--- /dev/null
+From 48e54cd0417880b610e30ed303cde09c56b74adb Mon Sep 17 00:00:00 2001
+From: Vijendar Mukunda <Vijendar.Mukunda@amd.com>
+Date: Fri, 2 Aug 2019 19:21:23 +0530
+Subject: ASoC: amd: acp3x: use dma_ops of parent device for acp3x dma driver
+
+[ Upstream commit 88639051017fb61a414b636dd0fc490da2b62b64 ]
+
+AMD platform device acp3x_rv_i2s created by parent PCI device
+driver. Pass struct device of the parent to
+snd_pcm_lib_preallocate_pages() so dma_alloc_coherent() can use
+correct dma_ops. Otherwise, it will use default dma_ops which
+is nommu_dma_ops on x86_64 even when IOMMU is enabled and
+set to non passthrough mode.
+
+Signed-off-by: Vijendar Mukunda <vijendar.mukunda@amd.com>
+Link: https://lore.kernel.org/r/1564753899-17124-1-git-send-email-Vijendar.Mukunda@amd.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/amd/raven/acp3x-pcm-dma.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c
+index 9775bda2a4ca3..d8aa6ab3f68bc 100644
+--- a/sound/soc/amd/raven/acp3x-pcm-dma.c
++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c
+@@ -367,9 +367,11 @@ static snd_pcm_uframes_t acp3x_dma_pointer(struct snd_pcm_substream *substream)
+
+ static int acp3x_dma_new(struct snd_soc_pcm_runtime *rtd)
+ {
++ struct snd_soc_component *component = snd_soc_rtdcom_lookup(rtd,
++ DRV_NAME);
++ struct device *parent = component->dev->parent;
+ snd_pcm_lib_preallocate_pages_for_all(rtd->pcm, SNDRV_DMA_TYPE_DEV,
+- rtd->pcm->card->dev,
+- MIN_BUFFER, MAX_BUFFER);
++ parent, MIN_BUFFER, MAX_BUFFER);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 1f3aada3fe075634d99094dfc047328161ebf785 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Thu, 11 Jul 2019 13:10:45 +0900
+Subject: ASoC: audio-graph-card: add missing const at graph_get_dai_id()
+
+[ Upstream commit ec3042ad39d4e2ddbc3a3344f90bb10d8feb53bc ]
+
+commit c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in
+graph_get_dai_id()") fixups use-after-free issue,
+but, it need to use "const" for reg. This patch adds it.
+
+We will have below without this patch
+
+LINUX/sound/soc/generic/audio-graph-card.c: In function 'graph_get_dai_id':
+LINUX/sound/soc/generic/audio-graph-card.c:87:7: warning: assignment discards\
+ 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
+ reg = of_get_property(node, "reg", NULL);
+
+Fixes: c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()")
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Acked-by: Wen Yang <wen.yang99@zte.com.cn>
+Link: https://lore.kernel.org/r/87sgrd43ja.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/audio-graph-card.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index a681ea443fc16..6398741ebd0ef 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -63,7 +63,7 @@ static int graph_get_dai_id(struct device_node *ep)
+ struct device_node *endpoint;
+ struct of_endpoint info;
+ int i, id;
+- u32 *reg;
++ const u32 *reg;
+ int ret;
+
+ /* use driver specified DAI ID if exist */
+--
+2.20.1
+
--- /dev/null
+From bd0a9f03b7cd9871fa81810fd4a7e980c0a009a2 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Wed, 10 Jul 2019 15:25:09 +0800
+Subject: ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()
+
+[ Upstream commit c152f8491a8d9a4b25afd65a86eb5e55e2a8c380 ]
+
+After calling of_node_put() on the node variable, it is still being
+used, which may result in use-after-free.
+Fix this issue by calling of_node_put() after the last usage.
+
+Fixes: a0c426fe1433 ("ASoC: simple-card-utils: check "reg" property on asoc_simple_card_get_dai_id()")
+Link: https://lore.kernel.org/r/1562743509-30496-5-git-send-email-wen.yang99@zte.com.cn
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/audio-graph-card.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index d5188a179378f..a681ea443fc16 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -63,6 +63,7 @@ static int graph_get_dai_id(struct device_node *ep)
+ struct device_node *endpoint;
+ struct of_endpoint info;
+ int i, id;
++ u32 *reg;
+ int ret;
+
+ /* use driver specified DAI ID if exist */
+@@ -83,8 +84,9 @@ static int graph_get_dai_id(struct device_node *ep)
+ return info.id;
+
+ node = of_get_parent(ep);
++ reg = of_get_property(node, "reg", NULL);
+ of_node_put(node);
+- if (of_get_property(node, "reg", NULL))
++ if (reg)
+ return info.port;
+ }
+ node = of_graph_get_port_parent(ep);
+--
+2.20.1
+
--- /dev/null
+From 1b8def342f410e60183a74b2a6256508db09cd41 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Wed, 10 Jul 2019 15:25:08 +0800
+Subject: ASoC: audio-graph-card: fix use-after-free in
+ graph_dai_link_of_dpcm()
+
+[ Upstream commit aa2e362cb6b3f5ca88093ada01e1a0ace8a517b2 ]
+
+After calling of_node_put() on the ports, port, and node variables,
+they are still being used, which may result in use-after-free.
+Fix this issue by calling of_node_put() after the last usage.
+
+Fixes: dd98fbc558a0 ("ASoC: audio-graph-card: cleanup DAI link loop method - step1")
+Link: https://lore.kernel.org/r/1562743509-30496-4-git-send-email-wen.yang99@zte.com.cn
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/audio-graph-card.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c
+index 70ed28d97d497..d5188a179378f 100644
+--- a/sound/soc/generic/audio-graph-card.c
++++ b/sound/soc/generic/audio-graph-card.c
+@@ -222,10 +222,6 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ dev_dbg(dev, "link_of DPCM (%pOF)\n", ep);
+
+- of_node_put(ports);
+- of_node_put(port);
+- of_node_put(node);
+-
+ if (li->cpu) {
+ int is_single_links = 0;
+
+@@ -243,17 +239,17 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ ret = asoc_simple_parse_cpu(ep, dai_link, &is_single_links);
+ if (ret)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_parse_clk_cpu(dev, ep, dai_link, dai);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_set_dailink_name(dev, dai_link,
+ "fe.%s",
+ dai_link->cpu_dai_name);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ /* card->num_links includes Codec */
+ asoc_simple_canonicalize_cpu(dai_link, is_single_links);
+@@ -277,17 +273,17 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ ret = asoc_simple_parse_codec(ep, dai_link);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_parse_clk_codec(dev, ep, dai_link, dai);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_set_dailink_name(dev, dai_link,
+ "be.%s",
+ codecs->dai_name);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ /* check "prefix" from top node */
+ snd_soc_of_parse_node_prefix(top, cconf, codecs->of_node,
+@@ -307,19 +303,23 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ ret = asoc_simple_parse_tdm(ep, dai);
+ if (ret)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_parse_daifmt(dev, cpu_ep, codec_ep,
+ NULL, &dai_link->dai_fmt);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ dai_link->dpcm_playback = 1;
+ dai_link->dpcm_capture = 1;
+ dai_link->ops = &graph_ops;
+ dai_link->init = asoc_simple_dai_init;
+
+- return 0;
++out_put_node:
++ of_node_put(ports);
++ of_node_put(port);
++ of_node_put(node);
++ return ret;
+ }
+
+ static int graph_dai_link_of(struct asoc_simple_priv *priv,
+--
+2.20.1
+
--- /dev/null
+From e6ff0657812277c1799bbe4de29f756f9c4e5470 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Mon, 22 Jul 2019 08:57:44 -0500
+Subject: ASoC: dapm: fix a memory leak bug
+
+[ Upstream commit 45004d66f2a28d78f543fb2ffbc133e31dc2d162 ]
+
+In snd_soc_dapm_new_control_unlocked(), a kernel buffer is allocated in
+dapm_cnew_widget() to hold the new dapm widget. Then, different actions are
+taken according to the id of the widget, i.e., 'w->id'. If any failure
+occurs during this process, snd_soc_dapm_new_control_unlocked() should be
+terminated by going to the 'request_failed' label. However, the allocated
+kernel buffer is not freed on this code path, leading to a memory leak bug.
+
+To fix the above issue, free the buffer before returning from
+snd_soc_dapm_new_control_unlocked() through the 'request_failed' label.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Link: https://lore.kernel.org/r/1563803864-2809-1-git-send-email-wang6495@umn.edu
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 835ce1ff188d9..f40adb604c25b 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3705,6 +3705,8 @@ request_failed:
+ dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n",
+ w->name, ret);
+
++ kfree_const(w->sname);
++ kfree(w);
+ return ERR_PTR(ret);
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 9406ac2faa7762af4933c3b9ad5d52cb3041182d Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 18 Jul 2019 09:43:33 +0100
+Subject: ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
+
+[ Upstream commit 8dd26dff00c0636b1d8621acaeef3f6f3a39dd77 ]
+
+DPCM uses snd_soc_dapm_dai_get_connected_widgets to build a
+list of the widgets connected to a specific front end DAI so it
+can search through this list for available back end DAIs. The
+custom_stop_condition was added to is_connected_ep to facilitate this
+list not containing more widgets than is necessary. Doing so both
+speeds up the DPCM handling as less widgets need to be searched and
+avoids issues with CODEC to CODEC links as these would be confused
+with back end DAIs if they appeared in the list of available widgets.
+
+custom_stop_condition was implemented by aborting the graph walk
+when the condition is triggered, however there is an issue with this
+approach. Whilst walking the graph is_connected_ep should update the
+endpoints cache on each widget, if the walk is aborted the number
+of attached end points is unknown for that sub-graph. When the stop
+condition triggered, the original patch ignored the triggering widget
+and returned zero connected end points; a later patch updated this
+to set the triggering widget's cache to 1 and return that. Both of
+these approaches result in inaccurate values being stored in various
+end point caches as the values propagate back through the graph,
+which can result in later issues with widgets powering/not powering
+unexpectedly.
+
+As the original goal was to reduce the size of the widget list passed
+to the DPCM code, the simplest solution is to limit the functionality
+of the custom_stop_condition to the widget list. This means the rest
+of the graph will still be processed resulting in correct end point
+caches, but only widgets up to the stop condition will be added to the
+returned widget list.
+
+Fixes: 6742064aef7f ("ASoC: dapm: support user-defined stop condition in dai_get_connected_widgets")
+Fixes: 5fdd022c2026 ("ASoC: dpcm: play nice with CODEC<->CODEC links")
+Fixes: 09464974eaa8 ("ASoC: dapm: Fix to return correct path list in is_connected_ep.")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190718084333.15598-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-dapm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index c91df5a9c8406..835ce1ff188d9 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -1156,8 +1156,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+ list_add_tail(&widget->work_list, list);
+
+ if (custom_stop_condition && custom_stop_condition(widget, dir)) {
+- widget->endpoints[dir] = 1;
+- return widget->endpoints[dir];
++ list = NULL;
++ custom_stop_condition = NULL;
+ }
+
+ if ((widget->is_ep & SND_SOC_DAPM_DIR_TO_EP(dir)) && widget->connected) {
+@@ -1194,8 +1194,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+ *
+ * Optionally, can be supplied with a function acting as a stopping condition.
+ * This function takes the dapm widget currently being examined and the walk
+- * direction as an arguments, it should return true if the walk should be
+- * stopped and false otherwise.
++ * direction as an arguments, it should return true if widgets from that point
++ * in the graph onwards should not be added to the widget list.
+ */
+ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
+ struct list_head *list,
+--
+2.20.1
+
--- /dev/null
+From e449c08033911ac8709ab75eec8f898b6d6b20de Mon Sep 17 00:00:00 2001
+From: Ricard Wanderlof <ricard.wanderlof@axis.com>
+Date: Wed, 24 Jul 2019 11:38:44 +0200
+Subject: ASoC: Fail card instantiation if DAI format setup fails
+
+[ Upstream commit 40aa5383e393d72f6aa3943a4e7b1aae25a1e43b ]
+
+If the DAI format setup fails, there is no valid communication format
+between CPU and CODEC, so fail card instantiation, rather than continue
+with a card that will most likely not function properly.
+
+Signed-off-by: Ricard Wanderlof <ricardw@axis.com>
+Link: https://lore.kernel.org/r/alpine.DEB.2.20.1907241132350.6338@lnxricardw1.se.axis.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/soc-core.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 6aeba0d66ec50..dd0f43a1c5e14 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -1605,8 +1605,11 @@ static int soc_probe_link_dais(struct snd_soc_card *card,
+ }
+ }
+
+- if (dai_link->dai_fmt)
+- snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
++ if (dai_link->dai_fmt) {
++ ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt);
++ if (ret)
++ return ret;
++ }
+
+ ret = soc_post_component_init(rtd, dai_link->name);
+ if (ret)
+--
+2.20.1
+
--- /dev/null
+From d07db774f10fb8bfd479cb65ca951d1536d41659 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 12 Jul 2019 13:27:08 +0200
+Subject: ASoC: Intel: bytcht_es8316: Add quirk for Irbis NB41 netbook
+
+[ Upstream commit aa2ba991c4206d5b778dcaa7b4997396e79f8e90 ]
+
+The Irbis NB41 netbook has its internal mic on IN2, inverted jack-detect
+and stereo speakers, add a quirk for this.
+
+Cc: russianneuromancer@ya.ru
+Reported-and-tested-by: russianneuromancer@ya.ru
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20190712112708.25327-1-hdegoede@redhat.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/intel/boards/bytcht_es8316.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c
+index 2fe1ce8791235..c360ebc3ccc7f 100644
+--- a/sound/soc/intel/boards/bytcht_es8316.c
++++ b/sound/soc/intel/boards/bytcht_es8316.c
+@@ -436,6 +436,14 @@ static const struct acpi_gpio_mapping byt_cht_es8316_gpios[] = {
+
+ /* Please keep this list alphabetically sorted */
+ static const struct dmi_system_id byt_cht_es8316_quirk_table[] = {
++ { /* Irbis NB41 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "IRBIS"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "NB41"),
++ },
++ .driver_data = (void *)(BYT_CHT_ES8316_INTMIC_IN2_MAP
++ | BYT_CHT_ES8316_JD_INVERTED),
++ },
+ { /* Teclast X98 Plus II */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "TECLAST"),
+--
+2.20.1
+
--- /dev/null
+From 9810f34ff37eed6df409dfe3d42357d1424d8890 Mon Sep 17 00:00:00 2001
+From: Cheng-Yi Chiang <cychiang@chromium.org>
+Date: Fri, 26 Jul 2019 12:42:02 +0800
+Subject: ASoC: rockchip: Fix mono capture
+
+[ Upstream commit 789e162a6255325325bd321ab0cd51dc7e285054 ]
+
+This reverts commit db51707b9c9aeedd310ebce60f15d5bb006567e0.
+Revert "ASoC: rockchip: i2s: Support mono capture"
+
+Previous discussion in
+
+https://patchwork.kernel.org/patch/10147153/
+
+explains the issue of the patch.
+While device is configured as 1-ch, hardware is still
+generating a 2-ch stream.
+When user space reads the data and assumes it is a 1-ch stream,
+the rate will be slower by 2x.
+
+Revert the change so 1-ch is not supported.
+User space can selectively take one channel data out of two channel
+if 1-ch is preferred.
+Currently, both channels record identical data.
+
+Signed-off-by: Cheng-Yi Chiang <cychiang@chromium.org>
+Link: https://lore.kernel.org/r/20190726044202.26866-1-cychiang@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/rockchip/rockchip_i2s.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c
+index 0a34d0eb8dba9..88ebaf6e1880a 100644
+--- a/sound/soc/rockchip/rockchip_i2s.c
++++ b/sound/soc/rockchip/rockchip_i2s.c
+@@ -326,7 +326,6 @@ static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream,
+ val |= I2S_CHN_4;
+ break;
+ case 2:
+- case 1:
+ val |= I2S_CHN_2;
+ break;
+ default:
+@@ -459,7 +458,7 @@ static struct snd_soc_dai_driver rockchip_i2s_dai = {
+ },
+ .capture = {
+ .stream_name = "Capture",
+- .channels_min = 1,
++ .channels_min = 2,
+ .channels_max = 2,
+ .rates = SNDRV_PCM_RATE_8000_192000,
+ .formats = (SNDRV_PCM_FMTBIT_S8 |
+@@ -659,7 +658,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev)
+ }
+
+ if (!of_property_read_u32(node, "rockchip,capture-channels", &val)) {
+- if (val >= 1 && val <= 8)
++ if (val >= 2 && val <= 8)
+ soc_dai->capture.channels_max = val;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 25ef5246b4c7ae4fcf65a92a061d599e34998ed3 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Sat, 13 Jul 2019 11:46:15 +0800
+Subject: ASoC: samsung: odroid: fix a double-free issue for cpu_dai
+
+[ Upstream commit 2abee12c0ab1924a69993d2c063a39a952e7d836 ]
+
+The cpu_dai variable is still being used after the of_node_put() call,
+which may result in double-free:
+
+ of_node_put(cpu_dai); ---> released here
+
+ ret = devm_snd_soc_register_card(dev, card);
+ if (ret < 0) {
+...
+ goto err_put_clk_i2s; --> jump to err_put_clk_i2s
+...
+
+err_put_clk_i2s:
+ clk_put(priv->clk_i2s_bus);
+err_put_sclk:
+ clk_put(priv->sclk_i2s);
+err_put_cpu_dai:
+ of_node_put(cpu_dai); --> double-free here
+
+Fixes: d832d2b246c5 ("ASoC: samsung: odroid: Fix of_node refcount unbalance")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: Sangbeom Kim <sbkim73@samsung.com>
+Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: alsa-devel@alsa-project.org
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/1562989575-33785-3-git-send-email-wen.yang99@zte.com.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/samsung/odroid.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index 95c35e3ff3303..d606e48fe551a 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -299,7 +299,6 @@ static int odroid_audio_probe(struct platform_device *pdev)
+ ret = PTR_ERR(priv->clk_i2s_bus);
+ goto err_put_sclk;
+ }
+- of_node_put(cpu_dai);
+
+ ret = devm_snd_soc_register_card(dev, card);
+ if (ret < 0) {
+@@ -307,6 +306,7 @@ static int odroid_audio_probe(struct platform_device *pdev)
+ goto err_put_clk_i2s;
+ }
+
++ of_node_put(cpu_dai);
+ of_node_put(codec);
+ return 0;
+
+--
+2.20.1
+
--- /dev/null
+From 11573275bf379e4ff719713deb151790de4e818f Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Sat, 13 Jul 2019 11:46:14 +0800
+Subject: ASoC: samsung: odroid: fix an use-after-free issue for codec
+
+[ Upstream commit 9b6d104a6b150bd4d3e5b039340e1f6b20c2e3c1 ]
+
+The codec variable is still being used after the of_node_put() call,
+which may result in use-after-free.
+
+Fixes: bc3cf17b575a ("ASoC: samsung: odroid: Add support for secondary CPU DAI")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: Krzysztof Kozlowski <krzk@kernel.org>
+Cc: Sangbeom Kim <sbkim73@samsung.com>
+Cc: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Cc: Liam Girdwood <lgirdwood@gmail.com>
+Cc: Mark Brown <broonie@kernel.org>
+Cc: Jaroslav Kysela <perex@perex.cz>
+Cc: Takashi Iwai <tiwai@suse.com>
+Cc: alsa-devel@alsa-project.org
+Cc: linux-kernel@vger.kernel.org
+Link: https://lore.kernel.org/r/1562989575-33785-2-git-send-email-wen.yang99@zte.com.cn
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/samsung/odroid.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index e688169ff12ab..95c35e3ff3303 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -275,9 +275,8 @@ static int odroid_audio_probe(struct platform_device *pdev)
+ }
+
+ of_node_put(cpu);
+- of_node_put(codec);
+ if (ret < 0)
+- return ret;
++ goto err_put_node;
+
+ ret = snd_soc_of_get_dai_link_codecs(dev, codec, codec_link);
+ if (ret < 0)
+@@ -308,6 +307,7 @@ static int odroid_audio_probe(struct platform_device *pdev)
+ goto err_put_clk_i2s;
+ }
+
++ of_node_put(codec);
+ return 0;
+
+ err_put_clk_i2s:
+@@ -317,6 +317,8 @@ err_put_sclk:
+ err_put_cpu_dai:
+ of_node_put(cpu_dai);
+ snd_soc_of_put_dai_link_codecs(codec_link);
++err_put_node:
++ of_node_put(codec);
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From d5fda0296ffa92f381dbb26713a9bce6fe1fde05 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Wed, 10 Jul 2019 15:25:06 +0800
+Subject: ASoC: simple-card: fix an use-after-free in simple_dai_link_of_dpcm()
+
+[ Upstream commit 724808ad556c15e9473418d082f8aae81dd267f6 ]
+
+The node variable is still being used after the of_node_put() call,
+which may result in use-after-free.
+
+Fixes: cfc652a73331 ("ASoC: simple-card: tidyup prefix for snd_soc_codec_conf")
+Link: https://lore.kernel.org/r/1562743509-30496-2-git-send-email-wen.yang99@zte.com.cn
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index 9b568f578bcd2..544064fdc780c 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -138,8 +138,6 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ li->link++;
+
+- of_node_put(node);
+-
+ /* For single DAI link & old style of DT node */
+ if (is_top)
+ prefix = PREFIX;
+@@ -161,17 +159,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ ret = asoc_simple_parse_cpu(np, dai_link, &is_single_links);
+ if (ret)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_parse_clk_cpu(dev, np, dai_link, dai);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_set_dailink_name(dev, dai_link,
+ "fe.%s",
+ dai_link->cpu_dai_name);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ asoc_simple_canonicalize_cpu(dai_link, is_single_links);
+ } else {
+@@ -194,17 +192,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ ret = asoc_simple_parse_codec(np, dai_link);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_parse_clk_codec(dev, np, dai_link, dai);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_set_dailink_name(dev, dai_link,
+ "be.%s",
+ codecs->dai_name);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ /* check "prefix" from top node */
+ snd_soc_of_parse_node_prefix(top, cconf, codecs->of_node,
+@@ -222,19 +220,21 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv,
+
+ ret = asoc_simple_parse_tdm(np, dai);
+ if (ret)
+- return ret;
++ goto out_put_node;
+
+ ret = asoc_simple_parse_daifmt(dev, node, codec,
+ prefix, &dai_link->dai_fmt);
+ if (ret < 0)
+- return ret;
++ goto out_put_node;
+
+ dai_link->dpcm_playback = 1;
+ dai_link->dpcm_capture = 1;
+ dai_link->ops = &simple_ops;
+ dai_link->init = asoc_simple_dai_init;
+
+- return 0;
++out_put_node:
++ of_node_put(node);
++ return ret;
+ }
+
+ static int simple_dai_link_of(struct asoc_simple_priv *priv,
+--
+2.20.1
+
--- /dev/null
+From a4cdd3628b0ea2344cea0d556953e98a94cad8c9 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Wed, 10 Jul 2019 15:25:07 +0800
+Subject: ASoC: simple-card: fix an use-after-free in simple_for_each_link()
+
+[ Upstream commit 27862d5a3325bc531ec15e3c607e44aa0fd57f6f ]
+
+The codec variable is still being used after the of_node_put() call,
+which may result in use-after-free.
+
+Fixes: d947cdfd4be2 ("ASoC: simple-card: cleanup DAI link loop method - step1")
+Link: https://lore.kernel.org/r/1562743509-30496-3-git-send-email-wen.yang99@zte.com.cn
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/generic/simple-card.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index 544064fdc780c..2712a2b201024 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -378,8 +378,6 @@ static int simple_for_each_link(struct asoc_simple_priv *priv,
+ goto error;
+ }
+
+- of_node_put(codec);
+-
+ /* get convert-xxx property */
+ memset(&adata, 0, sizeof(adata));
+ for_each_child_of_node(node, np)
+@@ -401,11 +399,13 @@ static int simple_for_each_link(struct asoc_simple_priv *priv,
+ ret = func_noml(priv, np, codec, li, is_top);
+
+ if (ret < 0) {
++ of_node_put(codec);
+ of_node_put(np);
+ goto error;
+ }
+ }
+
++ of_node_put(codec);
+ node = of_get_next_child(top, node);
+ } while (!is_top && node);
+
+--
+2.20.1
+
--- /dev/null
+From 0608aa7f4935a8283c240294ca6396f8c6eb6153 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Wed, 10 Jul 2019 16:59:55 +0900
+Subject: ASoC: simple_card_utils.h: care NULL dai at asoc_simple_debug_dai()
+
+[ Upstream commit 52db6685932e326ed607644ab7ebdae8c194adda ]
+
+props->xxx_dai might be NULL when DPCM.
+This patch cares it for debug.
+
+Fixes: commit 0580dde59438 ("ASoC: simple-card-utils: add asoc_simple_debug_info()")
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87o922gw4u.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/sound/simple_card_utils.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/sound/simple_card_utils.h b/include/sound/simple_card_utils.h
+index 3429888347e7c..b3609e4c46e0f 100644
+--- a/include/sound/simple_card_utils.h
++++ b/include/sound/simple_card_utils.h
+@@ -149,6 +149,10 @@ inline void asoc_simple_debug_dai(struct asoc_simple_priv *priv,
+ {
+ struct device *dev = simple_priv_to_dev(priv);
+
++ /* dai might be NULL */
++ if (!dai)
++ return;
++
+ if (dai->name)
+ dev_dbg(dev, "%s dai name = %s\n",
+ name, dai->name);
+--
+2.20.1
+
--- /dev/null
+From 9276a74cdcf3404b96d5bd35ba52c93661e9be73 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Sun, 21 Jul 2019 23:23:08 +0900
+Subject: ASoC: SOF: use __u32 instead of uint32_t in uapi headers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 62ec3d13601bd626ca7a0edef6d45dbb753d94e8 ]
+
+When CONFIG_UAPI_HEADER_TEST=y, exported headers are compile-tested to
+make sure they can be included from user-space.
+
+Currently, header.h and fw.h are excluded from the test coverage.
+To make them join the compile-test, we need to fix the build errors
+attached below.
+
+For a case like this, we decided to use __u{8,16,32,64} variable types
+in this discussion:
+
+ https://lkml.org/lkml/2019/6/5/18
+
+Build log:
+
+ CC usr/include/sound/sof/header.h.s
+ CC usr/include/sound/sof/fw.h.s
+In file included from <command-line>:32:0:
+./usr/include/sound/sof/header.h:19:2: error: unknown type name ‘uint32_t’
+ uint32_t magic; /**< 'S', 'O', 'F', '\0' */
+ ^~~~~~~~
+./usr/include/sound/sof/header.h:20:2: error: unknown type name ‘uint32_t’
+ uint32_t type; /**< component specific type */
+ ^~~~~~~~
+./usr/include/sound/sof/header.h:21:2: error: unknown type name ‘uint32_t’
+ uint32_t size; /**< size in bytes of data excl. this struct */
+ ^~~~~~~~
+./usr/include/sound/sof/header.h:22:2: error: unknown type name ‘uint32_t’
+ uint32_t abi; /**< SOF ABI version */
+ ^~~~~~~~
+./usr/include/sound/sof/header.h:23:2: error: unknown type name ‘uint32_t’
+ uint32_t reserved[4]; /**< reserved for future use */
+ ^~~~~~~~
+./usr/include/sound/sof/header.h:24:2: error: unknown type name ‘uint32_t’
+ uint32_t data[0]; /**< Component data - opaque to core */
+ ^~~~~~~~
+In file included from <command-line>:32:0:
+./usr/include/sound/sof/fw.h:49:2: error: unknown type name ‘uint32_t’
+ uint32_t size; /* bytes minus this header */
+ ^~~~~~~~
+./usr/include/sound/sof/fw.h:50:2: error: unknown type name ‘uint32_t’
+ uint32_t offset; /* offset from base */
+ ^~~~~~~~
+./usr/include/sound/sof/fw.h:64:2: error: unknown type name ‘uint32_t’
+ uint32_t size; /* bytes minus this header */
+ ^~~~~~~~
+./usr/include/sound/sof/fw.h:65:2: error: unknown type name ‘uint32_t’
+ uint32_t num_blocks; /* number of blocks */
+ ^~~~~~~~
+./usr/include/sound/sof/fw.h:73:2: error: unknown type name ‘uint32_t’
+ uint32_t file_size; /* size of file minus this header */
+ ^~~~~~~~
+./usr/include/sound/sof/fw.h:74:2: error: unknown type name ‘uint32_t’
+ uint32_t num_modules; /* number of modules */
+ ^~~~~~~~
+./usr/include/sound/sof/fw.h:75:2: error: unknown type name ‘uint32_t’
+ uint32_t abi; /* version of header format */
+ ^~~~~~~~
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Link: https://lore.kernel.org/r/20190721142308.30306-1-yamada.masahiro@socionext.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/uapi/sound/sof/fw.h | 16 +++++++++-------
+ include/uapi/sound/sof/header.h | 14 ++++++++------
+ 2 files changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/include/uapi/sound/sof/fw.h b/include/uapi/sound/sof/fw.h
+index 1afca973eb097..e9f697467a861 100644
+--- a/include/uapi/sound/sof/fw.h
++++ b/include/uapi/sound/sof/fw.h
+@@ -13,6 +13,8 @@
+ #ifndef __INCLUDE_UAPI_SOF_FW_H__
+ #define __INCLUDE_UAPI_SOF_FW_H__
+
++#include <linux/types.h>
++
+ #define SND_SOF_FW_SIG_SIZE 4
+ #define SND_SOF_FW_ABI 1
+ #define SND_SOF_FW_SIG "Reef"
+@@ -46,8 +48,8 @@ enum snd_sof_fw_blk_type {
+
+ struct snd_sof_blk_hdr {
+ enum snd_sof_fw_blk_type type;
+- uint32_t size; /* bytes minus this header */
+- uint32_t offset; /* offset from base */
++ __u32 size; /* bytes minus this header */
++ __u32 offset; /* offset from base */
+ } __packed;
+
+ /*
+@@ -61,8 +63,8 @@ enum snd_sof_fw_mod_type {
+
+ struct snd_sof_mod_hdr {
+ enum snd_sof_fw_mod_type type;
+- uint32_t size; /* bytes minus this header */
+- uint32_t num_blocks; /* number of blocks */
++ __u32 size; /* bytes minus this header */
++ __u32 num_blocks; /* number of blocks */
+ } __packed;
+
+ /*
+@@ -70,9 +72,9 @@ struct snd_sof_mod_hdr {
+ */
+ struct snd_sof_fw_header {
+ unsigned char sig[SND_SOF_FW_SIG_SIZE]; /* "Reef" */
+- uint32_t file_size; /* size of file minus this header */
+- uint32_t num_modules; /* number of modules */
+- uint32_t abi; /* version of header format */
++ __u32 file_size; /* size of file minus this header */
++ __u32 num_modules; /* number of modules */
++ __u32 abi; /* version of header format */
+ } __packed;
+
+ #endif
+diff --git a/include/uapi/sound/sof/header.h b/include/uapi/sound/sof/header.h
+index 7868990b0d6f3..5f4518e7a9723 100644
+--- a/include/uapi/sound/sof/header.h
++++ b/include/uapi/sound/sof/header.h
+@@ -9,6 +9,8 @@
+ #ifndef __INCLUDE_UAPI_SOUND_SOF_USER_HEADER_H__
+ #define __INCLUDE_UAPI_SOUND_SOF_USER_HEADER_H__
+
++#include <linux/types.h>
++
+ /*
+ * Header for all non IPC ABI data.
+ *
+@@ -16,12 +18,12 @@
+ * Used by any bespoke component data structures or binary blobs.
+ */
+ struct sof_abi_hdr {
+- uint32_t magic; /**< 'S', 'O', 'F', '\0' */
+- uint32_t type; /**< component specific type */
+- uint32_t size; /**< size in bytes of data excl. this struct */
+- uint32_t abi; /**< SOF ABI version */
+- uint32_t reserved[4]; /**< reserved for future use */
+- uint32_t data[0]; /**< Component data - opaque to core */
++ __u32 magic; /**< 'S', 'O', 'F', '\0' */
++ __u32 type; /**< component specific type */
++ __u32 size; /**< size in bytes of data excl. this struct */
++ __u32 abi; /**< SOF ABI version */
++ __u32 reserved[4]; /**< reserved for future use */
++ __u32 data[0]; /**< Component data - opaque to core */
+ } __packed;
+
+ #endif
+--
+2.20.1
+
--- /dev/null
+From 200d6795c6e86d543b2ff0bb67dbe7568ca6bfe4 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Fri, 26 Jul 2019 09:42:43 +0300
+Subject: ASoC: ti: davinci-mcasp: Correct slot_width posed constraint
+
+[ Upstream commit 1e112c35e3c96db7c8ca6ddaa96574f00c06e7db ]
+
+The slot_width is a property for the bus while the constraint for
+SNDRV_PCM_HW_PARAM_SAMPLE_BITS is for the in memory format.
+
+Applying slot_width constraint to sample_bits works most of the time, but
+it will blacklist valid formats in some cases.
+
+With slot_width 24 we can support S24_3LE and S24_LE formats as they both
+look the same on the bus, but a a 24 constraint on sample_bits would not
+allow S24_LE as it is stored in 32bits in memory.
+
+Implement a simple hw_rule function to allow all formats which require less
+or equal number of bits on the bus as slot_width (if configured).
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20190726064244.3762-2-peter.ujfalusi@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/davinci-mcasp.c | 43 ++++++++++++++++++++++++++++--------
+ 1 file changed, 34 insertions(+), 9 deletions(-)
+
+diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
+index dc01bbca0ff69..56009d1472084 100644
+--- a/sound/soc/ti/davinci-mcasp.c
++++ b/sound/soc/ti/davinci-mcasp.c
+@@ -1254,6 +1254,28 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream,
+ return ret;
+ }
+
++static int davinci_mcasp_hw_rule_slot_width(struct snd_pcm_hw_params *params,
++ struct snd_pcm_hw_rule *rule)
++{
++ struct davinci_mcasp_ruledata *rd = rule->private;
++ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT);
++ struct snd_mask nfmt;
++ int i, slot_width;
++
++ snd_mask_none(&nfmt);
++ slot_width = rd->mcasp->slot_width;
++
++ for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) {
++ if (snd_mask_test(fmt, i)) {
++ if (snd_pcm_format_width(i) <= slot_width) {
++ snd_mask_set(&nfmt, i);
++ }
++ }
++ }
++
++ return snd_mask_refine(fmt, &nfmt);
++}
++
+ static const unsigned int davinci_mcasp_dai_rates[] = {
+ 8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000,
+ 88200, 96000, 176400, 192000,
+@@ -1361,7 +1383,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ struct davinci_mcasp_ruledata *ruledata =
+ &mcasp->ruledata[substream->stream];
+ u32 max_channels = 0;
+- int i, dir;
++ int i, dir, ret;
+ int tdm_slots = mcasp->tdm_slots;
+
+ /* Do not allow more then one stream per direction */
+@@ -1390,6 +1412,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ max_channels++;
+ }
+ ruledata->serializers = max_channels;
++ ruledata->mcasp = mcasp;
+ max_channels *= tdm_slots;
+ /*
+ * If the already active stream has less channels than the calculated
+@@ -1415,20 +1438,22 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream,
+ 0, SNDRV_PCM_HW_PARAM_CHANNELS,
+ &mcasp->chconstr[substream->stream]);
+
+- if (mcasp->slot_width)
+- snd_pcm_hw_constraint_minmax(substream->runtime,
+- SNDRV_PCM_HW_PARAM_SAMPLE_BITS,
+- 8, mcasp->slot_width);
++ if (mcasp->slot_width) {
++ /* Only allow formats require <= slot_width bits on the bus */
++ ret = snd_pcm_hw_rule_add(substream->runtime, 0,
++ SNDRV_PCM_HW_PARAM_FORMAT,
++ davinci_mcasp_hw_rule_slot_width,
++ ruledata,
++ SNDRV_PCM_HW_PARAM_FORMAT, -1);
++ if (ret)
++ return ret;
++ }
+
+ /*
+ * If we rely on implicit BCLK divider setting we should
+ * set constraints based on what we can provide.
+ */
+ if (mcasp->bclk_master && mcasp->bclk_div == 0 && mcasp->sysclk_freq) {
+- int ret;
+-
+- ruledata->mcasp = mcasp;
+-
+ ret = snd_pcm_hw_rule_add(substream->runtime, 0,
+ SNDRV_PCM_HW_PARAM_RATE,
+ davinci_mcasp_hw_rule_rate,
+--
+2.20.1
+
--- /dev/null
+From 71beec0944314bbcb8643aa3c4ddd0f090ae08ba Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Thu, 25 Jul 2019 11:34:23 +0300
+Subject: ASoC: ti: davinci-mcasp: Fix clk PDIR handling for i2s master mode
+
+[ Upstream commit 34a2a80ff30b5d2330abfa8980c7f0cc15a8158a ]
+
+When running McASP as master capture alone will not record any audio unless
+a parallel playback stream is running. As soon as the playback stops the
+captured data is going to be silent again.
+
+In McASP master mode we need to set the PDIR for the clock pins and fix
+the mcasp_set_axr_pdir() to skip the bits in the PDIR registers above
+AMUTE.
+
+This went unnoticed as most of the boards uses McASP as slave and neither
+of these issues are visible (audible) in those setups.
+
+Fixes: ca3d9433349e ("ASoC: davinci-mcasp: Update PDIR (pin direction) register handling")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Link: https://lore.kernel.org/r/20190725083423.7321-1-peter.ujfalusi@ti.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/ti/davinci-mcasp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c
+index 5e8e31743a28d..dc01bbca0ff69 100644
+--- a/sound/soc/ti/davinci-mcasp.c
++++ b/sound/soc/ti/davinci-mcasp.c
+@@ -194,7 +194,7 @@ static inline void mcasp_set_axr_pdir(struct davinci_mcasp *mcasp, bool enable)
+ {
+ u32 bit;
+
+- for_each_set_bit(bit, &mcasp->pdir, PIN_BIT_AFSR) {
++ for_each_set_bit(bit, &mcasp->pdir, PIN_BIT_AMUTE) {
+ if (enable)
+ mcasp_set_bits(mcasp, DAVINCI_MCASP_PDIR_REG, BIT(bit));
+ else
+@@ -222,6 +222,7 @@ static void mcasp_start_rx(struct davinci_mcasp *mcasp)
+ if (mcasp_is_synchronous(mcasp)) {
+ mcasp_set_ctl_reg(mcasp, DAVINCI_MCASP_GBLCTLX_REG, TXHCLKRST);
+ mcasp_set_ctl_reg(mcasp, DAVINCI_MCASP_GBLCTLX_REG, TXCLKRST);
++ mcasp_set_clk_pdir(mcasp, true);
+ }
+
+ /* Activate serializer(s) */
+--
+2.20.1
+
--- /dev/null
+From c1be329ee47e0dbe7ad78ef6ab8d5189572ea635 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 6 Aug 2019 03:08:08 -0500
+Subject: ata: rb532_cf: Fix unused variable warning in rb532_pata_driver_probe
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit db341a049ec7e87053c91008cb452d0bfa6dde72 ]
+
+Fix the following warning (Building: rb532_defconfig mips):
+
+drivers/ata/pata_rb532_cf.c: In function ‘rb532_pata_driver_remove’:
+drivers/ata/pata_rb532_cf.c:161:24: warning: unused variable ‘info’ [-Wunused-variable]
+ struct rb532_cf_info *info = ah->private_data;
+ ^~~~
+
+Fixes: cd56f35e52d9 ("ata: rb532_cf: Convert to use GPIO descriptors")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/pata_rb532_cf.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c
+index 7c37f2ff09e41..deae466395de1 100644
+--- a/drivers/ata/pata_rb532_cf.c
++++ b/drivers/ata/pata_rb532_cf.c
+@@ -158,7 +158,6 @@ static int rb532_pata_driver_probe(struct platform_device *pdev)
+ static int rb532_pata_driver_remove(struct platform_device *pdev)
+ {
+ struct ata_host *ah = platform_get_drvdata(pdev);
+- struct rb532_cf_info *info = ah->private_data;
+
+ ata_host_detach(ah);
+
+--
+2.20.1
+
--- /dev/null
+From f623d92208414572a25f0239a0b55464818540fc Mon Sep 17 00:00:00 2001
+From: He Zhe <zhe.he@windriver.com>
+Date: Thu, 8 Aug 2019 11:09:54 +0800
+Subject: block: aoe: Fix kernel crash due to atomic sleep when exiting
+
+[ Upstream commit 430380b4637aec646996b4aef67ad417593923b2 ]
+
+Since commit 3582dd291788 ("aoe: convert aoeblk to blk-mq"), aoedev_downdev
+has had the possibility of sleeping and causing the following crash.
+
+BUG: scheduling while atomic: rmmod/2242/0x00000003
+Modules linked in: aoe
+Preemption disabled at:
+[<ffffffffc01d95e5>] flush+0x95/0x4a0 [aoe]
+CPU: 7 PID: 2242 Comm: rmmod Tainted: G I 5.2.3 #1
+Hardware name: Intel Corporation S5520HC/S5520HC, BIOS S5500.86B.01.10.0025.030220091519 03/02/2009
+Call Trace:
+ dump_stack+0x4f/0x6a
+ ? flush+0x95/0x4a0 [aoe]
+ __schedule_bug.cold+0x44/0x54
+ __schedule+0x44f/0x680
+ schedule+0x44/0xd0
+ blk_mq_freeze_queue_wait+0x46/0xb0
+ ? wait_woken+0x80/0x80
+ blk_mq_freeze_queue+0x1b/0x20
+ aoedev_downdev+0x111/0x160 [aoe]
+ flush+0xff/0x4a0 [aoe]
+ aoedev_exit+0x23/0x30 [aoe]
+ aoe_exit+0x35/0x948 [aoe]
+ __se_sys_delete_module+0x183/0x210
+ __x64_sys_delete_module+0x16/0x20
+ do_syscall_64+0x4d/0x130
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+RIP: 0033:0x7f24e0043b07
+Code: 73 01 c3 48 8b 0d 89 73 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f
+1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff
+ff 73 01 c3 48 8b 0d 59 73 0b 00 f7 d8 64 89 01 48
+RSP: 002b:00007ffe18f7f1e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
+RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f24e0043b07
+RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000555c3ecf87c8
+RBP: 00007ffe18f7f1f0 R08: 0000000000000000 R09: 0000000000000000
+R10: 00007f24e00b4ac0 R11: 0000000000000206 R12: 00007ffe18f7f238
+R13: 00007ffe18f7f410 R14: 00007ffe18f80e73 R15: 0000555c3ecf8760
+
+This patch, handling in the same way of pass two, unlocks the locks and
+restart pass one after aoedev_downdev is done.
+
+Fixes: 3582dd291788 ("aoe: convert aoeblk to blk-mq")
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/aoe/aoedev.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
+index 5b49f1b33ebec..e2ea2356da061 100644
+--- a/drivers/block/aoe/aoedev.c
++++ b/drivers/block/aoe/aoedev.c
+@@ -323,10 +323,14 @@ flush(const char __user *str, size_t cnt, int exiting)
+ }
+
+ flush_scheduled_work();
+- /* pass one: without sleeping, do aoedev_downdev */
++ /* pass one: do aoedev_downdev, which might sleep */
++restart1:
+ spin_lock_irqsave(&devlist_lock, flags);
+ for (d = devlist; d; d = d->next) {
+ spin_lock(&d->lock);
++ if (d->flags & DEVFL_TKILL)
++ goto cont;
++
+ if (exiting) {
+ /* unconditionally take each device down */
+ } else if (specified) {
+@@ -338,8 +342,11 @@ flush(const char __user *str, size_t cnt, int exiting)
+ || d->ref)
+ goto cont;
+
++ spin_unlock(&d->lock);
++ spin_unlock_irqrestore(&devlist_lock, flags);
+ aoedev_downdev(d);
+ d->flags |= DEVFL_TKILL;
++ goto restart1;
+ cont:
+ spin_unlock(&d->lock);
+ }
+@@ -348,7 +355,7 @@ cont:
+ /* pass two: call freedev, which might sleep,
+ * for aoedevs marked with DEVFL_TKILL
+ */
+-restart:
++restart2:
+ spin_lock_irqsave(&devlist_lock, flags);
+ for (d = devlist; d; d = d->next) {
+ spin_lock(&d->lock);
+@@ -357,7 +364,7 @@ restart:
+ spin_unlock(&d->lock);
+ spin_unlock_irqrestore(&devlist_lock, flags);
+ freedev(d);
+- goto restart;
++ goto restart2;
+ }
+ spin_unlock(&d->lock);
+ }
+--
+2.20.1
+
--- /dev/null
+From f9b8018d89423512903474e4e95c3fd4dd924ba6 Mon Sep 17 00:00:00 2001
+From: Paolo Valente <paolo.valente@linaro.org>
+Date: Wed, 7 Aug 2019 19:21:11 +0200
+Subject: block, bfq: handle NULL return value by bfq_init_rq()
+
+[ Upstream commit fd03177c33b287c6541f4048f1d67b7b45a1abc9 ]
+
+As reported in [1], the call bfq_init_rq(rq) may return NULL in case
+of OOM (in particular, if rq->elv.icq is NULL because memory
+allocation failed in failed in ioc_create_icq()).
+
+This commit handles this circumstance.
+
+[1] https://lkml.org/lkml/2019/7/22/824
+
+Cc: Hsin-Yi Wang <hsinyi@google.com>
+Cc: Nicolas Boichat <drinkcat@chromium.org>
+Cc: Doug Anderson <dianders@chromium.org>
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Reported-by: Hsin-Yi Wang <hsinyi@google.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Paolo Valente <paolo.valente@linaro.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index 404e776aa36d0..b528710364e9e 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2085,9 +2085,14 @@ static void bfq_request_merged(struct request_queue *q, struct request *req,
+ blk_rq_pos(container_of(rb_prev(&req->rb_node),
+ struct request, rb_node))) {
+ struct bfq_queue *bfqq = bfq_init_rq(req);
+- struct bfq_data *bfqd = bfqq->bfqd;
++ struct bfq_data *bfqd;
+ struct request *prev, *next_rq;
+
++ if (!bfqq)
++ return;
++
++ bfqd = bfqq->bfqd;
++
+ /* Reposition request in its sort_list */
+ elv_rb_del(&bfqq->sort_list, req);
+ elv_rb_add(&bfqq->sort_list, req);
+@@ -2134,6 +2139,9 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq,
+ struct bfq_queue *bfqq = bfq_init_rq(rq),
+ *next_bfqq = bfq_init_rq(next);
+
++ if (!bfqq)
++ return;
++
+ /*
+ * If next and rq belong to the same bfq_queue and next is older
+ * than rq, then reposition rq in the fifo (by substituting next
+@@ -5061,12 +5069,12 @@ static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq,
+
+ spin_lock_irq(&bfqd->lock);
+ bfqq = bfq_init_rq(rq);
+- if (at_head || blk_rq_is_passthrough(rq)) {
++ if (!bfqq || at_head || blk_rq_is_passthrough(rq)) {
+ if (at_head)
+ list_add(&rq->queuelist, &bfqd->dispatch);
+ else
+ list_add_tail(&rq->queuelist, &bfqd->dispatch);
+- } else { /* bfqq is assumed to be non null here */
++ } else {
+ idle_timer_disabled = __bfq_insert_request(bfqd, rq);
+ /*
+ * Update bfqq, because, if a queue merge has occurred
+--
+2.20.1
+
--- /dev/null
+From f85edccd4e4a99d83df8e461d69754f57fb9a6a8 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Tue, 16 Jul 2019 17:25:10 -0500
+Subject: bonding: Force slave speed check after link state recovery for
+ 802.3ad
+
+[ Upstream commit 12185dfe44360f814ac4ead9d22ad2af7511b2e9 ]
+
+The following scenario was encountered during testing of logical
+partition mobility on pseries partitions with bonded ibmvnic
+adapters in LACP mode.
+
+1. Driver receives a signal that the device has been
+ swapped, and it needs to reset to initialize the new
+ device.
+
+2. Driver reports loss of carrier and begins initialization.
+
+3. Bonding driver receives NETDEV_CHANGE notifier and checks
+ the slave's current speed and duplex settings. Because these
+ are unknown at the time, the bond sets its link state to
+ BOND_LINK_FAIL and handles the speed update, clearing
+ AD_PORT_LACP_ENABLE.
+
+4. Driver finishes recovery and reports that the carrier is on.
+
+5. Bond receives a new notification and checks the speed again.
+ The speeds are valid but miimon has not altered the link
+ state yet. AD_PORT_LACP_ENABLE remains off.
+
+Because the slave's link state is still BOND_LINK_FAIL,
+no further port checks are made when it recovers. Though
+the slave devices are operational and have valid speed
+and duplex settings, the bond will not send LACPDU's. The
+simplest fix I can see is to force another speed check
+in bond_miimon_commit. This way the bond will update
+AD_PORT_LACP_ENABLE if needed when transitioning from
+BOND_LINK_FAIL to BOND_LINK_UP.
+
+CC: Jarod Wilson <jarod@redhat.com>
+CC: Jay Vosburgh <j.vosburgh@gmail.com>
+CC: Veaceslav Falico <vfalico@gmail.com>
+CC: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/bonding/bond_main.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index f183cadd14e3d..e8f48f3cdf948 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2205,6 +2205,15 @@ static void bond_miimon_commit(struct bonding *bond)
+ bond_for_each_slave(bond, slave, iter) {
+ switch (slave->new_link) {
+ case BOND_LINK_NOCHANGE:
++ /* For 802.3ad mode, check current slave speed and
++ * duplex again in case its port was disabled after
++ * invalid speed/duplex reporting but recovered before
++ * link monitoring could make a decision on the actual
++ * link status
++ */
++ if (BOND_MODE(bond) == BOND_MODE_8023AD &&
++ slave->link == BOND_LINK_UP)
++ bond_3ad_adapter_speed_duplex_changed(slave);
+ continue;
+
+ case BOND_LINK_UP:
+--
+2.20.1
+
--- /dev/null
+From 15e16ce4c6363fbb2b11a7aeeb3fa83c2fff1c38 Mon Sep 17 00:00:00 2001
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Fri, 19 Jul 2019 10:29:21 -0700
+Subject: bpf: sockmap, only create entry if ulp is not already enabled
+
+[ Upstream commit 0e858739c2d2eedeeac1d35bfa0ec3cc2a7190d8 ]
+
+Sockmap does not currently support adding sockets after TLS has been
+enabled. There never was a real use case for this so it was never
+added. But, we lost the test for ULP at some point so add it here
+and fail the socket insert if TLS is enabled. Future work could
+make sockmap support this use case but fixup the bug here.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index bbc91597d8364..8a4a45e7c29df 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -339,6 +339,7 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx,
+ struct sock *sk, u64 flags)
+ {
+ struct bpf_stab *stab = container_of(map, struct bpf_stab, map);
++ struct inet_connection_sock *icsk = inet_csk(sk);
+ struct sk_psock_link *link;
+ struct sk_psock *psock;
+ struct sock *osk;
+@@ -349,6 +350,8 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx,
+ return -EINVAL;
+ if (unlikely(idx >= map->max_entries))
+ return -E2BIG;
++ if (unlikely(icsk->icsk_ulp_data))
++ return -EINVAL;
+
+ link = sk_psock_init_link();
+ if (!link)
+--
+2.20.1
+
--- /dev/null
+From 85609ec10a99c99e36a1a07b0bf17e9c3312c451 Mon Sep 17 00:00:00 2001
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Fri, 19 Jul 2019 10:29:19 -0700
+Subject: bpf: sockmap, sock_map_delete needs to use xchg
+
+[ Upstream commit 45a4521dcbd92e71c9e53031b40e34211d3b4feb ]
+
+__sock_map_delete() may be called from a tcp event such as unhash or
+close from the following trace,
+
+ tcp_bpf_close()
+ tcp_bpf_remove()
+ sk_psock_unlink()
+ sock_map_delete_from_link()
+ __sock_map_delete()
+
+In this case the sock lock is held but this only protects against
+duplicate removals on the TCP side. If the map is free'd then we have
+this trace,
+
+ sock_map_free
+ xchg() <- replaces map entry
+ sock_map_unref()
+ sk_psock_put()
+ sock_map_del_link()
+
+The __sock_map_delete() call however uses a read, test, null over the
+map entry which can result in both paths trying to free the map
+entry.
+
+To fix use xchg in TCP paths as well so we avoid having two references
+to the same map entry.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index be6092ac69f8a..1d40e040320d2 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -281,16 +281,20 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test,
+ struct sock **psk)
+ {
+ struct sock *sk;
++ int err = 0;
+
+ raw_spin_lock_bh(&stab->lock);
+ sk = *psk;
+ if (!sk_test || sk_test == sk)
+- *psk = NULL;
++ sk = xchg(psk, NULL);
++
++ if (likely(sk))
++ sock_map_unref(sk, psk);
++ else
++ err = -EINVAL;
++
+ raw_spin_unlock_bh(&stab->lock);
+- if (unlikely(!sk))
+- return -EINVAL;
+- sock_map_unref(sk, psk);
+- return 0;
++ return err;
+ }
+
+ static void sock_map_delete_from_link(struct bpf_map *map, struct sock *sk,
+--
+2.20.1
+
--- /dev/null
+From 06c56cd261236b355336fd222a801db8dcbacce5 Mon Sep 17 00:00:00 2001
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Fri, 19 Jul 2019 10:29:20 -0700
+Subject: bpf: sockmap, synchronize_rcu before free'ing map
+
+[ Upstream commit 2bb90e5cc90e1d09f631aeab041a9cf913a5bbe5 ]
+
+We need to have a synchronize_rcu before free'ing the sockmap because
+any outstanding psock references will have a pointer to the map and
+when they use this could trigger a use after free.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/sock_map.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/core/sock_map.c b/net/core/sock_map.c
+index 1d40e040320d2..bbc91597d8364 100644
+--- a/net/core/sock_map.c
++++ b/net/core/sock_map.c
+@@ -252,6 +252,8 @@ static void sock_map_free(struct bpf_map *map)
+ raw_spin_unlock_bh(&stab->lock);
+ rcu_read_unlock();
+
++ synchronize_rcu();
++
+ bpf_map_area_free(stab->sks);
+ kfree(stab);
+ }
+--
+2.20.1
+
--- /dev/null
+From 9c4e64c50d72bfbcf936e60f035c92a1495cbd32 Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Mon, 24 Jun 2019 08:34:13 +0000
+Subject: can: dev: call netif_carrier_off() in register_candev()
+
+[ Upstream commit c63845609c4700488e5eacd6ab4d06d5d420e5ef ]
+
+CONFIG_CAN_LEDS is deprecated. When trying to use the generic netdev
+trigger as suggested, there's a small inconsistency with the link
+property: The LED is on initially, stays on when the device is brought
+up, and then turns off (as expected) when the device is brought down.
+
+Make sure the LED always reflects the state of the CAN device.
+
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index b6b93a2d93a59..483d270664cc8 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1249,6 +1249,8 @@ int register_candev(struct net_device *dev)
+ return -EINVAL;
+
+ dev->rtnl_link_ops = &can_link_ops;
++ netif_carrier_off(dev);
++
+ return register_netdev(dev);
+ }
+ EXPORT_SYMBOL_GPL(register_candev);
+--
+2.20.1
+
--- /dev/null
+From a8e20bc3e292c4f40432a9848917d4dbdb430a4e Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Sat, 18 May 2019 17:35:43 +0800
+Subject: can: gw: Fix error path of cgw_module_init
+
+[ Upstream commit b7a14297f102b6e2ce6f16feffebbb9bde1e9b55 ]
+
+This patch add error path for cgw_module_init to avoid possible crash if
+some error occurs.
+
+Fixes: c1aabdf379bc ("can-gw: add netlink based CAN routing")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/can/gw.c | 48 +++++++++++++++++++++++++++++++++---------------
+ 1 file changed, 33 insertions(+), 15 deletions(-)
+
+diff --git a/net/can/gw.c b/net/can/gw.c
+index 5275ddf580bc7..72711053ebe66 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -1046,32 +1046,50 @@ static __init int cgw_module_init(void)
+ pr_info("can: netlink gateway (rev " CAN_GW_VERSION ") max_hops=%d\n",
+ max_hops);
+
+- register_pernet_subsys(&cangw_pernet_ops);
++ ret = register_pernet_subsys(&cangw_pernet_ops);
++ if (ret)
++ return ret;
++
++ ret = -ENOMEM;
+ cgw_cache = kmem_cache_create("can_gw", sizeof(struct cgw_job),
+ 0, 0, NULL);
+-
+ if (!cgw_cache)
+- return -ENOMEM;
++ goto out_cache_create;
+
+ /* set notifier */
+ notifier.notifier_call = cgw_notifier;
+- register_netdevice_notifier(¬ifier);
++ ret = register_netdevice_notifier(¬ifier);
++ if (ret)
++ goto out_register_notifier;
+
+ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_GETROUTE,
+ NULL, cgw_dump_jobs, 0);
+- if (ret) {
+- unregister_netdevice_notifier(¬ifier);
+- kmem_cache_destroy(cgw_cache);
+- return -ENOBUFS;
+- }
+-
+- /* Only the first call to rtnl_register_module can fail */
+- rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
+- cgw_create_job, NULL, 0);
+- rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
+- cgw_remove_job, NULL, 0);
++ if (ret)
++ goto out_rtnl_register1;
++
++ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE,
++ cgw_create_job, NULL, 0);
++ if (ret)
++ goto out_rtnl_register2;
++ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE,
++ cgw_remove_job, NULL, 0);
++ if (ret)
++ goto out_rtnl_register3;
+
+ return 0;
++
++out_rtnl_register3:
++ rtnl_unregister(PF_CAN, RTM_NEWROUTE);
++out_rtnl_register2:
++ rtnl_unregister(PF_CAN, RTM_GETROUTE);
++out_rtnl_register1:
++ unregister_netdevice_notifier(¬ifier);
++out_register_notifier:
++ kmem_cache_destroy(cgw_cache);
++out_cache_create:
++ unregister_pernet_subsys(&cangw_pernet_ops);
++
++ return ret;
+ }
+
+ static __exit void cgw_module_exit(void)
+--
+2.20.1
+
--- /dev/null
+From d1654555d9b482c511dbe266a04cff4044b7e74c Mon Sep 17 00:00:00 2001
+From: Weitao Hou <houweitaoo@gmail.com>
+Date: Tue, 25 Jun 2019 20:50:48 +0800
+Subject: can: mcp251x: add error check when wq alloc failed
+
+[ Upstream commit 375f755899b8fc21196197e02aab26257df26e85 ]
+
+add error check when workqueue alloc failed, and remove redundant code
+to make it clear.
+
+Fixes: e0000163e30e ("can: Driver for the Microchip MCP251x SPI CAN controllers")
+Signed-off-by: Weitao Hou <houweitaoo@gmail.com>
+Acked-by: Willem de Bruijn <willemb@google.com>
+Tested-by: Sean Nyekjaer <sean@geanix.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/spi/mcp251x.c | 49 ++++++++++++++++-------------------
+ 1 file changed, 22 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index 44e99e3d71348..2aec934fab0cd 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -664,17 +664,6 @@ static int mcp251x_power_enable(struct regulator *reg, int enable)
+ return regulator_disable(reg);
+ }
+
+-static void mcp251x_open_clean(struct net_device *net)
+-{
+- struct mcp251x_priv *priv = netdev_priv(net);
+- struct spi_device *spi = priv->spi;
+-
+- free_irq(spi->irq, priv);
+- mcp251x_hw_sleep(spi);
+- mcp251x_power_enable(priv->transceiver, 0);
+- close_candev(net);
+-}
+-
+ static int mcp251x_stop(struct net_device *net)
+ {
+ struct mcp251x_priv *priv = netdev_priv(net);
+@@ -940,37 +929,43 @@ static int mcp251x_open(struct net_device *net)
+ flags | IRQF_ONESHOT, DEVICE_NAME, priv);
+ if (ret) {
+ dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
+- mcp251x_power_enable(priv->transceiver, 0);
+- close_candev(net);
+- goto open_unlock;
++ goto out_close;
+ }
+
+ priv->wq = alloc_workqueue("mcp251x_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM,
+ 0);
++ if (!priv->wq) {
++ ret = -ENOMEM;
++ goto out_clean;
++ }
+ INIT_WORK(&priv->tx_work, mcp251x_tx_work_handler);
+ INIT_WORK(&priv->restart_work, mcp251x_restart_work_handler);
+
+ ret = mcp251x_hw_reset(spi);
+- if (ret) {
+- mcp251x_open_clean(net);
+- goto open_unlock;
+- }
++ if (ret)
++ goto out_free_wq;
+ ret = mcp251x_setup(net, spi);
+- if (ret) {
+- mcp251x_open_clean(net);
+- goto open_unlock;
+- }
++ if (ret)
++ goto out_free_wq;
+ ret = mcp251x_set_normal_mode(spi);
+- if (ret) {
+- mcp251x_open_clean(net);
+- goto open_unlock;
+- }
++ if (ret)
++ goto out_free_wq;
+
+ can_led_event(net, CAN_LED_EVENT_OPEN);
+
+ netif_wake_queue(net);
++ mutex_unlock(&priv->mcp_lock);
+
+-open_unlock:
++ return 0;
++
++out_free_wq:
++ destroy_workqueue(priv->wq);
++out_clean:
++ free_irq(spi->irq, priv);
++ mcp251x_hw_sleep(spi);
++out_close:
++ mcp251x_power_enable(priv->transceiver, 0);
++ close_candev(net);
+ mutex_unlock(&priv->mcp_lock);
+ return ret;
+ }
+--
+2.20.1
+
--- /dev/null
+From 25804a71462bf127027592599e7e0e279b0eac67 Mon Sep 17 00:00:00 2001
+From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Date: Wed, 31 Jul 2019 15:25:59 +0800
+Subject: can: peak_usb: force the string buffer NULL-terminated
+
+[ Upstream commit e787f19373b8a5fa24087800ed78314fd17b984a ]
+
+strncpy() does not ensure NULL-termination when the input string size
+equals to the destination buffer size IFNAMSIZ. The output string is
+passed to dev_info() which relies on the NULL-termination.
+
+Use strlcpy() instead.
+
+This issue is identified by a Coccinelle script.
+
+Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index 22b9c8e6d040a..65dce642b86b5 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -855,7 +855,7 @@ static void peak_usb_disconnect(struct usb_interface *intf)
+
+ dev_prev_siblings = dev->prev_siblings;
+ dev->state &= ~PCAN_USB_STATE_CONNECTED;
+- strncpy(name, netdev->name, IFNAMSIZ);
++ strlcpy(name, netdev->name, IFNAMSIZ);
+
+ unregister_netdev(netdev);
+
+--
+2.20.1
+
--- /dev/null
+From b5fc64020ebb9cffa1b11c6425771a3de3e35142 Mon Sep 17 00:00:00 2001
+From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Date: Wed, 31 Jul 2019 15:31:14 +0800
+Subject: can: sja1000: force the string buffer NULL-terminated
+
+[ Upstream commit cd28aa2e056cd1ea79fc5f24eed0ce868c6cab5c ]
+
+strncpy() does not ensure NULL-termination when the input string size
+equals to the destination buffer size IFNAMSIZ. The output string
+'name' is passed to dev_info which relies on NULL-termination.
+
+Use strlcpy() instead.
+
+This issue is identified by a Coccinelle script.
+
+Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/sja1000/peak_pcmcia.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c
+index 185c7f7d38a4a..5e0d5e8101c86 100644
+--- a/drivers/net/can/sja1000/peak_pcmcia.c
++++ b/drivers/net/can/sja1000/peak_pcmcia.c
+@@ -479,7 +479,7 @@ static void pcan_free_channels(struct pcan_pccard *card)
+ if (!netdev)
+ continue;
+
+- strncpy(name, netdev->name, IFNAMSIZ);
++ strlcpy(name, netdev->name, IFNAMSIZ);
+
+ unregister_sja1000dev(netdev);
+
+--
+2.20.1
+
--- /dev/null
+From ff2f9731211bd8929031d6dbd858b594facf393e Mon Sep 17 00:00:00 2001
+From: Likun Gao <Likun.Gao@amd.com>
+Date: Fri, 2 Aug 2019 15:18:57 +0800
+Subject: drm/amdgpu: pin the csb buffer on hw init for gfx v8
+
+[ Upstream commit 72cda9bb5e219aea0f2f62f56ae05198c59022a7 ]
+
+Without this pin, the csb buffer will be filled with inconsistent
+data after S3 resume. And that will causes gfx hang on gfxoff
+exit since this csb will be executed then.
+
+Signed-off-by: Likun Gao <Likun.Gao@amd.com>
+Tested-by: Paul Gover <pmw.gover@yahoo.co.uk>
+Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
+Reviewed-by: Xiaojie Yuan <xiaojie.yuan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 40 +++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 02955e6e9dd9e..c21ef99cc590f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -1317,6 +1317,39 @@ static int gfx_v8_0_rlc_init(struct amdgpu_device *adev)
+ return 0;
+ }
+
++static int gfx_v8_0_csb_vram_pin(struct amdgpu_device *adev)
++{
++ int r;
++
++ r = amdgpu_bo_reserve(adev->gfx.rlc.clear_state_obj, false);
++ if (unlikely(r != 0))
++ return r;
++
++ r = amdgpu_bo_pin(adev->gfx.rlc.clear_state_obj,
++ AMDGPU_GEM_DOMAIN_VRAM);
++ if (!r)
++ adev->gfx.rlc.clear_state_gpu_addr =
++ amdgpu_bo_gpu_offset(adev->gfx.rlc.clear_state_obj);
++
++ amdgpu_bo_unreserve(adev->gfx.rlc.clear_state_obj);
++
++ return r;
++}
++
++static void gfx_v8_0_csb_vram_unpin(struct amdgpu_device *adev)
++{
++ int r;
++
++ if (!adev->gfx.rlc.clear_state_obj)
++ return;
++
++ r = amdgpu_bo_reserve(adev->gfx.rlc.clear_state_obj, true);
++ if (likely(r == 0)) {
++ amdgpu_bo_unpin(adev->gfx.rlc.clear_state_obj);
++ amdgpu_bo_unreserve(adev->gfx.rlc.clear_state_obj);
++ }
++}
++
+ static void gfx_v8_0_mec_fini(struct amdgpu_device *adev)
+ {
+ amdgpu_bo_free_kernel(&adev->gfx.mec.hpd_eop_obj, NULL, NULL);
+@@ -4777,6 +4810,10 @@ static int gfx_v8_0_hw_init(void *handle)
+ gfx_v8_0_init_golden_registers(adev);
+ gfx_v8_0_constants_init(adev);
+
++ r = gfx_v8_0_csb_vram_pin(adev);
++ if (r)
++ return r;
++
+ r = adev->gfx.rlc.funcs->resume(adev);
+ if (r)
+ return r;
+@@ -4893,6 +4930,9 @@ static int gfx_v8_0_hw_fini(void *handle)
+ else
+ pr_err("rlc is busy, skip halt rlc\n");
+ amdgpu_gfx_rlc_exit_safe_mode(adev);
++
++ gfx_v8_0_csb_vram_unpin(adev);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From e04bdc62bc4d8f3cdb79c749ef393add11e2607c Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Fri, 2 Aug 2019 11:46:16 -0700
+Subject: drm/rockchip: Suspend DP late
+
+[ Upstream commit f7ccbed656f78212593ca965d9a8f34bf24e0aab ]
+
+In commit fe64ba5c6323 ("drm/rockchip: Resume DP early") we moved
+resume to be early but left suspend at its normal time. This seems
+like it could be OK, but casues problems if a suspend gets interrupted
+partway through. The OS only balances matching suspend/resume levels.
+...so if suspend was called then resume will be called. If suspend
+late was called then resume early will be called. ...but if suspend
+was called resume early might not get called. This leads to an
+unbalance in the clock enables / disables.
+
+Lets take the simple fix and just move suspend to be late to match.
+This makes the PM core take proper care in keeping things balanced.
+
+Fixes: fe64ba5c6323 ("drm/rockchip: Resume DP early")
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Sean Paul <seanpaul@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190802184616.44822-1-dianders@chromium.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+index 95e5c517a15f7..9aae3d8e99ef4 100644
+--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+@@ -432,7 +432,7 @@ static int rockchip_dp_resume(struct device *dev)
+
+ static const struct dev_pm_ops rockchip_dp_pm_ops = {
+ #ifdef CONFIG_PM_SLEEP
+- .suspend = rockchip_dp_suspend,
++ .suspend_late = rockchip_dp_suspend,
+ .resume_early = rockchip_dp_resume,
+ #endif
+ };
+--
+2.20.1
+
--- /dev/null
+From 7fee11c1331e99a66ad596e53715d0844206209c Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Mon, 24 Jun 2019 09:39:59 -0700
+Subject: drm/vmwgfx: fix memory leak when too many retries have occurred
+
+[ Upstream commit 6b7c3b86f0b63134b2ab56508921a0853ffa687a ]
+
+Currently when too many retries have occurred there is a memory
+leak on the allocation for reply on the error return path. Fix
+this by kfree'ing reply before returning.
+
+Addresses-Coverity: ("Resource leak")
+Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message failure")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+index e4e09d47c5c0e..59e9d05ab928b 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -389,8 +389,10 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ break;
+ }
+
+- if (retries == RETRIES)
++ if (retries == RETRIES) {
++ kfree(reply);
+ return -EINVAL;
++ }
+
+ *msg_len = reply_len;
+ *msg = reply;
+--
+2.20.1
+
--- /dev/null
+From 39ae76039307b5b5d6f0956dd62571065e946894 Mon Sep 17 00:00:00 2001
+From: Paul Walmsley <paul.walmsley@sifive.com>
+Date: Thu, 8 Aug 2019 15:36:44 -0700
+Subject: dt-bindings: riscv: fix the schema compatible string for the HiFive
+ Unleashed board
+
+[ Upstream commit b390e0bfd2996f1215231395f4e25a4c011eeaf9 ]
+
+The YAML binding document for SiFive boards has an incorrect
+compatible string for the HiFive Unleashed board. Change it to match
+the name of the board on the SiFive web site:
+
+ https://www.sifive.com/boards/hifive-unleashed
+
+which also matches the contents of the board DT data file:
+
+ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts#n13
+
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ Documentation/devicetree/bindings/riscv/sifive.yaml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/riscv/sifive.yaml b/Documentation/devicetree/bindings/riscv/sifive.yaml
+index 9d17dc2f3f843..3ab532713dc12 100644
+--- a/Documentation/devicetree/bindings/riscv/sifive.yaml
++++ b/Documentation/devicetree/bindings/riscv/sifive.yaml
+@@ -19,7 +19,7 @@ properties:
+ compatible:
+ items:
+ - enum:
+- - sifive,freedom-unleashed-a00
++ - sifive,hifive-unleashed-a00
+ - const: sifive,fu540-c000
+ - const: sifive,fu540
+ ...
+--
+2.20.1
+
--- /dev/null
+From 12026ca257a553c262ca91d91f83856490900b80 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 30 Jul 2019 22:29:59 +0800
+Subject: enetc: Fix build error without PHYLIB
+
+[ Upstream commit 5f4e4203add2b860d2345312509a160f8292063b ]
+
+If PHYLIB is not set, build enetc will fails:
+
+drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_open':
+enetc.c: undefined reference to `phy_disconnect'
+enetc.c: undefined reference to `phy_start'
+drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_close':
+enetc.c: undefined reference to `phy_stop'
+enetc.c: undefined reference to `phy_disconnect'
+drivers/net/ethernet/freescale/enetc/enetc_ethtool.o: undefined reference to `phy_ethtool_get_link_ksettings'
+drivers/net/ethernet/freescale/enetc/enetc_ethtool.o: undefined reference to `phy_ethtool_set_link_ksettings'
+drivers/net/ethernet/freescale/enetc/enetc_mdio.o: In function `enetc_mdio_probe':
+enetc_mdio.c: undefined reference to `mdiobus_alloc_size'
+enetc_mdio.c: undefined reference to `mdiobus_free'
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/Kconfig b/drivers/net/ethernet/freescale/enetc/Kconfig
+index 8429f5c1d8106..8ac109e73a7bb 100644
+--- a/drivers/net/ethernet/freescale/enetc/Kconfig
++++ b/drivers/net/ethernet/freescale/enetc/Kconfig
+@@ -2,6 +2,7 @@
+ config FSL_ENETC
+ tristate "ENETC PF driver"
+ depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST)
++ select PHYLIB
+ help
+ This driver supports NXP ENETC gigabit ethernet controller PCIe
+ physical function (PF) devices, managing ENETC Ports at a privileged
+--
+2.20.1
+
--- /dev/null
+From 0a71df88d38c11583f753d448be98698ab6a15f5 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 1 Aug 2019 09:24:19 +0800
+Subject: enetc: Select PHYLIB while CONFIG_FSL_ENETC_VF is set
+
+[ Upstream commit 2802d2cf24b1ca7ea4c54dde266ded6a16020eb5 ]
+
+Like FSL_ENETC, when CONFIG_FSL_ENETC_VF is set,
+we should select PHYLIB, otherwise building still fails:
+
+drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_open':
+enetc.c:(.text+0x2744): undefined reference to `phy_start'
+enetc.c:(.text+0x282c): undefined reference to `phy_disconnect'
+drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_close':
+enetc.c:(.text+0x28f8): undefined reference to `phy_stop'
+enetc.c:(.text+0x2904): undefined reference to `phy_disconnect'
+drivers/net/ethernet/freescale/enetc/enetc_ethtool.o:(.rodata+0x3f8): undefined reference to `phy_ethtool_get_link_ksettings'
+drivers/net/ethernet/freescale/enetc/enetc_ethtool.o:(.rodata+0x400): undefined reference to `phy_ethtool_set_link_ksettings'
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/enetc/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/freescale/enetc/Kconfig b/drivers/net/ethernet/freescale/enetc/Kconfig
+index 8ac109e73a7bb..a268e74b1834e 100644
+--- a/drivers/net/ethernet/freescale/enetc/Kconfig
++++ b/drivers/net/ethernet/freescale/enetc/Kconfig
+@@ -13,6 +13,7 @@ config FSL_ENETC
+ config FSL_ENETC_VF
+ tristate "ENETC VF driver"
+ depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST)
++ select PHYLIB
+ help
+ This driver supports NXP ENETC gigabit ethernet controller PCIe
+ virtual function (VF) devices enabled by the ENETC PF driver.
+--
+2.20.1
+
--- /dev/null
+From 473c88cc057964e83f71c1826b9f1095a09e7013 Mon Sep 17 00:00:00 2001
+From: Ben Segal <bpsegal20@gmail.com>
+Date: Tue, 23 Jul 2019 11:22:42 +0300
+Subject: habanalabs: fix F/W download in BE architecture
+
+[ Upstream commit 75035fe22b808a520e1d712ebe913684ba406e01 ]
+
+writeX macros might perform byte-swapping in BE architectures. As our F/W
+is in LE format, we need to make sure no byte-swapping will occur.
+
+There is a standard kernel function (called memcpy_toio) for copying data
+to I/O area which is used in a lot of drivers to download F/W to PCIe
+adapters. That function also makes sure the data is copied "as-is",
+without byte-swapping.
+
+This patch use that function to copy the F/W to the GOYA ASIC instead of
+writeX macros.
+
+Signed-off-by: Ben Segal <bpsegal20@gmail.com>
+Reviewed-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/habanalabs/firmware_if.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/misc/habanalabs/firmware_if.c b/drivers/misc/habanalabs/firmware_if.c
+index eda5d7fcb79f2..fe9e57a81b6fd 100644
+--- a/drivers/misc/habanalabs/firmware_if.c
++++ b/drivers/misc/habanalabs/firmware_if.c
+@@ -24,7 +24,7 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name,
+ {
+ const struct firmware *fw;
+ const u64 *fw_data;
+- size_t fw_size, i;
++ size_t fw_size;
+ int rc;
+
+ rc = request_firmware(&fw, fw_name, hdev->dev);
+@@ -45,22 +45,7 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name,
+
+ fw_data = (const u64 *) fw->data;
+
+- if ((fw->size % 8) != 0)
+- fw_size -= 8;
+-
+- for (i = 0 ; i < fw_size ; i += 8, fw_data++, dst += 8) {
+- if (!(i & (0x80000 - 1))) {
+- dev_dbg(hdev->dev,
+- "copied so far %zu out of %zu for %s firmware",
+- i, fw_size, fw_name);
+- usleep_range(20, 100);
+- }
+-
+- writeq(*fw_data, dst);
+- }
+-
+- if ((fw->size % 8) != 0)
+- writel(*(const u32 *) fw_data, dst);
++ memcpy_toio(dst, fw_data, fw_size);
+
+ out:
+ release_firmware(fw);
+--
+2.20.1
+
--- /dev/null
+From e8e14df27893185806b07c4c57fda57496f5c0d7 Mon Sep 17 00:00:00 2001
+From: Ilya Trukhanov <lahvuun@gmail.com>
+Date: Tue, 2 Jul 2019 13:37:16 +0300
+Subject: HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT
+
+[ Upstream commit 65f11c72780fa9d598df88def045ccb6a885cf80 ]
+
+Enable force feedback for the Thrustmaster Dual Trigger 2 in 1 Rumble Force
+gamepad. Compared to other Thrustmaster devices, left and right rumble
+motors here are swapped.
+
+Signed-off-by: Ilya Trukhanov <lahvuun@gmail.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-tmff.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c
+index e12f2588ddebb..bdfc5ff3b2c5c 100644
+--- a/drivers/hid/hid-tmff.c
++++ b/drivers/hid/hid-tmff.c
+@@ -22,6 +22,8 @@
+
+ #include "hid-ids.h"
+
++#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT 0xb320
++
+ static const signed short ff_rumble[] = {
+ FF_RUMBLE,
+ -1
+@@ -76,6 +78,7 @@ static int tmff_play(struct input_dev *dev, void *data,
+ struct hid_field *ff_field = tmff->ff_field;
+ int x, y;
+ int left, right; /* Rumbling */
++ int motor_swap;
+
+ switch (effect->type) {
+ case FF_CONSTANT:
+@@ -100,6 +103,13 @@ static int tmff_play(struct input_dev *dev, void *data,
+ ff_field->logical_minimum,
+ ff_field->logical_maximum);
+
++ /* 2-in-1 strong motor is left */
++ if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) {
++ motor_swap = left;
++ left = right;
++ right = motor_swap;
++ }
++
+ dbg_hid("(left,right)=(%08x, %08x)\n", left, right);
+ ff_field->value[0] = left;
+ ff_field->value[1] = right;
+@@ -226,6 +236,8 @@ static const struct hid_device_id tm_devices[] = {
+ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304), /* FireStorm Dual Power 2 (and 3) */
+ .driver_data = (unsigned long)ff_rumble },
++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT), /* Dual Trigger 2-in-1 */
++ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323), /* Dual Trigger 3-in-1 (PC Mode) */
+ .driver_data = (unsigned long)ff_rumble },
+ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324), /* Dual Trigger 3-in-1 (PS3 Mode) */
+--
+2.20.1
+
--- /dev/null
+From 4ccfe178c96f309aeaecc7e225395581c88097a8 Mon Sep 17 00:00:00 2001
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Date: Tue, 11 Jun 2019 14:13:20 +0200
+Subject: HID: input: fix a4tech horizontal wheel custom usage
+
+[ Upstream commit 1c703b53e5bfb5c2205c30f0fb157ce271fd42fb ]
+
+Some a4tech mice use the 'GenericDesktop.00b8' usage to inform whether
+the previous wheel report was horizontal or vertical. Before
+c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") this
+usage was being mapped to 'Relative.Misc'. After the patch it's simply
+ignored (usage->type == 0 & usage->code == 0). Which ultimately makes
+hid-a4tech ignore the WHEEL/HWHEEL selection event, as it has no
+usage->type.
+
+We shouldn't rely on a mapping for that usage as it's nonstandard and
+doesn't really map to an input event. So we bypass the mapping and make
+sure the custom event handling properly handles both reports.
+
+Fixes: c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-a4tech.c | 30 +++++++++++++++++++++++++++---
+ 1 file changed, 27 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c
+index 98bf694626f71..3a8c4a5971f70 100644
+--- a/drivers/hid/hid-a4tech.c
++++ b/drivers/hid/hid-a4tech.c
+@@ -23,12 +23,36 @@
+ #define A4_2WHEEL_MOUSE_HACK_7 0x01
+ #define A4_2WHEEL_MOUSE_HACK_B8 0x02
+
++#define A4_WHEEL_ORIENTATION (HID_UP_GENDESK | 0x000000b8)
++
+ struct a4tech_sc {
+ unsigned long quirks;
+ unsigned int hw_wheel;
+ __s32 delayed_value;
+ };
+
++static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi,
++ struct hid_field *field, struct hid_usage *usage,
++ unsigned long **bit, int *max)
++{
++ struct a4tech_sc *a4 = hid_get_drvdata(hdev);
++
++ if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 &&
++ usage->hid == A4_WHEEL_ORIENTATION) {
++ /*
++ * We do not want to have this usage mapped to anything as it's
++ * nonstandard and doesn't really behave like an HID report.
++ * It's only selecting the orientation (vertical/horizontal) of
++ * the previous mouse wheel report. The input_events will be
++ * generated once both reports are recorded in a4_event().
++ */
++ return -1;
++ }
++
++ return 0;
++
++}
++
+ static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ struct hid_field *field, struct hid_usage *usage,
+ unsigned long **bit, int *max)
+@@ -52,8 +76,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ struct a4tech_sc *a4 = hid_get_drvdata(hdev);
+ struct input_dev *input;
+
+- if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput ||
+- !usage->type)
++ if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput)
+ return 0;
+
+ input = field->hidinput->input;
+@@ -64,7 +87,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field,
+ return 1;
+ }
+
+- if (usage->hid == 0x000100b8) {
++ if (usage->hid == A4_WHEEL_ORIENTATION) {
+ input_event(input, EV_REL, value ? REL_HWHEEL :
+ REL_WHEEL, a4->delayed_value);
+ input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES :
+@@ -131,6 +154,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices);
+ static struct hid_driver a4_driver = {
+ .name = "a4tech",
+ .id_table = a4_devices,
++ .input_mapping = a4_input_mapping,
+ .input_mapped = a4_input_mapped,
+ .event = a4_event,
+ .probe = a4_probe,
+--
+2.20.1
+
--- /dev/null
+From d5e3327d9e922e0ae1907dcb86b29c90b802bcd1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Filipe=20La=C3=ADns?= <lains@archlinux.org>
+Date: Tue, 16 Jul 2019 08:37:26 +0100
+Subject: HID: logitech-hidpp: add USB PID for a few more supported mice
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 27fc32fd9417968a459d43d9a7c50fd423d53eb9 ]
+
+Add more device IDs to logitech-hidpp driver.
+
+Signed-off-by: Filipe Laíns <lains@archlinux.org>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-logitech-hidpp.c | 32 +++++++++++++++++++++++++++++++-
+ 1 file changed, 31 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
+index cf05816a601f5..34e2b3f9d540d 100644
+--- a/drivers/hid/hid-logitech-hidpp.c
++++ b/drivers/hid/hid-logitech-hidpp.c
+@@ -3749,15 +3749,45 @@ static const struct hid_device_id hidpp_devices[] = {
+
+ { L27MHZ_DEVICE(HID_ANY_ID) },
+
+- { /* Logitech G403 Gaming Mouse over USB */
++ { /* Logitech G203/Prodigy Gaming Mouse */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC084) },
++ { /* Logitech G302 Gaming Mouse */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07F) },
++ { /* Logitech G303 Gaming Mouse */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC080) },
++ { /* Logitech G400 Gaming Mouse */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07E) },
++ { /* Logitech G403 Wireless Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) },
++ { /* Logitech G403 Gaming Mouse */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC083) },
++ { /* Logitech G403 Hero Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08F) },
++ { /* Logitech G502 Proteus Core Gaming Mouse */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07D) },
++ { /* Logitech G502 Proteus Spectrum Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC332) },
++ { /* Logitech G502 Hero Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08B) },
+ { /* Logitech G700 Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) },
++ { /* Logitech G700s Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07C) },
++ { /* Logitech G703 Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) },
++ { /* Logitech G703 Hero Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC090) },
+ { /* Logitech G900 Gaming Mouse over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC081) },
++ { /* Logitech G903 Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) },
++ { /* Logitech G903 Hero Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) },
+ { /* Logitech G920 Wheel over USB */
+ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL),
+ .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
++ { /* Logitech G Pro Gaming Mouse over USB */
++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC088) },
+
+ { /* MX5000 keyboard over Bluetooth */
+ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305),
+--
+2.20.1
+
--- /dev/null
+From 22003e35948b90f8ea20694557b962f8932d13b6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Istv=C3=A1n=20V=C3=A1radi?= <ivaradi@varadiistvan.hu>
+Date: Wed, 24 Jul 2019 20:09:18 +0200
+Subject: HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 7bc74853fd61432ec59f812a40425bf6d8c986a4 ]
+
+The Saitek X52 joystick has a pair of axes that are originally
+(by the Windows driver) used as mouse pointer controls. The corresponding
+usage->hid values are 0x50024 and 0x50026. Thus they are handled
+as unknown axes and both get mapped to ABS_MISC. The quirk makes
+the second axis to be mapped to ABS_MISC1 and thus made available
+separately.
+
+[jkosina@suse.cz: squashed two patches into one]
+Signed-off-by: István Váradi <ivaradi@varadiistvan.hu>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 34a812025b948..76aa474e92c15 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -990,6 +990,7 @@
+ #define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7
+ #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa
+ #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0
++#define USB_DEVICE_ID_SAITEK_X52 0x075c
+
+ #define USB_VENDOR_ID_SAMSUNG 0x0419
+ #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001
+diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
+index 5b669f7d653fa..4fe2c3ab76f9c 100644
+--- a/drivers/hid/hid-quirks.c
++++ b/drivers/hid/hid-quirks.c
+@@ -141,6 +141,7 @@ static const struct hid_device_id hid_quirks[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD },
++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET },
+--
+2.20.1
+
--- /dev/null
+From e22a8dfeac241a46448dbdf7be0827e946951cf8 Mon Sep 17 00:00:00 2001
+From: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
+Date: Wed, 31 Jul 2019 15:17:23 +0200
+Subject: isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on
+ the stack
+
+[ Upstream commit d8a1de3d5bb881507602bc02e004904828f88711 ]
+
+Since linux 4.9 it is not possible to use buffers on the stack for DMA transfers.
+
+During usb probe the driver crashes with "transfer buffer is on stack" message.
+
+This fix k-allocates a buffer to be used on "read_reg_atomic", which is a macro
+that calls "usb_control_msg" under the hood.
+
+Kernel 4.19 backtrace:
+
+usb_hcd_submit_urb+0x3e5/0x900
+? sched_clock+0x9/0x10
+? log_store+0x203/0x270
+? get_random_u32+0x6f/0x90
+? cache_alloc_refill+0x784/0x8a0
+usb_submit_urb+0x3b4/0x550
+usb_start_wait_urb+0x4e/0xd0
+usb_control_msg+0xb8/0x120
+hfcsusb_probe+0x6bc/0xb40 [hfcsusb]
+usb_probe_interface+0xc2/0x260
+really_probe+0x176/0x280
+driver_probe_device+0x49/0x130
+__driver_attach+0xa9/0xb0
+? driver_probe_device+0x130/0x130
+bus_for_each_dev+0x5a/0x90
+driver_attach+0x14/0x20
+? driver_probe_device+0x130/0x130
+bus_add_driver+0x157/0x1e0
+driver_register+0x51/0xe0
+usb_register_driver+0x5d/0x120
+? 0xf81ed000
+hfcsusb_drv_init+0x17/0x1000 [hfcsusb]
+do_one_initcall+0x44/0x190
+? free_unref_page_commit+0x6a/0xd0
+do_init_module+0x46/0x1c0
+load_module+0x1dc1/0x2400
+sys_init_module+0xed/0x120
+do_fast_syscall_32+0x7a/0x200
+entry_SYSENTER_32+0x6b/0xbe
+
+Signed-off-by: Juliana Rodrigueiro <juliana.rodrigueiro@intra2net.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/mISDN/hfcsusb.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index 8fb7c5dea07fc..008a74a1ed444 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1693,13 +1693,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel)
+ static int
+ setup_hfcsusb(struct hfcsusb *hw)
+ {
++ void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL);
+ u_char b;
++ int ret;
+
+ if (debug & DBG_HFC_CALL_TRACE)
+ printk(KERN_DEBUG "%s: %s\n", hw->name, __func__);
+
++ if (!dmabuf)
++ return -ENOMEM;
++
++ ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf);
++
++ memcpy(&b, dmabuf, sizeof(u_char));
++ kfree(dmabuf);
++
+ /* check the chip id */
+- if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) {
++ if (ret != 1) {
+ printk(KERN_DEBUG "%s: %s: cannot read chip id\n",
+ hw->name, __func__);
+ return 1;
+--
+2.20.1
+
--- /dev/null
+From 7721254524a05a20eaf1525d58c7d9d9f9fadf60 Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Fri, 26 Jul 2019 16:27:36 +0800
+Subject: isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in
+ start_isoc_chain()
+
+[ Upstream commit a0d57a552b836206ad7705a1060e6e1ce5a38203 ]
+
+In start_isoc_chain(), usb_alloc_urb() on line 1392 may fail
+and return NULL. At this time, fifo->iso[i].urb is assigned to NULL.
+
+Then, fifo->iso[i].urb is used at some places, such as:
+LINE 1405: fill_isoc_urb(fifo->iso[i].urb, ...)
+ urb->number_of_packets = num_packets;
+ urb->transfer_flags = URB_ISO_ASAP;
+ urb->actual_length = 0;
+ urb->interval = interval;
+LINE 1416: fifo->iso[i].urb->...
+LINE 1419: fifo->iso[i].urb->...
+
+Thus, possible null-pointer dereferences may occur.
+
+To fix these bugs, "continue" is added to avoid using fifo->iso[i].urb
+when it is NULL.
+
+These bugs are found by a static analysis tool STCheck written by us.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/isdn/hardware/mISDN/hfcsusb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c
+index 0e224232f7464..8fb7c5dea07fc 100644
+--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
+@@ -1394,6 +1394,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb,
+ printk(KERN_DEBUG
+ "%s: %s: alloc urb for fifo %i failed",
+ hw->name, __func__, fifo->fifonum);
++ continue;
+ }
+ fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo;
+ fifo->iso[i].indx = i;
+--
+2.20.1
+
--- /dev/null
+From 8ee9cbe6076124d7cfc8a295dbaf8c4e0ec9b7fb Mon Sep 17 00:00:00 2001
+From: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+Date: Thu, 13 Jun 2019 15:11:24 +0300
+Subject: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
+
+[ Upstream commit abcbef5977df1fb61026ba429964cd6b9a085699 ]
+
+The driver should call iwl_dbg_tlv_free even if debugfs is not defined
+since ini mode does not depend on debugfs ifdef.
+
+Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+Fixes: 68f6f492c4fa ("iwlwifi: trans: support loading ini TLVs from external file")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+index efd4bf04d0162..fa81ad67539f3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+@@ -1649,8 +1649,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
+ err_fw:
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ debugfs_remove_recursive(drv->dbgfs_drv);
+- iwl_fw_dbg_free(drv->trans);
+ #endif
++ iwl_fw_dbg_free(drv->trans);
+ kfree(drv);
+ err:
+ return ERR_PTR(ret);
+--
+2.20.1
+
--- /dev/null
+From d9877451a721bef735937109e869e2fe3c60dc7a Mon Sep 17 00:00:00 2001
+From: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+Date: Thu, 13 Jun 2019 15:08:24 +0300
+Subject: iwlwifi: dbg_ini: move iwl_dbg_tlv_load_bin out of debug override
+ ifdef
+
+[ Upstream commit 072b30642f90b01d139131ec7bf763778a3a3f41 ]
+
+ini debug mode should work even if debug override is not defined.
+
+Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
+Fixes: 68f6f492c4fa ("iwlwifi: trans: support loading ini TLVs from external file")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+index fba242284507b..efd4bf04d0162 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+@@ -1627,6 +1627,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans)
+ init_completion(&drv->request_firmware_complete);
+ INIT_LIST_HEAD(&drv->list);
+
++ iwl_load_fw_dbg_tlv(drv->trans->dev, drv->trans);
++
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ /* Create the device debugfs entries. */
+ drv->dbgfs_drv = debugfs_create_dir(dev_name(trans->dev),
+--
+2.20.1
+
--- /dev/null
+From 9985c25c7ec42947b1aa8d3314a4c88847280441 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 27 Jun 2019 09:44:50 +0200
+Subject: iwlwifi: fix locking in delayed GTK setting
+
+[ Upstream commit 6569e7d36773956298ec1d5f4e6a2487913d2752 ]
+
+This code clearly never could have worked, since it locks
+while already locked. Add an unlocked __iwl_mvm_mac_set_key()
+variant that doesn't do locking to fix that.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 39 ++++++++++++-------
+ 1 file changed, 26 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 964c7baabede3..edffae3741e00 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -207,11 +207,11 @@ static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = {
+ },
+ };
+
+-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+- enum set_key_cmd cmd,
+- struct ieee80211_vif *vif,
+- struct ieee80211_sta *sta,
+- struct ieee80211_key_conf *key);
++static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
++ enum set_key_cmd cmd,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta,
++ struct ieee80211_key_conf *key);
+
+ void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type)
+ {
+@@ -2725,7 +2725,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
+
+ mvmvif->ap_early_keys[i] = NULL;
+
+- ret = iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
++ ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key);
+ if (ret)
+ goto out_quota_failed;
+ }
+@@ -3493,11 +3493,11 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw,
+ return ret;
+ }
+
+-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+- enum set_key_cmd cmd,
+- struct ieee80211_vif *vif,
+- struct ieee80211_sta *sta,
+- struct ieee80211_key_conf *key)
++static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
++ enum set_key_cmd cmd,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta,
++ struct ieee80211_key_conf *key)
+ {
+ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+ struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+@@ -3552,8 +3552,6 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+ return -EOPNOTSUPP;
+ }
+
+- mutex_lock(&mvm->mutex);
+-
+ switch (cmd) {
+ case SET_KEY:
+ if ((vif->type == NL80211_IFTYPE_ADHOC ||
+@@ -3699,7 +3697,22 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
+ ret = -EINVAL;
+ }
+
++ return ret;
++}
++
++static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
++ enum set_key_cmd cmd,
++ struct ieee80211_vif *vif,
++ struct ieee80211_sta *sta,
++ struct ieee80211_key_conf *key)
++{
++ struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
++ int ret;
++
++ mutex_lock(&mvm->mutex);
++ ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key);
+ mutex_unlock(&mvm->mutex);
++
+ return ret;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From cd492659772467f8f879d9e7b59422127777dd60 Mon Sep 17 00:00:00 2001
+From: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Date: Thu, 13 Jun 2019 16:34:07 +0300
+Subject: iwlwifi: mvm: avoid races in rate init and rate perform
+
+[ Upstream commit 0f8084cdc1f9d4a6693ef4168167febb0918c6f6 ]
+
+Rate perform uses the lq_sta table to calculate the next rate to scale
+while rate init resets the same table,
+
+Rate perform is done in soft irq context in parallel to rate init
+that can be called in case we are doing changes like AP changes BW
+or moving state for auth to assoc.
+
+Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 42 ++++++++++++++++++--
+ drivers/net/wireless/intel/iwlwifi/mvm/rs.h | 7 +++-
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 6 +++
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 1 +
+ 4 files changed, 51 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index 63fdb4e68e9d7..836541caa3167 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1197,6 +1197,27 @@ static u8 rs_get_tid(struct ieee80211_hdr *hdr)
+ return tid;
+ }
+
++void iwl_mvm_rs_init_wk(struct work_struct *wk)
++{
++ struct iwl_mvm_sta *mvmsta = container_of(wk, struct iwl_mvm_sta,
++ rs_init_wk);
++ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif);
++ struct ieee80211_sta *sta;
++
++ rcu_read_lock();
++
++ sta = rcu_dereference(mvmvif->mvm->fw_id_to_mac_id[mvmsta->sta_id]);
++ if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta))) {
++ rcu_read_unlock();
++ return;
++ }
++
++ iwl_mvm_rs_rate_init(mvmvif->mvm, sta, mvmvif->phy_ctxt->channel->band,
++ true);
++
++ rcu_read_unlock();
++}
++
+ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ int tid, struct ieee80211_tx_info *info, bool ndp)
+ {
+@@ -1269,7 +1290,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ (unsigned long)(lq_sta->last_tx +
+ (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) {
+ IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n");
+- iwl_mvm_rs_rate_init(mvm, sta, info->band, true);
++ schedule_work(&mvmsta->rs_init_wk);
+ return;
+ }
+ lq_sta->last_tx = jiffies;
+@@ -1442,16 +1463,24 @@ static void rs_drv_mac80211_tx_status(void *mvm_r,
+ struct iwl_op_mode *op_mode = mvm_r;
+ struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+
+- if (!iwl_mvm_sta_from_mac80211(sta)->vif)
++ if (!mvmsta->vif)
+ return;
+
+ if (!ieee80211_is_data(hdr->frame_control) ||
+ info->flags & IEEE80211_TX_CTL_NO_ACK)
+ return;
+
++ /* If it's locked we are in middle of init flow
++ * just wait for next tx status to update the lq_sta data
++ */
++ if (!mutex_trylock(&mvmsta->lq_sta.rs_drv.mutex))
++ return;
++
+ iwl_mvm_rs_tx_status(mvm, sta, rs_get_tid(hdr), info,
+ ieee80211_is_qos_nullfunc(hdr->frame_control));
++ mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex);
+ }
+
+ /*
+@@ -4136,10 +4165,15 @@ static const struct rate_control_ops rs_mvm_ops_drv = {
+ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ enum nl80211_band band, bool update)
+ {
+- if (iwl_mvm_has_tlc_offload(mvm))
++ if (iwl_mvm_has_tlc_offload(mvm)) {
+ rs_fw_rate_init(mvm, sta, band, update);
+- else
++ } else {
++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
++
++ mutex_lock(&mvmsta->lq_sta.rs_drv.mutex);
+ rs_drv_rate_init(mvm, sta, band, update);
++ mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex);
++ }
+ }
+
+ int iwl_mvm_rate_control_register(void)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+index f7eb60dbaf202..086f47e2a4f0c 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h
+@@ -4,7 +4,7 @@
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ *
+ * Contact Information:
+ * Intel Linux Wireless <linuxwifi@intel.com>
+@@ -376,6 +376,9 @@ struct iwl_lq_sta {
+ /* tx power reduce for this sta */
+ int tpc_reduce;
+
++ /* avoid races of reinit and update table from rx_tx */
++ struct mutex mutex;
++
+ /* persistent fields - initialized only once - keep last! */
+ struct lq_sta_pers {
+ #ifdef CONFIG_MAC80211_DEBUGFS
+@@ -440,6 +443,8 @@ struct iwl_mvm_sta;
+ int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
+ bool enable);
+
++void iwl_mvm_rs_init_wk(struct work_struct *wk);
++
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm);
+ #endif
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index f545a737a92df..ac9bc65c4d156 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -1684,6 +1684,10 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
+ */
+ if (iwl_mvm_has_tlc_offload(mvm))
+ iwl_mvm_rs_add_sta(mvm, mvm_sta);
++ else
++ mutex_init(&mvm_sta->lq_sta.rs_drv.mutex);
++
++ INIT_WORK(&mvm_sta->rs_init_wk, iwl_mvm_rs_init_wk);
+
+ iwl_mvm_toggle_tx_ant(mvm, &mvm_sta->tx_ant);
+
+@@ -1846,6 +1850,8 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm,
+ if (ret)
+ return ret;
+
++ cancel_work_sync(&mvm_sta->rs_init_wk);
++
+ /* flush its queues here since we are freeing mvm_sta */
+ ret = iwl_mvm_flush_sta(mvm, mvm_sta, false, 0);
+ if (ret)
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+index b4d4071b865db..6e93c30492b78 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h
+@@ -421,6 +421,7 @@ struct iwl_mvm_sta {
+ struct iwl_lq_sta_rs_fw rs_fw;
+ struct iwl_lq_sta rs_drv;
+ } lq_sta;
++ struct work_struct rs_init_wk;
+ struct ieee80211_vif *vif;
+ struct iwl_mvm_key_pn __rcu *ptk_pn[4];
+ struct iwl_mvm_rxq_dup_data *dup_data;
+--
+2.20.1
+
--- /dev/null
+From 75ee07c11d49de416b5adb936f2b739907dca4ec Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 12 Jun 2019 11:09:58 +0200
+Subject: iwlwifi: mvm: disable TX-AMSDU on older NICs
+
+[ Upstream commit cfb21b11b891b08b79be07be57c40a85bb926668 ]
+
+On older NICs, we occasionally see issues with A-MSDU support,
+where the commands in the FIFO get confused and then we see an
+assert EDC because the next command in the FIFO isn't TX.
+
+We've tried to isolate this issue and understand where it comes
+from, but haven't found any errors in building the A-MSDU in
+software.
+
+At least for now, disable A-MSDU support on older hardware so
+that users can use it again without fearing the assert.
+
+This fixes https://bugzilla.kernel.org/show_bug.cgi?id=203315.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index edffae3741e00..a6183281ee1e1 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -474,7 +474,19 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
+ ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW);
+ ieee80211_hw_set(hw, BUFF_MMPDU_TXQ);
+ ieee80211_hw_set(hw, STA_MMPDU_TXQ);
+- ieee80211_hw_set(hw, TX_AMSDU);
++ /*
++ * On older devices, enabling TX A-MSDU occasionally leads to
++ * something getting messed up, the command read from the FIFO
++ * gets out of sync and isn't a TX command, so that we have an
++ * assert EDC.
++ *
++ * It's not clear where the bug is, but since we didn't used to
++ * support A-MSDU until moving the mac80211 iTXQs, just leave it
++ * for older devices. We also don't see this issue on any newer
++ * devices.
++ */
++ if (mvm->cfg->device_family >= IWL_DEVICE_FAMILY_9000)
++ ieee80211_hw_set(hw, TX_AMSDU);
+ ieee80211_hw_set(hw, TX_FRAG_LIST);
+
+ if (iwl_mvm_has_tlc_offload(mvm)) {
+--
+2.20.1
+
--- /dev/null
+From dfdb243340a18a989564fb07037488e6d55cfc47 Mon Sep 17 00:00:00 2001
+From: Gregory Greenman <gregory.greenman@intel.com>
+Date: Sun, 30 Jun 2019 09:18:15 +0300
+Subject: iwlwifi: mvm: send LQ command always ASYNC
+
+[ Upstream commit cd4d6b0bcd51580efda9ae54ab7b2d630b4147dc ]
+
+The only place where the command was sent as SYNC is during
+init and this is not really critical. This change is required
+for replacing RS mutex with a spinlock (in the subsequent patch),
+since SYNC comamnd requres sleeping and thus the flow cannot
+be done when holding a spinlock.
+
+Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 +-
+ drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 23 ++++++++++---------
+ drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +-
+ .../net/wireless/intel/iwlwifi/mvm/utils.c | 4 ++--
+ 4 files changed, 16 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+index ed8fc9a9204ca..0c11a219e3477 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+@@ -1807,7 +1807,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+ #endif /* CONFIG_IWLWIFI_DEBUGFS */
+
+ /* rate scaling */
+-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync);
++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq);
+ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg);
+ int rs_pretty_print_rate(char *buf, int bufsz, const u32 rate);
+ void rs_update_last_rssi(struct iwl_mvm *mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+index 836541caa3167..01b032f18bc8b 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+@@ -1326,7 +1326,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ IWL_DEBUG_RATE(mvm,
+ "Too many rates mismatch. Send sync LQ. rs_state %d\n",
+ lq_sta->rs_state);
+- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
+ }
+ /* Regardless, ignore this status info for outdated rate */
+ return;
+@@ -1388,7 +1388,8 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ if (info->status.ampdu_ack_len == 0)
+ info->status.ampdu_len = 1;
+
+- rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl, tx_resp_rate.index,
++ rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl,
++ tx_resp_rate.index,
+ info->status.ampdu_len,
+ info->status.ampdu_ack_len);
+
+@@ -1823,7 +1824,7 @@ static void rs_update_rate_tbl(struct iwl_mvm *mvm,
+ struct iwl_scale_tbl_info *tbl)
+ {
+ rs_fill_lq_cmd(mvm, sta, lq_sta, &tbl->rate);
+- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
+ }
+
+ static bool rs_tweak_rate_tbl(struct iwl_mvm *mvm,
+@@ -2925,7 +2926,7 @@ void rs_update_last_rssi(struct iwl_mvm *mvm,
+ static void rs_initialize_lq(struct iwl_mvm *mvm,
+ struct ieee80211_sta *sta,
+ struct iwl_lq_sta *lq_sta,
+- enum nl80211_band band, bool update)
++ enum nl80211_band band)
+ {
+ struct iwl_scale_tbl_info *tbl;
+ struct rs_rate *rate;
+@@ -2955,7 +2956,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
+ rs_set_expected_tpt_table(lq_sta, tbl);
+ rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
+ /* TODO restore station should remember the lq cmd */
+- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, !update);
++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq);
+ }
+
+ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
+@@ -3208,7 +3209,7 @@ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg)
+ * Called after adding a new station to initialize rate scaling
+ */
+ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- enum nl80211_band band, bool update)
++ enum nl80211_band band)
+ {
+ int i, j;
+ struct ieee80211_hw *hw = mvm->hw;
+@@ -3288,7 +3289,7 @@ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ #ifdef CONFIG_IWLWIFI_DEBUGFS
+ iwl_mvm_reset_frame_stats(mvm);
+ #endif
+- rs_initialize_lq(mvm, sta, lq_sta, band, update);
++ rs_initialize_lq(mvm, sta, lq_sta, band);
+ }
+
+ static void rs_drv_rate_update(void *mvm_r,
+@@ -3602,7 +3603,7 @@ static void rs_set_lq_ss_params(struct iwl_mvm *mvm,
+
+ bfersta_ss_params &= ~LQ_SS_BFER_ALLOWED;
+ bfersta_lq_cmd->ss_params = cpu_to_le32(bfersta_ss_params);
+- iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd, false);
++ iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd);
+
+ ss_params |= LQ_SS_BFER_ALLOWED;
+ IWL_DEBUG_RATE(mvm,
+@@ -3768,7 +3769,7 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm,
+
+ if (lq_sta->pers.dbg_fixed_rate) {
+ rs_fill_lq_cmd(mvm, NULL, lq_sta, NULL);
+- iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq, false);
++ iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq);
+ }
+ }
+
+@@ -4171,7 +4172,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+
+ mutex_lock(&mvmsta->lq_sta.rs_drv.mutex);
+- rs_drv_rate_init(mvm, sta, band, update);
++ rs_drv_rate_init(mvm, sta, band);
+ mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex);
+ }
+ }
+@@ -4203,7 +4204,7 @@ static int rs_drv_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
+ lq->flags &= ~LQ_FLAG_USE_RTS_MSK;
+ }
+
+- return iwl_mvm_send_lq_cmd(mvm, lq, false);
++ return iwl_mvm_send_lq_cmd(mvm, lq);
+ }
+
+ /**
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+index ac9bc65c4d156..22715cdb83171 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+@@ -2978,7 +2978,7 @@ out:
+ IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n",
+ sta->addr, tid);
+
+- return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq, false);
++ return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq);
+ }
+
+ static void iwl_mvm_unreserve_agg_queue(struct iwl_mvm *mvm,
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+index cc56ab88fb439..a71277de2e0eb 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c
+@@ -641,12 +641,12 @@ int iwl_mvm_reconfig_scd(struct iwl_mvm *mvm, int queue, int fifo, int sta_id,
+ * this case to clear the state indicating that station creation is in
+ * progress.
+ */
+-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync)
++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq)
+ {
+ struct iwl_host_cmd cmd = {
+ .id = LQ_CMD,
+ .len = { sizeof(struct iwl_lq_cmd), },
+- .flags = sync ? 0 : CMD_ASYNC,
++ .flags = CMD_ASYNC,
+ .data = { lq, },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 26dd451b7a89fc33e1fc40d99d38558fd8a07aa0 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Mon, 5 Aug 2019 10:34:51 +0100
+Subject: KVM: arm: Don't write junk to CP15 registers on reset
+
+[ Upstream commit c69509c70aa45a8c4954c88c629a64acf4ee4a36 ]
+
+At the moment, the way we reset CP15 registers is mildly insane:
+We write junk to them, call the reset functions, and then check that
+we have something else in them.
+
+The "fun" thing is that this can happen while the guest is running
+(PSCI, for example). If anything in KVM has to evaluate the state
+of a CP15 register while junk is in there, bad thing may happen.
+
+Let's stop doing that. Instead, we track that we have called a
+reset function for that register, and assume that the reset
+function has done something.
+
+In the end, the very need of this reset check is pretty dubious,
+as it doesn't check everything (a lot of the CP15 reg leave outside
+of the cp15_regs[] array). It may well be axed in the near future.
+
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kvm/coproc.c | 23 +++++++++++++++--------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c
+index d2806bcff8bbb..07745ee022a12 100644
+--- a/arch/arm/kvm/coproc.c
++++ b/arch/arm/kvm/coproc.c
+@@ -651,13 +651,22 @@ int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run)
+ }
+
+ static void reset_coproc_regs(struct kvm_vcpu *vcpu,
+- const struct coproc_reg *table, size_t num)
++ const struct coproc_reg *table, size_t num,
++ unsigned long *bmap)
+ {
+ unsigned long i;
+
+ for (i = 0; i < num; i++)
+- if (table[i].reset)
++ if (table[i].reset) {
++ int reg = table[i].reg;
++
+ table[i].reset(vcpu, &table[i]);
++ if (reg > 0 && reg < NR_CP15_REGS) {
++ set_bit(reg, bmap);
++ if (table[i].is_64bit)
++ set_bit(reg + 1, bmap);
++ }
++ }
+ }
+
+ static struct coproc_params decode_32bit_hsr(struct kvm_vcpu *vcpu)
+@@ -1432,17 +1441,15 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu)
+ {
+ size_t num;
+ const struct coproc_reg *table;
+-
+- /* Catch someone adding a register without putting in reset entry. */
+- memset(vcpu->arch.ctxt.cp15, 0x42, sizeof(vcpu->arch.ctxt.cp15));
++ DECLARE_BITMAP(bmap, NR_CP15_REGS) = { 0, };
+
+ /* Generic chip reset first (so target could override). */
+- reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs));
++ reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs), bmap);
+
+ table = get_target_table(vcpu->arch.target, &num);
+- reset_coproc_regs(vcpu, table, num);
++ reset_coproc_regs(vcpu, table, num, bmap);
+
+ for (num = 1; num < NR_CP15_REGS; num++)
+- WARN(vcpu_cp15(vcpu, num) == 0x42424242,
++ WARN(!test_bit(num, bmap),
+ "Didn't reset vcpu_cp15(vcpu, %zi)", num);
+ }
+--
+2.20.1
+
--- /dev/null
+From a9dca1d28f52236f401c54ff146f21a0183fefbf Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Mon, 5 Aug 2019 10:34:51 +0100
+Subject: KVM: arm64: Don't write junk to sysregs on reset
+
+[ Upstream commit 03fdfb2690099c19160a3f2c5b77db60b3afeded ]
+
+At the moment, the way we reset system registers is mildly insane:
+We write junk to them, call the reset functions, and then check that
+we have something else in them.
+
+The "fun" thing is that this can happen while the guest is running
+(PSCI, for example). If anything in KVM has to evaluate the state
+of a system register while junk is in there, bad thing may happen.
+
+Let's stop doing that. Instead, we track that we have called a
+reset function for that register, and assume that the reset
+function has done something. This requires fixing a couple of
+sysreg refinition in the trap table.
+
+In the end, the very need of this reset check is pretty dubious,
+as it doesn't check everything (a lot of the sysregs leave outside of
+the sys_regs[] array). It may well be axed in the near future.
+
+Tested-by: Zenghui Yu <yuzenghui@huawei.com>
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm64/kvm/sys_regs.c | 32 ++++++++++++++++++--------------
+ 1 file changed, 18 insertions(+), 14 deletions(-)
+
+diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
+index ce933f2960496..5b7085ca213df 100644
+--- a/arch/arm64/kvm/sys_regs.c
++++ b/arch/arm64/kvm/sys_regs.c
+@@ -632,7 +632,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r)
+ */
+ val = ((pmcr & ~ARMV8_PMU_PMCR_MASK)
+ | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E);
+- __vcpu_sys_reg(vcpu, PMCR_EL0) = val;
++ __vcpu_sys_reg(vcpu, r->reg) = val;
+ }
+
+ static bool check_pmu_access_disabled(struct kvm_vcpu *vcpu, u64 flags)
+@@ -981,13 +981,13 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p,
+ /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */
+ #define DBG_BCR_BVR_WCR_WVR_EL1(n) \
+ { SYS_DESC(SYS_DBGBVRn_EL1(n)), \
+- trap_bvr, reset_bvr, n, 0, get_bvr, set_bvr }, \
++ trap_bvr, reset_bvr, 0, 0, get_bvr, set_bvr }, \
+ { SYS_DESC(SYS_DBGBCRn_EL1(n)), \
+- trap_bcr, reset_bcr, n, 0, get_bcr, set_bcr }, \
++ trap_bcr, reset_bcr, 0, 0, get_bcr, set_bcr }, \
+ { SYS_DESC(SYS_DBGWVRn_EL1(n)), \
+- trap_wvr, reset_wvr, n, 0, get_wvr, set_wvr }, \
++ trap_wvr, reset_wvr, 0, 0, get_wvr, set_wvr }, \
+ { SYS_DESC(SYS_DBGWCRn_EL1(n)), \
+- trap_wcr, reset_wcr, n, 0, get_wcr, set_wcr }
++ trap_wcr, reset_wcr, 0, 0, get_wcr, set_wcr }
+
+ /* Macro to expand the PMEVCNTRn_EL0 register */
+ #define PMU_PMEVCNTR_EL0(n) \
+@@ -1540,7 +1540,7 @@ static const struct sys_reg_desc sys_reg_descs[] = {
+ { SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 },
+ { SYS_DESC(SYS_CTR_EL0), access_ctr },
+
+- { SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, },
++ { SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 },
+ { SYS_DESC(SYS_PMCNTENSET_EL0), access_pmcnten, reset_unknown, PMCNTENSET_EL0 },
+ { SYS_DESC(SYS_PMCNTENCLR_EL0), access_pmcnten, NULL, PMCNTENSET_EL0 },
+ { SYS_DESC(SYS_PMOVSCLR_EL0), access_pmovs, NULL, PMOVSSET_EL0 },
+@@ -2254,13 +2254,19 @@ static int emulate_sys_reg(struct kvm_vcpu *vcpu,
+ }
+
+ static void reset_sys_reg_descs(struct kvm_vcpu *vcpu,
+- const struct sys_reg_desc *table, size_t num)
++ const struct sys_reg_desc *table, size_t num,
++ unsigned long *bmap)
+ {
+ unsigned long i;
+
+ for (i = 0; i < num; i++)
+- if (table[i].reset)
++ if (table[i].reset) {
++ int reg = table[i].reg;
++
+ table[i].reset(vcpu, &table[i]);
++ if (reg > 0 && reg < NR_SYS_REGS)
++ set_bit(reg, bmap);
++ }
+ }
+
+ /**
+@@ -2774,18 +2780,16 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu)
+ {
+ size_t num;
+ const struct sys_reg_desc *table;
+-
+- /* Catch someone adding a register without putting in reset entry. */
+- memset(&vcpu->arch.ctxt.sys_regs, 0x42, sizeof(vcpu->arch.ctxt.sys_regs));
++ DECLARE_BITMAP(bmap, NR_SYS_REGS) = { 0, };
+
+ /* Generic chip reset first (so target could override). */
+- reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs));
++ reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs), bmap);
+
+ table = get_target_table(vcpu->arch.target, true, &num);
+- reset_sys_reg_descs(vcpu, table, num);
++ reset_sys_reg_descs(vcpu, table, num, bmap);
+
+ for (num = 1; num < NR_SYS_REGS; num++) {
+- if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242,
++ if (WARN(!test_bit(num, bmap),
+ "Didn't reset __vcpu_sys_reg(%zi)\n", num))
+ break;
+ }
+--
+2.20.1
+
--- /dev/null
+From ce5ec16cb4e0f19ff736d7e596f80a4b06492800 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Wed, 7 Aug 2019 12:23:57 -0600
+Subject: libata: add SG safety checks in SFF pio transfers
+
+[ Upstream commit 752ead44491e8c91e14d7079625c5916b30921c5 ]
+
+Abort processing of a command if we run out of mapped data in the
+SG list. This should never happen, but a previous bug caused it to
+be possible. Play it safe and attempt to abort nicely if we don't
+have more SG segments left.
+
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-sff.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 10aa278821427..4f115adb4ee83 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -658,6 +658,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+ unsigned int offset;
+ unsigned char *buf;
+
++ if (!qc->cursg) {
++ qc->curbytes = qc->nbytes;
++ return;
++ }
+ if (qc->curbytes == qc->nbytes - qc->sect_size)
+ ap->hsm_task_state = HSM_ST_LAST;
+
+@@ -683,6 +687,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
+
+ if (qc->cursg_ofs == qc->cursg->length) {
+ qc->cursg = sg_next(qc->cursg);
++ if (!qc->cursg)
++ ap->hsm_task_state = HSM_ST_LAST;
+ qc->cursg_ofs = 0;
+ }
+ }
+--
+2.20.1
+
--- /dev/null
+From 919fe54872d74180ee32fdfd6a5b9c6aee93fe1f Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Wed, 7 Aug 2019 12:20:52 -0600
+Subject: libata: have ata_scsi_rw_xlat() fail invalid passthrough requests
+
+[ Upstream commit 2d7271501720038381d45fb3dcbe4831228fc8cc ]
+
+For passthrough requests, libata-scsi takes what the user passes in
+as gospel. This can be problematic if the user fills in the CDB
+incorrectly. One example of that is in request sizes. For read/write
+commands, the CDB contains fields describing the transfer length of
+the request. These should match with the SG_IO header fields, but
+libata-scsi currently does no validation of that.
+
+Check that the number of blocks in the CDB for passthrough requests
+matches what was mapped into the request. If the CDB asks for more
+data then the validated SG_IO header fields, error it.
+
+Reported-by: Krishna Ram Prakash R <krp@gtux.in>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/ata/libata-scsi.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 391ac0503dc07..76d0f9de767bc 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -1786,6 +1786,21 @@ nothing_to_do:
+ return 1;
+ }
+
++static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks)
++{
++ struct request *rq = scmd->request;
++ u32 req_blocks;
++
++ if (!blk_rq_is_passthrough(rq))
++ return true;
++
++ req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size;
++ if (n_blocks > req_blocks)
++ return false;
++
++ return true;
++}
++
+ /**
+ * ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one
+ * @qc: Storage for translated ATA taskfile
+@@ -1830,6 +1845,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ scsi_10_lba_len(cdb, &block, &n_block);
+ if (cdb[1] & (1 << 3))
+ tf_flags |= ATA_TFLAG_FUA;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ case READ_6:
+ case WRITE_6:
+@@ -1844,6 +1861,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ */
+ if (!n_block)
+ n_block = 256;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ case READ_16:
+ case WRITE_16:
+@@ -1854,6 +1873,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc)
+ scsi_16_lba_len(cdb, &block, &n_block);
+ if (cdb[1] & (1 << 3))
+ tf_flags |= ATA_TFLAG_FUA;
++ if (!ata_check_nblocks(scmd, n_block))
++ goto invalid_fld;
+ break;
+ default:
+ DPRINTK("no-byte command\n");
+--
+2.20.1
+
--- /dev/null
+From 5444bf9713f3f1806ad6ab12f639f2beca3b972b Mon Sep 17 00:00:00 2001
+From: Ilya Maximets <i.maximets@samsung.com>
+Date: Tue, 23 Jul 2019 15:08:10 +0300
+Subject: libbpf: fix using uninitialized ioctl results
+
+[ Upstream commit decb705e01a5d325c9876b9674043cde4b54f0db ]
+
+'channels.max_combined' initialized only on ioctl success and
+errno is only valid on ioctl failure.
+
+The code doesn't produce any runtime issues, but makes memory
+sanitizers angry:
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x55C056F: xsk_get_max_queues (xsk.c:336)
+ by 0x55C05B2: xsk_create_bpf_maps (xsk.c:354)
+ by 0x55C089F: xsk_setup_xdp_prog (xsk.c:447)
+ by 0x55C0E57: xsk_socket__create (xsk.c:601)
+ Uninitialised value was created by a stack allocation
+ at 0x55C04CD: xsk_get_max_queues (xsk.c:318)
+
+Additionally fixed warning on uninitialized bytes in ioctl arguments:
+
+ Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s)
+ at 0x648D45B: ioctl (in /usr/lib64/libc-2.28.so)
+ by 0x55C0546: xsk_get_max_queues (xsk.c:330)
+ by 0x55C05B2: xsk_create_bpf_maps (xsk.c:354)
+ by 0x55C089F: xsk_setup_xdp_prog (xsk.c:447)
+ by 0x55C0E57: xsk_socket__create (xsk.c:601)
+ Address 0x1ffefff378 is on thread 1's stack
+ in frame #1, created by xsk_get_max_queues (xsk.c:318)
+ Uninitialised value was created by a stack allocation
+ at 0x55C04CD: xsk_get_max_queues (xsk.c:318)
+
+CC: Magnus Karlsson <magnus.karlsson@intel.com>
+Fixes: 1cad07884239 ("libbpf: add support for using AF_XDP sockets")
+Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/xsk.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index ca272c5b67f47..8e03b65830da0 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -327,15 +327,14 @@ static int xsk_load_xdp_prog(struct xsk_socket *xsk)
+
+ static int xsk_get_max_queues(struct xsk_socket *xsk)
+ {
+- struct ethtool_channels channels;
+- struct ifreq ifr;
++ struct ethtool_channels channels = { .cmd = ETHTOOL_GCHANNELS };
++ struct ifreq ifr = {};
+ int fd, err, ret;
+
+ fd = socket(AF_INET, SOCK_DGRAM, 0);
+ if (fd < 0)
+ return -errno;
+
+- channels.cmd = ETHTOOL_GCHANNELS;
+ ifr.ifr_data = (void *)&channels;
+ strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1);
+ ifr.ifr_name[IFNAMSIZ - 1] = '\0';
+@@ -345,7 +344,7 @@ static int xsk_get_max_queues(struct xsk_socket *xsk)
+ goto out;
+ }
+
+- if (channels.max_combined == 0 || errno == EOPNOTSUPP)
++ if (err || channels.max_combined == 0)
+ /* If the device says it has no channels, then all traffic
+ * is sent to a single stream, so max queues = 1.
+ */
+--
+2.20.1
+
--- /dev/null
+From 284fa0e31c1eba7f1393c8f7eb8fef474f4843da Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andriin@fb.com>
+Date: Fri, 19 Jul 2019 12:46:03 -0700
+Subject: libbpf: sanitize VAR to conservative 1-byte INT
+
+[ Upstream commit 1d4126c4e1190d2f7d3f388552f9bd17ae0c64fc ]
+
+If VAR in non-sanitized BTF was size less than 4, converting such VAR
+into an INT with size=4 will cause BTF validation failure due to
+violationg of STRUCT (into which DATASEC was converted) member size.
+Fix by conservatively using size=1.
+
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/libbpf.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
+index 3865a5d272514..77e14d9954796 100644
+--- a/tools/lib/bpf/libbpf.c
++++ b/tools/lib/bpf/libbpf.c
+@@ -1044,8 +1044,13 @@ static void bpf_object__sanitize_btf(struct bpf_object *obj)
+ if (!has_datasec && kind == BTF_KIND_VAR) {
+ /* replace VAR with INT */
+ t->info = BTF_INFO_ENC(BTF_KIND_INT, 0, 0);
+- t->size = sizeof(int);
+- *(int *)(t+1) = BTF_INT_ENC(0, 0, 32);
++ /*
++ * using size = 1 is the safest choice, 4 will be too
++ * big and cause kernel BTF validation failure if
++ * original variable took less than 4 bytes
++ */
++ t->size = 1;
++ *(int *)(t+1) = BTF_INT_ENC(0, 0, 8);
+ } else if (!has_datasec && kind == BTF_KIND_DATASEC) {
+ /* replace DATASEC with STRUCT */
+ struct btf_var_secinfo *v = (void *)(t + 1);
+--
+2.20.1
+
--- /dev/null
+From a1431c0a4e3400e08cff8fb830495fc1ddcdc21d Mon Sep 17 00:00:00 2001
+From: Andrii Nakryiko <andriin@fb.com>
+Date: Wed, 24 Jul 2019 14:47:53 -0700
+Subject: libbpf: silence GCC8 warning about string truncation
+
+[ Upstream commit cb8ffde5694ae5fffb456eae932aac442aa3a207 ]
+
+Despite a proper NULL-termination after strncpy(..., ..., IFNAMSIZ - 1),
+GCC8 still complains about *expected* string truncation:
+
+ xsk.c:330:2: error: 'strncpy' output may be truncated copying 15 bytes
+ from a string of length 15 [-Werror=stringop-truncation]
+ strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1);
+
+This patch gets rid of the issue altogether by using memcpy instead.
+There is no performance regression, as strncpy will still copy and fill
+all of the bytes anyway.
+
+v1->v2:
+- rebase against bpf tree.
+
+Cc: Magnus Karlsson <magnus.karlsson@intel.com>
+Signed-off-by: Andrii Nakryiko <andriin@fb.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/bpf/xsk.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c
+index 8e03b65830da0..fa948c5445ecf 100644
+--- a/tools/lib/bpf/xsk.c
++++ b/tools/lib/bpf/xsk.c
+@@ -336,7 +336,7 @@ static int xsk_get_max_queues(struct xsk_socket *xsk)
+ return -errno;
+
+ ifr.ifr_data = (void *)&channels;
+- strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1);
++ memcpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1);
+ ifr.ifr_name[IFNAMSIZ - 1] = '\0';
+ err = ioctl(fd, SIOCETHTOOL, &ifr);
+ if (err && errno != EOPNOTSUPP) {
+@@ -561,7 +561,7 @@ int xsk_socket__create(struct xsk_socket **xsk_ptr, const char *ifname,
+ err = -errno;
+ goto out_socket;
+ }
+- strncpy(xsk->ifname, ifname, IFNAMSIZ - 1);
++ memcpy(xsk->ifname, ifname, IFNAMSIZ - 1);
+ xsk->ifname[IFNAMSIZ - 1] = '\0';
+
+ err = xsk_set_xdp_socket_config(&xsk->config, usr_config);
+--
+2.20.1
+
--- /dev/null
+From 7c45aee975a7c24b29a7f4335b225853b1259186 Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Mon, 29 Jul 2019 16:23:32 +0800
+Subject: mac80211_hwsim: Fix possible null-pointer dereferences in
+ hwsim_dump_radio_nl()
+
+[ Upstream commit b55f3b841099e641bdb2701d361a4c304e2dbd6f ]
+
+In hwsim_dump_radio_nl(), when genlmsg_put() on line 3617 fails, hdr is
+assigned to NULL. Then hdr is used on lines 3622 and 3623:
+ genl_dump_check_consistent(cb, hdr);
+ genlmsg_end(skb, hdr);
+
+Thus, possible null-pointer dereferences may occur.
+
+To fix these bugs, hdr is used here when it is not NULL.
+
+This bug is found by a static analysis tool STCheck written by us.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Link: https://lore.kernel.org/r/20190729082332.28895-1-baijiaju1990@gmail.com
+[put braces on all branches]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/mac80211_hwsim.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index 1c699a9fa8661..faec05ab42754 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3615,10 +3615,12 @@ static int hwsim_dump_radio_nl(struct sk_buff *skb,
+ hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, &hwsim_genl_family,
+ NLM_F_MULTI, HWSIM_CMD_GET_RADIO);
+- if (!hdr)
++ if (hdr) {
++ genl_dump_check_consistent(cb, hdr);
++ genlmsg_end(skb, hdr);
++ } else {
+ res = -EMSGSIZE;
+- genl_dump_check_consistent(cb, hdr);
+- genlmsg_end(skb, hdr);
++ }
+ }
+
+ done:
+--
+2.20.1
+
--- /dev/null
+From 6c368a73a12a871934f63561bb93ef70c21ae3d1 Mon Sep 17 00:00:00 2001
+From: Vladimir Kondratiev <vladimir.kondratiev@linux.intel.com>
+Date: Tue, 16 Jul 2019 10:36:56 +0300
+Subject: mips: fix cacheinfo
+
+[ Upstream commit b8bea8a5e5d942e62203416ab41edecaed4fda02 ]
+
+Because CONFIG_OF defined for MIPS, cacheinfo attempts to fill information
+from DT, ignoring data filled by architecture routine. This leads to error
+reported
+
+ cacheinfo: Unable to detect cache hierarchy for CPU 0
+
+Way to fix this provided in
+commit fac51482577d ("drivers: base: cacheinfo: fix x86 with
+ CONFIG_OF enabled")
+
+Utilize same mechanism to report that cacheinfo set by architecture
+specific function
+
+Signed-off-by: Vladimir Kondratiev <vladimir.kondratiev@linux.intel.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/cacheinfo.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c
+index e0dd66881da68..f777e44653d57 100644
+--- a/arch/mips/kernel/cacheinfo.c
++++ b/arch/mips/kernel/cacheinfo.c
+@@ -69,6 +69,8 @@ static int __populate_cache_leaves(unsigned int cpu)
+ if (c->tcache.waysize)
+ populate_cache(tcache, this_leaf, 3, CACHE_TYPE_UNIFIED);
+
++ this_cpu_ci->cpu_map_populated = true;
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 0634671bc65b48e88b7f999c7e6227610aafeee4 Mon Sep 17 00:00:00 2001
+From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Date: Mon, 13 May 2019 13:47:25 +0200
+Subject: MIPS: kernel: only use i8253 clocksource with periodic clockevent
+
+[ Upstream commit a07e3324538a989b7cdbf2c679be6a7f9df2544f ]
+
+i8253 clocksource needs a free running timer. This could only
+be used, if i8253 clockevent is set up as periodic.
+
+Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/kernel/i8253.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c
+index 5f209f111e59e..df7ddd246eaac 100644
+--- a/arch/mips/kernel/i8253.c
++++ b/arch/mips/kernel/i8253.c
+@@ -32,7 +32,8 @@ void __init setup_pit_timer(void)
+
+ static int __init init_pit_clocksource(void)
+ {
+- if (num_possible_cpus() > 1) /* PIT does not scale! */
++ if (num_possible_cpus() > 1 || /* PIT does not scale! */
++ !clockevent_state_periodic(&i8253_clockevent))
+ return 0;
+
+ return clocksource_i8253_init();
+--
+2.20.1
+
--- /dev/null
+From 33ed00df46d0a7a07080724e22c12c088407772c Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Tue, 6 Aug 2019 10:55:12 +0200
+Subject: net: cxgb3_main: Fix a resource leak in a error path in 'init_one()'
+
+[ Upstream commit debea2cd3193ac868289e8893c3a719c265b0612 ]
+
+A call to 'kfree_skb()' is missing in the error handling path of
+'init_one()'.
+This is already present in 'remove_one()' but is missing here.
+
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+index 1e82b9efe4471..58f89f6a040fe 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+@@ -3269,7 +3269,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ if (!adapter->regs) {
+ dev_err(&pdev->dev, "cannot map device registers\n");
+ err = -ENOMEM;
+- goto out_free_adapter;
++ goto out_free_adapter_nofail;
+ }
+
+ adapter->pdev = pdev;
+@@ -3397,6 +3397,9 @@ out_free_dev:
+ if (adapter->port[i])
+ free_netdev(adapter->port[i]);
+
++out_free_adapter_nofail:
++ kfree_skb(adapter->nofail_skb);
++
+ out_free_adapter:
+ kfree(adapter);
+
+--
+2.20.1
+
--- /dev/null
+From f68e2364f52733a0669ff4af2c16a76ebfef1b31 Mon Sep 17 00:00:00 2001
+From: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Date: Wed, 31 Jul 2019 16:15:42 +0800
+Subject: net/ethernet/qlogic/qed: force the string buffer NULL-terminated
+
+[ Upstream commit 3690c8c9a8edff0db077a38783112d8fe12a7dd2 ]
+
+strncpy() does not ensure NULL-termination when the input string
+size equals to the destination buffer size 30.
+The output string is passed to qed_int_deassertion_aeu_bit()
+which calls DP_INFO() and relies NULL-termination.
+
+Use strlcpy instead. The other conditional branch above strncpy()
+needs no fix as snprintf() ensures NULL-termination.
+
+This issue is identified by a Coccinelle script.
+
+Signed-off-by: Wang Xiayang <xywang.sjtu@sjtu.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_int.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
+index fdfedbc8e4311..70a771cd87889 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -1093,7 +1093,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn,
+ snprintf(bit_name, 30,
+ p_aeu->bit_name, num);
+ else
+- strncpy(bit_name,
++ strlcpy(bit_name,
+ p_aeu->bit_name, 30);
+
+ /* We now need to pass bitmask in its
+--
+2.20.1
+
--- /dev/null
+From cd6d7d3385e2a917043e5a3de1ea1037ef094999 Mon Sep 17 00:00:00 2001
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Date: Sat, 3 Aug 2019 20:31:41 +0800
+Subject: net: hisilicon: Fix dma_map_single failed on arm64
+
+[ Upstream commit 96a50c0d907ac8f5c3d6b051031a19eb8a2b53e3 ]
+
+On the arm64 platform, executing "ifconfig eth0 up" will fail,
+returning "ifconfig: SIOCSIFFLAGS: Input/output error."
+
+ndev->dev is not initialized, dma_map_single->get_dma_ops->
+dummy_dma_ops->__dummy_map_page will return DMA_ERROR_CODE
+directly, so when we use dma_map_single, the first parameter
+is to use the device of platform_device.
+
+Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hip04_eth.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index ee6da8d66cd31..51cf6b0db904b 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -153,6 +153,7 @@ struct hip04_priv {
+ unsigned int reg_inten;
+
+ struct napi_struct napi;
++ struct device *dev;
+ struct net_device *ndev;
+
+ struct tx_desc *tx_desc;
+@@ -383,7 +384,7 @@ static int hip04_tx_reclaim(struct net_device *ndev, bool force)
+ }
+
+ if (priv->tx_phys[tx_tail]) {
+- dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail],
++ dma_unmap_single(priv->dev, priv->tx_phys[tx_tail],
+ priv->tx_skb[tx_tail]->len,
+ DMA_TO_DEVICE);
+ priv->tx_phys[tx_tail] = 0;
+@@ -434,8 +435,8 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ return NETDEV_TX_BUSY;
+ }
+
+- phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE);
+- if (dma_mapping_error(&ndev->dev, phys)) {
++ phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE);
++ if (dma_mapping_error(priv->dev, phys)) {
+ dev_kfree_skb(skb);
+ return NETDEV_TX_OK;
+ }
+@@ -505,7 +506,7 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+ goto refill;
+ }
+
+- dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head],
++ dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head],
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+ priv->rx_phys[priv->rx_head] = 0;
+
+@@ -534,9 +535,9 @@ refill:
+ buf = netdev_alloc_frag(priv->rx_buf_size);
+ if (!buf)
+ goto done;
+- phys = dma_map_single(&ndev->dev, buf,
++ phys = dma_map_single(priv->dev, buf,
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, phys))
++ if (dma_mapping_error(priv->dev, phys))
+ goto done;
+ priv->rx_buf[priv->rx_head] = buf;
+ priv->rx_phys[priv->rx_head] = phys;
+@@ -639,9 +640,9 @@ static int hip04_mac_open(struct net_device *ndev)
+ for (i = 0; i < RX_DESC_NUM; i++) {
+ dma_addr_t phys;
+
+- phys = dma_map_single(&ndev->dev, priv->rx_buf[i],
++ phys = dma_map_single(priv->dev, priv->rx_buf[i],
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+- if (dma_mapping_error(&ndev->dev, phys))
++ if (dma_mapping_error(priv->dev, phys))
+ return -EIO;
+
+ priv->rx_phys[i] = phys;
+@@ -675,7 +676,7 @@ static int hip04_mac_stop(struct net_device *ndev)
+
+ for (i = 0; i < RX_DESC_NUM; i++) {
+ if (priv->rx_phys[i]) {
+- dma_unmap_single(&ndev->dev, priv->rx_phys[i],
++ dma_unmap_single(priv->dev, priv->rx_phys[i],
+ RX_BUF_SIZE, DMA_FROM_DEVICE);
+ priv->rx_phys[i] = 0;
+ }
+@@ -819,6 +820,7 @@ static int hip04_mac_probe(struct platform_device *pdev)
+ return -ENOMEM;
+
+ priv = netdev_priv(ndev);
++ priv->dev = d;
+ priv->ndev = ndev;
+ platform_set_drvdata(pdev, ndev);
+ SET_NETDEV_DEV(ndev, &pdev->dev);
+--
+2.20.1
+
--- /dev/null
+From e170233988ab7a4d28ec54153b2b460cbbe032c1 Mon Sep 17 00:00:00 2001
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Date: Sat, 3 Aug 2019 20:31:40 +0800
+Subject: net: hisilicon: fix hip04-xmit never return TX_BUSY
+
+[ Upstream commit f2243b82785942be519016067ee6c55a063bbfe2 ]
+
+TX_DESC_NUM is 256, in tx_count, the maximum value of
+mod(TX_DESC_NUM - 1) is 254, the variable "count" in
+the hip04_mac_start_xmit function is never equal to
+(TX_DESC_NUM - 1), so hip04_mac_start_xmit never
+return NETDEV_TX_BUSY.
+
+tx_count is modified to mod(TX_DESC_NUM) so that
+the maximum value of tx_count can reach
+(TX_DESC_NUM - 1), then hip04_mac_start_xmit can reurn
+NETDEV_TX_BUSY.
+
+Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hip04_eth.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index 5abe88dfe6abf..ee6da8d66cd31 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -181,7 +181,7 @@ struct hip04_priv {
+
+ static inline unsigned int tx_count(unsigned int head, unsigned int tail)
+ {
+- return (head - tail) % (TX_DESC_NUM - 1);
++ return (head - tail) % TX_DESC_NUM;
+ }
+
+ static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex)
+--
+2.20.1
+
--- /dev/null
+From e7061399a67f328951ca013b704e1c1a8a7ae518 Mon Sep 17 00:00:00 2001
+From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Date: Sat, 3 Aug 2019 20:31:39 +0800
+Subject: net: hisilicon: make hip04_tx_reclaim non-reentrant
+
+[ Upstream commit 1a2c070ae805910a853b4a14818481ed2e17c727 ]
+
+If hip04_tx_reclaim is interrupted while it is running
+and then __napi_schedule continues to execute
+hip04_rx_poll->hip04_tx_reclaim, reentrancy occurs
+and oops is generated. So you need to mask the interrupt
+during the hip04_tx_reclaim run.
+
+The kernel oops exception stack is as follows:
+
+Unable to handle kernel NULL pointer dereference
+at virtual address 00000050
+pgd = c0003000
+[00000050] *pgd=80000000a04003, *pmd=00000000
+Internal error: Oops: 206 [#1] SMP ARM
+Modules linked in: hip04_eth mtdblock mtd_blkdevs mtd
+ohci_platform ehci_platform ohci_hcd ehci_hcd
+vfat fat sd_mod usb_storage scsi_mod usbcore usb_common
+CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.4.185 #1
+Hardware name: Hisilicon A15
+task: c0a250e0 task.stack: c0a00000
+PC is at hip04_tx_reclaim+0xe0/0x17c [hip04_eth]
+LR is at hip04_tx_reclaim+0x30/0x17c [hip04_eth]
+pc : [<bf30c3a4>] lr : [<bf30c2f4>] psr: 600e0313
+sp : c0a01d88 ip : 00000000 fp : c0601f9c
+r10: 00000000 r9 : c3482380 r8 : 00000001
+r7 : 00000000 r6 : 000000e1 r5 : c3482000 r4 : 0000000c
+r3 : f2209800 r2 : 00000000 r1 : 00000000 r0 : 00000000
+Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel
+Control: 32c5387d Table: 03d28c80 DAC: 55555555
+Process swapper/0 (pid: 0, stack limit = 0xc0a00190)
+Stack: (0xc0a01d88 to 0xc0a02000)
+[<bf30c3a4>] (hip04_tx_reclaim [hip04_eth]) from [<bf30d2e0>]
+ (hip04_rx_poll+0x88/0x368 [hip04_eth])
+[<bf30d2e0>] (hip04_rx_poll [hip04_eth]) from [<c04c2d9c>] (net_rx_action+0x114/0x34c)
+[<c04c2d9c>] (net_rx_action) from [<c021eed8>] (__do_softirq+0x218/0x318)
+[<c021eed8>] (__do_softirq) from [<c021f284>] (irq_exit+0x88/0xac)
+[<c021f284>] (irq_exit) from [<c0240090>] (msa_irq_exit+0x11c/0x1d4)
+[<c0240090>] (msa_irq_exit) from [<c02677e0>] (__handle_domain_irq+0x110/0x148)
+[<c02677e0>] (__handle_domain_irq) from [<c0201588>] (gic_handle_irq+0xd4/0x118)
+[<c0201588>] (gic_handle_irq) from [<c0551700>] (__irq_svc+0x40/0x58)
+Exception stack(0xc0a01f30 to 0xc0a01f78)
+1f20: c0ae8b40 00000000 00000000 00000000
+1f40: 00000002 ffffe000 c0601f9c 00000000 ffffffff c0a2257c c0a22440 c0831a38
+1f60: c0a01ec4 c0a01f80 c0203714 c0203718 600e0213 ffffffff
+[<c0551700>] (__irq_svc) from [<c0203718>] (arch_cpu_idle+0x20/0x3c)
+[<c0203718>] (arch_cpu_idle) from [<c025bfd8>] (cpu_startup_entry+0x244/0x29c)
+[<c025bfd8>] (cpu_startup_entry) from [<c054b0d8>] (rest_init+0xc8/0x10c)
+[<c054b0d8>] (rest_init) from [<c0800c58>] (start_kernel+0x468/0x514)
+Code: a40599e5 016086e2 018088e2 7660efe6 (503090e5)
+---[ end trace 1db21d6d09c49d74 ]---
+Kernel panic - not syncing: Fatal exception in interrupt
+CPU3: stopping
+CPU: 3 PID: 0 Comm: swapper/3 Tainted: G D O 4.4.185 #1
+
+Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/hisilicon/hip04_eth.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
+index e1f2978506fd3..5abe88dfe6abf 100644
+--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
+@@ -494,6 +494,9 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget)
+ u16 len;
+ u32 err;
+
++ /* clean up tx descriptors */
++ tx_remaining = hip04_tx_reclaim(ndev, false);
++
+ while (cnt && !last) {
+ buf = priv->rx_buf[priv->rx_head];
+ skb = build_skb(buf, priv->rx_buf_size);
+@@ -554,8 +557,7 @@ refill:
+ }
+ napi_complete_done(napi, rx);
+ done:
+- /* clean up tx descriptors and start a new timer if necessary */
+- tx_remaining = hip04_tx_reclaim(ndev, false);
++ /* start a new timer if necessary */
+ if (rx < budget && tx_remaining)
+ hip04_start_tx_timer(priv);
+
+--
+2.20.1
+
--- /dev/null
+From 1ad609398c77e7135b4da0a1016036de75fe8b17 Mon Sep 17 00:00:00 2001
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Fri, 19 Jul 2019 16:38:48 +0200
+Subject: net: mvpp2: Don't check for 3 consecutive Idle frames for 10G links
+
+[ Upstream commit bba18318e7d1d5c8b0bbafd65010a0cee3c65608 ]
+
+PPv2's XLGMAC can wait for 3 idle frames before triggering a link up
+event. This can cause the link to be stuck low when there's traffic on
+the interface, so disable this feature.
+
+Fixes: 4bb043262878 ("net: mvpp2: phylink support")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 50ed1bdb632db..885529701de90 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -4580,9 +4580,9 @@ static void mvpp2_xlg_config(struct mvpp2_port *port, unsigned int mode,
+ else
+ ctrl0 &= ~MVPP22_XLG_CTRL0_RX_FLOW_CTRL_EN;
+
+- ctrl4 &= ~MVPP22_XLG_CTRL4_MACMODSELECT_GMAC;
+- ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC |
+- MVPP22_XLG_CTRL4_EN_IDLE_CHECK;
++ ctrl4 &= ~(MVPP22_XLG_CTRL4_MACMODSELECT_GMAC |
++ MVPP22_XLG_CTRL4_EN_IDLE_CHECK);
++ ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC;
+
+ if (old_ctrl0 != ctrl0)
+ writel(ctrl0, port->base + MVPP22_XLG_CTRL0_REG);
+--
+2.20.1
+
--- /dev/null
+From f7000d6b6b0f7a40e5097121d0f6176160cbc28e Mon Sep 17 00:00:00 2001
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+Date: Tue, 30 Jul 2019 16:08:13 +0800
+Subject: net: phy: phy_led_triggers: Fix a possible null-pointer dereference
+ in phy_led_trigger_change_speed()
+
+[ Upstream commit 271da132e29b5341c31eca6ba6a72ea1302ebac8 ]
+
+In phy_led_trigger_change_speed(), there is an if statement on line 48
+to check whether phy->last_triggered is NULL:
+ if (!phy->last_triggered)
+
+When phy->last_triggered is NULL, it is used on line 52:
+ led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
+
+Thus, a possible null-pointer dereference may occur.
+
+To fix this bug, led_trigger_event(&phy->last_triggered->trigger,
+LED_OFF) is called when phy->last_triggered is not NULL.
+
+This bug is found by a static analysis tool STCheck written by
+the OSLAB group in Tsinghua University.
+
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/phy/phy_led_triggers.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c
+index b86a4b2116f81..59a94e07e7c55 100644
+--- a/drivers/net/phy/phy_led_triggers.c
++++ b/drivers/net/phy/phy_led_triggers.c
+@@ -48,8 +48,9 @@ void phy_led_trigger_change_speed(struct phy_device *phy)
+ if (!phy->last_triggered)
+ led_trigger_event(&phy->led_link_trigger->trigger,
+ LED_FULL);
++ else
++ led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
+
+- led_trigger_event(&phy->last_triggered->trigger, LED_OFF);
+ led_trigger_event(&plt->trigger, LED_FULL);
+ phy->last_triggered = plt;
+ }
+--
+2.20.1
+
--- /dev/null
+From ffb8375755a6c0dba01b36c4efeb12da8d2dd301 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+Date: Tue, 6 Aug 2019 15:16:17 +0200
+Subject: net: stmmac: Fix issues when number of Queues >= 4
+
+[ Upstream commit e8df7e8c233a18d2704e37ecff47583b494789d3 ]
+
+When queues >= 4 we use different registers but we were not subtracting
+the offset of 4. Fix this.
+
+Found out by Coverity.
+
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 4 ++++
+ drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 4 ++++
+ 2 files changed, 8 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index e3850938cf2f3..d7bf0ad954b8c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -85,6 +85,8 @@ static void dwmac4_rx_queue_priority(struct mac_device_info *hw,
+ u32 value;
+
+ base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + base_register);
+
+@@ -102,6 +104,8 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw,
+ u32 value;
+
+ base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + base_register);
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+index 64b8cb88ea45d..d4bd99770f5d1 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c
+@@ -106,6 +106,8 @@ static void dwxgmac2_rx_queue_prio(struct mac_device_info *hw, u32 prio,
+ u32 value, reg;
+
+ reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + reg);
+ value &= ~XGMAC_PSRQ(queue);
+@@ -169,6 +171,8 @@ static void dwxgmac2_map_mtl_to_dma(struct mac_device_info *hw, u32 queue,
+ u32 value, reg;
+
+ reg = (queue < 4) ? XGMAC_MTL_RXQ_DMA_MAP0 : XGMAC_MTL_RXQ_DMA_MAP1;
++ if (queue >= 4)
++ queue -= 4;
+
+ value = readl(ioaddr + reg);
+ value &= ~XGMAC_QxMDMACH(queue);
+--
+2.20.1
+
--- /dev/null
+From 46f3957b42fffea07e6a8cff4e1fa98285e834cf Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Sat, 27 Jul 2019 21:21:37 +0200
+Subject: net: stmmac: manage errors returned by of_get_mac_address()
+
+[ Upstream commit 195b2919ccd7ffcaf6b6bbcb39444a53ab8308c7 ]
+
+Commit d01f449c008a ("of_net: add NVMEM support to of_get_mac_address")
+added support for reading the MAC address from an nvmem-cell. This
+required changing the logic to return an error pointer upon failure.
+
+If stmmac is loaded before the nvmem provider driver then
+of_get_mac_address() return an error pointer with -EPROBE_DEFER.
+
+Propagate this error so the stmmac driver will be probed again after the
+nvmem provider driver is loaded.
+Default to a random generated MAC address in case of any other error,
+instead of using the error pointer as MAC address.
+
+Fixes: d01f449c008a ("of_net: add NVMEM support to of_get_mac_address")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+index 0f0f4b31eb7ec..9b5218a8c15bc 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+@@ -385,6 +385,13 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
+ return ERR_PTR(-ENOMEM);
+
+ *mac = of_get_mac_address(np);
++ if (IS_ERR(*mac)) {
++ if (PTR_ERR(*mac) == -EPROBE_DEFER)
++ return ERR_CAST(*mac);
++
++ *mac = NULL;
++ }
++
+ plat->interface = of_get_phy_mode(np);
+
+ /* Get max speed of operation from device tree */
+--
+2.20.1
+
--- /dev/null
+From 4733a786a21c112c3d64a2ba5960b759afc54986 Mon Sep 17 00:00:00 2001
+From: Jose Abreu <Jose.Abreu@synopsys.com>
+Date: Tue, 6 Aug 2019 15:16:18 +0200
+Subject: net: stmmac: tc: Do not return a fragment entry
+
+[ Upstream commit 4a6a1385a4db5f42258a40fcd497cbfd22075968 ]
+
+Do not try to return a fragment entry from TC list. Otherwise we may not
+clean properly allocated entries.
+
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+index 58ea18af9813a..37c0bc699cd9c 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
+@@ -37,7 +37,7 @@ static struct stmmac_tc_entry *tc_find_entry(struct stmmac_priv *priv,
+ entry = &priv->tc_entries[i];
+ if (!entry->in_use && !first && free)
+ first = entry;
+- if (entry->handle == loc && !free)
++ if ((entry->handle == loc) && !free && !entry->is_frag)
+ dup = entry;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8723a38312b4b9c4725e3cf3756e5f21d4794830 Mon Sep 17 00:00:00 2001
+From: Bob Ham <bob.ham@puri.sm>
+Date: Wed, 24 Jul 2019 07:52:27 -0700
+Subject: net: usb: qmi_wwan: Add the BroadMobi BM818 card
+
+[ Upstream commit 9a07406b00cdc6ec689dc142540739575c717f3c ]
+
+The BroadMobi BM818 M.2 card uses the QMI protocol
+
+Signed-off-by: Bob Ham <bob.ham@puri.sm>
+Signed-off-by: Angus Ainslie (Purism) <angus@akkea.ca>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 8b4ad10cf9402..26c5207466afc 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1294,6 +1294,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */
+ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
+ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */
++ {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */
+ {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
+ {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
+ {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
+--
+2.20.1
+
--- /dev/null
+From 4fe5ff76b72ef4c3e8d36bbcc44b1b79c5f9c994 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Sat, 20 Jul 2019 07:22:45 -0500
+Subject: netfilter: ebtables: fix a memory leak bug in compat
+
+[ Upstream commit 15a78ba1844a8e052c1226f930133de4cef4e7ad ]
+
+In compat_do_replace(), a temporary buffer is allocated through vmalloc()
+to hold entries copied from the user space. The buffer address is firstly
+saved to 'newinfo->entries', and later on assigned to 'entries_tmp'. Then
+the entries in this temporary buffer is copied to the internal kernel
+structure through compat_copy_entries(). If this copy process fails,
+compat_do_replace() should be terminated. However, the allocated temporary
+buffer is not freed on this path, leading to a memory leak.
+
+To fix the bug, free the buffer before returning from compat_do_replace().
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/bridge/netfilter/ebtables.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 1fa9ac483173d..c8177a89f52c3 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -2267,8 +2267,10 @@ static int compat_do_replace(struct net *net, void __user *user,
+ state.buf_kern_len = size64;
+
+ ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state);
+- if (WARN_ON(ret < 0))
++ if (WARN_ON(ret < 0)) {
++ vfree(entries_tmp);
+ goto out_unlock;
++ }
+
+ vfree(entries_tmp);
+ tmp.entries_size = size64;
+--
+2.20.1
+
--- /dev/null
+From c4dfbb7a6a791165fcdae05ba04a303f79af0eaa Mon Sep 17 00:00:00 2001
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Mon, 24 Jun 2019 15:20:11 +0200
+Subject: netfilter: ipset: Actually allow destination MAC address for
+ hash:ip,mac sets too
+
+[ Upstream commit b89d15480d0cacacae1a0fe0b3da01b529f2914f ]
+
+In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
+for mac and ipmac sets"), ipset.git commit 1543514c46a7, I removed the
+KADT check that prevents matching on destination MAC addresses for
+hash:mac sets, but forgot to remove the same check for hash:ip,mac set.
+
+Drop this check: functionality is now commented in man pages and there's
+no reason to restrict to source MAC address matching anymore.
+
+Reported-by: Chen Yi <yiche@redhat.com>
+Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_hash_ipmac.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
+index faf59b6a998fe..eb14434083203 100644
+--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
+@@ -89,10 +89,6 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
+ struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
+ struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
+
+- /* MAC can be src only */
+- if (!(opt->flags & IPSET_DIM_TWO_SRC))
+- return 0;
+-
+ if (skb_mac_header(skb) < skb->head ||
+ (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 6d6cc8e81f5f4ddbed29926db69d0f3f18543f0c Mon Sep 17 00:00:00 2001
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Mon, 24 Jun 2019 15:20:12 +0200
+Subject: netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and
+ hash:ip,mac sets
+
+[ Upstream commit 1b4a75108d5bc153daf965d334e77e8e94534f96 ]
+
+In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address
+for mac and ipmac sets"), ipset.git commit 1543514c46a7, I added to the
+KADT functions for sets matching on MAC addreses the copy of source or
+destination MAC address depending on the configured match.
+
+This was done correctly for hash:mac, but for hash:ip,mac and
+bitmap:ip,mac, copying and pasting the same code block presents an
+obvious problem: in these two set types, the MAC address is the second
+dimension, not the first one, and we are actually selecting the MAC
+address depending on whether the first dimension (IP address) specifies
+source or destination.
+
+Fix this by checking for the IPSET_DIM_TWO_SRC flag in option flags.
+
+This way, mixing source and destination matches for the two dimensions
+of ip,mac set types works as expected. With this setup:
+
+ ip netns add A
+ ip link add veth1 type veth peer name veth2 netns A
+ ip addr add 192.0.2.1/24 dev veth1
+ ip -net A addr add 192.0.2.2/24 dev veth2
+ ip link set veth1 up
+ ip -net A link set veth2 up
+
+ dst=$(ip netns exec A cat /sys/class/net/veth2/address)
+
+ ip netns exec A ipset create test_bitmap bitmap:ip,mac range 192.0.0.0/16
+ ip netns exec A ipset add test_bitmap 192.0.2.1,${dst}
+ ip netns exec A iptables -A INPUT -m set ! --match-set test_bitmap src,dst -j DROP
+
+ ip netns exec A ipset create test_hash hash:ip,mac
+ ip netns exec A ipset add test_hash 192.0.2.1,${dst}
+ ip netns exec A iptables -A INPUT -m set ! --match-set test_hash src,dst -j DROP
+
+ipset correctly matches a test packet:
+
+ # ping -c1 192.0.2.2 >/dev/null
+ # echo $?
+ 0
+
+Reported-by: Chen Yi <yiche@redhat.com>
+Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +-
+ net/netfilter/ipset/ip_set_hash_ipmac.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+index b73c37b3a791f..cfe7b556775f1 100644
+--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+@@ -227,7 +227,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
+
+ e.id = ip_to_id(map, ip);
+
+- if (opt->flags & IPSET_DIM_ONE_SRC)
++ if (opt->flags & IPSET_DIM_TWO_SRC)
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
+index eb14434083203..24d8f4df4230c 100644
+--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
+@@ -93,7 +93,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
+ (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ return -EINVAL;
+
+- if (opt->flags & IPSET_DIM_ONE_SRC)
++ if (opt->flags & IPSET_DIM_TWO_SRC)
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_source);
+ else
+ ether_addr_copy(e.ether, eth_hdr(skb)->h_dest);
+--
+2.20.1
+
--- /dev/null
+From 2ebe878f04c8a15ccf3995c841bb0456708f6b63 Mon Sep 17 00:00:00 2001
+From: Jozsef Kadlecsik <kadlec@netfilter.org>
+Date: Tue, 23 Jul 2019 10:25:55 +0200
+Subject: netfilter: ipset: Fix rename concurrency with listing
+
+[ Upstream commit 6c1f7e2c1b96ab9b09ac97c4df2bd9dc327206f6 ]
+
+Shijie Luo reported that when stress-testing ipset with multiple concurrent
+create, rename, flush, list, destroy commands, it can result
+
+ipset <version>: Broken LIST kernel message: missing DATA part!
+
+error messages and broken list results. The problem was the rename operation
+was not properly handled with respect of listing. The patch fixes the issue.
+
+Reported-by: Shijie Luo <luoshijie1@huawei.com>
+Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/ipset/ip_set_core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
+index 16afa0df4004d..e103c875383a5 100644
+--- a/net/netfilter/ipset/ip_set_core.c
++++ b/net/netfilter/ipset/ip_set_core.c
+@@ -1161,7 +1161,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl,
+ return -ENOENT;
+
+ write_lock_bh(&ip_set_ref_lock);
+- if (set->ref != 0) {
++ if (set->ref != 0 || set->ref_netlink != 0) {
+ ret = -IPSET_ERR_REFERENCED;
+ goto out;
+ }
+--
+2.20.1
+
--- /dev/null
+From 1c07b194a3f7fdfa340b9bc5b89770c2648dd216 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sat, 3 Aug 2019 13:39:24 -0400
+Subject: NFS: Fix regression whereby fscache errors are appearing on 'nofsc'
+ mounts
+
+[ Upstream commit dea1bb35c5f35e0577cfc61f79261d80b8715221 ]
+
+People are reporing seeing fscache errors being reported concerning
+duplicate cookies even in cases where they are not setting up fscache
+at all. The rule needs to be that if fscache is not enabled, then it
+should have no side effects at all.
+
+To ensure this is the case, we disable fscache completely on all superblocks
+for which the 'fsc' mount option was not set. In order to avoid issues
+with '-oremount', we also disable the ability to turn fscache on via
+remount.
+
+Fixes: f1fe29b4a02d ("NFS: Use i_writecount to control whether...")
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=200145
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Cc: Steve Dickson <steved@redhat.com>
+Cc: David Howells <dhowells@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/fscache.c | 7 ++++++-
+ fs/nfs/fscache.h | 2 +-
+ fs/nfs/super.c | 1 +
+ 3 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c
+index 53507aa96b0b6..3800ab6f08fa8 100644
+--- a/fs/nfs/fscache.c
++++ b/fs/nfs/fscache.c
+@@ -114,6 +114,10 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int
+ struct rb_node **p, *parent;
+ int diff;
+
++ nfss->fscache_key = NULL;
++ nfss->fscache = NULL;
++ if (!(nfss->options & NFS_OPTION_FSCACHE))
++ return;
+ if (!uniq) {
+ uniq = "";
+ ulen = 1;
+@@ -226,10 +230,11 @@ void nfs_fscache_release_super_cookie(struct super_block *sb)
+ void nfs_fscache_init_inode(struct inode *inode)
+ {
+ struct nfs_fscache_inode_auxdata auxdata;
++ struct nfs_server *nfss = NFS_SERVER(inode);
+ struct nfs_inode *nfsi = NFS_I(inode);
+
+ nfsi->fscache = NULL;
+- if (!S_ISREG(inode->i_mode))
++ if (!(nfss->fscache && S_ISREG(inode->i_mode)))
+ return;
+
+ memset(&auxdata, 0, sizeof(auxdata));
+diff --git a/fs/nfs/fscache.h b/fs/nfs/fscache.h
+index 25a75e40d91d9..ad041cfbf9ec0 100644
+--- a/fs/nfs/fscache.h
++++ b/fs/nfs/fscache.h
+@@ -182,7 +182,7 @@ static inline void nfs_fscache_wait_on_invalidate(struct inode *inode)
+ */
+ static inline const char *nfs_server_fscache_state(struct nfs_server *server)
+ {
+- if (server->fscache && (server->options & NFS_OPTION_FSCACHE))
++ if (server->fscache)
+ return "yes";
+ return "no ";
+ }
+diff --git a/fs/nfs/super.c b/fs/nfs/super.c
+index f88ddac2dcdf3..4d375b517eda8 100644
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -2239,6 +2239,7 @@ nfs_compare_remount_data(struct nfs_server *nfss,
+ data->acdirmin != nfss->acdirmin / HZ ||
+ data->acdirmax != nfss->acdirmax / HZ ||
+ data->timeo != (10U * nfss->client->cl_timeout->to_initval / HZ) ||
++ (data->options & NFS_OPTION_FSCACHE) != (nfss->options & NFS_OPTION_FSCACHE) ||
+ data->nfs_server.port != nfss->port ||
+ data->nfs_server.addrlen != nfss->nfs_client->cl_addrlen ||
+ !rpc_cmp_addr((struct sockaddr *)&data->nfs_server.address,
+--
+2.20.1
+
--- /dev/null
+From 4f3720990a9ede2cb813d0b19dd5b5d34ea91f76 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Wed, 7 Aug 2019 07:31:27 -0400
+Subject: NFSv4: Ensure state recovery handles ETIMEDOUT correctly
+
+[ Upstream commit 67e7b52d44e3d539dfbfcd866c3d3d69da23a909 ]
+
+Ensure that the state recovery code handles ETIMEDOUT correctly,
+and also that we set RPC_TASK_TIMEOUT when recovering open state.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 2 ++
+ fs/nfs/nfs4state.c | 7 +++++--
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 74e1732a4bd01..2023011c7a8fe 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2150,6 +2150,7 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct
+ case -ENOENT:
+ case -EAGAIN:
+ case -ESTALE:
++ case -ETIMEDOUT:
+ break;
+ case -NFS4ERR_BADSESSION:
+ case -NFS4ERR_BADSLOT:
+@@ -2470,6 +2471,7 @@ static int nfs4_run_open_task(struct nfs4_opendata *data,
+ if (!ctx) {
+ nfs4_init_sequence(&o_arg->seq_args, &o_res->seq_res, 1, 1);
+ data->is_recover = true;
++ task_setup_data.flags |= RPC_TASK_TIMEOUT;
+ } else {
+ nfs4_init_sequence(&o_arg->seq_args, &o_res->seq_res, 1, 0);
+ pnfs_lgopen_prepare(data, ctx);
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 261de26d897f7..0e69cd846afb5 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1528,6 +1528,7 @@ restart:
+ switch (status) {
+ case 0:
+ break;
++ case -ETIMEDOUT:
+ case -ESTALE:
+ case -NFS4ERR_ADMIN_REVOKED:
+ case -NFS4ERR_STALE_STATEID:
+@@ -1681,11 +1682,13 @@ restart:
+ case -NFS4ERR_EXPIRED:
+ case -NFS4ERR_NO_GRACE:
+ nfs4_state_mark_reclaim_nograce(sp->so_server->nfs_client, state);
++ /* Fall through */
+ case -NFS4ERR_STALE_CLIENTID:
+ case -NFS4ERR_BADSESSION:
+ case -NFS4ERR_BADSLOT:
+ case -NFS4ERR_BAD_HIGH_SLOT:
+ case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
++ case -ETIMEDOUT:
+ goto out_err;
+ }
+ nfs4_put_open_state(state);
+@@ -1970,7 +1973,6 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status)
+ return -EPERM;
+ case -EACCES:
+ case -NFS4ERR_DELAY:
+- case -ETIMEDOUT:
+ case -EAGAIN:
+ ssleep(1);
+ break;
+@@ -2599,7 +2601,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ }
+
+ /* Now recover expired state... */
+- if (test_and_clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) {
++ if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) {
+ section = "reclaim nograce";
+ status = nfs4_do_reclaim(clp,
+ clp->cl_mvops->nograce_recovery_ops);
+@@ -2607,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ continue;
+ if (status < 0)
+ goto out_error;
++ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state);
+ }
+
+ nfs4_end_drain_session(clp);
+--
+2.20.1
+
--- /dev/null
+From fe07427f4c9b9b5ffed9663f78e8e011db94a0ef Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Fri, 19 Jul 2019 13:48:44 -0400
+Subject: NFSv4: Fix a credential refcount leak in
+ nfs41_check_delegation_stateid
+
+[ Upstream commit 8c39a39e28b86a4021d9be314ce01019bafa5fdc ]
+
+It is unsafe to dereference delegation outside the rcu lock, and in
+any case, the refcount is guaranteed held if cred is non-zero.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 63edda145d1b8..420f2350c2781 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2752,8 +2752,7 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID)
+ nfs_finish_clear_delegation_stateid(state, &stateid);
+
+- if (delegation->cred)
+- put_cred(cred);
++ put_cred(cred);
+ }
+
+ /**
+--
+2.20.1
+
--- /dev/null
+From 8f6e029060201bfb475b1d541bc0c35fb7335463 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sat, 3 Aug 2019 10:11:27 -0400
+Subject: NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()
+
+[ Upstream commit c77e22834ae9a11891cb613bd9a551be1b94f2bc ]
+
+John Hubbard reports seeing the following stack trace:
+
+nfs4_do_reclaim
+ rcu_read_lock /* we are now in_atomic() and must not sleep */
+ nfs4_purge_state_owners
+ nfs4_free_state_owner
+ nfs4_destroy_seqid_counter
+ rpc_destroy_wait_queue
+ cancel_delayed_work_sync
+ __cancel_work_timer
+ __flush_work
+ start_flush_work
+ might_sleep:
+ (kernel/workqueue.c:2975: BUG)
+
+The solution is to separate out the freeing of the state owners
+from nfs4_purge_state_owners(), and perform that outside the atomic
+context.
+
+Reported-by: John Hubbard <jhubbard@nvidia.com>
+Fixes: 0aaaf5c424c7f ("NFS: Cache state owners after files are closed")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4_fs.h | 3 ++-
+ fs/nfs/nfs4client.c | 5 ++++-
+ fs/nfs/nfs4state.c | 27 ++++++++++++++++++++++-----
+ 3 files changed, 28 insertions(+), 7 deletions(-)
+
+diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
+index 8a38a254f5162..235919156eddd 100644
+--- a/fs/nfs/nfs4_fs.h
++++ b/fs/nfs/nfs4_fs.h
+@@ -465,7 +465,8 @@ static inline void nfs4_schedule_session_recovery(struct nfs4_session *session,
+
+ extern struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *, const struct cred *, gfp_t);
+ extern void nfs4_put_state_owner(struct nfs4_state_owner *);
+-extern void nfs4_purge_state_owners(struct nfs_server *);
++extern void nfs4_purge_state_owners(struct nfs_server *, struct list_head *);
++extern void nfs4_free_state_owners(struct list_head *head);
+ extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *);
+ extern void nfs4_put_open_state(struct nfs4_state *);
+ extern void nfs4_close_state(struct nfs4_state *, fmode_t);
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 81b9b6d7927ac..208a236dc2350 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -758,9 +758,12 @@ out:
+
+ static void nfs4_destroy_server(struct nfs_server *server)
+ {
++ LIST_HEAD(freeme);
++
+ nfs_server_return_all_delegations(server);
+ unset_pnfs_layoutdriver(server);
+- nfs4_purge_state_owners(server);
++ nfs4_purge_state_owners(server, &freeme);
++ nfs4_free_state_owners(&freeme);
+ }
+
+ /*
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 556ec916846f0..261de26d897f7 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -624,24 +624,39 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp)
+ /**
+ * nfs4_purge_state_owners - Release all cached state owners
+ * @server: nfs_server with cached state owners to release
++ * @head: resulting list of state owners
+ *
+ * Called at umount time. Remaining state owners will be on
+ * the LRU with ref count of zero.
++ * Note that the state owners are not freed, but are added
++ * to the list @head, which can later be used as an argument
++ * to nfs4_free_state_owners.
+ */
+-void nfs4_purge_state_owners(struct nfs_server *server)
++void nfs4_purge_state_owners(struct nfs_server *server, struct list_head *head)
+ {
+ struct nfs_client *clp = server->nfs_client;
+ struct nfs4_state_owner *sp, *tmp;
+- LIST_HEAD(doomed);
+
+ spin_lock(&clp->cl_lock);
+ list_for_each_entry_safe(sp, tmp, &server->state_owners_lru, so_lru) {
+- list_move(&sp->so_lru, &doomed);
++ list_move(&sp->so_lru, head);
+ nfs4_remove_state_owner_locked(sp);
+ }
+ spin_unlock(&clp->cl_lock);
++}
+
+- list_for_each_entry_safe(sp, tmp, &doomed, so_lru) {
++/**
++ * nfs4_purge_state_owners - Release all cached state owners
++ * @head: resulting list of state owners
++ *
++ * Frees a list of state owners that was generated by
++ * nfs4_purge_state_owners
++ */
++void nfs4_free_state_owners(struct list_head *head)
++{
++ struct nfs4_state_owner *sp, *tmp;
++
++ list_for_each_entry_safe(sp, tmp, head, so_lru) {
+ list_del(&sp->so_lru);
+ nfs4_free_state_owner(sp);
+ }
+@@ -1864,12 +1879,13 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov
+ struct nfs4_state_owner *sp;
+ struct nfs_server *server;
+ struct rb_node *pos;
++ LIST_HEAD(freeme);
+ int status = 0;
+
+ restart:
+ rcu_read_lock();
+ list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) {
+- nfs4_purge_state_owners(server);
++ nfs4_purge_state_owners(server, &freeme);
+ spin_lock(&clp->cl_lock);
+ for (pos = rb_first(&server->state_owners);
+ pos != NULL;
+@@ -1898,6 +1914,7 @@ restart:
+ spin_unlock(&clp->cl_lock);
+ }
+ rcu_read_unlock();
++ nfs4_free_state_owners(&freeme);
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 8731eb0d22eeed2eab7b137888f1d7d40b74c0bc Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Mon, 22 Jul 2019 09:54:29 +0100
+Subject: NFSv4: When recovering state fails with EAGAIN, retry the same
+ recovery
+
+[ Upstream commit c34fae003c79570b6c930b425fea3f0b7b1e7056 ]
+
+If the server returns with EAGAIN when we're trying to recover from
+a server reboot, we currently delay for 1 second, but then mark the
+stateid as needing recovery after the grace period has expired.
+
+Instead, we should just retry the same recovery process immediately
+after the 1 second delay. Break out of the loop after 10 retries.
+
+Fixes: 35a61606a612 ("NFS: Reduce indentation of the switch statement...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4state.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index e2e3c4f04d3e0..556ec916846f0 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1606,6 +1606,7 @@ static int __nfs4_reclaim_open_state(struct nfs4_state_owner *sp, struct nfs4_st
+ static int nfs4_reclaim_open_state(struct nfs4_state_owner *sp, const struct nfs4_state_recovery_ops *ops)
+ {
+ struct nfs4_state *state;
++ unsigned int loop = 0;
+ int status = 0;
+
+ /* Note: we rely on the sp->so_states list being ordered
+@@ -1632,8 +1633,10 @@ restart:
+
+ switch (status) {
+ default:
+- if (status >= 0)
++ if (status >= 0) {
++ loop = 0;
+ break;
++ }
+ printk(KERN_ERR "NFS: %s: unhandled error %d\n", __func__, status);
+ /* Fall through */
+ case -ENOENT:
+@@ -1647,6 +1650,10 @@ restart:
+ break;
+ case -EAGAIN:
+ ssleep(1);
++ if (loop++ < 10) {
++ set_bit(ops->state_flag_bit, &state->flags);
++ break;
++ }
+ /* Fall through */
+ case -NFS4ERR_ADMIN_REVOKED:
+ case -NFS4ERR_STALE_STATEID:
+--
+2.20.1
+
--- /dev/null
+From 8a210359ebe2f5ccc88a11f5a253355b95bf969d Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Mon, 22 Jul 2019 18:32:59 +0100
+Subject: NFSv4.1: Fix open stateid recovery
+
+[ Upstream commit 27a30cf64a5cbe2105e4ff9613246b32d584766a ]
+
+The logic for checking in nfs41_check_open_stateid() whether the state
+is supported by a delegation is inverted. In addition, it makes more
+sense to perform that check before we check for expired locks.
+
+Fixes: 8a64c4ef106d1 ("NFSv4.1: Even if the stateid is OK,...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/nfs4proc.c | 65 +++++++++++++++++++++++++++--------------------
+ 1 file changed, 38 insertions(+), 27 deletions(-)
+
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 420f2350c2781..74e1732a4bd01 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1654,6 +1654,14 @@ static void nfs_state_set_open_stateid(struct nfs4_state *state,
+ write_sequnlock(&state->seqlock);
+ }
+
++static void nfs_state_clear_open_state_flags(struct nfs4_state *state)
++{
++ clear_bit(NFS_O_RDWR_STATE, &state->flags);
++ clear_bit(NFS_O_WRONLY_STATE, &state->flags);
++ clear_bit(NFS_O_RDONLY_STATE, &state->flags);
++ clear_bit(NFS_OPEN_STATE, &state->flags);
++}
++
+ static void nfs_state_set_delegation(struct nfs4_state *state,
+ const nfs4_stateid *deleg_stateid,
+ fmode_t fmode)
+@@ -2049,13 +2057,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state *
+ {
+ int ret;
+
+- /* Don't trigger recovery in nfs_test_and_clear_all_open_stateid */
+- clear_bit(NFS_O_RDWR_STATE, &state->flags);
+- clear_bit(NFS_O_WRONLY_STATE, &state->flags);
+- clear_bit(NFS_O_RDONLY_STATE, &state->flags);
+ /* memory barrier prior to reading state->n_* */
+- clear_bit(NFS_DELEGATED_STATE, &state->flags);
+- clear_bit(NFS_OPEN_STATE, &state->flags);
+ smp_rmb();
+ ret = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE);
+ if (ret != 0)
+@@ -2131,6 +2133,8 @@ static int nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *sta
+ ctx = nfs4_state_find_open_context(state);
+ if (IS_ERR(ctx))
+ return -EAGAIN;
++ clear_bit(NFS_DELEGATED_STATE, &state->flags);
++ nfs_state_clear_open_state_flags(state);
+ ret = nfs4_do_open_reclaim(ctx, state);
+ put_nfs_open_context(ctx);
+ return ret;
+@@ -2672,6 +2676,7 @@ static int nfs40_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
+ {
+ /* NFSv4.0 doesn't allow for delegation recovery on open expire */
+ nfs40_clear_delegation_stateid(state);
++ nfs_state_clear_open_state_flags(state);
+ return nfs4_open_expired(sp, state);
+ }
+
+@@ -2714,13 +2719,13 @@ out_free:
+ return -NFS4ERR_EXPIRED;
+ }
+
+-static void nfs41_check_delegation_stateid(struct nfs4_state *state)
++static int nfs41_check_delegation_stateid(struct nfs4_state *state)
+ {
+ struct nfs_server *server = NFS_SERVER(state->inode);
+ nfs4_stateid stateid;
+ struct nfs_delegation *delegation;
+ const struct cred *cred = NULL;
+- int status;
++ int status, ret = NFS_OK;
+
+ /* Get the delegation credential for use by test/free_stateid */
+ rcu_read_lock();
+@@ -2728,20 +2733,15 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ if (delegation == NULL) {
+ rcu_read_unlock();
+ nfs_state_clear_delegation(state);
+- return;
++ return NFS_OK;
+ }
+
+ nfs4_stateid_copy(&stateid, &delegation->stateid);
+- if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) {
+- rcu_read_unlock();
+- nfs_state_clear_delegation(state);
+- return;
+- }
+
+ if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED,
+ &delegation->flags)) {
+ rcu_read_unlock();
+- return;
++ return NFS_OK;
+ }
+
+ if (delegation->cred)
+@@ -2751,8 +2751,24 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state)
+ trace_nfs4_test_delegation_stateid(state, NULL, status);
+ if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID)
+ nfs_finish_clear_delegation_stateid(state, &stateid);
++ else
++ ret = status;
+
+ put_cred(cred);
++ return ret;
++}
++
++static void nfs41_delegation_recover_stateid(struct nfs4_state *state)
++{
++ nfs4_stateid tmp;
++
++ if (test_bit(NFS_DELEGATED_STATE, &state->flags) &&
++ nfs4_copy_delegation_stateid(state->inode, state->state,
++ &tmp, NULL) &&
++ nfs4_stateid_match_other(&state->stateid, &tmp))
++ nfs_state_set_delegation(state, &tmp, state->state);
++ else
++ nfs_state_clear_delegation(state);
+ }
+
+ /**
+@@ -2822,21 +2838,12 @@ static int nfs41_check_open_stateid(struct nfs4_state *state)
+ const struct cred *cred = state->owner->so_cred;
+ int status;
+
+- if (test_bit(NFS_OPEN_STATE, &state->flags) == 0) {
+- if (test_bit(NFS_DELEGATED_STATE, &state->flags) == 0) {
+- if (nfs4_have_delegation(state->inode, state->state))
+- return NFS_OK;
+- return -NFS4ERR_OPENMODE;
+- }
++ if (test_bit(NFS_OPEN_STATE, &state->flags) == 0)
+ return -NFS4ERR_BAD_STATEID;
+- }
+ status = nfs41_test_and_free_expired_stateid(server, stateid, cred);
+ trace_nfs4_test_open_stateid(state, NULL, status);
+ if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID) {
+- clear_bit(NFS_O_RDONLY_STATE, &state->flags);
+- clear_bit(NFS_O_WRONLY_STATE, &state->flags);
+- clear_bit(NFS_O_RDWR_STATE, &state->flags);
+- clear_bit(NFS_OPEN_STATE, &state->flags);
++ nfs_state_clear_open_state_flags(state);
+ stateid->type = NFS4_INVALID_STATEID_TYPE;
+ return status;
+ }
+@@ -2849,7 +2856,11 @@ static int nfs41_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st
+ {
+ int status;
+
+- nfs41_check_delegation_stateid(state);
++ status = nfs41_check_delegation_stateid(state);
++ if (status != NFS_OK)
++ return status;
++ nfs41_delegation_recover_stateid(state);
++
+ status = nfs41_check_expired_locks(state);
+ if (status != NFS_OK)
+ return status;
+--
+2.20.1
+
--- /dev/null
+From 83bc740a79a35ed5d9da162a1b53f787ad2dd355 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Fri, 26 Jul 2019 14:40:53 +0100
+Subject: NFSv4.1: Only reap expired delegations
+
+[ Upstream commit ad11408970df79d5f481aa9964e91f183133424c ]
+
+Fix nfs_reap_expired_delegations() to ensure that we only reap delegations
+that are actually expired, rather than triggering on random errors.
+
+Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/nfs/delegation.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 0af854cce8ffa..071b90a45933a 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -1046,6 +1046,22 @@ void nfs_test_expired_all_delegations(struct nfs_client *clp)
+ nfs4_schedule_state_manager(clp);
+ }
+
++static void
++nfs_delegation_test_free_expired(struct inode *inode,
++ nfs4_stateid *stateid,
++ const struct cred *cred)
++{
++ struct nfs_server *server = NFS_SERVER(inode);
++ const struct nfs4_minor_version_ops *ops = server->nfs_client->cl_mvops;
++ int status;
++
++ if (!cred)
++ return;
++ status = ops->test_and_free_expired(server, stateid, cred);
++ if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID)
++ nfs_remove_bad_delegation(inode, stateid);
++}
++
+ /**
+ * nfs_reap_expired_delegations - reap expired delegations
+ * @clp: nfs_client to process
+@@ -1057,7 +1073,6 @@ void nfs_test_expired_all_delegations(struct nfs_client *clp)
+ */
+ void nfs_reap_expired_delegations(struct nfs_client *clp)
+ {
+- const struct nfs4_minor_version_ops *ops = clp->cl_mvops;
+ struct nfs_delegation *delegation;
+ struct nfs_server *server;
+ struct inode *inode;
+@@ -1088,11 +1103,7 @@ restart:
+ nfs4_stateid_copy(&stateid, &delegation->stateid);
+ clear_bit(NFS_DELEGATION_TEST_EXPIRED, &delegation->flags);
+ rcu_read_unlock();
+- if (cred != NULL &&
+- ops->test_and_free_expired(server, &stateid, cred) < 0) {
+- nfs_revoke_delegation(inode, &stateid);
+- nfs_inode_find_state_and_recover(inode, &stateid);
+- }
++ nfs_delegation_test_free_expired(inode, &stateid, cred);
+ put_cred(cred);
+ if (nfs4_server_rebooted(clp)) {
+ nfs_inode_mark_test_expired_delegation(server,inode);
+--
+2.20.1
+
--- /dev/null
+From eae8058f0e0dff7500187b253d4545826c80c9e6 Mon Sep 17 00:00:00 2001
+From: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Date: Mon, 22 Jul 2019 12:44:50 +0530
+Subject: {nl,mac}80211: fix interface combinations on crypto controlled
+ devices
+
+[ Upstream commit e6f4051123fd33901e9655a675b22aefcdc5d277 ]
+
+Commit 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on
+crypto controlled devices") has introduced a change which allows
+4addr operation on crypto controlled devices (ex: ath10k). This
+change has inadvertently impacted the interface combinations logic
+on such devices.
+
+General rule is that software interfaces like AP/VLAN should not be
+listed under supported interface combinations and should not be
+considered during validation of these combinations; because of the
+aforementioned change, AP/VLAN interfaces(if present) will be checked
+against interfaces supported by the device and blocks valid interface
+combinations.
+
+Consider a case where an AP and AP/VLAN are up and running; when a
+second AP device is brought up on the same physical device, this AP
+will be checked against the AP/VLAN interface (which will not be
+part of supported interface combinations of the device) and blocks
+second AP to come up.
+
+Add a new API cfg80211_iftype_allowed() to fix the problem, this
+API works for all devices with/without SW crypto control.
+
+Signed-off-by: Manikanta Pubbisetty <mpubbise@codeaurora.org>
+Fixes: 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on crypto controlled devices")
+Link: https://lore.kernel.org/r/1563779690-9716-1-git-send-email-mpubbise@codeaurora.org
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cfg80211.h | 15 +++++++++++++++
+ net/mac80211/util.c | 7 +++----
+ net/wireless/core.c | 6 ++----
+ net/wireless/nl80211.c | 4 +---
+ net/wireless/util.c | 27 +++++++++++++++++++++++++--
+ 5 files changed, 46 insertions(+), 13 deletions(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 8fb5be3ca0ca8..8b13bd05befac 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -7254,6 +7254,21 @@ void cfg80211_pmsr_complete(struct wireless_dev *wdev,
+ struct cfg80211_pmsr_request *req,
+ gfp_t gfp);
+
++/**
++ * cfg80211_iftype_allowed - check whether the interface can be allowed
++ * @wiphy: the wiphy
++ * @iftype: interface type
++ * @is_4addr: use_4addr flag, must be '0' when check_swif is '1'
++ * @check_swif: check iftype against software interfaces
++ *
++ * Check whether the interface is allowed to operate; additionally, this API
++ * can be used to check iftype against the software interfaces when
++ * check_swif is '1'.
++ */
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++ bool is_4addr, u8 check_swif);
++
++
+ /* Logging, debugging and troubleshooting/diagnostic helpers. */
+
+ /* wiphy_printk helpers, similar to dev_printk */
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 1b224fa27367f..ad1e58184c4e4 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3796,9 +3796,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ }
+
+ /* Always allow software iftypes */
+- if (local->hw.wiphy->software_iftypes & BIT(iftype) ||
+- (iftype == NL80211_IFTYPE_AP_VLAN &&
+- local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) {
++ if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) {
+ if (radar_detect)
+ return -EINVAL;
+ return 0;
+@@ -3833,7 +3831,8 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+
+ if (sdata_iter == sdata ||
+ !ieee80211_sdata_running(sdata_iter) ||
+- local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
++ cfg80211_iftype_allowed(local->hw.wiphy,
++ wdev_iter->iftype, 0, 1))
+ continue;
+
+ params.iftype_num[wdev_iter->iftype]++;
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 53ad3dbb76fe5..ed24a0b071c33 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -1397,10 +1397,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
+ }
+ break;
+ case NETDEV_PRE_UP:
+- if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)) &&
+- !(wdev->iftype == NL80211_IFTYPE_AP_VLAN &&
+- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP &&
+- wdev->use_4addr))
++ if (!cfg80211_iftype_allowed(wdev->wiphy, wdev->iftype,
++ wdev->use_4addr, 0))
+ return notifier_from_errno(-EOPNOTSUPP);
+
+ if (rfkill_blocked(rdev->rfkill))
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 520d437aa8d15..88a1de9def115 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3481,9 +3481,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
+ return err;
+ }
+
+- if (!(rdev->wiphy.interface_modes & (1 << type)) &&
+- !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
+- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
++ if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
+ return -EOPNOTSUPP;
+
+ err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
+diff --git a/net/wireless/util.c b/net/wireless/util.c
+index 1c39d6a2e8501..d0e35b7b9e350 100644
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -1697,7 +1697,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+ num_interfaces += params->iftype_num[iftype];
+ if (params->iftype_num[iftype] > 0 &&
+- !(wiphy->software_iftypes & BIT(iftype)))
++ !cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ used_iftypes |= BIT(iftype);
+ }
+
+@@ -1719,7 +1719,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy,
+ return -ENOMEM;
+
+ for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) {
+- if (wiphy->software_iftypes & BIT(iftype))
++ if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1))
+ continue;
+ for (j = 0; j < c->n_limits; j++) {
+ all_iftypes |= limits[j].types;
+@@ -2072,3 +2072,26 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap,
+ return max_vht_nss;
+ }
+ EXPORT_SYMBOL(ieee80211_get_vht_max_nss);
++
++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype,
++ bool is_4addr, u8 check_swif)
++
++{
++ bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN;
++
++ switch (check_swif) {
++ case 0:
++ if (is_vlan && is_4addr)
++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++ return wiphy->interface_modes & BIT(iftype);
++ case 1:
++ if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan)
++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP;
++ return wiphy->software_iftypes & BIT(iftype);
++ default:
++ break;
++ }
++
++ return false;
++}
++EXPORT_SYMBOL(cfg80211_iftype_allowed);
+--
+2.20.1
+
--- /dev/null
+From 6995baeac1cf1565b26b31343fd749516620251d Mon Sep 17 00:00:00 2001
+From: Jean Delvare <jdelvare@suse.de>
+Date: Sun, 28 Jul 2019 18:42:55 +0200
+Subject: nvmem: Use the same permissions for eeprom as for nvmem
+
+[ Upstream commit e70d8b287301eb6d7c7761c6171c56af62110ea3 ]
+
+The compatibility "eeprom" attribute is currently root-only no
+matter what the configuration says. The "nvmem" attribute does
+respect the setting of the root_only configuration bit, so do the
+same for "eeprom".
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Fixes: b6c217ab9be6 ("nvmem: Add backwards compatibility support for older EEPROM drivers.")
+Reviewed-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Cc: Andrew Lunn <andrew@lunn.ch>
+Cc: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20190728184255.563332e6@endymion
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nvmem/nvmem-sysfs.c | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/nvmem/nvmem-sysfs.c b/drivers/nvmem/nvmem-sysfs.c
+index 6f303b91f6e70..9e0c429cd08a2 100644
+--- a/drivers/nvmem/nvmem-sysfs.c
++++ b/drivers/nvmem/nvmem-sysfs.c
+@@ -224,10 +224,17 @@ int nvmem_sysfs_setup_compat(struct nvmem_device *nvmem,
+ if (!config->base_dev)
+ return -EINVAL;
+
+- if (nvmem->read_only)
+- nvmem->eeprom = bin_attr_ro_root_nvmem;
+- else
+- nvmem->eeprom = bin_attr_rw_root_nvmem;
++ if (nvmem->read_only) {
++ if (config->root_only)
++ nvmem->eeprom = bin_attr_ro_root_nvmem;
++ else
++ nvmem->eeprom = bin_attr_ro_nvmem;
++ } else {
++ if (config->root_only)
++ nvmem->eeprom = bin_attr_rw_root_nvmem;
++ else
++ nvmem->eeprom = bin_attr_rw_nvmem;
++ }
+ nvmem->eeprom.attr.name = "eeprom";
+ nvmem->eeprom.size = nvmem->size;
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+--
+2.20.1
+
--- /dev/null
+From 481b766d4040970a778463e267ff4d0708154878 Mon Sep 17 00:00:00 2001
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Thu, 1 Aug 2019 16:26:42 +0200
+Subject: perf bench numa: Fix cpu0 binding
+
+[ Upstream commit 6bbfe4e602691b90ac866712bd4c43c51e546a60 ]
+
+Michael reported an issue with perf bench numa failing with binding to
+cpu0 with '-0' option.
+
+ # perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd
+ # Running 'numa/mem' benchmark:
+
+ # Running main, "perf bench numa numa-mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd"
+ binding to node 0, mask: 0000000000000001 => -1
+ perf: bench/numa.c:356: bind_to_memnode: Assertion `!(ret)' failed.
+ Aborted (core dumped)
+
+This happens when the cpu0 is not part of node0, which is the benchmark
+assumption and we can see that's not the case for some powerpc servers.
+
+Using correct node for cpu0 binding.
+
+Reported-by: Michael Petlan <mpetlan@redhat.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Satheesh Rajendran <sathnaga@linux.vnet.ibm.com>
+Link: http://lkml.kernel.org/r/20190801142642.28004-1-jolsa@kernel.org
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/bench/numa.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index a7784554a80de..23c27ca48abf3 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -379,8 +379,10 @@ static u8 *alloc_data(ssize_t bytes0, int map_flags,
+
+ /* Allocate and initialize all memory on CPU#0: */
+ if (init_cpu0) {
+- orig_mask = bind_to_node(0);
+- bind_to_memnode(0);
++ int node = numa_node_of_cpu(0);
++
++ orig_mask = bind_to_node(node);
++ bind_to_memnode(node);
+ }
+
+ bytes = bytes0 + HPSIZE;
+--
+2.20.1
+
--- /dev/null
+From faf4f2698bb91a50367383312e287a74b4442e09 Mon Sep 17 00:00:00 2001
+From: He Zhe <zhe.he@windriver.com>
+Date: Fri, 2 Aug 2019 16:29:52 +0800
+Subject: perf cpumap: Fix writing to illegal memory in handling cpumap mask
+
+[ Upstream commit 5f5e25f1c7933a6e1673515c0b1d5acd82fea1ed ]
+
+cpu_map__snprint_mask() would write to illegal memory pointed by
+zalloc(0) when there is only one cpu.
+
+This patch fixes the calculation and adds sanity check against the input
+parameters.
+
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Fixes: 4400ac8a9a90 ("perf cpumap: Introduce cpu_map__snprint_mask()")
+Link: http://lkml.kernel.org/r/1564734592-15624-2-git-send-email-zhe.he@windriver.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/util/cpumap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
+index 0b599229bc7e9..0aba5b39c21ef 100644
+--- a/tools/perf/util/cpumap.c
++++ b/tools/perf/util/cpumap.c
+@@ -701,7 +701,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size)
+ unsigned char *bitmap;
+ int last_cpu = cpu_map__cpu(map, map->nr - 1);
+
+- bitmap = zalloc((last_cpu + 7) / 8);
++ if (buf == NULL)
++ return 0;
++
++ bitmap = zalloc(last_cpu / 8 + 1);
+ if (bitmap == NULL) {
+ buf[0] = '\0';
+ return 0;
+--
+2.20.1
+
--- /dev/null
+From af6f9676c1db8e59ac84999f4816f47d867aceed Mon Sep 17 00:00:00 2001
+From: He Zhe <zhe.he@windriver.com>
+Date: Fri, 2 Aug 2019 16:29:51 +0800
+Subject: perf ftrace: Fix failure to set cpumask when only one cpu is present
+
+[ Upstream commit cf30ae726c011e0372fd4c2d588466c8b50a8907 ]
+
+The buffer containing the string used to set cpumask is overwritten at
+the end of the string later in cpu_map__snprint_mask due to not enough
+memory space, when there is only one cpu.
+
+And thus causes the following failure:
+
+ $ perf ftrace ls
+ failed to reset ftrace
+ $
+
+This patch fixes the calculation of the cpumask string size.
+
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Fixes: dc23103278c5 ("perf ftrace: Add support for -a and -C option")
+Link: http://lkml.kernel.org/r/1564734592-15624-1-git-send-email-zhe.he@windriver.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/builtin-ftrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
+index 9c228c55e1fb7..22386ab350504 100644
+--- a/tools/perf/builtin-ftrace.c
++++ b/tools/perf/builtin-ftrace.c
+@@ -173,7 +173,7 @@ static int set_tracing_cpumask(struct cpu_map *cpumap)
+ int last_cpu;
+
+ last_cpu = cpu_map__cpu(cpumap, cpumap->nr - 1);
+- mask_size = (last_cpu + 3) / 4 + 1;
++ mask_size = last_cpu / 4 + 2; /* one more byte for EOS */
+ mask_size += last_cpu / 32; /* ',' is needed for every 32th cpus */
+
+ cpumask = malloc(mask_size);
+--
+2.20.1
+
--- /dev/null
+From 3a917799af722635e93cd2503ef743bf629b333b Mon Sep 17 00:00:00 2001
+From: Jin Yao <yao.jin@linux.intel.com>
+Date: Mon, 29 Jul 2019 15:27:55 +0800
+Subject: perf pmu-events: Fix missing "cpu_clk_unhalted.core" event
+
+[ Upstream commit 8e6e5bea2e34c61291d00cb3f47560341aa84bc3 ]
+
+The events defined in pmu-events JSON are parsed and added into perf
+tool. For fixed counters, we handle the encodings between JSON and perf
+by using a static array fixed[].
+
+But the fixed[] has missed an important event "cpu_clk_unhalted.core".
+
+For example, on the Tremont platform,
+
+ [root@localhost ~]# perf stat -e cpu_clk_unhalted.core -a
+ event syntax error: 'cpu_clk_unhalted.core'
+ \___ parser error
+
+With this patch, the event cpu_clk_unhalted.core can be parsed.
+
+ [root@localhost perf]# ./perf stat -e cpu_clk_unhalted.core -a -vvv
+ ------------------------------------------------------------
+ perf_event_attr:
+ type 4
+ size 112
+ config 0x3c
+ sample_type IDENTIFIER
+ read_format TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING
+ disabled 1
+ inherit 1
+ exclude_guest 1
+ ------------------------------------------------------------
+...
+
+Signed-off-by: Jin Yao <yao.jin@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Jin Yao <yao.jin@intel.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Kan Liang <kan.liang@linux.intel.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lkml.kernel.org/r/20190729072755.2166-1-yao.jin@linux.intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/perf/pmu-events/jevents.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c
+index 58f77fd0f59fe..ed5423d8a95fd 100644
+--- a/tools/perf/pmu-events/jevents.c
++++ b/tools/perf/pmu-events/jevents.c
+@@ -450,6 +450,7 @@ static struct fixed {
+ { "inst_retired.any_p", "event=0xc0" },
+ { "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" },
+ { "cpu_clk_unhalted.thread", "event=0x3c" },
++ { "cpu_clk_unhalted.core", "event=0x3c" },
+ { "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" },
+ { NULL, NULL},
+ };
+--
+2.20.1
+
--- /dev/null
+From 063e6c3f2dd647cd52e4b69d0ea3dadc72681e92 Mon Sep 17 00:00:00 2001
+From: Michal Kalderon <michal.kalderon@marvell.com>
+Date: Thu, 25 Jul 2019 13:59:55 +0300
+Subject: qed: RDMA - Fix the hw_ver returned in device attributes
+
+[ Upstream commit 81af04b432fdfabcdbd2c06be2ee647e3ca41a22 ]
+
+The hw_ver field was initialized to zero. Return the chip revision.
+This is relevant for rdma driver.
+
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qed/qed_rdma.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+index 13802b825d65a..909422d939033 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+@@ -442,7 +442,7 @@ static void qed_rdma_init_devinfo(struct qed_hwfn *p_hwfn,
+ /* Vendor specific information */
+ dev->vendor_id = cdev->vendor_id;
+ dev->vendor_part_id = cdev->device_id;
+- dev->hw_ver = 0;
++ dev->hw_ver = cdev->chip_rev;
+ dev->fw_ver = (FW_MAJOR_VERSION << 24) | (FW_MINOR_VERSION << 16) |
+ (FW_REVISION_VERSION << 8) | (FW_ENGINEERING_VERSION);
+
+--
+2.20.1
+
--- /dev/null
+From f320f7073ea95461f1116fe5c2ded94b61d8d5f7 Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Sat, 13 Jul 2019 11:07:17 +0200
+Subject: regulator: axp20x: fix DCDC5 and DCDC6 for AXP803
+
+[ Upstream commit 8f46e22b5ac692b48d04bb722547ca17b66dda02 ]
+
+Refactoring of axp20x driver introduced a bug in AXP803's DCDC6
+regulator definition. AXP803_DCDC6_1120mV_STEPS was obtained by
+subtracting 0x47 and 0x33. This should be 0x14 (hex) and not 14
+(dec).
+
+Refactoring also carried over a bug in DCDC5 regulator definition.
+Number of possible voltages must be for 1 bigger than maximum valid
+voltage index, because 0 is also valid and it means lowest voltage.
+
+Fixes: 1dbe0ccb0631 ("regulator: axp20x-regulator: add support for AXP803")
+Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20190713090717.347-3-jernej.skrabec@siol.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/axp20x-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
+index c951568994a11..989506bd90b19 100644
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -174,14 +174,14 @@
+ #define AXP803_DCDC5_1140mV_STEPS 35
+ #define AXP803_DCDC5_1140mV_END \
+ (AXP803_DCDC5_1140mV_START + AXP803_DCDC5_1140mV_STEPS)
+-#define AXP803_DCDC5_NUM_VOLTAGES 68
++#define AXP803_DCDC5_NUM_VOLTAGES 69
+
+ #define AXP803_DCDC6_600mV_START 0x00
+ #define AXP803_DCDC6_600mV_STEPS 50
+ #define AXP803_DCDC6_600mV_END \
+ (AXP803_DCDC6_600mV_START + AXP803_DCDC6_600mV_STEPS)
+ #define AXP803_DCDC6_1120mV_START 0x33
+-#define AXP803_DCDC6_1120mV_STEPS 14
++#define AXP803_DCDC6_1120mV_STEPS 20
+ #define AXP803_DCDC6_1120mV_END \
+ (AXP803_DCDC6_1120mV_START + AXP803_DCDC6_1120mV_STEPS)
+ #define AXP803_DCDC6_NUM_VOLTAGES 72
+--
+2.20.1
+
--- /dev/null
+From f0db4e4e1ca44220092571251afee776a736bc4f Mon Sep 17 00:00:00 2001
+From: Jernej Skrabec <jernej.skrabec@siol.net>
+Date: Sat, 13 Jul 2019 11:07:16 +0200
+Subject: regulator: axp20x: fix DCDCA and DCDCD for AXP806
+
+[ Upstream commit 1ef55fed9219963359a7b3bc7edca8517c6e45ac ]
+
+Refactoring of the driver introduced bugs in AXP806's DCDCA and DCDCD
+regulator definitions.
+
+In DCDCA case, AXP806_DCDCA_1120mV_STEPS was obtained by subtracting
+0x47 and 0x33. This should be 0x14 (hex) and not 14 (dec).
+
+In DCDCD case, axp806_dcdcd_ranges[] contains two ranges with same
+start and end macros, which is clearly wrong. Second range starts at
+1.6V so it should use AXP806_DCDCD_1600mV_[START|END] macros. They are
+already defined but unused.
+
+Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks")
+Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
+Link: https://lore.kernel.org/r/20190713090717.347-2-jernej.skrabec@siol.net
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/axp20x-regulator.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c
+index 152053361862d..c951568994a11 100644
+--- a/drivers/regulator/axp20x-regulator.c
++++ b/drivers/regulator/axp20x-regulator.c
+@@ -240,7 +240,7 @@
+ #define AXP806_DCDCA_600mV_END \
+ (AXP806_DCDCA_600mV_START + AXP806_DCDCA_600mV_STEPS)
+ #define AXP806_DCDCA_1120mV_START 0x33
+-#define AXP806_DCDCA_1120mV_STEPS 14
++#define AXP806_DCDCA_1120mV_STEPS 20
+ #define AXP806_DCDCA_1120mV_END \
+ (AXP806_DCDCA_1120mV_START + AXP806_DCDCA_1120mV_STEPS)
+ #define AXP806_DCDCA_NUM_VOLTAGES 72
+@@ -774,8 +774,8 @@ static const struct regulator_linear_range axp806_dcdcd_ranges[] = {
+ AXP806_DCDCD_600mV_END,
+ 20000),
+ REGULATOR_LINEAR_RANGE(1600000,
+- AXP806_DCDCD_600mV_START,
+- AXP806_DCDCD_600mV_END,
++ AXP806_DCDCD_1600mV_START,
++ AXP806_DCDCD_1600mV_END,
+ 100000),
+ };
+
+--
+2.20.1
+
--- /dev/null
+From a0168f1b41af143741932507f3b5c598130a1cba Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 30 Jul 2019 14:42:50 +0100
+Subject: rxrpc: Fix potential deadlock
+
+[ Upstream commit 60034d3d146b11922ab1db613bce062dddc0327a ]
+
+There is a potential deadlock in rxrpc_peer_keepalive_dispatch() whereby
+rxrpc_put_peer() is called with the peer_hash_lock held, but if it reduces
+the peer's refcount to 0, rxrpc_put_peer() calls __rxrpc_put_peer() - which
+the tries to take the already held lock.
+
+Fix this by providing a version of rxrpc_put_peer() that can be called in
+situations where the lock is already held.
+
+The bug may produce the following lockdep report:
+
+============================================
+WARNING: possible recursive locking detected
+5.2.0-next-20190718 #41 Not tainted
+--------------------------------------------
+kworker/0:3/21678 is trying to acquire lock:
+00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh
+/./include/linux/spinlock.h:343 [inline]
+00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
+__rxrpc_put_peer /net/rxrpc/peer_object.c:415 [inline]
+00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
+rxrpc_put_peer+0x2d3/0x6a0 /net/rxrpc/peer_object.c:435
+
+but task is already holding lock:
+00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh
+/./include/linux/spinlock.h:343 [inline]
+00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
+rxrpc_peer_keepalive_dispatch /net/rxrpc/peer_event.c:378 [inline]
+00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at:
+rxrpc_peer_keepalive_worker+0x6b3/0xd02 /net/rxrpc/peer_event.c:430
+
+Fixes: 330bdcfadcee ("rxrpc: Fix the keepalive generator [ver #2]")
+Reported-by: syzbot+72af434e4b3417318f84@syzkaller.appspotmail.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/ar-internal.h | 1 +
+ net/rxrpc/peer_event.c | 2 +-
+ net/rxrpc/peer_object.c | 18 ++++++++++++++++++
+ 3 files changed, 20 insertions(+), 1 deletion(-)
+
+diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
+index 80335b4ee4fd6..822f45386e311 100644
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -1061,6 +1061,7 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *);
+ struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *);
+ struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *);
+ void rxrpc_put_peer(struct rxrpc_peer *);
++void rxrpc_put_peer_locked(struct rxrpc_peer *);
+
+ /*
+ * proc.c
+diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c
+index 9f2f45c09e583..7666ec72d37e5 100644
+--- a/net/rxrpc/peer_event.c
++++ b/net/rxrpc/peer_event.c
+@@ -378,7 +378,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet,
+ spin_lock_bh(&rxnet->peer_hash_lock);
+ list_add_tail(&peer->keepalive_link,
+ &rxnet->peer_keepalive[slot & mask]);
+- rxrpc_put_peer(peer);
++ rxrpc_put_peer_locked(peer);
+ }
+
+ spin_unlock_bh(&rxnet->peer_hash_lock);
+diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c
+index 9d3ce81cf8ae8..9c3ac96f71cbf 100644
+--- a/net/rxrpc/peer_object.c
++++ b/net/rxrpc/peer_object.c
+@@ -436,6 +436,24 @@ void rxrpc_put_peer(struct rxrpc_peer *peer)
+ }
+ }
+
++/*
++ * Drop a ref on a peer record where the caller already holds the
++ * peer_hash_lock.
++ */
++void rxrpc_put_peer_locked(struct rxrpc_peer *peer)
++{
++ const void *here = __builtin_return_address(0);
++ int n;
++
++ n = atomic_dec_return(&peer->usage);
++ trace_rxrpc_peer(peer, rxrpc_peer_put, n, here);
++ if (n == 0) {
++ hash_del_rcu(&peer->hash_link);
++ list_del_init(&peer->keepalive_link);
++ kfree_rcu(peer, rcu);
++ }
++}
++
+ /*
+ * Make sure all peer records have been discarded.
+ */
+--
+2.20.1
+
--- /dev/null
+From f46c5cfc8605a5ec1e3fe359ebf7e3dd6934b95d Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 30 Jul 2019 14:42:50 +0100
+Subject: rxrpc: Fix the lack of notification when sendmsg() fails on a DATA
+ packet
+
+[ Upstream commit c69565ee6681e151e2bb80502930a16e04b553d1 ]
+
+Fix the fact that a notification isn't sent to the recvmsg side to indicate
+a call failed when sendmsg() fails to transmit a DATA packet with the error
+ENETUNREACH, EHOSTUNREACH or ECONNREFUSED.
+
+Without this notification, the afs client just sits there waiting for the
+call to complete in some manner (which it's not now going to do), which
+also pins the rxrpc call in place.
+
+This can be seen if the client has a scope-level IPv6 address, but not a
+global-level IPv6 address, and we try and transmit an operation to a
+server's IPv6 address.
+
+Looking in /proc/net/rxrpc/calls shows completed calls just sat there with
+an abort code of RX_USER_ABORT and an error code of -ENETUNREACH.
+
+Fixes: c54e43d752c7 ("rxrpc: Fix missing start of call timeout")
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Marc Dionne <marc.dionne@auristor.com>
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/rxrpc/sendmsg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 5d3f33ce6d410..bae14438f8691 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -226,6 +226,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call,
+ rxrpc_set_call_completion(call,
+ RXRPC_CALL_LOCAL_ERROR,
+ 0, ret);
++ rxrpc_notify_socket(call);
+ goto out;
+ }
+ _debug("need instant resend %d", ret);
+--
+2.20.1
+
--- /dev/null
+From 5aed462929318b6eed1f2e30b2112077ef8ff418 Mon Sep 17 00:00:00 2001
+From: Vasily Gorbik <gor@linux.ibm.com>
+Date: Fri, 26 Jul 2019 08:23:20 +0200
+Subject: s390/mm: fix dump_pagetables top level page table walking
+
+[ Upstream commit 8024b5a9fc2bed9a00f0bdba60b443fa3cc4bb5d ]
+
+Since commit d1874a0c2805 ("s390/mm: make the pxd_offset functions more
+robust") behaviour of p4d_offset, pud_offset and pmd_offset has been
+changed so that they cannot be used to iterate through top level page
+table, because the index for the top level page table is now calculated
+in pgd_offset. To avoid dumping the very first region/segment top level
+table entry 2048 times simply iterate entry pointer like it is already
+done in other page walking cases.
+
+Fixes: d1874a0c2805 ("s390/mm: make the pxd_offset functions more robust")
+Reported-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/mm/dump_pagetables.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
+index 3b93ba0b5d8d6..5d67b81c704a4 100644
+--- a/arch/s390/mm/dump_pagetables.c
++++ b/arch/s390/mm/dump_pagetables.c
+@@ -161,9 +161,9 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st,
+ }
+ #endif
+
+- for (i = 0; i < PTRS_PER_PMD && addr < max_addr; i++) {
++ pmd = pmd_offset(pud, addr);
++ for (i = 0; i < PTRS_PER_PMD && addr < max_addr; i++, pmd++) {
+ st->current_address = addr;
+- pmd = pmd_offset(pud, addr);
+ if (!pmd_none(*pmd)) {
+ if (pmd_large(*pmd)) {
+ prot = pmd_val(*pmd) &
+@@ -192,9 +192,9 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st,
+ }
+ #endif
+
+- for (i = 0; i < PTRS_PER_PUD && addr < max_addr; i++) {
++ pud = pud_offset(p4d, addr);
++ for (i = 0; i < PTRS_PER_PUD && addr < max_addr; i++, pud++) {
+ st->current_address = addr;
+- pud = pud_offset(p4d, addr);
+ if (!pud_none(*pud))
+ if (pud_large(*pud)) {
+ prot = pud_val(*pud) &
+@@ -222,9 +222,9 @@ static void walk_p4d_level(struct seq_file *m, struct pg_state *st,
+ }
+ #endif
+
+- for (i = 0; i < PTRS_PER_P4D && addr < max_addr; i++) {
++ p4d = p4d_offset(pgd, addr);
++ for (i = 0; i < PTRS_PER_P4D && addr < max_addr; i++, p4d++) {
+ st->current_address = addr;
+- p4d = p4d_offset(pgd, addr);
+ if (!p4d_none(*p4d))
+ walk_pud_level(m, st, p4d, addr);
+ else
+--
+2.20.1
+
--- /dev/null
+From f824bc07b31b58eab49e0ceffe2309a6671f5470 Mon Sep 17 00:00:00 2001
+From: Vasily Gorbik <gor@linux.ibm.com>
+Date: Fri, 2 Aug 2019 13:27:22 +0200
+Subject: s390/protvirt: avoid memory sharing for diag 308 set/store
+
+[ Upstream commit a287a49e672d9762bb85de117b477bdf3ef20bd5 ]
+
+This reverts commit db9492cef45e ("s390/protvirt: add memory sharing for
+diag 308 set/store") which due to ultravisor implementation change is
+not needed after all.
+
+Fixes: db9492cef45e ("s390/protvirt: add memory sharing for diag 308 set/store")
+Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/boot/ipl_parm.c | 2 --
+ arch/s390/kernel/ipl.c | 9 ---------
+ 2 files changed, 11 deletions(-)
+
+diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c
+index 3c49bde8aa5e3..b8aa6a9f937b2 100644
+--- a/arch/s390/boot/ipl_parm.c
++++ b/arch/s390/boot/ipl_parm.c
+@@ -48,9 +48,7 @@ void store_ipl_parmblock(void)
+ {
+ int rc;
+
+- uv_set_shared(__pa(&ipl_block));
+ rc = __diag308(DIAG308_STORE, &ipl_block);
+- uv_remove_shared(__pa(&ipl_block));
+ if (rc == DIAG308_RC_OK &&
+ ipl_block.hdr.version <= IPL_MAX_SUPPORTED_VERSION)
+ ipl_block_valid = 1;
+diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
+index 2c0a515428d61..6837affc19e81 100644
+--- a/arch/s390/kernel/ipl.c
++++ b/arch/s390/kernel/ipl.c
+@@ -31,7 +31,6 @@
+ #include <asm/os_info.h>
+ #include <asm/sections.h>
+ #include <asm/boot_data.h>
+-#include <asm/uv.h>
+ #include "entry.h"
+
+ #define IPL_PARM_BLOCK_VERSION 0
+@@ -892,21 +891,15 @@ static void __reipl_run(void *unused)
+ {
+ switch (reipl_type) {
+ case IPL_TYPE_CCW:
+- uv_set_shared(__pa(reipl_block_ccw));
+ diag308(DIAG308_SET, reipl_block_ccw);
+- uv_remove_shared(__pa(reipl_block_ccw));
+ diag308(DIAG308_LOAD_CLEAR, NULL);
+ break;
+ case IPL_TYPE_FCP:
+- uv_set_shared(__pa(reipl_block_fcp));
+ diag308(DIAG308_SET, reipl_block_fcp);
+- uv_remove_shared(__pa(reipl_block_fcp));
+ diag308(DIAG308_LOAD_CLEAR, NULL);
+ break;
+ case IPL_TYPE_NSS:
+- uv_set_shared(__pa(reipl_block_nss));
+ diag308(DIAG308_SET, reipl_block_nss);
+- uv_remove_shared(__pa(reipl_block_nss));
+ diag308(DIAG308_LOAD_CLEAR, NULL);
+ break;
+ case IPL_TYPE_UNKNOWN:
+@@ -1176,9 +1169,7 @@ static struct kset *dump_kset;
+
+ static void diag308_dump(void *dump_block)
+ {
+- uv_set_shared(__pa(dump_block));
+ diag308(DIAG308_SET, dump_block);
+- uv_remove_shared(__pa(dump_block));
+ while (1) {
+ if (diag308(DIAG308_LOAD_NORMAL_DUMP, NULL) != 0x302)
+ break;
+--
+2.20.1
+
--- /dev/null
+From 7250890a516010c209b7ab4197b6fbb31e0bf4b9 Mon Sep 17 00:00:00 2001
+From: Vasily Gorbik <gor@linux.ibm.com>
+Date: Mon, 5 Aug 2019 14:25:16 +0200
+Subject: s390: put _stext and _etext into .text section
+
+[ Upstream commit 24350fdadbdec780406a1ef988e6cd3875e374a8 ]
+
+Perf relies on _etext and _stext symbols being one of 't', 'T', 'v' or
+'V'. Put them into .text section to guarantee that.
+
+Also moves padding to page boundary inside .text which has an effect that
+.text section is now padded with nops rather than 0's, which apparently
+has been the initial intention for specifying 0x0700 fill expression.
+
+Reported-by: Thomas Richter <tmricht@linux.ibm.com>
+Tested-by: Thomas Richter <tmricht@linux.ibm.com>
+Suggested-by: Andreas Krebbel <krebbel@linux.ibm.com>
+Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/vmlinux.lds.S | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S
+index 49d55327de0bc..7e0eb40209177 100644
+--- a/arch/s390/kernel/vmlinux.lds.S
++++ b/arch/s390/kernel/vmlinux.lds.S
+@@ -32,10 +32,9 @@ PHDRS {
+ SECTIONS
+ {
+ . = 0x100000;
+- _stext = .; /* Start of text section */
+ .text : {
+- /* Text and read-only data */
+- _text = .;
++ _stext = .; /* Start of text section */
++ _text = .; /* Text and read-only data */
+ HEAD_TEXT
+ TEXT_TEXT
+ SCHED_TEXT
+@@ -47,11 +46,10 @@ SECTIONS
+ *(.text.*_indirect_*)
+ *(.fixup)
+ *(.gnu.warning)
++ . = ALIGN(PAGE_SIZE);
++ _etext = .; /* End of text section */
+ } :text = 0x0700
+
+- . = ALIGN(PAGE_SIZE);
+- _etext = .; /* End of text section */
+-
+ NOTES :text :note
+
+ .dummy : { *(.dummy) } :data
+--
+2.20.1
+
--- /dev/null
+From d10c168b81e34fd55b66bc794e0b795a3c300514 Mon Sep 17 00:00:00 2001
+From: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Date: Fri, 2 Aug 2019 15:59:43 +0100
+Subject: sched/deadline: Fix double accounting of rq/running bw in push & pull
+
+[ Upstream commit f4904815f97a934258445a8f763f6b6c48f007e7 ]
+
+{push,pull}_dl_task() always calls {de,}activate_task() with .flags=0
+which sets p->on_rq=TASK_ON_RQ_MIGRATING.
+
+{push,pull}_dl_task()->{de,}activate_task()->{de,en}queue_task()->
+{de,en}queue_task_dl() calls {sub,add}_{running,rq}_bw() since
+p->on_rq==TASK_ON_RQ_MIGRATING.
+So {sub,add}_{running,rq}_bw() in {push,pull}_dl_task() is
+double-accounting for that task.
+
+Fix it by removing rq/running bw accounting in [push/pull]_dl_task().
+
+Fixes: 7dd778841164 ("sched/core: Unify p->on_rq updates")
+Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Valentin Schneider <valentin.schneider@arm.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Luca Abeni <luca.abeni@santannapisa.it>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Juri Lelli <juri.lelli@redhat.com>
+Cc: Qais Yousef <qais.yousef@arm.com>
+Link: https://lkml.kernel.org/r/20190802145945.18702-2-dietmar.eggemann@arm.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/deadline.c | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
+index 43901fa3f2693..1c66480afda81 100644
+--- a/kernel/sched/deadline.c
++++ b/kernel/sched/deadline.c
+@@ -2088,17 +2088,13 @@ retry:
+ }
+
+ deactivate_task(rq, next_task, 0);
+- sub_running_bw(&next_task->dl, &rq->dl);
+- sub_rq_bw(&next_task->dl, &rq->dl);
+ set_task_cpu(next_task, later_rq->cpu);
+- add_rq_bw(&next_task->dl, &later_rq->dl);
+
+ /*
+ * Update the later_rq clock here, because the clock is used
+ * by the cpufreq_update_util() inside __add_running_bw().
+ */
+ update_rq_clock(later_rq);
+- add_running_bw(&next_task->dl, &later_rq->dl);
+ activate_task(later_rq, next_task, ENQUEUE_NOCLOCK);
+ ret = 1;
+
+@@ -2186,11 +2182,7 @@ static void pull_dl_task(struct rq *this_rq)
+ resched = true;
+
+ deactivate_task(src_rq, p, 0);
+- sub_running_bw(&p->dl, &src_rq->dl);
+- sub_rq_bw(&p->dl, &src_rq->dl);
+ set_task_cpu(p, this_cpu);
+- add_rq_bw(&p->dl, &this_rq->dl);
+- add_running_bw(&p->dl, &this_rq->dl);
+ activate_task(this_rq, p, 0);
+ dmin = p->dl.deadline;
+
+--
+2.20.1
+
--- /dev/null
+From 9006f6b85279584b2b329480ab43d308d172d826 Mon Sep 17 00:00:00 2001
+From: Suren Baghdasaryan <surenb@google.com>
+Date: Mon, 29 Jul 2019 18:33:10 -0700
+Subject: sched/psi: Do not require setsched permission from the trigger
+ creator
+
+[ Upstream commit 04e048cf09d7b5fc995817cdc5ae1acd4482429c ]
+
+When a process creates a new trigger by writing into /proc/pressure/*
+files, permissions to write such a file should be used to determine whether
+the process is allowed to do so or not. Current implementation would also
+require such a process to have setsched capability. Setting of psi trigger
+thread's scheduling policy is an implementation detail and should not be
+exposed to the user level. Remove the permission check by using _nocheck
+version of the function.
+
+Suggested-by: Nick Kralevich <nnk@google.com>
+Signed-off-by: Suren Baghdasaryan <surenb@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: lizefan@huawei.com
+Cc: mingo@redhat.com
+Cc: akpm@linux-foundation.org
+Cc: kernel-team@android.com
+Cc: dennisszhou@gmail.com
+Cc: dennis@kernel.org
+Cc: hannes@cmpxchg.org
+Cc: axboe@kernel.dk
+Link: https://lkml.kernel.org/r/20190730013310.162367-1-surenb@google.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/psi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
+index 7fe2c5fd26b54..23fbbcc414d5d 100644
+--- a/kernel/sched/psi.c
++++ b/kernel/sched/psi.c
+@@ -1061,7 +1061,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group,
+ mutex_unlock(&group->trigger_lock);
+ return ERR_CAST(kworker);
+ }
+- sched_setscheduler(kworker->task, SCHED_FIFO, ¶m);
++ sched_setscheduler_nocheck(kworker->task, SCHED_FIFO, ¶m);
+ kthread_init_delayed_work(&group->poll_work,
+ psi_poll_work);
+ rcu_assign_pointer(group->poll_kworker, kworker);
+--
+2.20.1
+
--- /dev/null
+From 7010bed51b704bc7885709251437f1658a1d41b1 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Thu, 1 Aug 2019 12:41:31 +0200
+Subject: sched/psi: Reduce psimon FIFO priority
+
+[ Upstream commit 14f5c7b46a41a595fc61db37f55721714729e59e ]
+
+PSI defaults to a FIFO-99 thread, reduce this to FIFO-1.
+
+FIFO-99 is the very highest priority available to SCHED_FIFO and
+it not a suitable default; it would indicate the psi work is the
+most important work on the machine.
+
+Since Real-Time tasks will have pre-allocated memory and locked it in
+place, Real-Time tasks do not care about PSI. All it needs is to be
+above OTHER.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Tested-by: Suren Baghdasaryan <surenb@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/sched/psi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
+index 7acc632c3b82b..7fe2c5fd26b54 100644
+--- a/kernel/sched/psi.c
++++ b/kernel/sched/psi.c
+@@ -1051,7 +1051,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group,
+
+ if (!rcu_access_pointer(group->poll_kworker)) {
+ struct sched_param param = {
+- .sched_priority = MAX_RT_PRIO - 1,
++ .sched_priority = 1,
+ };
+ struct kthread_worker *kworker;
+
+--
+2.20.1
+
--- /dev/null
+From 25cdd35e7b901f4b295aa430c47f1b2abcc717b4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 23 Jul 2019 03:15:38 -0700
+Subject: selftests/bpf: add another gso_segs access
+
+[ Upstream commit be69483bf4f3abaaca5d5ba460dbb50239463552 ]
+
+Use BPF_REG_1 for source and destination of gso_segs read,
+to exercise "bpf: fix access to skb_shared_info->gso_segs" fix.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Suggested-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/verifier/ctx_skb.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/tools/testing/selftests/bpf/verifier/ctx_skb.c b/tools/testing/selftests/bpf/verifier/ctx_skb.c
+index b0fda2877119c..d438193804b21 100644
+--- a/tools/testing/selftests/bpf/verifier/ctx_skb.c
++++ b/tools/testing/selftests/bpf/verifier/ctx_skb.c
+@@ -974,6 +974,17 @@
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
+ },
++{
++ "read gso_segs from CGROUP_SKB",
++ .insns = {
++ BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
++ offsetof(struct __sk_buff, gso_segs)),
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_EXIT_INSN(),
++ },
++ .result = ACCEPT,
++ .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
++},
+ {
+ "write gso_segs from CGROUP_SKB",
+ .insns = {
+--
+2.20.1
+
--- /dev/null
+From 438f23acd354a6ee0120eccc235cf1f802fd02b9 Mon Sep 17 00:00:00 2001
+From: Ilya Leoshkevich <iii@linux.ibm.com>
+Date: Fri, 19 Jul 2019 11:06:11 +0200
+Subject: selftests/bpf: fix sendmsg6_prog on s390
+
+[ Upstream commit c8eee4135a456bc031d67cadc454e76880d1afd8 ]
+
+"sendmsg6: rewrite IP & port (C)" fails on s390, because the code in
+sendmsg_v6_prog() assumes that (ctx->user_ip6[0] & 0xFFFF) refers to
+leading IPv6 address digits, which is not the case on big-endian
+machines.
+
+Since checking bitwise operations doesn't seem to be the point of the
+test, replace two short comparisons with a single int comparison.
+
+Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Acked-by: Andrey Ignatov <rdna@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
+index 5aeaa284fc474..a680628204108 100644
+--- a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
++++ b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c
+@@ -41,8 +41,7 @@ int sendmsg_v6_prog(struct bpf_sock_addr *ctx)
+ }
+
+ /* Rewrite destination. */
+- if ((ctx->user_ip6[0] & 0xFFFF) == bpf_htons(0xFACE) &&
+- ctx->user_ip6[0] >> 16 == bpf_htons(0xB00C)) {
++ if (ctx->user_ip6[0] == bpf_htonl(0xFACEB00C)) {
+ ctx->user_ip6[0] = bpf_htonl(DST_REWRITE_IP6_0);
+ ctx->user_ip6[1] = bpf_htonl(DST_REWRITE_IP6_1);
+ ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2);
+--
+2.20.1
+
--- /dev/null
+From 76612075407c692e4ad3e7ac2743bfe0832522fc Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Tue, 23 Jul 2019 11:19:25 +0300
+Subject: selftests: forwarding: gre_multipath: Enable IPv4 forwarding
+
+[ Upstream commit efa7b79f675da0efafe3f32ba0d6efe916cf4867 ]
+
+The test did not enable IPv4 forwarding during its setup phase, which
+causes the test to fail on machines where IPv4 forwarding is disabled.
+
+Fixes: 54818c4c4b93 ("selftests: forwarding: Test multipath tunneling")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Tested-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/net/forwarding/gre_multipath.sh | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+index cca2baa03fb81..37d7297e1cf8a 100755
+--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh
++++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+@@ -187,12 +187,16 @@ setup_prepare()
+ sw1_create
+ sw2_create
+ h2_create
++
++ forwarding_enable
+ }
+
+ cleanup()
+ {
+ pre_cleanup
+
++ forwarding_restore
++
+ h2_destroy
+ sw2_destroy
+ sw1_destroy
+--
+2.20.1
+
--- /dev/null
+From c2764d264428935e37bc299d68364318b4356446 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Tue, 23 Jul 2019 11:19:26 +0300
+Subject: selftests: forwarding: gre_multipath: Fix flower filters
+
+[ Upstream commit 1be79d89b7ae96e004911bd228ce8c2b5cc6415f ]
+
+The TC filters used in the test do not work with veth devices because the
+outer Ethertype is 802.1Q and not IPv4. The test passes with mlxsw
+netdevs since the hardware always looks at "The first Ethertype that
+does not point to either: VLAN, CNTAG or configurable Ethertype".
+
+Fix this by matching on the VLAN ID instead, but on the ingress side.
+The reason why this is not performed at egress is explained in the
+commit cited below.
+
+Fixes: 541ad323db3a ("selftests: forwarding: gre_multipath: Update next-hop statistics match criteria")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Tested-by: Stephen Suryaputra <ssuryaextr@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../selftests/net/forwarding/gre_multipath.sh | 24 +++++++++----------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+index 37d7297e1cf8a..a8d8e8b3dc819 100755
+--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh
++++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh
+@@ -93,18 +93,10 @@ sw1_create()
+ ip route add vrf v$ol1 192.0.2.16/28 \
+ nexthop dev g1a \
+ nexthop dev g1b
+-
+- tc qdisc add dev $ul1 clsact
+- tc filter add dev $ul1 egress pref 111 prot ipv4 \
+- flower dst_ip 192.0.2.66 action pass
+- tc filter add dev $ul1 egress pref 222 prot ipv4 \
+- flower dst_ip 192.0.2.82 action pass
+ }
+
+ sw1_destroy()
+ {
+- tc qdisc del dev $ul1 clsact
+-
+ ip route del vrf v$ol1 192.0.2.16/28
+
+ ip route del vrf v$ol1 192.0.2.82/32 via 192.0.2.146
+@@ -139,10 +131,18 @@ sw2_create()
+ ip route add vrf v$ol2 192.0.2.0/28 \
+ nexthop dev g2a \
+ nexthop dev g2b
++
++ tc qdisc add dev $ul2 clsact
++ tc filter add dev $ul2 ingress pref 111 prot 802.1Q \
++ flower vlan_id 111 action pass
++ tc filter add dev $ul2 ingress pref 222 prot 802.1Q \
++ flower vlan_id 222 action pass
+ }
+
+ sw2_destroy()
+ {
++ tc qdisc del dev $ul2 clsact
++
+ ip route del vrf v$ol2 192.0.2.0/28
+
+ ip route del vrf v$ol2 192.0.2.81/32 via 192.0.2.145
+@@ -215,15 +215,15 @@ multipath4_test()
+ nexthop dev g1a weight $weight1 \
+ nexthop dev g1b weight $weight2
+
+- local t0_111=$(tc_rule_stats_get $ul1 111 egress)
+- local t0_222=$(tc_rule_stats_get $ul1 222 egress)
++ local t0_111=$(tc_rule_stats_get $ul2 111 ingress)
++ local t0_222=$(tc_rule_stats_get $ul2 222 ingress)
+
+ ip vrf exec v$h1 \
+ $MZ $h1 -q -p 64 -A 192.0.2.1 -B 192.0.2.18 \
+ -d 1msec -t udp "sp=1024,dp=0-32768"
+
+- local t1_111=$(tc_rule_stats_get $ul1 111 egress)
+- local t1_222=$(tc_rule_stats_get $ul1 222 egress)
++ local t1_111=$(tc_rule_stats_get $ul2 111 ingress)
++ local t1_222=$(tc_rule_stats_get $ul2 222 ingress)
+
+ local d111=$((t1_111 - t0_111))
+ local d222=$((t1_222 - t0_222))
+--
+2.20.1
+
--- /dev/null
+From b1b864c83777dbb9ed4b21a8a332472c9b9b0854 Mon Sep 17 00:00:00 2001
+From: Naresh Kamboju <naresh.kamboju () linaro ! org>
+Date: Wed, 7 Aug 2019 13:58:14 +0000
+Subject: selftests: kvm: Adding config fragments
+
+[ Upstream commit c096397c78f766db972f923433031f2dec01cae0 ]
+
+selftests kvm test cases need pre-required kernel configs for the test
+to get pass.
+
+Signed-off-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/kvm/config | 3 +++
+ 1 file changed, 3 insertions(+)
+ create mode 100644 tools/testing/selftests/kvm/config
+
+diff --git a/tools/testing/selftests/kvm/config b/tools/testing/selftests/kvm/config
+new file mode 100644
+index 0000000000000..63ed533f73d6e
+--- /dev/null
++++ b/tools/testing/selftests/kvm/config
+@@ -0,0 +1,3 @@
++CONFIG_KVM=y
++CONFIG_KVM_INTEL=y
++CONFIG_KVM_AMD=y
+--
+2.20.1
+
--- /dev/null
+asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch
+asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch
+asoc-simple-card-fix-an-use-after-free-in-simple_for.patch
+asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch
+asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch
+asoc-audio-graph-card-add-missing-const-at-graph_get.patch
+regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch
+regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch
+asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch
+asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch
+asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch
+hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch
+hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch
+mips-kernel-only-use-i8253-clocksource-with-periodic.patch
+mips-fix-cacheinfo.patch
+libbpf-sanitize-var-to-conservative-1-byte-int.patch
+netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch
+asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch
+asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch
+spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch
+bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch
+bpf-sockmap-synchronize_rcu-before-free-ing-map.patch
+bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch
+selftests-bpf-fix-sendmsg6_prog-on-s390.patch
+asoc-dapm-fix-a-memory-leak-bug.patch
+bonding-force-slave-speed-check-after-link-state-rec.patch
+net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch
+selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch
+selftests-forwarding-gre_multipath-fix-flower-filter.patch
+selftests-bpf-add-another-gso_segs-access.patch
+libbpf-fix-using-uninitialized-ioctl-results.patch
+can-dev-call-netif_carrier_off-in-register_candev.patch
+can-mcp251x-add-error-check-when-wq-alloc-failed.patch
+can-gw-fix-error-path-of-cgw_module_init.patch
+asoc-fail-card-instantiation-if-dai-format-setup-fai.patch
+staging-fbtft-fix-gpio-handling.patch
+libbpf-silence-gcc8-warning-about-string-truncation.patch
+st21nfca_connectivity_event_received-null-check-the-.patch
+st_nci_hci_connectivity_event_received-null-check-th.patch
+nl-mac-80211-fix-interface-combinations-on-crypto-co.patch
+asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch
+asoc-rockchip-fix-mono-capture.patch
+asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch
+net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch
+qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch
+isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch
+habanalabs-fix-f-w-download-in-be-architecture.patch
+mac80211_hwsim-fix-possible-null-pointer-dereference.patch
+net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch
+netfilter-ipset-actually-allow-destination-mac-addre.patch
+netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch
+netfilter-ipset-fix-rename-concurrency-with-listing.patch
+rxrpc-fix-potential-deadlock.patch
+rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch
+nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch
+iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch
+iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch
+iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch
+iwlwifi-fix-locking-in-delayed-gtk-setting.patch
+iwlwifi-mvm-send-lq-command-always-async.patch
+enetc-fix-build-error-without-phylib.patch
+isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch
+net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch
+perf-bench-numa-fix-cpu0-binding.patch
+spi-pxa2xx-add-support-for-intel-tiger-lake.patch
+can-sja1000-force-the-string-buffer-null-terminated.patch
+can-peak_usb-force-the-string-buffer-null-terminated.patch
+asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch
+net-ethernet-qlogic-qed-force-the-string-buffer-null.patch
+enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch
+nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch
+nfsv4-when-recovering-state-fails-with-eagain-retry-.patch
+nfsv4.1-fix-open-stateid-recovery.patch
+nfsv4.1-only-reap-expired-delegations.patch
+nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch
+nfs-fix-regression-whereby-fscache-errors-are-appear.patch
+hid-quirks-set-the-increment_usage_on_duplicate-quir.patch
+hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch
+drm-rockchip-suspend-dp-late.patch
+smb3-fix-potential-memory-leak-when-processing-compo.patch
+smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch
+sched-deadline-fix-double-accounting-of-rq-running-b.patch
+sched-psi-reduce-psimon-fifo-priority.patch
+sched-psi-do-not-require-setsched-permission-from-th.patch
+s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch
+s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch
+s390-put-_stext-and-_etext-into-.text-section.patch
+ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch
+net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch
+net-stmmac-fix-issues-when-number-of-queues-4.patch
+net-stmmac-tc-do-not-return-a-fragment-entry.patch
+drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch
+net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch
+net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch
+net-hisilicon-fix-dma_map_single-failed-on-arm64.patch
+nfsv4-ensure-state-recovery-handles-etimedout-correc.patch
+libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch
+libata-add-sg-safety-checks-in-sff-pio-transfers.patch
+x86-lib-cpu-address-missing-prototypes-warning.patch
+drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch
+block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch
+block-bfq-handle-null-return-value-by-bfq_init_rq.patch
+perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch
+perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch
+perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch
+dt-bindings-riscv-fix-the-schema-compatible-string-f.patch
+kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch
+kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch
+selftests-kvm-adding-config-fragments.patch
+iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch
--- /dev/null
+From 28ec6454f9c6cad9bc9c1625e58cca39d74dab41 Mon Sep 17 00:00:00 2001
+From: Pavel Shilovsky <pshilov@microsoft.com>
+Date: Mon, 22 Jul 2019 11:38:22 -0700
+Subject: SMB3: Fix potential memory leak when processing compound chain
+
+[ Upstream commit 3edeb4a4146dc3b54d6fa71b7ee0585cb52ebfdf ]
+
+When a reconnect happens in the middle of processing a compound chain
+the code leaks a buffer from the memory pool. Fix this by properly
+checking for a return code and freeing buffers in case of error.
+
+Also maintain a buf variable to be equal to either smallbuf or bigbuf
+depending on a response buffer size while parsing a chain and when
+returning to the caller.
+
+Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
+Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 29 +++++++++++++++++------------
+ 1 file changed, 17 insertions(+), 12 deletions(-)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 2ec37dc589a7b..ae10d6e297c3a 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -4015,7 +4015,6 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ {
+ int ret, length;
+ char *buf = server->smallbuf;
+- char *tmpbuf;
+ struct smb2_sync_hdr *shdr;
+ unsigned int pdu_length = server->pdu_size;
+ unsigned int buf_size;
+@@ -4045,18 +4044,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ return length;
+
+ next_is_large = server->large_buf;
+- one_more:
++one_more:
+ shdr = (struct smb2_sync_hdr *)buf;
+ if (shdr->NextCommand) {
+- if (next_is_large) {
+- tmpbuf = server->bigbuf;
++ if (next_is_large)
+ next_buffer = (char *)cifs_buf_get();
+- } else {
+- tmpbuf = server->smallbuf;
++ else
+ next_buffer = (char *)cifs_small_buf_get();
+- }
+ memcpy(next_buffer,
+- tmpbuf + le32_to_cpu(shdr->NextCommand),
++ buf + le32_to_cpu(shdr->NextCommand),
+ pdu_length - le32_to_cpu(shdr->NextCommand));
+ }
+
+@@ -4085,12 +4081,21 @@ receive_encrypted_standard(struct TCP_Server_Info *server,
+ pdu_length -= le32_to_cpu(shdr->NextCommand);
+ server->large_buf = next_is_large;
+ if (next_is_large)
+- server->bigbuf = next_buffer;
++ server->bigbuf = buf = next_buffer;
+ else
+- server->smallbuf = next_buffer;
+-
+- buf += le32_to_cpu(shdr->NextCommand);
++ server->smallbuf = buf = next_buffer;
+ goto one_more;
++ } else if (ret != 0) {
++ /*
++ * ret != 0 here means that we didn't get to handle_mid() thus
++ * server->smallbuf and server->bigbuf are still valid. We need
++ * to free next_buffer because it is not going to be used
++ * anywhere.
++ */
++ if (next_is_large)
++ free_rsp_buf(CIFS_LARGE_BUFFER, next_buffer);
++ else
++ free_rsp_buf(CIFS_SMALL_BUFFER, next_buffer);
+ }
+
+ return ret;
+--
+2.20.1
+
--- /dev/null
+From 81579dab0752b9082b7324fafa8bf0b30275ae9d Mon Sep 17 00:00:00 2001
+From: Sebastien Tisserant <stisserant@wallix.com>
+Date: Thu, 1 Aug 2019 12:06:08 -0500
+Subject: SMB3: Kernel oops mounting a encryptData share with
+ CONFIG_DEBUG_VIRTUAL
+
+[ Upstream commit ee9d66182392695535cc9fccfcb40c16f72de2a9 ]
+
+Fix kernel oops when mounting a encryptData CIFS share with
+CONFIG_DEBUG_VIRTUAL
+
+Signed-off-by: Sebastien Tisserant <stisserant@wallix.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2ops.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index ae10d6e297c3a..42de31d206169 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -3439,7 +3439,15 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
+ static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf,
+ unsigned int buflen)
+ {
+- sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf));
++ void *addr;
++ /*
++ * VMAP_STACK (at least) puts stack into the vmalloc address space
++ */
++ if (is_vmalloc_addr(buf))
++ addr = vmalloc_to_page(buf);
++ else
++ addr = virt_to_page(buf);
++ sg_set_page(sg, addr, buflen, offset_in_page(buf));
+ }
+
+ /* Assumes the first rqst has a transform header as the first iov.
+--
+2.20.1
+
--- /dev/null
+From 25e7f39c84a1e0619044c540e3be9cbe4cfbd6dc Mon Sep 17 00:00:00 2001
+From: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Date: Thu, 1 Aug 2019 16:49:01 +0300
+Subject: spi: pxa2xx: Add support for Intel Tiger Lake
+
+[ Upstream commit a4127952859a869cf3fc5a49547dbe2ffa2eac89 ]
+
+Intel Tiger Lake -LP LPSS SPI controller is otherwise similar than
+Cannon Lake but has more controllers and up to two chip selects per
+controller.
+
+Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Link: https://lore.kernel.org/r/20190801134901.12635-1-jarkko.nikula@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index c1af8887d9186..1f32c9e3ca65c 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1453,6 +1453,14 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = {
+ { PCI_VDEVICE(INTEL, 0x02aa), LPSS_CNL_SSP },
+ { PCI_VDEVICE(INTEL, 0x02ab), LPSS_CNL_SSP },
+ { PCI_VDEVICE(INTEL, 0x02fb), LPSS_CNL_SSP },
++ /* TGL-LP */
++ { PCI_VDEVICE(INTEL, 0xa0aa), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0xa0ab), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0xa0de), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0xa0df), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0xa0fb), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0xa0fd), LPSS_CNL_SSP },
++ { PCI_VDEVICE(INTEL, 0xa0fe), LPSS_CNL_SSP },
+ { },
+ };
+
+--
+2.20.1
+
--- /dev/null
+From 82187707eb68d614596effb35da7d883c48676b5 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Fri, 19 Jul 2019 14:27:13 +0200
+Subject: spi: pxa2xx: Balance runtime PM enable/disable on error
+
+[ Upstream commit 1274204542f683e1d8491ebe9cc86284d5a8ebcc ]
+
+Don't undo the PM initialization if we error out before we managed to
+initialize it. The call to pm_runtime_disable() without being preceded
+by pm_runtime_enable() would disturb the balance of the Force.
+
+In practice, this happens if we fail to allocate any of the GPIOS ("cs",
+"ready") due to -EPROBE_DEFER because we're getting probled before the
+GPIO driver.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Link: https://lore.kernel.org/r/20190719122713.3444318-1-lkundrak@v3.sk
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/spi/spi-pxa2xx.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index af3f37ba82c83..c1af8887d9186 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -1817,14 +1817,16 @@ static int pxa2xx_spi_probe(struct platform_device *pdev)
+ status = devm_spi_register_controller(&pdev->dev, controller);
+ if (status != 0) {
+ dev_err(&pdev->dev, "problem registering spi controller\n");
+- goto out_error_clock_enabled;
++ goto out_error_pm_runtime_enabled;
+ }
+
+ return status;
+
+-out_error_clock_enabled:
++out_error_pm_runtime_enabled:
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
++
++out_error_clock_enabled:
+ clk_disable_unprepare(ssp->clk);
+
+ out_error_dma_irq_alloc:
+--
+2.20.1
+
--- /dev/null
+From 36b3ab496ac2380c68c5134115e8a5891d06aa86 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Tue, 23 Jul 2019 17:04:30 -0500
+Subject: st21nfca_connectivity_event_received: null check the allocation
+
+[ Upstream commit 9891d06836e67324c9e9c4675ed90fc8b8110034 ]
+
+devm_kzalloc may fail and return null. So the null check is needed.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/st21nfca/se.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c
+index 06fc542fd1987..6586378cacb05 100644
+--- a/drivers/nfc/st21nfca/se.c
++++ b/drivers/nfc/st21nfca/se.c
+@@ -317,6 +317,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host,
+
+ transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
+ skb->len - 2, GFP_KERNEL);
++ if (!transaction)
++ return -ENOMEM;
+
+ transaction->aid_len = skb->data[1];
+ memcpy(transaction->aid, &skb->data[2],
+--
+2.20.1
+
--- /dev/null
+From 493220b3e57ee6e9f2e08402b3b88a53820e3b60 Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Tue, 23 Jul 2019 17:11:51 -0500
+Subject: st_nci_hci_connectivity_event_received: null check the allocation
+
+[ Upstream commit 3008e06fdf0973770370f97d5f1fba3701d8281d ]
+
+devm_kzalloc may fail and return NULL. So the null check is needed.
+
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/nfc/st-nci/se.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
+index c3e10b6ab3a4d..f25f1ec5f9e97 100644
+--- a/drivers/nfc/st-nci/se.c
++++ b/drivers/nfc/st-nci/se.c
+@@ -333,6 +333,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,
+
+ transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev,
+ skb->len - 2, GFP_KERNEL);
++ if (!transaction)
++ return -ENOMEM;
+
+ transaction->aid_len = skb->data[1];
+ memcpy(transaction->aid, &skb->data[2], transaction->aid_len);
+--
+2.20.1
+
--- /dev/null
+From a75b04d4f32b3bb31264ad8b308ce0a1940d4a34 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jan=20Sebastian=20G=C3=B6tte?= <linux@jaseg.net>
+Date: Wed, 17 Jul 2019 23:41:37 +0900
+Subject: Staging: fbtft: Fix GPIO handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ Upstream commit 92e3e884887c0d278042fbbb6f6c9b41d6addb71 ]
+
+Commit c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor
+interface") breaks GPIO handling. In several places, checks to only set
+a GPIO if it was configured ended up backwards.
+I have tested this fix. The fixed driver works with a ili9486
+display connected to a raspberry pi via SPI.
+
+Fixes: c440eee1a7a1d ("Staging: fbtft: Switch to the gpio descriptor interface")
+Tested-by: Jan Sebastian Götte <linux@jaseg.net>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Signed-off-by: Jan Sebastian Götte <linux@jaseg.net>
+Link: https://lore.kernel.org/r/75ada52f-afa1-08bc-d0ce-966fc1110e70@jaseg.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/staging/fbtft/fb_bd663474.c | 2 +-
+ drivers/staging/fbtft/fb_ili9163.c | 2 +-
+ drivers/staging/fbtft/fb_ili9325.c | 2 +-
+ drivers/staging/fbtft/fb_s6d1121.c | 2 +-
+ drivers/staging/fbtft/fb_ssd1289.c | 2 +-
+ drivers/staging/fbtft/fb_ssd1331.c | 4 ++--
+ drivers/staging/fbtft/fb_upd161704.c | 2 +-
+ drivers/staging/fbtft/fbtft-bus.c | 2 +-
+ drivers/staging/fbtft/fbtft-core.c | 4 ++--
+ 9 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/staging/fbtft/fb_bd663474.c b/drivers/staging/fbtft/fb_bd663474.c
+index b6c6d66e4eb1b..e2c7646588f8c 100644
+--- a/drivers/staging/fbtft/fb_bd663474.c
++++ b/drivers/staging/fbtft/fb_bd663474.c
+@@ -24,7 +24,7 @@
+
+ static int init_display(struct fbtft_par *par)
+ {
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ par->fbtftops.reset(par);
+diff --git a/drivers/staging/fbtft/fb_ili9163.c b/drivers/staging/fbtft/fb_ili9163.c
+index d609a2b67db9b..fd32376700e28 100644
+--- a/drivers/staging/fbtft/fb_ili9163.c
++++ b/drivers/staging/fbtft/fb_ili9163.c
+@@ -77,7 +77,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ par->fbtftops.reset(par);
+
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ write_reg(par, MIPI_DCS_SOFT_RESET); /* software reset */
+diff --git a/drivers/staging/fbtft/fb_ili9325.c b/drivers/staging/fbtft/fb_ili9325.c
+index b090e7ab6fdd6..85e54a10ed72c 100644
+--- a/drivers/staging/fbtft/fb_ili9325.c
++++ b/drivers/staging/fbtft/fb_ili9325.c
+@@ -85,7 +85,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ par->fbtftops.reset(par);
+
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ bt &= 0x07;
+diff --git a/drivers/staging/fbtft/fb_s6d1121.c b/drivers/staging/fbtft/fb_s6d1121.c
+index b3d0701880fe3..5a129b1352cc8 100644
+--- a/drivers/staging/fbtft/fb_s6d1121.c
++++ b/drivers/staging/fbtft/fb_s6d1121.c
+@@ -29,7 +29,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ par->fbtftops.reset(par);
+
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ /* Initialization sequence from Lib_UTFT */
+diff --git a/drivers/staging/fbtft/fb_ssd1289.c b/drivers/staging/fbtft/fb_ssd1289.c
+index bbf75f795234b..88a5b6925901d 100644
+--- a/drivers/staging/fbtft/fb_ssd1289.c
++++ b/drivers/staging/fbtft/fb_ssd1289.c
+@@ -28,7 +28,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ par->fbtftops.reset(par);
+
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ write_reg(par, 0x00, 0x0001);
+diff --git a/drivers/staging/fbtft/fb_ssd1331.c b/drivers/staging/fbtft/fb_ssd1331.c
+index 4cfe9f8535d0f..37622c9462aa7 100644
+--- a/drivers/staging/fbtft/fb_ssd1331.c
++++ b/drivers/staging/fbtft/fb_ssd1331.c
+@@ -81,7 +81,7 @@ static void write_reg8_bus8(struct fbtft_par *par, int len, ...)
+ va_start(args, len);
+
+ *buf = (u8)va_arg(args, unsigned int);
+- if (!par->gpio.dc)
++ if (par->gpio.dc)
+ gpiod_set_value(par->gpio.dc, 0);
+ ret = par->fbtftops.write(par, par->buf, sizeof(u8));
+ if (ret < 0) {
+@@ -104,7 +104,7 @@ static void write_reg8_bus8(struct fbtft_par *par, int len, ...)
+ return;
+ }
+ }
+- if (!par->gpio.dc)
++ if (par->gpio.dc)
+ gpiod_set_value(par->gpio.dc, 1);
+ va_end(args);
+ }
+diff --git a/drivers/staging/fbtft/fb_upd161704.c b/drivers/staging/fbtft/fb_upd161704.c
+index 564a38e344406..c77832ae5e5ba 100644
+--- a/drivers/staging/fbtft/fb_upd161704.c
++++ b/drivers/staging/fbtft/fb_upd161704.c
+@@ -26,7 +26,7 @@ static int init_display(struct fbtft_par *par)
+ {
+ par->fbtftops.reset(par);
+
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ /* Initialization sequence from Lib_UTFT */
+diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c
+index 2ea814d0dca5d..63c65dd67b175 100644
+--- a/drivers/staging/fbtft/fbtft-bus.c
++++ b/drivers/staging/fbtft/fbtft-bus.c
+@@ -135,7 +135,7 @@ int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len)
+ remain = len / 2;
+ vmem16 = (u16 *)(par->info->screen_buffer + offset);
+
+- if (!par->gpio.dc)
++ if (par->gpio.dc)
+ gpiod_set_value(par->gpio.dc, 1);
+
+ /* non buffered write */
+diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c
+index bc750250ccd6c..5127de922f6a2 100644
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -916,7 +916,7 @@ static int fbtft_init_display_dt(struct fbtft_par *par)
+ return -EINVAL;
+
+ par->fbtftops.reset(par);
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ while (p) {
+@@ -1007,7 +1007,7 @@ int fbtft_init_display(struct fbtft_par *par)
+ }
+
+ par->fbtftops.reset(par);
+- if (!par->gpio.cs)
++ if (par->gpio.cs)
+ gpiod_set_value(par->gpio.cs, 0); /* Activate chip */
+
+ i = 0;
+--
+2.20.1
+
--- /dev/null
+From c810428da124e41b8e1943b90a51b4d2eb8435bd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Valdis=20Kl=C4=93tnieks?= <valdis.kletnieks@vt.edu>
+Date: Wed, 7 Aug 2019 23:27:17 -0400
+Subject: x86/lib/cpu: Address missing prototypes warning
+
+[ Upstream commit 04f5bda84b0712d6f172556a7e8dca9ded5e73b9 ]
+
+When building with W=1, warnings about missing prototypes are emitted:
+
+ CC arch/x86/lib/cpu.o
+arch/x86/lib/cpu.c:5:14: warning: no previous prototype for 'x86_family' [-Wmissing-prototypes]
+ 5 | unsigned int x86_family(unsigned int sig)
+ | ^~~~~~~~~~
+arch/x86/lib/cpu.c:18:14: warning: no previous prototype for 'x86_model' [-Wmissing-prototypes]
+ 18 | unsigned int x86_model(unsigned int sig)
+ | ^~~~~~~~~
+arch/x86/lib/cpu.c:33:14: warning: no previous prototype for 'x86_stepping' [-Wmissing-prototypes]
+ 33 | unsigned int x86_stepping(unsigned int sig)
+ | ^~~~~~~~~~~~
+
+Add the proper include file so the prototypes are there.
+
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/42513.1565234837@turing-police
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/lib/cpu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c
+index 04967cdce5d12..7ad68917a51e8 100644
+--- a/arch/x86/lib/cpu.c
++++ b/arch/x86/lib/cpu.c
+@@ -1,6 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ #include <linux/types.h>
+ #include <linux/export.h>
++#include <asm/cpu.h>
+
+ unsigned int x86_family(unsigned int sig)
+ {
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
