sleeping-early.patch
+clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch
+clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch
+arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch
+bpf-allow-narrow-loads-of-bpf_sysctl-fields-with-off.patch
+samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch
+bpf-change-size-to-u64-for-bpf_map_-area_alloc-charg.patch
+powerpc-bpf-fix-tail-call-implementation.patch
+idr-fix-idr_get_next_ul-race-with-idr_remove.patch
+idr-fix-integer-overflow-in-idr_for_each_entry.patch
+idr-fix-idr_alloc_u32-on-32-bit-systems.patch
+x86-resctrl-prevent-null-pointer-dereference-when-re.patch
+arm64-dts-zii-ultra-fix-arm-regulator-gpio-handle.patch
+fbdev-c2p-fix-link-failure-on-non-inlining.patch
+asoc-hdac_hda-fix-race-in-device-removal.patch
+clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch
+clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch
+net-fec-add-missed-clk_disable_unprepare-in-remove.patch
+netfilter-ipset-fix-nla_policies-to-fully-support-nl.patch
+bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch
+netfilter-nf_tables-bogus-eopnotsupp-on-basechain-up.patch
+netfilter-nf_tables_offload-skip-ebusy-on-chain-upda.patch
+stacktrace-don-t-skip-first-entry-on-noncurrent-task.patch
+can-peak_usb-report-bus-recovery-as-well.patch
+can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch
+can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch
+can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch
+can-rx-offload-can_rx_offload_offload_one-increment-.patch
+can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch
+can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch
+can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch
+can-flexcan-increase-error-counters-if-skb-enqueuein.patch
+x86-tsc-respect-tsc-command-line-paraemeter-for-cloc.patch
+perf-scripting-engines-iterate-on-tep-event-arrays-d.patch
+can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch
+nvme-rdma-fix-a-segmentation-fault-during-module-unl.patch
+nvme-multipath-fix-crash-in-nvme_mpath_clear_ctrl_pa.patch
+watchdog-pm8916_wdt-fix-pretimeout-registration-flow.patch
+watchdog-meson-fix-the-wrong-value-of-left-time.patch
+watchdog-imx_sc_wdt-pretimeout-should-follow-scu-fir.patch
+watchdog-bd70528-add-module_alias-to-allow-module-au.patch
+asoc-stm32-sai-add-restriction-on-mmap-support.patch
+alsa-hda-hdmi-add-tigerlake-support.patch
+arm-dts-stm32-fix-can-ram-mapping-on-stm32mp157c.patch
+asoc-sof-topology-fix-bytes-control-size-checks.patch
+mm-gup_benchmark-fix-map_hugetlb-case.patch
+scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch
+net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch
+net-bcmgenet-reapply-manual-settings-to-the-phy.patch
+drm-amdgpu-dont-schedule-jobs-while-in-reset.patch
+net-mlx5e-fix-eswitch-debug-print-of-max-fdb-flow.patch
+net-mlx5e-use-correct-enum-to-determine-uplink-port.patch
+net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch
+drm-amd-swsmu-fix-smu-workload-bit-map-error.patch
+drm-amdgpu-register-gpu-instance-before-fan-boost-fe.patch
+drm-amdgpu-add-warning-for-grbm-1-cycle-delay-issue-.patch
+net-stmmac-gmac4-bitrev32-returns-u32.patch
+net-stmmac-xgmac-bitrev32-returns-u32.patch
+net-stmmac-xgmac-fix-tsa-selection.patch
+net-stmmac-xgmac-disable-flow-control-when-1-or-more.patch
+ceph-return-einval-if-given-fsc-mount-option-on-kern.patch
+mac80211-fix-ieee80211_txq_setup_flows-failure-path.patch
+net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch
+mac80211-fix-station-inactive_time-shortly-after-boo.patch
+block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch
+pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch
+ice-fix-potential-infinite-loop-because-loop-counter.patch
+iavf-initialize-itrn-registers-with-correct-values.patch
+i40e-fix-for-ethtool-m-issue-on-x722-nic.patch
--- /dev/null
+From 7518a65f69026c217e4ed999182105052cb8c172 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 15 Oct 2019 15:09:09 +0100
+Subject: soc: imx: gpc: fix initialiser format
+
+From: Ben Dooks <ben.dooks@codethink.co.uk>
+
+[ Upstream commit 96ed1044fa98ea9e164fc1e679cad61575bf4f32 ]
+
+Make the initialiers in imx_gpc_domains C99 format to fix the
+following sparse warnings:
+
+drivers/soc/imx/gpc.c:252:30: warning: obsolete array initializer, use C99 syntax
+drivers/soc/imx/gpc.c:258:29: warning: obsolete array initializer, use C99 syntax
+drivers/soc/imx/gpc.c:269:34: warning: obsolete array initializer, use C99 syntax
+drivers/soc/imx/gpc.c:278:30: warning: obsolete array initializer, use C99 syntax
+
+Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Fixes: b0682d485f12 ("soc: imx: gpc: use GPC_PGC_DOMAIN_* indexes")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/imx/gpc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c
+index d9231bd3c691a..98b9d9a902ae3 100644
+--- a/drivers/soc/imx/gpc.c
++++ b/drivers/soc/imx/gpc.c
+@@ -249,13 +249,13 @@ static struct genpd_power_state imx6_pm_domain_pu_state = {
+ };
+
+ static struct imx_pm_domain imx_gpc_domains[] = {
+- [GPC_PGC_DOMAIN_ARM] {
++ [GPC_PGC_DOMAIN_ARM] = {
+ .base = {
+ .name = "ARM",
+ .flags = GENPD_FLAG_ALWAYS_ON,
+ },
+ },
+- [GPC_PGC_DOMAIN_PU] {
++ [GPC_PGC_DOMAIN_PU] = {
+ .base = {
+ .name = "PU",
+ .power_off = imx6_pm_domain_power_off,
+@@ -266,7 +266,7 @@ static struct imx_pm_domain imx_gpc_domains[] = {
+ .reg_offs = 0x260,
+ .cntr_pdn_bit = 0,
+ },
+- [GPC_PGC_DOMAIN_DISPLAY] {
++ [GPC_PGC_DOMAIN_DISPLAY] = {
+ .base = {
+ .name = "DISPLAY",
+ .power_off = imx6_pm_domain_power_off,
+@@ -275,7 +275,7 @@ static struct imx_pm_domain imx_gpc_domains[] = {
+ .reg_offs = 0x240,
+ .cntr_pdn_bit = 4,
+ },
+- [GPC_PGC_DOMAIN_PCI] {
++ [GPC_PGC_DOMAIN_PCI] = {
+ .base = {
+ .name = "PCI",
+ .power_off = imx6_pm_domain_power_off,
+--
+2.20.1
+
--- /dev/null
+From c4cbf6519e27fe96e8ed2e8789ff3cf6a42288ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 16 Sep 2019 14:23:43 -0500
+Subject: soundwire: intel: fix intel_register_dai PDI offsets and numbers
+
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+
+[ Upstream commit cf9249626f72878b6d205a4965093cba5cce98df ]
+
+There are two issues, likely copy/paste:
+
+1. Use cdns->pcm.num_in instead of stream_num_in for consistency with
+the rest of the code. This was not detected earlier since platforms did
+not have input-only PDIs.
+
+2. use the correct offset for bi-dir PDM, based on IN and OUT
+PDIs. Again this was not detected since PDM was not supported earlier.
+
+Reported-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com>
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Link: https://lore.kernel.org/r/20190916192348.467-2-pierre-louis.bossart@linux.intel.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soundwire/intel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
+index ec25a71d08873..db9c138adb1ff 100644
+--- a/drivers/soundwire/intel.c
++++ b/drivers/soundwire/intel.c
+@@ -765,7 +765,7 @@ static int intel_register_dai(struct sdw_intel *sdw)
+ /* Create PCM DAIs */
+ stream = &cdns->pcm;
+
+- ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, stream->num_in,
++ ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, cdns->pcm.num_in,
+ off, stream->num_ch_in, true);
+ if (ret)
+ return ret;
+@@ -796,7 +796,7 @@ static int intel_register_dai(struct sdw_intel *sdw)
+ if (ret)
+ return ret;
+
+- off += cdns->pdm.num_bd;
++ off += cdns->pdm.num_out;
+ ret = intel_create_dai(cdns, dais, INTEL_PDI_BD, cdns->pdm.num_bd,
+ off, stream->num_ch_bd, false);
+ if (ret)
+--
+2.20.1
+
--- /dev/null
+From 4dad81d2d3579335d4633731b6d3d7ad02f79a5e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 30 Oct 2019 08:25:45 +0100
+Subject: stacktrace: Don't skip first entry on noncurrent tasks
+
+From: Jiri Slaby <jslaby@suse.cz>
+
+[ Upstream commit b0c51f158455e31d5024100cf3580fcd88214b0e ]
+
+When doing cat /proc/<PID>/stack, the output is missing the first entry.
+When the current code walks the stack starting in stack_trace_save_tsk,
+it skips all scheduler functions (that's OK) plus one more function. But
+this one function should be skipped only for the 'current' task as it is
+stack_trace_save_tsk proper.
+
+The original code (before the common infrastructure) skipped one
+function only for the 'current' task -- see save_stack_trace_tsk before
+3599fe12a125. So do so also in the new infrastructure now.
+
+Fixes: 214d8ca6ee85 ("stacktrace: Provide common infrastructure")
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Michal Suchanek <msuchanek@suse.de>
+Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Link: https://lkml.kernel.org/r/20191030072545.19462-1-jslaby@suse.cz
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/stacktrace.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c
+index f5440abb75329..9bbfbdb96ae51 100644
+--- a/kernel/stacktrace.c
++++ b/kernel/stacktrace.c
+@@ -141,7 +141,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *tsk, unsigned long *store,
+ struct stacktrace_cookie c = {
+ .store = store,
+ .size = size,
+- .skip = skipnr + 1,
++ /* skip this function if they are tracing us */
++ .skip = skipnr + !!(current == tsk),
+ };
+
+ if (!try_get_task_stack(tsk))
+@@ -298,7 +299,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *task,
+ struct stack_trace trace = {
+ .entries = store,
+ .max_entries = size,
+- .skip = skipnr + 1,
++ /* skip this function if they are tracing us */
++ .skip = skipnr + !!(current == task),
+ };
+
+ save_stack_trace_tsk(task, &trace);
+--
+2.20.1
+
--- /dev/null
+From 68a7049bcc641c6a732d13688b6aa1bd590ee4eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 15:28:58 +0300
+Subject: thunderbolt: Fix lockdep circular locking depedency warning
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 6f6709734274aef75058356e029d5e8f86d0d53b ]
+
+When lockdep is enabled, plugging Thunderbolt dock on Dominik's laptop
+triggers following splat:
+
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 5.3.0-rc6+ #1 Tainted: G T
+ ------------------------------------------------------
+ pool-/usr/lib/b/1258 is trying to acquire lock:
+ 000000005ab0ad43 (pci_rescan_remove_lock){+.+.}, at: authorized_store+0xe8/0x210
+
+ but task is already holding lock:
+ 00000000bfb796b5 (&tb->lock){+.+.}, at: authorized_store+0x7c/0x210
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #1 (&tb->lock){+.+.}:
+ __mutex_lock+0xac/0x9a0
+ tb_domain_add+0x2d/0x130
+ nhi_probe+0x1dd/0x330
+ pci_device_probe+0xd2/0x150
+ really_probe+0xee/0x280
+ driver_probe_device+0x50/0xc0
+ bus_for_each_drv+0x84/0xd0
+ __device_attach+0xe4/0x150
+ pci_bus_add_device+0x4e/0x70
+ pci_bus_add_devices+0x2e/0x66
+ pci_bus_add_devices+0x59/0x66
+ pci_bus_add_devices+0x59/0x66
+ enable_slot+0x344/0x450
+ acpiphp_check_bridge.part.0+0x119/0x150
+ acpiphp_hotplug_notify+0xaa/0x140
+ acpi_device_hotplug+0xa2/0x3f0
+ acpi_hotplug_work_fn+0x1a/0x30
+ process_one_work+0x234/0x580
+ worker_thread+0x50/0x3b0
+ kthread+0x10a/0x140
+ ret_from_fork+0x3a/0x50
+
+ -> #0 (pci_rescan_remove_lock){+.+.}:
+ __lock_acquire+0xe54/0x1ac0
+ lock_acquire+0xb8/0x1b0
+ __mutex_lock+0xac/0x9a0
+ authorized_store+0xe8/0x210
+ kernfs_fop_write+0x125/0x1b0
+ vfs_write+0xc2/0x1d0
+ ksys_write+0x6c/0xf0
+ do_syscall_64+0x50/0x180
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+ other info that might help us debug this:
+ Possible unsafe locking scenario:
+ CPU0 CPU1
+ ---- ----
+ lock(&tb->lock);
+ lock(pci_rescan_remove_lock);
+ lock(&tb->lock);
+ lock(pci_rescan_remove_lock);
+
+ *** DEADLOCK ***
+ 5 locks held by pool-/usr/lib/b/1258:
+ #0: 000000003df1a1ad (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x4d/0x60
+ #1: 0000000095a40b02 (sb_writers#6){.+.+}, at: vfs_write+0x185/0x1d0
+ #2: 0000000017a7d714 (&of->mutex){+.+.}, at: kernfs_fop_write+0xf2/0x1b0
+ #3: 000000004f262981 (kn->count#208){.+.+}, at: kernfs_fop_write+0xfa/0x1b0
+ #4: 00000000bfb796b5 (&tb->lock){+.+.}, at: authorized_store+0x7c/0x210
+
+ stack backtrace:
+ CPU: 0 PID: 1258 Comm: pool-/usr/lib/b Tainted: G T 5.3.0-rc6+ #1
+
+On an system using ACPI hotplug the host router gets hotplugged first and then
+the firmware starts sending notifications about connected devices so the above
+scenario should not happen in reality. However, after taking a second
+look at commit a03e828915c0 ("thunderbolt: Serialize PCIe tunnel
+creation with PCI rescan") that introduced the locking, I don't think it
+is actually correct. It may have cured the symptom but probably the real
+root cause was somewhere closer to PCI stack and possibly is already
+fixed with recent kernels. I also tried to reproduce the original issue
+with the commit reverted but could not.
+
+So to keep lockdep happy and the code bit less complex drop calls to
+pci_lock_rescan_remove()/pci_unlock_rescan_remove() in
+tb_switch_set_authorized() effectively reverting a03e828915c0.
+
+Link: https://lkml.org/lkml/2019/8/30/513
+Fixes: a03e828915c0 ("thunderbolt: Serialize PCIe tunnel creation with PCI rescan")
+Reported-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/switch.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 00daf5a7f46a5..28395c3dcfed5 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -1025,13 +1025,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
+ if (sw->authorized)
+ goto unlock;
+
+- /*
+- * Make sure there is no PCIe rescan ongoing when a new PCIe
+- * tunnel is created. Otherwise the PCIe rescan code might find
+- * the new tunnel too early.
+- */
+- pci_lock_rescan_remove();
+-
+ switch (val) {
+ /* Approve switch */
+ case 1:
+@@ -1051,8 +1044,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val)
+ break;
+ }
+
+- pci_unlock_rescan_remove();
+-
+ if (!ret) {
+ sw->authorized = val;
+ /* Notify status change to the userspace */
+--
+2.20.1
+
--- /dev/null
+From c81e5bd708e346df613651370758444d36016ddb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Sep 2019 14:55:23 +0300
+Subject: thunderbolt: Read DP IN adapter first two dwords in one go
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit fd5c46b754d4799afda8dcdd6851e0390aa4961a ]
+
+When we discover existing DP tunnels the code checks whether DP IN
+adapter port is enabled by calling tb_dp_port_is_enabled() before it
+continues the discovery process. On Light Ridge (gen 1) controller
+reading only the first dword of the DP IN config space causes subsequent
+access to the same DP IN port path config space to fail or return
+invalid data as can be seen in the below splat:
+
+ thunderbolt 0000:07:00.0: CFG_ERROR(0:d): Invalid config space or offset
+ Call Trace:
+ tb_cfg_read+0xb9/0xd0
+ __tb_path_deactivate_hop+0x98/0x210
+ tb_path_activate+0x228/0x7d0
+ tb_tunnel_restart+0x95/0x200
+ tb_handle_hotplug+0x30e/0x630
+ process_one_work+0x1b4/0x340
+ worker_thread+0x44/0x3d0
+ kthread+0xeb/0x120
+ ? process_one_work+0x340/0x340
+ ? kthread_park+0xa0/0xa0
+ ret_from_fork+0x1f/0x30
+
+If both DP In adapter config dwords are read in one go the issue does
+not reproduce. This is likely firmware bug but we can work it around by
+always reading the two dwords in one go. There should be no harm for
+other controllers either so can do it unconditionally.
+
+Link: https://lkml.org/lkml/2019/8/28/160
+Reported-by: Brad Campbell <lists2009@fnarfbargle.com>
+Tested-by: Brad Campbell <lists2009@fnarfbargle.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/thunderbolt/switch.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
+index 5668a44e0653b..00daf5a7f46a5 100644
+--- a/drivers/thunderbolt/switch.c
++++ b/drivers/thunderbolt/switch.c
+@@ -887,12 +887,13 @@ int tb_dp_port_set_hops(struct tb_port *port, unsigned int video,
+ */
+ bool tb_dp_port_is_enabled(struct tb_port *port)
+ {
+- u32 data;
++ u32 data[2];
+
+- if (tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1))
++ if (tb_port_read(port, data, TB_CFG_PORT, port->cap_adap,
++ ARRAY_SIZE(data)))
+ return false;
+
+- return !!(data & (TB_DP_VIDEO_EN | TB_DP_AUX_EN));
++ return !!(data[0] & (TB_DP_VIDEO_EN | TB_DP_AUX_EN));
+ }
+
+ /**
+@@ -905,19 +906,21 @@ bool tb_dp_port_is_enabled(struct tb_port *port)
+ */
+ int tb_dp_port_enable(struct tb_port *port, bool enable)
+ {
+- u32 data;
++ u32 data[2];
+ int ret;
+
+- ret = tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1);
++ ret = tb_port_read(port, data, TB_CFG_PORT, port->cap_adap,
++ ARRAY_SIZE(data));
+ if (ret)
+ return ret;
+
+ if (enable)
+- data |= TB_DP_VIDEO_EN | TB_DP_AUX_EN;
++ data[0] |= TB_DP_VIDEO_EN | TB_DP_AUX_EN;
+ else
+- data &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN);
++ data[0] &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN);
+
+- return tb_port_write(port, &data, TB_CFG_PORT, port->cap_adap, 1);
++ return tb_port_write(port, data, TB_CFG_PORT, port->cap_adap,
++ ARRAY_SIZE(data));
+ }
+
+ /* switch utility functions */
+--
+2.20.1
+
--- /dev/null
+From 75640551116dab85272284bae50c578f2e4155cd Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 23 Oct 2019 15:41:59 +0300
+Subject: watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading
+
+From: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+
+[ Upstream commit 81363f248aecd2b5f10547af268a4dfaf8963489 ]
+
+The bd70528 watchdog driver is probed by MFD driver. Add MODULE_ALIAS
+in order to allow udev to load the module when MFD sub-device cell for
+watchdog is added.
+
+Fixes: bbc88a0ec9f37 ("watchdog: bd70528: Initial support for ROHM BD70528 watchdog block")
+Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/bd70528_wdt.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/watchdog/bd70528_wdt.c b/drivers/watchdog/bd70528_wdt.c
+index b0152fef4fc7e..bc60e036627af 100644
+--- a/drivers/watchdog/bd70528_wdt.c
++++ b/drivers/watchdog/bd70528_wdt.c
+@@ -288,3 +288,4 @@ module_platform_driver(bd70528_wdt);
+ MODULE_AUTHOR("Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>");
+ MODULE_DESCRIPTION("BD70528 watchdog driver");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("platform:bd70528-wdt");
+--
+2.20.1
+
--- /dev/null
+From 106ed3e7bf15108651711e733c5ab17ce65b3aaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 9 Oct 2019 15:37:47 +0800
+Subject: watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format
+
+From: Anson Huang <Anson.Huang@nxp.com>
+
+[ Upstream commit 2c50a6b825b3463a7600d6e6acadba73211c3d2c ]
+
+SCU firmware calculates pretimeout based on current time stamp
+instead of watchdog timeout stamp, need to convert the pretimeout
+to SCU firmware's timeout value.
+
+Fixes: 15f7d7fc5542 ("watchdog: imx_sc: Add pretimeout support")
+Signed-off-by: Anson Huang <Anson.Huang@nxp.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/imx_sc_wdt.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/watchdog/imx_sc_wdt.c b/drivers/watchdog/imx_sc_wdt.c
+index 78eaaf75a263f..9545d1e07421a 100644
+--- a/drivers/watchdog/imx_sc_wdt.c
++++ b/drivers/watchdog/imx_sc_wdt.c
+@@ -99,8 +99,14 @@ static int imx_sc_wdt_set_pretimeout(struct watchdog_device *wdog,
+ {
+ struct arm_smccc_res res;
+
++ /*
++ * SCU firmware calculates pretimeout based on current time
++ * stamp instead of watchdog timeout stamp, need to convert
++ * the pretimeout to SCU firmware's timeout value.
++ */
+ arm_smccc_smc(IMX_SIP_TIMER, IMX_SIP_TIMER_SET_PRETIME_WDOG,
+- pretimeout * 1000, 0, 0, 0, 0, 0, &res);
++ (wdog->timeout - pretimeout) * 1000, 0, 0, 0,
++ 0, 0, &res);
+ if (res.a0)
+ return -EACCES;
+
+--
+2.20.1
+
--- /dev/null
+From f6e58b458b751422b5e9e32f1b2237f60837f8b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 29 Sep 2019 18:53:49 +0800
+Subject: watchdog: meson: Fix the wrong value of left time
+
+From: Xingyu Chen <xingyu.chen@amlogic.com>
+
+[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ]
+
+The left time value is wrong when we get it by sysfs. The left time value
+should be equal to preset timeout value minus elapsed time value. According
+to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value
+is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved
+to BIT[16-31] of the WATCHDOG_TCNT.
+
+[0]: http://linux-meson.com
+
+Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver")
+Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
+Acked-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/meson_gxbb_wdt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c
+index d17c1a6ed7234..5a9ca10fbcfa0 100644
+--- a/drivers/watchdog/meson_gxbb_wdt.c
++++ b/drivers/watchdog/meson_gxbb_wdt.c
+@@ -89,8 +89,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev)
+
+ reg = readl(data->reg_base + GXBB_WDT_TCNT_REG);
+
+- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) -
+- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000;
++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) -
++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000;
+ }
+
+ static const struct watchdog_ops meson_gxbb_wdt_ops = {
+--
+2.20.1
+
--- /dev/null
+From 424a33839da171668b496d8981a6e8150f867ebb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 6 Sep 2019 22:30:53 +0200
+Subject: watchdog: pm8916_wdt: fix pretimeout registration flow
+
+From: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+
+[ Upstream commit 1993f1d7ca3f315e0459c58c8e7038039a96dd85 ]
+
+When an IRQ is present in the dts, the probe function shall fail if
+the interrupt can not be registered.
+
+The probe function shall also be retried if getting the irq is being
+deferred.
+
+Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+Reviewed-by: Loic Poulain <loic.poulain@linaro.org>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/watchdog/pm8916_wdt.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/watchdog/pm8916_wdt.c b/drivers/watchdog/pm8916_wdt.c
+index 2d3652004e39c..1213179f863c2 100644
+--- a/drivers/watchdog/pm8916_wdt.c
++++ b/drivers/watchdog/pm8916_wdt.c
+@@ -163,9 +163,17 @@ static int pm8916_wdt_probe(struct platform_device *pdev)
+
+ irq = platform_get_irq(pdev, 0);
+ if (irq > 0) {
+- if (devm_request_irq(dev, irq, pm8916_wdt_isr, 0, "pm8916_wdt",
+- wdt))
+- irq = 0;
++ err = devm_request_irq(dev, irq, pm8916_wdt_isr, 0,
++ "pm8916_wdt", wdt);
++ if (err)
++ return err;
++
++ wdt->wdev.info = &pm8916_wdt_pt_ident;
++ } else {
++ if (irq == -EPROBE_DEFER)
++ return -EPROBE_DEFER;
++
++ wdt->wdev.info = &pm8916_wdt_ident;
+ }
+
+ /* Configure watchdog to hard-reset mode */
+@@ -177,7 +185,6 @@ static int pm8916_wdt_probe(struct platform_device *pdev)
+ return err;
+ }
+
+- wdt->wdev.info = (irq > 0) ? &pm8916_wdt_pt_ident : &pm8916_wdt_ident,
+ wdt->wdev.ops = &pm8916_wdt_ops,
+ wdt->wdev.parent = dev;
+ wdt->wdev.min_timeout = PM8916_WDT_MIN_TIMEOUT;
+--
+2.20.1
+
--- /dev/null
+From 520aa09cafbbc7432cd976e7d1bc03177c2825e5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 29 Oct 2019 13:25:02 +0800
+Subject: x86/resctrl: Prevent NULL pointer dereference when reading mondata
+
+From: Xiaochen Shen <xiaochen.shen@intel.com>
+
+[ Upstream commit 26467b0f8407cbd628fa5b7bcfd156e772004155 ]
+
+When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED
+in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed
+until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later.
+
+During the window of deleting a mon group, if an application calls
+rdtgroup_mondata_show() to read mondata under this mon group,
+'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when
+rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path:
+rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count().
+Thus it results in NULL pointer dereference in mon_event_count().
+
+Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT
+immediately when reading mondata during the window of deleting a mon
+group.
+
+Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data")
+Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>
+Reviewed-by: Tony Luck <tony.luck@intel.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: pei.p.jia@intel.com
+Cc: Reinette Chatre <reinette.chatre@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
+index efbd54cc4e696..055c8613b5317 100644
+--- a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
++++ b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c
+@@ -522,6 +522,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg)
+ int ret = 0;
+
+ rdtgrp = rdtgroup_kn_lock_live(of->kn);
++ if (!rdtgrp) {
++ ret = -ENOENT;
++ goto out;
++ }
+
+ md.priv = of->kn->priv;
+ resid = md.u.rid;
+--
+2.20.1
+
--- /dev/null
+From ca863d68a153777a97553831b08a0cd9a14729f0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 24 Oct 2019 13:59:45 -0400
+Subject: x86/tsc: Respect tsc command line paraemeter for
+ clocksource_tsc_early
+
+From: Michael Zhivich <mzhivich@akamai.com>
+
+[ Upstream commit 63ec58b44fcc05efd1542045abd7faf056ac27d9 ]
+
+The introduction of clocksource_tsc_early broke the functionality of
+"tsc=reliable" and "tsc=nowatchdog" command line parameters, since
+clocksource_tsc_early is unconditionally registered with
+CLOCK_SOURCE_MUST_VERIFY and thus put on the watchdog list.
+
+This can cause the TSC to be declared unstable during boot:
+
+ clocksource: timekeeping watchdog on CPU0: Marking clocksource
+ 'tsc-early' as unstable because the skew is too large:
+ clocksource: 'refined-jiffies' wd_now: fffb7018 wd_last: fffb6e9d
+ mask: ffffffff
+ clocksource: 'tsc-early' cs_now: 68a6a7070f6a0 cs_last: 68a69ab6f74d6
+ mask: ffffffffffffffff
+ tsc: Marking TSC unstable due to clocksource watchdog
+
+The corresponding elapsed times are cs_nsec=1224152026 and wd_nsec=378942392, so
+the watchdog differs from TSC by 0.84 seconds.
+
+This happens when HPET is not available and jiffies are used as the TSC
+watchdog instead and the jiffies update is not happening due to lost timer
+interrupts in periodic mode, which can happen e.g. with expensive debug
+mechanisms enabled or under massive overload conditions in virtualized
+environments.
+
+Before the introduction of the early TSC clocksource the command line
+parameters "tsc=reliable" and "tsc=nowatchdog" could be used to work around
+this issue.
+
+Restore the behaviour by disabling the watchdog if requested on the kernel
+command line.
+
+[ tglx: Clarify changelog ]
+
+Fixes: aa83c45762a24 ("x86/tsc: Introduce early tsc clocksource")
+Signed-off-by: Michael Zhivich <mzhivich@akamai.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20191024175945.14338-1-mzhivich@akamai.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/tsc.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index 57d87f79558f2..04dd3cc6c6edd 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -1505,6 +1505,9 @@ void __init tsc_init(void)
+ return;
+ }
+
++ if (tsc_clocksource_reliable || no_tsc_watchdog)
++ clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY;
++
+ clocksource_register_khz(&clocksource_tsc_early, tsc_khz);
+ detect_art();
+ }
+--
+2.20.1
+
--- /dev/null
+From 24ed96e22e327ea815d8bae08b49b419ac946c96 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 1 Jul 2019 17:03:29 -0400
+Subject: XArray: Fix xas_next() with a single entry at 0
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit 91abab83839aa2eba073e4a63c729832fdb27ea1 ]
+
+If there is only a single entry at 0, the first time we call xas_next(),
+we return the entry. Unfortunately, all subsequent times we call
+xas_next(), we also return the entry at 0 instead of noticing that the
+xa_index is now greater than zero. This broke find_get_pages_contig().
+
+Fixes: 64d3e9a9e0cc ("xarray: Step through an XArray")
+Reported-by: Kent Overstreet <kent.overstreet@gmail.com>
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/test_xarray.c | 24 ++++++++++++++++++++++++
+ lib/xarray.c | 4 ++++
+ 2 files changed, 28 insertions(+)
+
+diff --git a/lib/test_xarray.c b/lib/test_xarray.c
+index 9d631a7b6a705..7df4f7f395bf2 100644
+--- a/lib/test_xarray.c
++++ b/lib/test_xarray.c
+@@ -1110,6 +1110,28 @@ static noinline void check_find_entry(struct xarray *xa)
+ XA_BUG_ON(xa, !xa_empty(xa));
+ }
+
++static noinline void check_move_tiny(struct xarray *xa)
++{
++ XA_STATE(xas, xa, 0);
++
++ XA_BUG_ON(xa, !xa_empty(xa));
++ rcu_read_lock();
++ XA_BUG_ON(xa, xas_next(&xas) != NULL);
++ XA_BUG_ON(xa, xas_next(&xas) != NULL);
++ rcu_read_unlock();
++ xa_store_index(xa, 0, GFP_KERNEL);
++ rcu_read_lock();
++ xas_set(&xas, 0);
++ XA_BUG_ON(xa, xas_next(&xas) != xa_mk_index(0));
++ XA_BUG_ON(xa, xas_next(&xas) != NULL);
++ xas_set(&xas, 0);
++ XA_BUG_ON(xa, xas_prev(&xas) != xa_mk_index(0));
++ XA_BUG_ON(xa, xas_prev(&xas) != NULL);
++ rcu_read_unlock();
++ xa_erase_index(xa, 0);
++ XA_BUG_ON(xa, !xa_empty(xa));
++}
++
+ static noinline void check_move_small(struct xarray *xa, unsigned long idx)
+ {
+ XA_STATE(xas, xa, 0);
+@@ -1217,6 +1239,8 @@ static noinline void check_move(struct xarray *xa)
+
+ xa_destroy(xa);
+
++ check_move_tiny(xa);
++
+ for (i = 0; i < 16; i++)
+ check_move_small(xa, 1UL << i);
+
+diff --git a/lib/xarray.c b/lib/xarray.c
+index 446b956c91888..1237c213f52bc 100644
+--- a/lib/xarray.c
++++ b/lib/xarray.c
+@@ -994,6 +994,8 @@ void *__xas_prev(struct xa_state *xas)
+
+ if (!xas_frozen(xas->xa_node))
+ xas->xa_index--;
++ if (!xas->xa_node)
++ return set_bounds(xas);
+ if (xas_not_node(xas->xa_node))
+ return xas_load(xas);
+
+@@ -1031,6 +1033,8 @@ void *__xas_next(struct xa_state *xas)
+
+ if (!xas_frozen(xas->xa_node))
+ xas->xa_index++;
++ if (!xas->xa_node)
++ return set_bounds(xas);
+ if (xas_not_node(xas->xa_node))
+ return xas_load(xas);
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
